Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the Member States, as well as other data protection regulations, is:

STELP Social Business GmbH
Uhlandstraße 14
70182 Stuttgart

Represented by: Fabian Ortlieb (Managing Director)
Email: lovd@stelp.eu

2. General information on data processing

As a matter of principle, we process our users’ personal data only insofar as this is necessary to provide a functional website and our content and services, or where the users have given their consent. Our users’ personal data is generally processed only with the user’s consent or on another legal basis pursuant to Art. 6(1) GDPR. Users’ personal data will be deleted or blocked as soon as the purpose for which it was stored no longer applies, unless its retention is necessary to fulfil legal obligations.

3. Provision of the website and creation of log files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing computer. The following data is collected: the IP address of the accessing device, the date and time of access, the name and URL of the file accessed, the website from which access is made (referrer URL), as well as the browser used and, where applicable, the operating system of the device and the name of the access provider.

The legal basis for the temporary storage of the data and log files is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free delivery and optimisation of our website, as well as ensuring the security of our information technology systems. The data will be deleted as soon as it is no longer required to achieve the purpose for which it was collected, generally after no more than 7 days, unless longer retention is required for security reasons (e.g. to investigate attacks).

4. Hosting

This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (“Hetzner”). The personal data collected on this website is stored on Hetzner’s servers. This may include, among other things, IP addresses, metadata and communications data, contract data, contact details, names, website accesses and other data generated through a website.

Hetzner is used on the basis of our legitimate interest in the secure, fast and efficient provision of our online offering by a professional provider (Art. 6(1)(f) GDPR).

We have concluded a data processing agreement with Hetzner pursuant to Art. 28 GDPR, under which Hetzner is obliged to process our website visitors’ data exclusively in accordance with our instructions and in compliance with the GDPR.

Further information on data protection at Hetzner: https://www.hetzner.com/de/rechtliches/datenschutz/

5. Cookies

Our website uses cookies. Cookies are small text files that are stored on the user’s device and accessed by the user through their browser.

**Technically necessary cookies:** We use cookies that are technically necessary to provide the functions of our website. Without these cookies, the corresponding functions of the website cannot be provided. This includes, in particular, a cookie for storing the language version selected by the user on our multilingual website.

The legal basis for the use of technically necessary cookies is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website in a technically error-free and user-friendly manner.

**Cookies requiring consent:** Where services that are not technically necessary are used on this website—in particular Google Analytics (see section 6)—the corresponding cookies or comparable technologies will only be set after the user’s prior, explicit consent (Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG). Consent may be withdrawn at any time with effect for the future via our cookie settings. [BITTE PRÜFEN: Link/Anker zu den Cookie-Einstellungen ergänzen, sobald die Consent-Lösung implementiert ist]

6. Google Analytics

This website uses Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Google Analytics uses cookies or comparable technologies that enable an analysis of users’ use of our website. The information generated by the cookie about the use of this website is generally transferred to a Google server and processed there.

We use Google Analytics to analyse and regularly improve the use of our website. The statistics obtained enable us to improve our offering and make it more appealing to users.

Processing is carried out exclusively on the basis of prior, explicit consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Consent may be withdrawn at any time with effect for the future via our cookie settings. The IP address transmitted by the user’s browser as part of Google Analytics is not combined with other data held by Google.

Google LLC is certified under the EU-U.S. Data Privacy Framework; in addition, EU standard contractual clauses pursuant to Art. 46 GDPR have been concluded with Google as an additional guarantee of an adequate level of data protection when data is transferred to the USA.

Further information on the terms of use and data protection can be found at https://marketingplatform.google.com/about/analytics/terms/de/ and https://policies.google.com/?hl=de., respectively

Google Analytics data is automatically deleted after [BITTE PRÜFEN: in GA4 eingestellte Aufbewahrungsdauer ergänzen, z. B. 14 Monate].

Users may also object to the collection of data generated by Google Analytics relating to their use of the website and to the processing of this data by Google by downloading and installing the browser add-on available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de

7. Google Maps

A map from the “Google Maps” service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”) is embedded on this website to display our location.

The map is only loaded after an active interaction by the user (clicking on the corresponding notice “This content comes from a third party”). Before this interaction, no connection to Google’s servers is established and no data is transmitted to Google. Only when the map is loaded is a connection to Google’s servers established, whereby the user’s IP address as well as location and usage data may be collected; this may also include a transfer to the USA.

The legal basis is the user’s consent pursuant to Art. 6 para. 1 lit. a GDPR, which is given through active interaction with the map service.

