Privacy policy.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws of the EU Member States is:

Mi Peru Restaurant & Tapasbar
Owner: Maribel Bueno de Palomino
Heidelberger Straße 40, 64285 Darmstadt, Germany
E-mail: info@miperu.de
Phone: +49 6151 276 5891

2. Data protection officer

We are not required by law to appoint a data protection officer. For data protection queries please contact the controller named in section 1 directly.

3. General information on data processing

We process personal data of our users only insofar as this is necessary to provide a functioning website and our content and services. Processing regularly takes place only with the user's consent (Art. 6 (1) (a) GDPR), for the performance of a contract (Art. 6 (1) (b) GDPR), to comply with a legal obligation (Art. 6 (1) (c) GDPR) or to safeguard legitimate interests (Art. 6 (1) (f) GDPR).

The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if provided for by European or national legislation.

4. Server log files (hosting at Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. With every access, the server automatically records information transmitted by your browser:

• IP address (truncated where technically possible)
• Date and time of the request
• URL accessed and HTTP status code
• Referrer URL
• Browser type, version and operating system

Legal basis is Art. 6 (1) (f) GDPR (legitimate interest in stable and secure operation). The data is automatically deleted after no more than 30 days. For the transfer to the USA an adequate level of data protection applies based on the EU-US Data Privacy Framework, to which Vercel Inc. is subject. Further information: vercel.com/legal/privacy-policy.

5. Cookies and comparable technologies

We use only technically necessary cookies and comparable storage mechanisms (e.g. localStorage) for the operation of the site:

• Language preference — stores the selected language (de/en/es) for future visits. Legal basis: Art. 6 (1) (f) GDPR in conjunction with § 25 (2) no. 2 TDDDG.
• Mini-game high score (local) — if you play the game on the Spiel page, your score and chosen initials are stored exclusively locally in your browser (localStorage). No transmission to us takes place. For the game on game.miperu.de, see the section on games.

We do not use tracking, analytics or advertising cookies; our audience measurement is cookieless (see next section). You can delete cookies at any time in your browser settings or refuse their storage.

6. Audience measurement (Vercel Web Analytics and Umami)

To understand which pages are used and how often, we use two cookieless statistics services. Both work without cookies, without cross-site fingerprinting and without building profiles; we only receive aggregated figures (e.g. page views, referring page, device type, country).

• Vercel Web Analytics by Vercel Inc. (address see section 4). A visit is attributed via a hash that changes daily; IP addresses are not stored.
• Umami — an open-source statistics tool operated by us. The application (Vercel Inc.) and the statistics database (Neon Inc.) run in data centres in Frankfurt (EU); both act as our processors. Umami does not store IP addresses and only creates anonymised visit identifiers that change daily. We use the same Umami instance on menu.miperu.de and game.miperu.de.

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in a data-minimising evaluation and improvement of our website). Transfers to the USA are covered by the EU-US Data Privacy Framework, under which Vercel Inc. is certified; for possible access by Neon Inc. (USA), the EU Commission's standard contractual clauses apply. The processing itself takes place in the EU. You can object to this processing at any time (Art. 21 GDPR), e.g. by e-mail to info@miperu.de, or prevent it with a content/tracking blocker in your browser.

7. Contact by e-mail, phone or form

If you contact us by e-mail, phone or via the contact form on the Kontakt page, we process the data you provide (e.g. name, e-mail address, phone number, message content) to deal with your enquiry.

Legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures) or Art. 6 (1) (f) GDPR (legitimate interest in handling enquiries). We delete enquiries as soon as they are no longer required; statutory retention obligations (in particular commercial and tax law retention periods of up to ten years) remain unaffected.

For the technical delivery of the data submitted via our forms we use the processor Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA — the form data is delivered to us by e-mail. A data processing agreement is in place; EU standard contractual clauses apply to the transfer to the USA. Further information: resend.com/legal/privacy-policy.

8. Applications

If you apply to us via the form on the Ausbildung page, by e-mail or in person, we process your details (e.g. name, contact details, school qualification, message) to carry out the application process. The legal basis is § 26 BDSG in conjunction with Art. 88 GDPR or Art. 6 (1) (b) GDPR (initiating a training relationship). The form is sent via Resend as described in section 7.

If no training relationship is established, we delete your application documents no later than six months after the end of the process — unless you have agreed to longer storage. If a training relationship is established, the data is transferred to your personnel file.

