Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Sala Thai Restaurant e.K., Owner: Sorapong Limsuval, Brandsende 12, 20095 Hamburg, Germany.

Administration: Raboisen 16, 20095 Hamburg. Telephone: 040 335788. Email: salathai@limsuval.de

Register court: Amtsgericht Hamburg, HRA 129513. VAT identification number: DE260450236.

We have not appointed a data protection officer, as the legal requirements for doing so do not apply to us. For any questions about data protection, please contact us at the address above.

2. General

We process personal data only where necessary to provide this website and the services offered through it, or where you have given your consent.

This website uses no analytics, tracking or advertising services. No reach measurement takes place, no usage profiles are created, and no data is transmitted to advertising networks.

Fonts are served exclusively from our own server. No connection is made to any third-party font service.

3. Hosting

This website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The servers are located in Germany. No personal data is transferred to third countries in connection with hosting.

When you access the website, technically necessary connection data is processed, in particular your IP address. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website reliably and securely.

Server log files: Our host automatically collects information transmitted by your browser. This includes your IP address, the date and time of access, the page requested, the browser and operating system used, and the referrer URL. This data is not combined with other sources and serves solely the technical operation and security of the site. It is stored only as long as necessary for that purpose and is then deleted or anonymised.

A data processing agreement pursuant to Art. 28 GDPR is in place with STRATO AG.

4. Consent and local storage

This website sets no cookies in the technical sense. Your consent decision is stored solely in your browser's local storage, so that you are not asked again on every page. It is stored for 12 months.

The legal basis for storing and reading this information is § 25(2)(2) TDDDG: the storage is strictly necessary to provide the function you requested, namely remembering your decision.

All further services, namely the reservation tool and the map display, are loaded only after your explicit consent. Before you consent, no connection whatsoever is made to these providers, and no IP address is transmitted.

You can change or fully withdraw your consent at any time using the „Cookie-Einstellungen“ link in the footer. Withdrawal does not affect the lawfulness of processing carried out beforehand.

5. Table reservations via Lightspeed

For online reservations we use Lightspeed Reservations, a service of Lightspeed Commerce Inc. The reservation form loads on our booking pages only after you have consented by selecting a location.

Data processed when you make a reservation: first and last name, email address, telephone number, number of guests, date and time, an optional message in the “Guest Request” field, and technically your IP address when the form loads.

Legal bases: Loading the form takes place on the basis of your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG. The subsequent processing of your reservation takes place in order to carry out pre-contractual measures, Art. 6(1)(b) GDPR.

Processing and international transfers: Lightspeed processes this data as a processor on our behalf. Lightspeed Commerce is based in Canada. An adequacy decision of the European Commission exists for Canada under Art. 45 GDPR. Where transfers go beyond its scope, they take place on the basis of Standard Contractual Clauses under Art. 46(2)(c) GDPR.

Lightspeed's data protection officer for Germany can be reached at: Karina Filusch, Friedrichstraße 95, 10117 Berlin.

Retention: We store reservation data for as long as necessary to carry out your reservation and handle any related matters. Beyond that, data is retained where commercial or tax law requires it. It is then deleted.

Reserving without the online form: You are always welcome to reserve by telephone. In that case no data is transmitted to Lightspeed before we enter the reservation ourselves.

6. Map display (Google Maps)

On our location pages we embed maps from Google Maps, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map does not load automatically. You first see a placeholder and decide yourself whether the map should load. Only after your consent is a connection to Google established and your IP address transmitted.

The legal basis is your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

Google may also transfer the collected data to the United States. Google LLC is certified under the EU-US Data Privacy Framework.

Further information: https://policies.google.com/privacy

7. Links to external services

Our website contains links to our delivery partner Wolt and to our Instagram profile. Both are plain links. Data is transmitted to these providers only when you actively click the relevant link and visit their site. No content from these providers is embedded on our website and no scripts from them are loaded.

The respective provider is solely responsible for the processing of your data on the Wolt and Instagram sites. Instagram is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

8. Your rights

You have the right at any time: to request information about the personal data we process (Art. 15 GDPR); to request the correction of inaccurate data (Art. 16 GDPR); to request the erasure of your data (Art. 17 GDPR); to request the restriction of processing (Art. 18 GDPR); to receive your data in a structured, commonly used format (Art. 20 GDPR); and to withdraw consent you have given, at any time (Art. 7(3) GDPR).

Right to object under Art. 21 GDPR: Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation.

To exercise these rights, please contact us using the details given in section 1.

Right to lodge a complaint: You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, https://datenschutz-hamburg.de

9. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

10. Changes to this privacy policy

We update this privacy policy when the legal situation or the services used on this website change. The version published here applies in each case.