1. Privacy Policy at a Glance
Protecting your personal data is important to us. We treat your data confidentially and in accordance with the applicable legal regulations and this Privacy Policy. Below, you will find information about what data we collect, how we use it, and what rights you have.

2. Data Controller
The entity responsible for data processing on this website is:
HIER Gastronomie GmbH
Schönhauser Allee 8
10119 Berlin
Phone: +49 176 459 659 78
Email: chiara@essenvonhier.de

3. Your Rights
You have the right at any time to:

• Obtain information about the data stored concerning you (Art. 15 GDPR)

• Request correction of inaccurate data (Art. 16 GDPR)

• Request deletion of your data (Art. 17 GDPR)

• Request restriction of processing (Art. 18 GDPR)

• Request data portability (Art. 20 GDPR)

• Object to processing (Art. 21 GDPR)

You may revoke any consent you have given at any time with effect for the future. In the event of revocation, your personal data will be deleted without delay. You also have the right to lodge a complaint with a data protection supervisory authority.

4. Contacting Us
When you contact us (e.g., via online contact form, email, telephone, or social media), as well as within the scope of an existing business relationship, your personal data will be processed to the extent necessary to respond to your inquiry and any requested measures.
Regardless of the communication channel used, we collect the content of your inquiry (e.g., entries in online contact forms, including first and last name, email address, telephone number).

We process your data for the following purposes: individual communication with you, administration and response to inquiries, and user-friendliness.
We process your data to safeguard our legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR in appropriately responding to contact requests. If your inquiry relates to a prospective or existing contractual relationship, processing is carried out for the implementation of pre-contractual measures pursuant to Art. 6 (1) sentence 1 lit. b GDPR.

5. Data Collection on Our Website
5.1 Cookies
Our website uses cookies provided either by us or by third parties. Cookies are small text files stored on the device you use and saved by your browser. Cookies help make our website more user-friendly, effective, and secure.
There are different types of cookies used for different purposes. Some cookies ensure that our services function properly or that you are recognized on your device after successful registration (“necessary” cookies). By placing these necessary cookies, we make it easier for you to visit our website and use the services available there.

Other cookies are used to analyze user preferences and improve our services (“advanced cookies”). We use these, for example, for tracking purposes (e.g., interest-/behavior-based profiling), remarketing, visitor action analysis, conversion measurement, reach measurement (e.g., access statistics, recognition of returning visitors), audience creation, and cross-device tracking. We only use non-essential cookies with your consent.
When you visit our website for the first time, a pop-up window (“cookie banner”) is displayed, describing the individual cookies in more detail. There, you can accept or reject cookies according to your preferences. You may change your settings at any time.
Please note that disabling cookies may limit the functionality of this website. We therefore accept no responsibility for the accuracy and completeness of the content displayed to you.

Depending on your browser settings, the following data may be processed through cookies:

• Usage data (e.g., websites visited, interest in content, access times)

• Meta/communication data (e.g., device information, IP addresses)

• Location data (data indicating the location of an end user's device)

Where personal data is processed through the use of “necessary” cookies, this is based on Art. 6 (1) sentence 1 lit. f GDPR due to our legitimate interest in quality assurance and the technically flawless presentation of the website. The processing of personal data through “advanced cookies” is based on your consent (Art. 6 (1) sentence 1 lit. a GDPR).

5.2 Server Log Files
When you visit our website, the provider automatically collects technical data, such as:

• Browser type and version

• Operating system

• Referrer URL

• Host name of the accessing computer

• Time of access

• IP address

This data is stored for security reasons but is not merged with other data sources.

