Imprint & Privacy Policy

Privacy Policy

1. Privacy at a glance

These notes give a brief overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. The details follow in the sections below.

This website is a purely informational site. It contains no contact form, no newsletter, no ordering function and no online reservation system. Table reservations are possible by telephone only. We use neither analytics nor tracking services and no advertising networks.

When you open the website, our hosting provider automatically collects technical access data, in particular your IP address. We also embed two pieces of third-party content: a review widget on the home page and a map from OpenStreetMap in the location section. Both are only loaded once you have given your consent in the consent banner. Without your consent, no code from these providers is loaded and no connection to their servers is established; a placeholder with a button appears in place of the map. The details are set out in sections 4, 6, 7 and 8.

2. Controller

The controller for data processing on this website is:

Restaurant Adria
Ekrem Saracevic
Kronprinzenstr. 1
53840 Troisdorf
Germany

Phone: +49 2241 75583
E-mail: info@adria-troisdorf.de

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

3. General information and mandatory disclosures

Data protection

We take the protection of your personal data seriously. We treat your personal data confidentially and in accordance with statutory data protection provisions and this privacy policy. Please note that data transmission over the internet, for example when communicating by e-mail, can have security gaps. Complete protection of data against access by third parties is not possible.

Legal bases for processing

Where we obtain your consent for processing operations, Art. 6 (1) (a) GDPR is the legal basis; for the storage of information on your device or access to it, Section 25 (1) TDDDG applies in addition. Where we process data in order to perform a contract or to take steps prior to entering into a contract, Art. 6 (1) (b) GDPR is the legal basis. Where processing is necessary for compliance with a legal obligation, we rely on Art. 6 (1) (c) GDPR. Otherwise, we base the processing on our legitimate interests pursuant to Art. 6 (1) (f) GDPR. The basis applicable in each case is stated in the relevant section.

Storage period

Unless a specific storage period is stated in this policy, your personal data will remain with us until the purpose of the processing no longer applies. If you assert a justified request for erasure or withdraw your consent, we will erase your data unless there are legally permissible grounds for continued storage, such as retention periods under tax or commercial law. In the latter case, we erase the data once those grounds cease to apply.

Recipients of personal data

We disclose personal data only where this is necessary to perform a contract, where we are legally obliged to do so, where we have a legitimate interest in the disclosure pursuant to Art. 6 (1) (f) GDPR, or where another legal basis permits it. The service providers used in connection with this website are named in sections 4 to 7.

Processing on our behalf

Where we engage service providers who process personal data on our behalf and on our instructions, we conclude a data processing agreement with them pursuant to Art. 28 GDPR. That agreement ensures that the provider processes our visitors' personal data only on our instructions and in compliance with the GDPR.

Encryption

For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar beginning with https and showing a padlock symbol. When encryption is active, the data you transmit to us cannot be read by third parties.

4. Hosting and server log files

Host

We host the content of our website with the following provider:

Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA

Vercel delivers the pages of this website through a global network of delivery points and provides the necessary infrastructure. The processing region for this website is set to Frankfurt am Main, which Vercel designates fra1. Server-side processing therefore takes place within the European Union as a rule. When a page is requested, Vercel processes technical access data, in particular your IP address. The legal basis is Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically faultless, secure and fast provision of our website.

For processing on our behalf, Vercel provides a Data Processing Addendum which incorporates the EU standard contractual clauses under Implementing Decision 2021/914.

Further information can be found in Vercel's privacy policy at https://vercel.com/legal/privacy-policy

Server log files

When this website is accessed, information transmitted by your browser is automatically recorded in what are known as server log files. This comprises:

• the IP address of the requesting device
• the date and time of the request
• the name and URL of the file retrieved
• the volume of data transferred and the HTTP status code
• the website from which the access originates, where your browser transmits it
• browser type, browser version and operating system used

This data is not merged with other data sources. It is collected on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically faultless presentation of our website, the security of our systems and the prevention of attacks. The processing takes place at our host Vercel; we do not carry out any evaluation of this data ourselves.

5. Image delivery via Cloudflare R2

The images on this website are not delivered by our web server but through the storage and delivery service Cloudflare R2 at the address media.twc-assets.com. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA.

When an image is loaded, your browser establishes a connection to Cloudflare's servers, and your IP address is transmitted to Cloudflare. The legal basis is Art. 6 (1) (f) GDPR. We have a legitimate interest in the fast and reliable delivery of the image files.

Cloudflare provides a Data Processing Addendum which incorporates the EU standard contractual clauses, and states that it acts in accordance with the EU-US Data Privacy Framework.

