Privacy notice

This notice explains which personal data we process when you visit this website and use our services, on what legal basis, and what rights you have. The German version is the legally binding one.

1. Controller

We have appointed a data protection officer voluntarily. You can reach them at the email address above, marked “Datenschutzbeauftragter”.

2. Visiting this website

When you open the site, your browser transmits technically necessary data to our hosting provider: a shortened IP address, the date and time of the request, the page requested, the volume of data transferred, the status code, and your browser and operating system type. This data is needed to deliver the page and to defend against attacks.

The legal basis is Article 6 (1) (f) GDPR; our legitimate interest is the stable and secure operation of the website. Server logs are deleted after seven days at the latest.

The site is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. A data processing agreement under Article 28 GDPR is in place; transfers to the USA are based on standard contractual clauses under Article 46 (2) (c) GDPR.

3. Cookies and local storage

We use no analytics, advertising or tracking cookies. Only two technically necessary values are kept in your browser’s local storage:

• the language you chose, so the site appears in that language;
• your answer to the cookie notice, so it does not reappear on every visit and so we know whether you allowed the map to load.

The legal basis is section 25 (2) no. 2 TDDG together with Article 6 (1) (f) GDPR. You can clear local storage at any time in your browser settings, and change your answer through “Cookie settings” in the footer.

4. The wait-time badge

The wait-time badge on the shop pages comes solely from our staff pressing a button at the till in that shop. No cameras, sensors, counters or visitor location data are used. Your device simply reads the current setting; no personal data is processed and nothing additional is sent to us.

5. Contact and franchise forms

If you write to us through a form, we process the details you enter (name, email address, optionally a phone number, a subject or a site and background, and your message) in order to answer your enquiry.

The legal basis is Article 6 (1) (b) GDPR where the enquiry relates to entering into a contract, and otherwise Article 6 (1) (a) GDPR on the basis of the consent you give in the form. You may withdraw that consent at any time with effect for the future.

We delete enquiries no later than six months after they are finally dealt with, unless statutory retention periods apply. Franchise enquiries are kept for the duration of the conversation and for no more than twelve months afterwards.

Please note: this website is a demonstration build. The forms validate your input on the server and give you a response, but nothing is stored or sent.

6. Job applications

Applications sent to our jobs address are processed in order to run the recruitment process. The legal basis is section 26 (1) BDSG together with Article 6 (1) (b) GDPR. If we do not make an offer, we delete the documents six months after the process ends, unless you have expressly agreed to a longer period.

7. OpenStreetMap map

On the Locations page you can load a map from the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. The map is embedded only after you explicitly click for it. Before that click no request whatsoever is made to an OpenStreetMap Foundation server; until then we show an overview map we drew ourselves.

If you do load the map, your browser transmits your IP address to the OpenStreetMap Foundation. The legal basis is your consent under Article 6 (1) (a) GDPR and section 25 (1) TDDG. Their privacy policy is at osmfoundation.org/wiki/Privacy_Policy.

8. Fonts

The Staatliches and Inter typefaces used on this site are served from our own server. There is no connection to Google Fonts and no IP address is passed to Google.

9. Recipients of your data

We pass on your data only where this is necessary to provide our services or where we are legally obliged to. Recipients are our hosting provider, our email provider and, in individual cases, our tax and legal advisers. All processors are bound by contract under Article 28 GDPR. We do not sell data.

10. Your rights

You have the right to

• access the data we hold about you (Article 15 GDPR),
• have inaccurate data corrected (Article 16 GDPR),
• erasure (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• object to processing based on a legitimate interest (Article 21 GDPR),
• withdraw consent with effect for the future (Article 7 (3) GDPR).

An informal email to the address above is enough. You also have the right to lodge a complaint with a supervisory authority; ours is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2 to 4, 40213 Düsseldorf.

11. No automated decision-making

We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR.

12. Changes

We update this notice when our processing or the law changes. The version published on this page applies. Last updated: 1 September 2026.