Further information on the handling of user data can be found in Google’s privacy policy: https://policies.google.com/privacy?hl=de.

8. Reservation request

On our website, you can request a table reservation using the form at /reservieren/. For this purpose, we use the WordPress plugin “Restaurant Reservations”, which runs on our own server hosted by Hetzner; the request data is not transmitted to any external reservation or booking service provider.

As part of the reservation request, we collect the following data: the date, time and number of people for the requested reservation, as well as the requester’s name, email address and telephone number; providing a message is optional.

The data is stored in our website’s WordPress database and additionally transmitted by email to our café team so that the reservation request can be processed and confirmed. The reservation request does not constitute an automatic booking, but rather a request that we review and respond to individually.

The legal basis for processing is Art. 6 para. 1 lit. b GDPR (performance of pre-contractual measures at your request).

The data is deleted as soon as it is no longer required to process the reservation request, generally [BITTE PRÜFEN: konkreten Zeitraum mit dem Café abstimmen, z. B. einige Wochen nach dem Reservierungstermin], unless statutory retention obligations prevent this.

9. Contact by email

Our website allows you to contact us by email at lovd@stelp.eu. In this case, the user’s personal data transmitted with the email (e.g. name, email address, content of the message) is stored.

If the inquiry concerns a contractual or pre-contractual matter, the legal basis for processing the data is Art. 6 para. 1 lit. b GDPR; in all other cases, processing is based on our legitimate interest in processing and responding to the inquiry addressed to us (Art. 6 para. 1 lit. f GDPR).

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected, generally when the respective conversation with the user has ended, subject to statutory retention obligations.

10. Social media links

On our website, we provide links to our profiles on the following social networks:

– Instagram (@lovd.stelp)
– LinkedIn (LOVD by STELP)

These references are merely links to the respective platforms and not actively embedded social plugins or widgets. Therefore, simply accessing our website does not transmit any data to the operators of the aforementioned networks.

Only when you actively click on one of the links do you leave our website and arrive at the respective provider’s page. The respective provider’s privacy policy applies there, and we have no influence over its content:

– Instagram / Meta Platforms Ireland Limited: https://www.facebook.com/privacy/policy/
– LinkedIn Ireland Unlimited Company: https://www.linkedin.com/legal/privacy-policy

11. Rights of data subjects

If your personal data is processed, you are a data subject within the meaning of the GDPR and have the following rights vis-à-vis the controller:

– **Right of access (Art. 15 GDPR):** You may request access to the personal data concerning you that we process.
– **Right to rectification (Art. 16 GDPR):** You have the right to have inaccurate personal data concerning you stored by us rectified or completed.
– **Right to erasure (Art. 17 GDPR):** You may request the erasure of your personal data stored by us, unless statutory or contractual retention obligations prevent this.
– **Right to restriction of processing (Art. 18 GDPR):** You may request the restriction of the processing of your personal data.
– **Right to data portability (Art. 20 GDPR):** You have the right to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transmitted to another controller.
– **Right to object (Art. 21 GDPR):** Where your data is processed on the basis of Art. 6 para. 1 lit. e or f GDPR, you have the right to object to the processing at any time on grounds relating to your particular situation.
– **Right to withdraw consent (Art. 7 para. 3 GDPR):** Where processing is based on consent, you may withdraw your consent at any time with effect for the future, without affecting the lawfulness of processing carried out up to the withdrawal.
– **Right to lodge a complaint with a supervisory authority (Art. 77 GDPR):** You have the right to lodge a complaint with a supervisory authority if you believe that the processing of personal data concerning you infringes the GDPR.

The competent supervisory authority for the controller is:

The State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg
Königstraße 10a
70173 Stuttgart
https://www.baden-wuerttemberg.datenschutz.de

12. Data security

During your visit to the website, we use the widely used SSL/TLS procedure (Secure Socket Layer or Transport Layer Security) in conjunction with the highest level of encryption supported by your browser. As a rule, this is 256-bit encryption. You can tell whether an individual page of our website is transmitted in encrypted form by the closed appearance of the key or padlock symbol in your browser’s status bar and by the https protocol abbreviation preceding the address in the address bar.

We also use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties.

13. Currency and amendment of this privacy policy

This privacy policy is currently valid and was last updated in September 2026.

The continued development of our website and the services offered through it, or changes to statutory or regulatory requirements, may make it necessary to amend this privacy policy. The current version of this privacy policy can be accessed at any time on this page.