Further information: https://www.cloudflare.com/privacypolicy/

6. Elfsight review widget

On the home page, in both the German and the English version, we embed a review widget provided by Elfsight. According to its own statements, the provider is Elfsight, SL, C. de la Constitució 17, AD700 Escaldes-Engordany, Andorra.

The widget is not loaded automatically. It stays blocked until you give your express consent in the consent banner. Only then does your browser load a script from static.elfsight.com, establish a direct connection to the provider's servers and transmit your IP address. Without your consent, none of this takes place.

According to Elfsight, IP address, operating system and browser type are recorded, stored for seven days and evaluated in anonymised form. The widget also sets the cookie elfsight_viewed_recently, which according to the provider is intended to prevent repeated counting of views by the same visitor.

The legal basis for loading the widget and for setting the cookie is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG. You may withdraw your consent at any time with effect for the future; section 8 explains how. The lawfulness of processing carried out before the withdrawal remains unaffected.

For Andorra, the European Commission has established an adequate level of data protection by Decision 2010/625/EU. A transfer there therefore does not require additional safeguards.

According to its own statements, Elfsight does not currently offer a data processing agreement. We have therefore not concluded such an agreement under Art. 28 GDPR with Elfsight. This is one of the reasons why the widget is only loaded after your express consent.

Further information: https://elfsight.com/privacy-policy/

7. OpenStreetMap map

In the location section of this website we embed a map from OpenStreetMap. The service is operated by the OpenStreetMap Foundation, a company limited by guarantee under the law of England and Wales, company number 05912761, registered office St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

The map is not loaded automatically. A placeholder with a button appears in its place. Only when you consent there does your browser load the map tiles from the service's servers. In doing so it establishes a direct connection to them and transmits in particular your IP address, along with the usual details of a page request such as browser type and the address of the page from which the map is loaded. Without your consent, none of this takes place.

According to the OpenStreetMap Foundation, a delivery network determines which tile server answers a request. From these requests the foundation publishes anonymised, aggregated usage figures.

The legal basis for loading the map and its tiles is your consent pursuant to Art. 6 (1) (a) GDPR in conjunction with Section 25 (1) TDDDG. You may withdraw your consent at any time with effect for the future; section 8 explains how. The lawfulness of processing carried out before the withdrawal remains unaffected.

The United Kingdom is a third country within the meaning of Art. 44 et seq. GDPR. On 19 December 2025 the European Commission again found that the United Kingdom provides an adequate level of data protection. A transfer there therefore does not currently require additional safeguards.

The terms of use for the tiles require clearly visible attribution on the map. We therefore state "© OpenStreetMap contributors" and link from there to https://www.openstreetmap.org/copyright. The map data is available under the Open Database License.

Privacy policy of the OpenStreetMap Foundation: https://osmfoundation.org/wiki/Privacy_Policy

Terms of use for the tiles: https://operations.osmfoundation.org/policies/tiles/

8. Consent management

So that you can decide for yourself whether third-party content is loaded, this website shows a consent banner the first time you visit. It appears on all pages for as long as you have not yet made a choice. Until you agree, none of these services is loaded.

Two services are concerned: the Elfsight review widget described in section 6 and the OpenStreetMap map described in section 7.

All that is stored is your decision, that is, whether you agreed or declined, together with the point in time. No identifier is created that would allow you to be recognised across different websites, and your decision is not passed on to third parties.

The legal basis for storing this decision is Section 25 (2) no. 2 TDDDG, because storage is strictly necessary in order to provide you with the setting you have chosen. In addition, we rely on Art. 6 (1) (c) GDPR, because we must be able to demonstrate that consent was given.

You may change your decision at any time and withdraw consent you have given with effect for the future. To do so, open the consent settings again or delete the stored decision in your browser. The lawfulness of processing carried out before the withdrawal remains unaffected.

Your decision is not stored in a cookie but in your browser's local storage, under the name adria-einwilligung. It therefore stays on your device and is not transmitted to our server when you visit this website. All that is stored is your answer, the time of the answer and the version of the consent question.

The decision is valid for 182 days, that is about six months. After that we ask again. We also ask again if what is being decided changes, for example because a further service is added; consent only covers what you were informed about. If you clear your browser's site data, the decision is gone as well and we will ask again on your next visit.

You can reach your decision at any time via the Consent settings entry in the footer of every page of this website. It appears once you have answered the question. Selecting it withdraws the stored decision and puts the question to you again. If you had previously consented, the page is reloaded in the process, so that third-party code that has already been loaded actually leaves your browser rather than merely being hidden.