5.3 Google Maps
Our website uses the Google Maps service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
To use Google Maps functions, it is necessary to store your IP address. This information is usually transferred to a Google server in the United States and stored there. We have no influence over this data transfer.
The use of Google Maps is in the interest of an appealing presentation of our online services and the easy location of our sites. The legal basis is Art. 6 (1) lit. f GDPR. Where corresponding consent is requested (e.g., via a cookie or consent tool), processing is carried out exclusively on the basis of Art. 6 (1) lit. a GDPR; consent may be revoked at any time.
More information on how Google handles user data can be found in Google's Privacy Policy: https://policies.google.com/privacy

6. Orders in Our Webshop
As part of an order in our webshop, the personal data you provide is collected and processed. This includes, in particular, your name and contact details, order data, payment information, and, where applicable, other information required in connection with the order or its processing.
Before or at the time of collecting this data, we will transparently inform you which information is required.
The processing of this data is carried out for the purpose of fulfilling your order. The legal basis for processing your data in connection with an order is Art. 6 (1) sentence 1 lit. b GDPR (performance of a contract or implementation of pre-contractual measures).

In addition, we process your data where we are legally obliged to do so (Art. 6 (1) sentence 1 lit. c GDPR), for example, to comply with retention obligations under commercial and tax law pursuant to the German Commercial Code (HGB) and Fiscal Code (AO).
We also process your data based on our legitimate interests pursuant to Art. 6 (1) sentence 1 lit. f GDPR, e.g., for legal enforcement and defense.
To fulfill the contract pursuant to Art. 6 (1) sentence 1 lit. b GDPR, we transfer your data to our service provider Lightspeed (see below under Lightspeed Restaurant POS).

7. Website Hosting via Wix
Our website is hosted by Wix.com Ltd., 40 Namal Tel Aviv St., Tel Aviv 6350671, Israel.
When you visit our website, Wix automatically collects certain data in so-called server log files. This includes, among other things, the IP address, browser and device information, date and time of access, and pages visited.
The processing of this data is necessary to ensure the secure and stable operation of our website (legal basis: Art. 6 (1) lit. f GDPR).
Wix processes personal data exclusively on our behalf and on the basis of a data processing agreement (Art. 28 GDPR). Data may be transferred to third countries (particularly Israel and the USA). Such transfers are carried out on the basis of appropriate safeguards within the meaning of Art. 46 et seq. GDPR (in particular EU Standard Contractual Clauses).

Further information can be found in Wix’s Privacy Policy: https://de.wix.com/about/privacy

8. Analytics Tools and Marketing
8.1 Google Analytics
We use Google Analytics, a web analytics service provided by Google Ireland Limited (parent company: Google LLC, USA). Cookies are used for this purpose (see above under “Cookies”), and pseudonymized user profiles are created. The information generated by the cookies (e.g., browser type/version, operating system, referrer URL, IP address, time of server request) is transferred to a Google server in the USA and stored there.
The data is used to evaluate website usage, compile reports, and optimize our website. Your IP address is not merged with other Google data; it is anonymized through IP masking. Data is only passed on to third parties where legally required or where processed by Google on our behalf.
Processing is carried out exclusively with your consent (Art. 6 (1) lit. a GDPR). You can disable cookies in your browser, although this may result in limitations when using the website. You can also prevent Google from collecting and processing data generated by cookies and related to your use of the website (including your IP address) by downloading and installing a browser add-on.
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.
Website: https://marketingplatform.google.com/intl/de/about/analytics/
Privacy Policy: https://policies.google.com/privacy

8.2 Meta Pixel
We use the Meta Pixel provided by Meta Platforms Ireland Ltd. (provider of Facebook and Instagram). This allows us to display targeted advertising on Instagram to users who have already shown interest in our services. Meta Pixel also helps us measure the effectiveness of our advertisements (e.g., whether users visit our website after clicking an ad).
Technical data such as IP address, device type, time of access, and click behavior may be processed. This processing only takes place if you have given your explicit consent beforehand (Art. 6 (1) lit. a GDPR).
Please note that Meta may link this data to your profile and use it for its own purposes. We have no influence over this. You can manage settings for usage-based advertising directly in your Facebook or Instagram account.
Further information:
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland
Privacy Policy: https://www.facebook.com/about/privacy

9. Use of Customer Data for Direct Marketing
9.1 Subscription to Our Email Newsletter
If you subscribe to our email newsletter, we will regularly send you information about our offers. The only mandatory information required for sending the newsletter is your email address. Providing additional data is voluntary and is used to address you personally.
For newsletter registration, we use the double opt-in procedure, ensuring that you only receive newsletters after explicitly confirming your consent by clicking a verification link sent to the email address provided. By activating the confirmation link, you grant us consent to use your personal data pursuant to Art. 6 (1) lit. a GDPR.

