Privacy policy

Draft — fill in the hosting provider and the date, then have it reviewed. This site loads no external fonts, no analytics and no tracking. The only third-party content is the booking calendar, and it loads only after you actively ask for it — which is why there is no cookie banner. Adding Google Analytics, a Meta pixel, an embedded video or a chat widget would make both this policy and a consent banner mandatory.

Controller

Kyrylo Zhornovyi, Lipsiusstraße 14, 01309 Dresden, Germany. Email: hello@local-table.de · Telephone: +49 89 39299697

Hosting and server logs

This website is hosted by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Opening a page causes the provider to process your IP address, the time of the request, the page requested, the referring page and your browser identifier. This is necessary to deliver the site and protect it from attack and rests on our legitimate interest under Art. 6(1)(f) GDPR. These logs are held by the provider for a short period and are not made available to us on the plan we use. A processing agreement under Art. 28 GDPR is in place.

Fonts and images

All typefaces and images are served from our own server. No connection is made to Google Fonts or any other third-party service when you load a page.

Contacting us

If you email or call, your details and the content of your message are processed to answer your enquiry — Art. 6(1)(b) GDPR for booking matters, otherwise Art. 6(1)(f). Enquiries are deleted once settled, unless commercial retention periods apply.

Bookings and payment

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. At checkout Stripe processes your name, email address, payment details and billing country. We never see or store full card details. Processing is necessary to perform the contract under Art. 6(1)(b) GDPR. Stripe may transfer data to the United States under the EU Commission's standard contractual clauses and the EU–US Data Privacy Framework; see stripe.com/privacy.

Booking calendar (Bókun)

Availability and bookings on this site are handled by Bókun ehf., Skólavörðustígur 12, 101 Reykjavík, Iceland, a Tripadvisor company. The calendar is not loaded when you open the page: it only loads after you click "Show available dates". Until then no connection to bokun.io is made and no third-party cookies are set.

Once you load it, Bókun receives your IP address and browser information and may set its own cookies, including one we set on our domain to remember your choice for six months. If you then make a booking, the name, email address, phone number, tour date and any dietary information you enter are processed by Bókun on our behalf in order to perform the contract with you, under Art. 6(1)(b) GDPR. Loading the calendar itself rests on your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, which you may withdraw at any time by deleting the cookies in your browser.

Payment is processed by Stripe as described above. Bókun's privacy policy is available at bokun.io/privacy-policy.

Dietary requirements

If you tell us about an allergy or intolerance when booking, that information may constitute health data under Art. 9 GDPR. We process it solely on the basis of your explicit consent under Art. 9(2)(a) GDPR, use it only to arrange suitable food at the stops, pass on only what a venue needs to know, and delete it 90 days after your tour. You may withdraw consent at any time, though we then cannot cater for the requirement.

Photographs

Photographs are sometimes taken during tours and used on this website and on social media. Guests are asked at the start of each tour and may decline, in which case they are not photographed. Existing photographs are published only where the recognisable persons have agreed. You may withdraw consent at any time by emailing us, and the image will be removed.

Retention

Booking and invoice records are kept for the periods required by German tax and commercial law, currently up to ten years.

Your rights

You have the right to information (Art. 15 GDPR), correction (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interest (Art. 21). Write to hello@local-table.de.

You may also complain to a supervisory authority. The competent one at our seat is Der Sächsische Datenschutzbeauftragte, Devrientstraße 5, 01067 Dresden.

Changes

Last updated 30 August 2026.