9. Table reservation (dish.co)

For online reservations we use the widget of the third-party provider Hospitality.Digital GmbH (dish.co), Metro-Straße 1, 40235 Düsseldorf. When the reservation page is loaded, an iframe is fetched from dish.co and data such as your IP address is transmitted to dish.co. dish.co sets a technically necessary session cookie so that the booking works.

The data you enter in the reservation form (date, time, party size, name, e-mail, phone, notes) is processed by dish.co on our behalf and forwarded to us for the purpose of the reservation. Legal basis: Art. 6 (1) (b) GDPR (contract performance). For further information see dish.co's privacy notice: dish.co/datenschutz/.

10. Map display (OpenStreetMap)

On our contact page we embed a map from the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, as an iframe. When the map is loaded, your IP address is transmitted to the OpenStreetMap Foundation servers.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a data-minimising, cookie-free display of our location). The map is deliberately lazy-loaded; OpenStreetMap does not set tracking cookies. Further information: osmfoundation.org/wiki/Privacy_Policy.

11. WhatsApp contact

You can reach us via WhatsApp. When you click the WhatsApp button you are forwarded to the WhatsApp app or web version — provider: WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, a subsidiary of Meta Platforms Ireland Ltd. When you contact us via WhatsApp the transmitted data (phone number, profile name, message content) is processed by WhatsApp/Meta.

We have no influence on this. Please refer to WhatsApp's privacy notice: whatsapp.com/legal/privacy-policy-eea. Legal basis for processing enquiries you send us via WhatsApp on our side is Art. 6 (1) (b) and (f) GDPR.

12. Games on game.miperu.de (guestbook and leaderboard via Google Firebase)

Our browser game "Lomo Saltado Tycoon" on game.miperu.de stores your progress locally in your browser (localStorage) along with a random player ID. Voluntarily, you can write a guestbook entry there (name, message) or add yourself to the global leaderboard with a name of your choice (name, score, time). These entries are publicly visible to all players.

For this we use Google Firebase (Cloud Firestore) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Entries are stored in a data centre in the EU. When the guestbook or leaderboard is opened, a connection to Google servers is established and your IP address is transmitted. Access by Google LLC (USA), e.g. for maintenance, cannot be ruled out; Google LLC is certified under the EU-US Data Privacy Framework. More information: firebase.google.com/support/privacy.

The legal basis is your consent given by voluntarily submitting an entry (Art. 6 (1) (a) GDPR). Please do not use your full real name. We delete entries on request to info@miperu.de; we remove inappropriate content without prior notice.

13. Fonts (self-hosted Google Fonts)

We use the fonts "Geist", "Reenie Beanie" and "JetBrains Mono". These are automatically copied to our server at build time via the Next.js component next/font and served exclusively from our own domain. No connection is made to Google servers when the page is loaded.

14. External links (social media & ordering platforms)

In the footer and on individual pages we link to external profiles and platforms — including Instagram, Facebook and TripAdvisor as well as the delivery/ordering platforms Lieferando and Wolt (the latter also for our sub-brand Paella Bar). Simply viewing our page does not transmit any data to these providers. Only when you click such a link do you leave our site and the respective platform may receive data in accordance with their privacy policies.

15. Recipients and data disclosure

Your personal data will only be transferred to third parties if (a) you have expressly consented, (b) disclosure is necessary for the performance of a contract (e.g. dish.co for reservations), (c) we are legally obliged to do so or (d) disclosure is necessary for the assertion, exercise or defence of legal claims and there is no reason to believe that you have an overriding legitimate interest in the non-disclosure of your data.

We do not sell, rent or otherwise commercially transfer personal data.

16. Storage period

We store personal data only for as long as it is necessary for the respective purpose or as required by statutory retention obligations. Once the purpose ceases or the retention period expires, the data is deleted or anonymised.

17. Rights of data subjects

You have the following rights vis-à-vis us at any time:

• Right of access (Art. 15 GDPR) regarding the data stored about you
• Right to rectification of inaccurate data (Art. 16 GDPR)
• Right to erasure of your stored data (Art. 17 GDPR), provided no statutory retention obligations apply
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent (Art. 7 (3) GDPR) with effect for the future

You can send your request informally to info@miperu.de.

18. Right to lodge a complaint with a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority. The competent authority for us is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany
E-mail: poststelle@datenschutz.hessen.de
Web: datenschutz.hessen.de

19. SSL/TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the „https://“ prefix and the padlock symbol in your browser's address bar.

20. Validity and changes to this privacy policy

This privacy policy is currently valid. As a result of the further development of our website or due to legal or regulatory requirements, it may become necessary to amend it. The current version is always available at miperu.de/datenschutz.