We store the IP address assigned by your Internet Service Provider (ISP), as well as the date and time of registration, in order to trace any potential misuse of your email address at a later date.
The data collected when registering for the newsletter is used strictly for this purpose. You may unsubscribe at any time via the link provided in the newsletter or by contacting the controller named above.
Once you unsubscribe, your email address will be removed from our newsletter distribution list without delay, unless you have expressly consented to further use of your data or we reserve the right to use data beyond this scope as permitted by law and as described in this Privacy Policy.

9.2 Sending Email Newsletters to Existing Customers
If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers by email for similar goods or services from our range.

Data processing is based on our legitimate interest in personalized direct marketing pursuant to Art. 6 (1) lit. f GDPR.
If you initially objected to the use of your email address for this purpose, we will not send you any emails.
You have the right to object at any time with future effect to the use of your email address for the aforementioned advertising purposes by notifying the controller named in this Privacy Policy. You will incur no costs other than the transmission costs according to the basic rates. Upon receipt of your objection, the use of your email address for advertising purposes will cease immediately.

9.3 Brevo
Our email newsletters are sent via the following provider:
Sendinblue GmbH
Köpenicker Str. 126
10179 Berlin
Germany

Based on our legitimate interest in effective and user-friendly newsletter marketing, we transfer the data provided during newsletter registration to this provider pursuant to Art. 6 (1) lit. f GDPR so that it can send newsletters on our behalf.
Subject to your explicit consent pursuant to Art. 6 (1) lit. a GDPR, the provider also carries out statistical analyses of newsletter campaigns using web beacons or tracking pixels embedded in emails, which can measure open rates and specific interactions with newsletter content.
Device information (e.g., time of access, IP address, browser type, and operating system) is also collected and analyzed but is not merged with other datasets.
You may revoke your consent to newsletter tracking at any time with effect for the future.
We have concluded a corresponding data processing agreement with the provider.

10. Social Media
We maintain profiles on the following social media platforms and process user data there in order to communicate with users active on these platforms or to provide information about us:
Instagram
Meta Platforms Inc.
1601 Willow Road, Menlo Park, CA 94025, USA
Website: https://www.instagram.com
Data Policy: https://help.instagram.com/155833707900388

11. Use of Lightspeed Restaurant POS
To process and manage orders through our webshop, we use the point-of-sale system “Lightspeed Restaurant POS,” a service provided by Lightspeed Commerce Inc., 700 St-Antoine Est, Suite 300, Montreal, Quebec H2Y 1A6, Canada.
In connection with the use of this system, personal data is processed, in particular name and contact details, order data, payment information, and, where applicable, other information required in connection with the order or its processing.
This data is processed for the purpose of handling and fulfilling orders, processing payments, managing customer inquiries, and organizing internal business processes.

The legal basis for processing is Art. 6 (1) lit. b GDPR, as processing is necessary for pre-contractual measures or the performance of a contract.
In connection with the use of Lightspeed, it cannot be ruled out that personal data may also be transferred to servers or companies outside the European Union or the European Economic Area, particularly to Canada.
Canada generally benefits from an adequacy decision by the European Commission for certain sectors. Where data is transferred to other third countries, such transfers are carried out according to the provider’s information on the basis of appropriate safeguards, particularly through the conclusion of Standard Contractual Clauses.

Further information on data processing by Lightspeed can be found in Lightspeed’s Privacy Policy.

12. Data Processing Agreements
We have concluded data processing agreements (Art. 28 GDPR) with all service providers that process personal data on our behalf (e.g., hosting providers, analytics tools, or marketing tools).

13. Storage Period and Deletion
We store the personal data referred to in Section 4 only for as long as necessary for the respective purpose or as long as statutory retention obligations exist.
If the purpose for storing the data ceases to apply or if you withdraw your consent to the storage of your personal data, the relevant data will be deleted without delay.

14. Changes to This Privacy Policy
We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements.