Indian Taj
Privacy policy
We take the protection of your personal data seriously. This page explains what we collect, why, how long we keep it and what rights you have.
Reservations
When you make a reservation we store your name, email, optional phone and the reservation details (date, time, party size, area). Purpose: handling and confirming your table. Legal basis: Art. 6(1)(b) GDPR (contract).
Retention: name, email and reservation date are kept for 3 years (commercial record-keeping). Phone, dietary notes, occasion and internal notes are automatically deleted 30 days after your visit.
Dietary notes (Art. 9 GDPR)
Information about allergies, intolerances or religious dietary rules may constitute special-category data under Art. 9(1) GDPR. Providing it is voluntary; the legal basis is your explicit consent under Art. 9(2)(a) GDPR, which you grant when submitting the form. You can withdraw consent at any time; these entries are automatically deleted within 30 days of your visit.
Transactional emails are delivered via Resend.com (Resend, Inc., USA) under EU Standard Contractual Clauses and a signed data processing agreement.
Analytics
We use Umami, self-hosted open-source analytics software. It runs solely on our own server at Hetzner in Germany and shares no data with third parties. It sets no cookies, stores no IP addresses, and builds no cross-device profiles. Only aggregate data is recorded: page visited, referring page, approximate region (country), device type and browser.
Hosting & database
This site is hosted on Hetzner Online GmbH (Nuremberg, Germany). Reservations are stored in a self-managed PostgreSQL database on the same infrastructure. Cloudflare, Inc. (USA) acts as CDN/proxy in front of the origin server (transfer covered by EU Standard Contractual Clauses).
Subprocessors
- Hetzner Online GmbH — hosting (DE)
- Cloudflare, Inc. — CDN/Proxy (US/EU, SCCs)
- Resend, Inc. — email delivery (US, SCCs, DPA)
Your rights
You have the right to access, rectification, erasure, restriction of processing, portability and objection. You can request erasure via the automated endpoint /api/gdpr/delete or by writing to [email protected]. You may also file a complaint with the Spanish data protection authority AEPD (aepd.es).