Privacy Policy

• This website does not set any cookies and does not use any third-party analytics or advertising tools.
• We only count how often our pages are viewed and how often the order buttons are clicked, as pure totals without any personal data (see section 4).
• Fonts and images are stored on our own server. No content is loaded from Google or similar providers.
• We only process data when you write to us (contact or catering form, email, phone) and to the extent technically necessary to deliver the website.
• Orders are placed via Lieferando, Uber Eats or Wolt. Their privacy policies apply there.

The controller responsible for data processing on this website is:

Our company is not legally required to appoint a data protection officer. If you have any questions about data protection, please contact us directly.

This website is provided via Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you visit the website, Cloudflare processes technically necessary data so that the page can be delivered and protected against attacks, in particular your IP address, the date and time of access, the page requested, browser and operating system information, and the referrer URL. We do not analyse this data ourselves and do not create user profiles.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely, quickly and reliably. We have concluded a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework; transfers to the USA are therefore covered by an adequacy decision of the European Commission (Art. 45 GDPR). For more information, see the Cloudflare privacy policy (opens in a new tab).

The connection to this website is encrypted using TLS (recognisable by “https://”).

We do not set any cookies and do not use any third-party analytics, tracking or marketing services. That is why there is no cookie banner on this website.

Our own visitor statistics: So that we know which pages are in demand, when a page is viewed or an order button (Lieferando, Uber Eats, Wolt) is clicked, the website reports to our own server which page or which button it was. Only a counter per day is stored, for example “Menu: 25 views”. We do not store IP addresses, device identifiers or any other information about you, and nothing is stored on or read from your device. It is therefore not possible to identify individual visitors. The counters are kept in a database at Cloudflare (see section 3). We receive a summary by email once a week. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is improving what we offer.

The fonts used are hosted locally on our server. When the page loads, no connection is made to servers of Google or other font providers.

To display the delivery hours, the website does not store anything on your device; the calculation takes place only in your browser. The same applies to the delivery area check (“Do we deliver to you?”): the address or postcode you enter is checked exclusively in your browser and is neither transmitted to us or third parties nor stored.

If you contact us via a form, by email or by phone, we process your information in order to respond to your enquiry. In the form, this is: your name or institution/company and contact person, email address, optionally your phone number, and your message. For catering enquiries, this also includes the occasion, date and approximate number of guests; for business enquiries, the type of institution, number of people, desired package and delivery frequency; for job applications, the position you are applying for.

The legal basis is Art. 6(1)(b) GDPR if your enquiry is aimed at a contract (e.g. a catering offer), otherwise Art. 6(1)(f) GDPR. Our legitimate interest is responding to enquiries.

Technical process: The form data is transmitted in encrypted form to a function on Cloudflare’s servers (see section 3), checked there and forwarded as an email to our inbox. To send it, we use the email service Resend (Resend, Inc., USA) as a processor. The transfer to the USA is based on the EU-US Data Privacy Framework, insofar as the provider is certified, and otherwise on EU standard contractual clauses (Art. 46 GDPR). Resend privacy policy (opens in a new tab).

Storage period: We delete your enquiry as soon as it has been dealt with and no further communication is to be expected. If the enquiry leads to an order, we keep the necessary documents for as long as statutory retention periods require (usually 6 or 10 years under commercial and tax law).

Job applications: We process your application data in order to carry out the application procedure (§ 26 BDSG, Art. 6(1)(b) GDPR). If you are not hired, we delete it no later than six months after the procedure has ended, unless you have agreed to longer storage.

To protect our forms against spam and automated attacks, we use Cloudflare Turnstile (provider: Cloudflare, see section 3). Turnstile is only loaded when you use a form. It uses technical characteristics (such as IP address, browser and device information, and interaction data) to check whether the input comes from a human. According to Cloudflare, Turnstile does not set any cookies for advertising or tracking purposes.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is protecting our website and our inbox against misuse. In addition, we use a control field that is invisible to humans (“honeypot”), which works without any further data processing.

You cannot order directly on this website. The order buttons lead to Lieferando, Uber Eats and Wolt. When you click one, you leave our website; only then is data transmitted to the respective provider. The providers themselves are responsible for the processing on their platforms:

• Lieferando (Takeaway.com) (opens in a new tab)
• Uber Eats (opens in a new tab)
• Wolt (opens in a new tab)

When you order from us, the platform sends us the data we need to prepare and deliver your order (e.g. name, delivery address, phone number, products ordered, notes such as the text you would like on a greeting card). We use this data only to process your order (Art. 6(1)(b) GDPR) and delete it as soon as it is no longer needed for this purpose and no statutory retention obligations prevent this.

We link to our Instagram profile. This is a simple link; no Instagram content is embedded on this website. Data is only transmitted to Meta Platforms Ireland Ltd. when you click the link. The Instagram privacy policy (opens in a new tab) applies.

You have the following rights at any time:

• access to the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to this at any time on grounds relating to your particular situation.

An informal message to info@sweetdreamhamburg.de is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit), Ludwig-Erhard-Straße 22, 20459 Hamburg, datenschutz-hamburg.de (opens in a new tab).

You are not obliged to provide us with any data. However, without an email address and a message, we cannot respond to your enquiry via the form. There is no automated decision-making, including profiling.