Last updated: August 2026
This privacy policy explains which personal data is processed when you visit our website, contact us or place an online order.
1. Controller
Grillrestaurant Rusticana
Owner: Jutta Elst
Grillparzerstrasse 5
81675 Munich
Germany
Phone: +49 89 470 38 87
Email: steaks@rusticana.de
2. Hosting and server log data
This website is hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When the website is accessed, the server processes technically necessary log data. This may include the IP address, date and time of access, requested page or file, transferred data volume, referrer URL, browser type, operating system and requesting provider.
The processing is necessary to provide the website securely and reliably and to detect and prevent attacks. It is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure operation of this website. Where required, a data processing agreement under Article 28 GDPR is in place with the hosting provider. More information is available in Hetzner's privacy policy.
3. Online orders and WooCommerce
We use WordPress and WooCommerce for our pickup shop. When you place an order, we process the information required to fulfil it. This includes your name, billing address, email address, phone number, ordered food and drinks, selected options and quantities, pickup date and time, order notes, order number, order status and technical order information.
The processing is necessary to take steps before entering into a contract and to fulfil the order contract under Article 6(1)(b) GDPR. Required fields enable us to assign and prepare the order and contact you if necessary. An online order cannot be completed without this information.
Payment is currently made when the order is collected at the restaurant. We do not collect card or bank details through this website. Order and accounting information is retained in accordance with statutory commercial and tax obligations. Other data is deleted when it is no longer required, unless a longer legal retention period or a legitimate interest in legal defence applies.
4. Contact form, email and phone
If you contact us through the contact form, by email or by phone, we process the information you provide, such as your name, email address, phone number, selected topic and message, in order to respond. For reservation requests, we also process your preferred date, time and number of guests.
If the enquiry concerns an order, reservation or potential contract, the legal basis is Article 6(1)(b) GDPR. General enquiries are processed under Article 6(1)(f) GDPR; our legitimate interest is the reliable handling of guest enquiries. The data is deleted once the enquiry has been fully resolved, unless statutory retention obligations or legitimate interests require longer storage.
5. Cookies and technically necessary storage
Our website uses technically necessary cookies and similar storage technologies. WooCommerce requires these to store the contents of the cart, maintain an order across several pages and assign a session. This may include cookies such as woocommerce_cart_hash, woocommerce_items_in_cart and wp_woocommerce_session_*, as well as technically necessary order attribution data.
Where storage or access is strictly necessary to provide the cart and ordering service requested by you, it is based on Section 25(2) no. 2 TDDDG. Subsequent processing is based on Article 6(1)(b) GDPR or Article 6(1)(f) GDPR for the secure provision of the website. We currently do not use our own analytics or advertising trackers.
6. Google Maps
A map supplied by Google Maps may be loaded on our home page. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Loading the map may transfer your IP address to Google. Processing by Google companies or service providers outside the European Union, particularly in the United States, is also possible.
The map is loaded only after you explicitly click “Load map”. The processing is then based on your consent under Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw consent with future effect by reloading the page and not activating the map again. For details, see Google's privacy policy.
7. Recipients of data
Personal data is made available only to recipients that require it for the purposes described above. These may include our hosting and email providers, technical service providers, tax advisers and tax authorities. Where required by law, service providers act as processors under Article 28 GDPR. Data is otherwise disclosed only where necessary to fulfil a contract, where required by law or where you have consented.
8. Retention periods
We retain personal data only for as long as necessary for the relevant purpose. It is then deleted or restricted where statutory retention duties apply. Depending on the type of document, commercial and tax records may have to be retained for six, eight or ten years. Statutory limitation periods and the need to establish, exercise or defend legal claims remain unaffected.
9. Your rights
Subject to the statutory conditions, you have rights including access under Article 15 GDPR, rectification under Article 16, erasure under Article 17, restriction of processing under Article 18, data portability under Article 20 and objection to processing based on Article 6(1)(e) or (f) under Article 21. You may withdraw consent at any time with future effect.
To exercise your rights, email steaks@rusticana.de. You also have the right to lodge a complaint with a data protection authority. The authority responsible for private-sector organisations in Bavaria is the Bavarian State Office for Data Protection Supervision, Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
10. Encryption
This website uses TLS encryption to protect transmitted data from unauthorised access. An encrypted connection is indicated by “https://” in your browser's address bar.
11. Updates to this privacy policy
We update this privacy policy when the website, the services used or legal requirements change. The version published on this page is the applicable version.