1. Controller
The controller responsible for data processing on this website within the meaning of the GDPR is:
OLAM Restaurant UG (haftungsbeschränkt)
Reinickendorfer Straße 102, 13347 Berlin, Germany
Phone: +49 178 2478889
Email: [email protected]
2. Data Protection Officer
We have not appointed a data protection officer. For any questions about data protection, or to exercise your rights, please contact us at [email protected].
3. Your Rights
You have the following rights regarding your personal data. To exercise them, contact us using the details above.
- Right of access (Art. 15 GDPR) — to obtain confirmation of, and a copy of, the data we hold about you.
- Right to rectification (Art. 16 GDPR) — to have inaccurate data corrected.
- Right to erasure (Art. 17 GDPR) — to have your data deleted, subject to statutory retention obligations.
- Right to restriction of processing (Art. 18 GDPR).
- Right to data portability (Art. 20 GDPR).
- Right to object (Art. 21 GDPR) — to processing based on our legitimate interests.
- Right to withdraw consent (Art. 7 (3) GDPR) — at any time, with effect for the future, where processing is based on consent.
You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin.
4. Access to Our Website (Server Log Files)
When you visit our website, our hosting infrastructure automatically collects and stores information that your browser transmits to us in server log files. This may include the IP address, date and time of the request, the page accessed, the referring URL, and details of your browser and operating system.
Purpose: to deliver the website reliably, ensure system security and stability, and prevent abuse.
Legal basis: our legitimate interest in the secure and efficient operation of the website (Art. 6 (1) (f) GDPR).
5. Hosting and Database
Our website and application data are processed using the following providers, with whom we have concluded data processing agreements pursuant to Art. 28 GDPR:
- Application hosting: DigitalOcean, LLC. Our website and application run on DigitalOcean’s App Platform in its Frankfurt, Germany region.
- Database and file storage: Convex, Inc. Backend data (such as reservations, orders, contact and newsletter records, and uploaded images) is stored on infrastructure located in the European Union (AWS region
eu-west-1, Ireland).
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a reliable, secure online presence) and, where the processing serves a contract, Art. 6 (1) (b) GDPR.
7. Table Reservations
When you book a table, we process the data you enter: name, email address, phone number (optional), date, time, party size, the occasion (optional), and any special requests you provide.
Purpose: to process, confirm and manage your reservation, and to contact you about it.
Legal basis: performance of a contract or pre-contractual measures at your request (Art. 6 (1) (b) GDPR).
8. Online Orders
If you place an order (dine-in, pickup, or delivery), we process your name, the order details, and — depending on the order type — your email address, phone number, table number, the collection date and time you choose, delivery address and delivery instructions. Pickup orders are paid online; see “Card Payments (Stripe)” below.
Purpose: to process and fulfil your order and to contact you about it.
Legal basis: performance of a contract (Art. 6 (1) (b) GDPR). Where order records must be retained for tax and commercial-law reasons, the legal basis is Art. 6 (1) (c) GDPR.
9. Card Payments (Stripe)
Pickup orders are paid online through Stripe, provided by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. When you pay, you are taken to a payment page hosted by Stripe, where you enter your payment details directly with Stripe. We never see or store your full card number.
To create the payment, we pass Stripe the items and amount of your order and the email address you gave us. Stripe tells us whether the payment succeeded and gives us a reference for it, which we store with your order so that we can confirm, fulfil and, if necessary, refund it. Stripe processes your data partly on our behalf and partly as an independent controller, in particular to meet its legal obligations and to prevent fraud. Stripe may transfer data to Stripe, Inc. in the USA (see “International Data Transfers”).
Legal basis: performance of a contract (Art. 6 (1) (b) GDPR); for records we must keep under tax and commercial law, Art. 6 (1) (c) GDPR; for fraud prevention, our and Stripe’s legitimate interest in secure payments (Art. 6 (1) (f) GDPR). See Stripe’s privacy policy at stripe.com/privacy.
10. Contact Form and Email
If you contact us via the contact form or by email, we process the data you provide (such as name, email address, phone number, and your message) in order to respond to your enquiry.
Legal basis: Art. 6 (1) (b) GDPR where your enquiry relates to a contract, otherwise our legitimate interest in responding to enquiries (Art. 6 (1) (f) GDPR). Transactional and notification emails are sent via an email (SMTP) service provider acting as our processor.
12. Google Maps
Our homepage can show a map from Google Maps to help you find us. The map is not loaded automatically: until you click “Show map”, no connection to Google is made. We do not receive any data about you from Google Maps.
When you click “Show map”, your browser loads the map directly from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Your IP address and technical details of your browser are then transmitted to Google and may be transferred to servers in the USA. We have no influence over this processing by Google. The “Get Directions” button likewise opens Google Maps in a new tab.
Legal basis: your consent, given by clicking “Show map” (Art. 6 (1) (a) GDPR; § 25 (1) TDDDG). The consent applies only to that page view: the map is not shown again until you click again, and reloading the page withdraws it. See Google’s privacy policy at policies.google.com/privacy.
13. External Images and Fonts
Some images on this website are loaded from external sources (e.g. images.unsplash.com). When such an image is loaded, your IP address is transmitted to the respective provider, which is technically necessary to display the content. The legal basis is our legitimate interest in an appealing presentation of our website (Art. 6 (1) (f) GDPR).
Web fonts are hosted locally on our own server (self-hosted via the framework’s font optimisation). No connection to Google Fonts is established when you visit our website.
14. International Data Transfers
Some of the providers named in this policy are, or belong to, companies based in the USA: DigitalOcean, LLC (hosting), Convex, Inc. (database and file storage), Stripe (payments) and Google (only if you choose to load the map). Where personal data is transferred to the USA or another country outside the European Economic Area, this takes place on the basis of the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), where the recipient is certified under it, or otherwise on the basis of the European Commission’s standard contractual clauses (Art. 46 (2) (c) GDPR).
15. Data Retention
We store personal data only for as long as necessary for the purposes described above or as required by law. Reservation and enquiry data is deleted once it is no longer needed and no statutory retention period applies. Data relevant under commercial and tax law (e.g. order and invoice records) is retained for the statutory periods, generally 6 to 10 years (§ 257 HGB, § 147 AO). Newsletter data is stored until you unsubscribe.
16. Data Security
This website uses TLS/SSL encryption for security and to protect the transmission of confidential content. An encrypted connection is indicated by “https://” in the address bar of your browser.
17. Changes to This Privacy Policy
We may update this privacy policy to reflect changes to our services or to legal requirements. The version published on this page applies, with the “last updated” date shown above.