9. Fonts

This website uses the fonts Libre Baskerville and IBM Plex Sans. Both are downloaded once when the pages are built and are then delivered from our own hosting together with the other files of the website. When you open the site, your browser therefore does not establish any connection to Google servers, and no data is transmitted to Google.

10. Cookies

We do not use analytics, marketing or tracking cookies, and we do not use comparable recognition technologies for such purposes.

All that is stored is your decision from the consent banner, see section 8. It is held in your browser's local storage, not in a cookie.

If you consent to the review widget, its provider Elfsight additionally sets the cookie described in section 6. Without your consent it is not set.

11. Enquiries by e-mail or telephone

If you contact us by e-mail or by telephone, for example to reserve a table, we process the personal data arising from this, namely your name, your contact details and the content of your enquiry, in order to deal with your request. We do not pass this data on without your consent.

The processing is based on Art. 6 (1) (b) GDPR where your enquiry is connected with the performance of a contract or is necessary for steps taken prior to entering into a contract, for instance a table reservation. In all other cases, the processing is based on our legitimate interest in handling enquiries addressed to us effectively, pursuant to Art. 6 (1) (f) GDPR, or on your consent pursuant to Art. 6 (1) (a) GDPR.

The data remains with us until you ask us to erase it, withdraw your consent, or the purpose of storage no longer applies, for example once your enquiry has been dealt with. Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.

12. Transfer of data to the USA

The processing for this website is set to the Frankfurt am Main region and therefore takes place within the European Union as a rule. However, our host Vercel Inc. and the image service Cloudflare, Inc. are based in the USA. Access from the USA to the data processed in Europe, for example for maintenance, security and support purposes, therefore cannot be ruled out, and delivery through the global networks of both providers may involve processing outside the European Union. This constitutes a transfer to a third country within the meaning of Art. 44 et seq. GDPR; the USA is such a third country.

The following safeguards apply to these transfers:

• Vercel Inc. states that it is certified under the EU-US Data Privacy Framework with the US Department of Commerce. In addition, Vercel's Data Processing Addendum incorporates the EU standard contractual clauses under Implementing Decision 2021/914.
• Cloudflare, Inc. likewise incorporates the EU standard contractual clauses in its Data Processing Addendum and refers to the EU-US Data Privacy Framework.

We point out that, despite these safeguards, the level of data protection in the USA is not fully comparable with that in the European Union and that access by state authorities to the data cannot be entirely ruled out.

13. Your rights

Under the GDPR you have the following rights:

• Access, Art. 15 GDPR. You may request information as to whether and which personal data we process about you, as well as about the purposes, recipients, storage period and origin of that data.
• Rectification, Art. 16 GDPR. You may request the rectification of inaccurate data and the completion of incomplete data.
• Erasure, Art. 17 GDPR. You may request the erasure of your data, provided that no statutory retention obligation or other permissible ground stands in the way.
• Restriction of processing, Art. 18 GDPR. You may request the restriction of processing, for example for the duration of our review if you contest the accuracy of your data, where the processing is unlawful and you prefer restriction to erasure, where we no longer need the data but you require it to establish or defend legal claims, or for as long as a decision on an objection under Art. 21 (1) GDPR is pending. Apart from being stored, restricted data may only be processed with your consent, for the establishment, exercise or defence of legal claims, for the protection of the rights of another person, or for reasons of important public interest.
• Data portability, Art. 20 GDPR. Data that we process automatically on the basis of your consent or in performance of a contract will be provided to you on request in a commonly used, machine-readable format. Direct transmission to another controller takes place where this is technically feasible.
• Objection, Art. 21 GDPR. Where we process data on the basis of Art. 6 (1) (e) or (f) GDPR, you may object to that processing at any time on grounds relating to your particular situation; this also applies to profiling based on those provisions. If you object, we will no longer process the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless the processing serves to establish, exercise or defend legal claims. Where your data is processed for direct marketing, you may object at any time without giving reasons.
• Withdrawal of consent, Art. 7 (3) GDPR. You may withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.
• Complaint to a supervisory authority, Art. 77 GDPR. You may lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement. This right applies without prejudice to any other administrative or judicial remedy.

To exercise these rights and for any further questions about data protection, please contact the controller named in section 2.

14. Status and amendments to this policy

This privacy policy applies in the version published here. If the services used or the legal requirements change, we will amend the policy accordingly.

Status of this privacy policy: 15 October 2026.

15. Governing version

This English text is a translation provided for convenience. In the event of a dispute, the German version of this privacy policy shall prevail.