Privacy policy
This policy explains how personal data is processed on this website. Last updated: 27 October 2026.
Controller
Acquarello Restaurant GmbH
Mühlbaurstraße 36
81677 München
Deutschland
+49 89 4704848
info@acquarello.com
Represented by Managing Director Mario-Enzo Gamba. Please use the contact details above for privacy enquiries and to exercise your rights.
Hosting and server logs
This website is hosted on EU servers by Hostinger International Ltd., 61 Lordou Vironos Street, Larnaca 6023, Cyprus. To deliver and protect the website, the host processes information including IP address, browser type and version, operating system, referrer URL, requested address and time of access.
This processing supports secure, reliable operation and the detection of technical faults or abusive access. It is based on our legitimate interest under Article 6(1)(f) GDPR. Logs are retained only as long as necessary for these purposes, subject to statutory retention obligations. They are not combined with other data to create advertising profiles.
Technical services by Tivaos GmbH
Tivaos GmbH, Marie-Curie-Straße 6, 85055 Ingolstadt, Germany, email: info@tivaos.com, supports the creation, operation, maintenance and technical support of this website.
A data processing agreement under Article 28 GDPR governs these services. Tivaos may access technical logs and processes them solely on our instructions, not for its own advertising. Hostinger acts as a hosting subprocessor. The legal basis is our legitimate interest in a secure, professionally maintained website under Article 6(1)(f) GDPR.
Contact by email or telephone
When you contact us, we process your message and contact details to answer your enquiry and any follow-up questions. Without this information, we may be unable to respond.
Enquiries relating to a contract or steps prior to a contract are processed under Article 6(1)(b) GDPR. Other enquiries are processed on the basis of our legitimate interest in responding under Article 6(1)(f) GDPR.
We delete the data once the enquiry is resolved and further retention is no longer necessary. Statutory retention obligations and the establishment, exercise or defence of legal claims remain unaffected.
Event enquiries and spam protection
Our event forms collect your name, email address, phone number, chosen occasion and, optionally, guest count and message. We use this information to respond to your enquiry and follow-up questions. Processing is based on Article 6(1)(b) GDPR for contractual enquiries, or Article 6(1)(f) GDPR and our legitimate interest in responding to other enquiries.
Your enquiry is emailed to reservierung@acquarello.com. A backup is held in WordPress for 90 days and then automatically removed by the daily deletion routine maintained by Tivaos. The restaurant is responsible for further processing and necessary retention in its mailbox, as explained under Contact by email or telephone. An enquiry does not constitute a confirmed reservation.
Email is sent via Zoho using the technical sender noreply@tivaos.email. Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands, acts as a subprocessor of Tivaos under the data processing arrangement pursuant to Article 28 GDPR.
We use Tivaos Form Shield on our own server to reject automated or abusive entries. This processes a short-lived verification token, a pseudonymised IP address, referring page and browser information. Rejected entries may be stored in shortened form in a security log, with a retention period of 30 days. Processing is based on our legitimate interest in secure operation and preventing abuse under Article 6(1)(f) GDPR. No external captcha service is loaded.
Reservations through OpenTable
Our reservation buttons link to OpenTable’s external booking page. No OpenTable booking widget is loaded on this website. Only when you open the link do you visit OpenTable. Its privacy policy applies there.
Reservation details are collected on the booking page. The restaurant processes the information needed to arrange and fulfil your reservation under Article 6(1)(b) GDPR. You can discuss special requirements, such as allergies, with us by phone in advance.
Cookies, local fonts and external links
Cookie consent with Complianz
We use the locally installed Complianz tool from Complianz B.V., Kalmarweg 14-5, 9723 JG Groningen, Netherlands, to obtain and store your cookie choices. Necessary cookies remember your consent or refusal. Processing is based on Article 6(1)(c) GDPR; the necessary storage is based on Section 25(2)(2) TDDDG. Details of cookies and their duration are provided in our cookie policy (German). You can change your choices or withdraw consent there at any time for the future.
Google Analytics 4
With your consent, we use Google Analytics 4, an analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It helps us understand and improve use of our website. Information processed includes pages visited, interactions, visit duration, referral sources and technical browser and device information. Cookies and identifiers can recognise visits. Google Analytics 4 does not log or store IP addresses; an IP address is technically processed when establishing the connection.
Google Analytics is integrated through Google Site Kit. Statistical measurement starts only when you allow both statistics and marketing. The Analytics library may load after statistics consent; measurement remains blocked without both permissions. Processing is based on Article 6(1)(a) GDPR and Section 25(1) TDDDG. Consent is voluntary and can be withdrawn at any time for the future through the cookie settings, without affecting the lawfulness of earlier processing.
Google processes the data as a processor. Processing by Google LLC in the United States is possible. Google relies on the EU-US Data Privacy Framework for certified recipients and, where applicable, standard contractual clauses. Further information is available in Google Analytics privacy information. You may also use the Google Analytics opt-out browser add-on.
Google Tag Manager
We use Google Tag Manager from Google Ireland Limited to manage measurement code. Its container loads only after marketing consent. Statistical measurement through Google Analytics additionally requires statistics consent. Connecting may transmit technical information, including an IP address, to Google. The consent requirements and withdrawal options described above apply.
Our fonts and images are served locally. Loading the fonts does not establish a connection to Google. The website runs on WordPress and Elementor on our hosting.
Google Maps and Instagram are provided solely as external links. Their content is not automatically loaded here. After following a link, the provider’s privacy information applies. For an Instagram profile you choose to visit, please see Instagram’s privacy policy.
This website does not make automated decisions, including profiling, under Article 22 GDPR.
Your rights
Right to object
Where we process data on the basis of legitimate interests under Article 6(1)(f) GDPR, you have the right to object under Article 21 GDPR on grounds relating to your particular situation. This also applies to profiling based on that provision. No reasons are required when you object to direct marketing.
Following an objection, we will stop the processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is necessary for legal claims. These exceptions do not apply to direct marketing or related profiling.
Access, correction, erasure and restriction
Under Articles 15 to 18 GDPR, you may request access to your personal data, correction of inaccurate data, erasure where the legal conditions are met and restriction of processing. Restriction may apply while accuracy is being checked, where processing is unlawful and you prefer restriction to deletion, where you need data for legal claims that we no longer need, or while an objection is being assessed.
Portability and withdrawal of consent
Under Article 20 GDPR, data processed automatically on the basis of consent or a contract can be provided in a commonly used, machine-readable format. Direct transfer to another controller is subject to technical feasibility. You may withdraw consent at any time under Article 7(3) GDPR without affecting the lawfulness of processing before withdrawal.
Right to complain
You may lodge a complaint under Article 77 GDPR with a supervisory authority, particularly in the EU Member State of your residence, workplace or the alleged infringement. This right exists independently of other legal remedies.
The supervisory authority for private-sector organisations in Bavaria is the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Germany.
SSL/TLS encryption
This website uses SSL/TLS encryption to protect transmission. An encrypted connection is identified by an address beginning with https://. Complete protection of all communication over the internet cannot be guaranteed.