Draft – to be reviewed and approved by the operator.

Privacy policy

Controller

Sunya Sadat · Schwester Kumpir Veringstraße 27, 21107 Hamburg, Germany Email: schwesterkumpir@web.de

Online ordering

To process an order we use your name, phone number, optional email address and note, the dishes ordered, pickup time and amount in order to perform the contract (Art. 6(1)(b) GDPR). Name, phone, email and note are deleted automatically 30 days after the order. Order items and amounts are kept as accounting records for up to 10 years (Section 147 AO, Section 257 HGB; Art. 6(1)(c) GDPR). To prevent misuse, the number of orders per connection is limited for 15 minutes; the IP address is stored only as a keyed hash for this purpose.

Hosting and database

The website and ordering system run on Render (Render Services, Inc., USA) on servers in Frankfurt am Main; order data is stored in a Neon database (Neon, Inc., USA) in Frankfurt (AWS eu-central-1). When you visit the site, the host processes technically necessary connection data such as IP address and time in order to deliver the site and prevent misuse (Art. 6(1)(f) GDPR). Data processing agreements are in place with both providers; possible access from the USA is covered by the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. Fonts are served from our own server, not from Google.

Browser storage and cookies

We do not use analytics or advertising cookies. Your cart and the link to your last order are stored only locally in your browser (local storage) so they survive a reload; you can delete them in your browser at any time (Section 25(2)(2) TDDDG). Staff who sign in receive a strictly necessary session cookie that expires after 8 hours at most or after 20 minutes of inactivity. Staff sign-ins and changes are logged with admin ID, action and time for up to 90 days.

Contact and external links

If you contact us, we process your details to handle your request (Art. 6(1)(b) or (f) GDPR). Google Maps, Lieferando and Wolt are only linked; their content is loaded only when you click the link, after which their privacy policies apply.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(f) GDPR. Please contact us (details above). You may also lodge a complaint with a supervisory authority, e.g. the Hamburg Commissioner for Data Protection and Freedom of Information (datenschutz-hamburg.de).

Last updated: November 2026