privacy policy

Courtesy translation. This English version is provided for information only. Only the German version (Datenschutzerklärung) is legally binding.

1. Privacy at a glance

General information

The following notes give a simple overview of what happens to your personal data when you visit our website. Personal data is any data that can be used to identify you personally. Detailed information can be found in the sections below.

Data collection on this website

Controller: Data processing on this website is carried out by the website operator (see “Controller”).

How do we collect data? On the one hand, when you provide it to us (e.g. entries in the group request or the contact form, reservations, job applications). On the other hand, data is collected automatically when you visit the website (e.g. technical data, server logs).

What do we use data for? For technical provision, to answer requests, to process reservations and applications and, where necessary, to protect legitimate interests.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on Art. 6(1)(e)/(f) GDPR. Where processing is based on your consent, you can withdraw it at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority.

Protection of minors

Our services are not directed at children under 16. Persons under 16 should not submit personal data via our website without the consent of their legal guardians. If we learn that data from children under 16 has been submitted without consent, we will delete it immediately.

2. Hosting

This website is hosted by: united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany.

As part of hosting, personal data (e.g. IP address, access data, error logs) is processed on the host’s servers. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and efficient provision). A data processing agreement (Art. 28 GDPR) is in place with the host.

3. Controller

butter.fly F&B GmbH
Große Langgasse 12
55116 Mainz, Germany
Phone: +49 178 3093871
Email: management@mybutterf.ly

We are currently not legally required to appoint a data protection officer. For data protection inquiries, please use the contact details above.

4. General legal bases, storage period, recipients

Legal bases

Depending on the purpose, we process personal data on the basis of:

• Art. 6(1)(a) GDPR (consent), including § 25(1) TDDDG for access to end devices,
• Art. 6(1)(b) GDPR (contract/pre-contractual measures; e.g. reservations, applications),
• Art. 6(1)(c) GDPR (legal obligations),
• Art. 6(1)(f) GDPR (legitimate interests, e.g. IT security, prevention of misuse).

For applications, additionally § 26 BDSG (German Federal Data Protection Act).

Storage period

Unless a more specific period is stated, we store data only as long as the purpose exists; statutory retention obligations remain unaffected.

Recipients/categories of recipients

IT service providers (hosting, email), providers of integrated functions (OpenTable, OpenFreeMap, Microsoft), internal departments (reservations/HR). Data is only shared on a legal basis (data processing agreements, joint/independent controllership).

Transfers to third countries

Some services may involve transfers to third countries (in particular the USA). Where no adequacy decision applies, we use appropriate safeguards (e.g. EU standard contractual clauses). Where providers are certified under the EU-US Data Privacy Framework, transfers are based on the adequacy decision.

5. Security of processing / TLS encryption

We use state-of-the-art technical and organizational measures; transmission is encrypted via TLS (https), recognizable by the lock icon in the address bar.

6. Rights of data subjects

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing under Art. 6(1)(e)/(f) GDPR (Art. 21 GDPR)
• Withdrawal of consent (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority

7. Data collection on this website

7.1 Server log files

When you access our pages, server logs are processed automatically (e.g. IP address, date/time, URL, referrer URL, user agent). Legal basis: Art. 6(1)(f) GDPR (technical operation/security). Retention: only as long as necessary for availability, error analysis and security incidents.

7.2 Cookies and browser storage

This website itself does not set cookies and does not use marketing tools; to measure reach, we use our own cookie-free counter (see section 7.3). The map on the “Directions & contact” page does not set cookies either (see section 11). OpenTable is only loaded when you actively open it (click on “show available tables”); OpenTable may then use its own cookies or similar technologies (see section 9). Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG, or § 25(2) no. 2 TDDDG for services you expressly request.

7.3 Cookie-free reach measurement

To understand which pages are used and how visitors find us, we count page views with our own script on our web space (stats.php). This also applies to our event website event.butterflybrunchbar.de. When a page is opened, your browser transmits: the page visited, the domain of the page you came from (referrer), a campaign parameter if present (utm_source), and whether it is a mobile device. We also count certain actions, e.g. submitting a form or clicking “show available tables”, a phone number, email address, route planner or PDF menu; for gift card orders, also the gift card amount. If you voluntarily answer “How did you hear about us?” when booking or sending a group or event inquiry, we only count the answer you chose (e.g. “Instagram”), with no link to you as a person.

We store daily totals only (e.g. “Menu page: 42 views”). IP addresses, cookies, device identifiers or any other features that could recognize individual visitors are neither set nor stored; nothing is stored on or read from your device. The data never leaves our web space. If you have enabled “Do Not Track” or “Global Privacy Control” in your browser, no counting takes place.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in designing our services according to demand). Retention: we keep the daily totals for up to 25 months.

8. Contacting us

8.1 Group request (7–15 guests)

Data processed: your entries in the form (number of guests, number of children, high chairs, date, time, occasion, optionally how you heard about us, information on allergies/intolerances, message, first and last name, email, phone) and your confirmation of the group conditions.

Purpose: checking availability, replying and preparing the binding reservation. The data is sent to our team by email; it is not stored in a website database. To prevent misuse, your IP address is stored in shortened form (hash value) for up to one hour.

Information on allergies/intolerances may be health data (Art. 9 GDPR). We only process it if you provide it voluntarily, on the basis of your explicit consent (Art. 9(2)(a) GDPR), and solely to prepare your food.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and Art. 6(1)(a) GDPR (consent). Retention: until the purpose is fulfilled; longer retention only where required by law or to assert/defend legal claims. The credit card guarantee is not collected via this form but in a separate step after our reply.

8.2 Contact form

Data processed: topic, message, name and email address. Purpose: answering your message. The data is sent to our team by email; it is not stored in a website database. To prevent misuse, your IP address is stored in shortened form (hash value) for up to one hour. We do not accept reservations via the contact form.

Legal basis: Art. 6(1)(b) GDPR where your message relates to a contract or pre-contractual measures; otherwise Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR (legitimate interest in handling inquiries). Retention: until your request has been fully handled; statutory retention obligations remain unaffected.

8.3 Gift card orders

Data processed: gift card amount, chosen delivery (digital, or additionally a printed card by mail), first and last name, company if applicable, billing address, email address and phone number, and, if the printed card is sent to a different address, the recipient's name and address (used only to mail the card), and your confirmation of the terms and cancellation policy. Purpose: processing the order (invoice, payment reconciliation, sending the gift card by email, mailing the printed card if applicable) and questions about the order. The data is sent to our team by email; it is not stored in a website database. You receive an automatic confirmation of receipt by email. To prevent misuse, your IP address is stored in shortened form (hash value) for up to one hour.

Address help: if you enter Germany as the country, your browser queries the OpenPLZ API (openplzapi.org, an open data service with official postal code and street data) for the matching city once you enter a five-digit postal code, and suggests matching street names as you type. In the process, the postal code, the letters typed or the street name and, for technical reasons, your IP address are transmitted to the service; your name, email address and house number are not. No cookies are set. Legal basis: Art. 6(1)(b) GDPR (correct billing and delivery address) and Art. 6(1)(f) GDPR (legitimate interest in accurate address details). The suggestions are optional; you can fill in all fields freely.

We create the gift card in our point-of-sale system (Lightspeed Restaurant, Lightspeed Commerce, as processor) and send it from there with a QR code to your email address; the balance is booked there when redeemed.

Legal basis: Art. 6(1)(b) GDPR (contract or pre-contractual measures) and Art. 6(1)(c) GDPR (retention obligations under commercial and tax law). Retention: invoices and accounting records are kept for the statutory periods (usually 8 or 10 years); other order data is deleted once the gift card has been redeemed or has expired.

8.4 Email and phone

If you contact us by email or phone, we process your details (e.g. sender address, phone number, content, attachments if any) for the purpose of communication. Legal basis: Art. 6(1)(b) or (f) GDPR.

9. Online reservations (OpenTable)

For 1 to 6 guests, we offer table reservations via OpenTable (EU provider: OpenTable GmbH, Frankfurt am Main; affiliated with OpenTable, Inc., USA). The OpenTable booking window is only loaded when you click “show available tables” on our reservation page, and opens as an embedded window (iframe) on our site. Only then is data such as your IP address and the selected party size, date and time transmitted to OpenTable.

Data processed: reservation data you enter (e.g. name, email, phone number, date/time/party size, notes); payment data for no-show protection, if applicable (collected directly by OpenTable). OpenTable may use cookies/similar technologies and process data for support, security and possibly marketing purposes in accordance with its own privacy policy.

Responsibility: OpenTable is an independent controller for its reservation system; we are the controller insofar as reservation information reaches us for the provision of our services.

Legal bases: Art. 6(1)(b) GDPR (performing your reservation), Art. 6(1)(f) GDPR (efficient reservation handling), where applicable Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (non-essential technologies). Transfers to third countries (USA) are possible; appropriate safeguards are used.

Minors: Reservations for minors must be made by legal guardians.

10. Fonts

For consistent display, we use the Noto Sans font. The font files are hosted on our own web space, including for our event website event.butterflybrunchbar.de. No connection to Google or any other font provider is made when a page is loaded.

11. Map (OpenFreeMap)

On the “Directions & contact” page, we show an interactive map with our location. The map software (MapLibre GL) is hosted on our own web space. Map data, map style and fonts are loaded from the OpenFreeMap map service (Hyperknot Software Kft., Hungary; map data © OpenStreetMap contributors) when the page is opened. For technical reasons, your IP address is transmitted, along with browser information, the referring page (referrer) and the map sections requested. According to its own information, OpenFreeMap does not store IP addresses in its access logs, uses no cookies or tracking and deletes server logs after 7 days; the service provider Cloudflare may be used for delivery. We do not set cookies for the map either.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in making our location easy to find). More information: OpenFreeMap privacy policy.

12. Job applications (Microsoft Forms)

We offer online applications via Microsoft Forms (Microsoft Ireland Operations Ltd., as processor within Microsoft 365). Purposes/data: processing your application data (master data, contact details, qualifications, documents) to carry out the selection process.

Legal bases: § 26 BDSG and Art. 6(1)(b) GDPR; for voluntary additional information, Art. 6(1)(a) GDPR. Retention: if hired, storage in the personnel file; if rejected, deletion usually after 6 months, unless legitimate interests (e.g. preservation of evidence under the German General Equal Treatment Act, AGG) prevent this or you have consented to longer storage (talent pool). Processing in third countries (USA) cannot be ruled out in support cases; appropriate safeguards are observed.

Minors: Applicants under 16 should only apply with the consent of their legal guardians.

13. Downloads (PDF food and drinks menus)

When PDF documents are accessed or downloaded, server log data is generated for technical reasons (see section 7.1). No further personal evaluation takes place unless required for error analysis, IT security or to fulfil legal obligations.

14. Direct marketing / objection to advertising

We do not use your contact details for direct marketing without a legal basis. You can object to the use of your data for advertising at any time (Art. 21(2) GDPR). We object to the use of the contact details published in the imprint for sending unsolicited advertising.

15. Changes to this privacy policy

We will update this privacy policy when required by technical, legal or organizational changes. The version published on this website applies.

Last updated: November 9, 2026