Privacy notice
1. Data protection at a glance
General notes
The protection of your personal data is important to us.
This privacy policy informs you about which personal data we process when using our website, for contact and reservation enquiries, for job applications, and as part of our communication with guests.
Personal data is any information relating to an identified or identifiable natural person.
We process personal data exclusively within the framework of the applicable statutory provisions, in particular the General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), the Telecommunications Digital Services Data Protection Act (TDDDG) and – where applicable – the Act Against Unfair Competition (UWG).
This privacy policy explains in particular what personal data we collect, for what purposes we process this data, on what legal bases the processing is based, how long data is stored and what rights you are entitled to.
2. Data controller
The controller responsible for the processing of personal data on this website is:
Maria Iakovi
Europaplatz 1
46399 Bocholt
Germany
Phone: +49 2871 1872359
Email: info@syrtaki-bocholt.de
Further details regarding the responsible party can be found in our legal notice.
3. What personal data do we process?
Depending on the nature of your use of our website and our offerings, in particular the following personal data may be processed:
– First name and surname,
– e-mail address,
– Phone number,
– Address,
– Details of an enquiry,
– Details of a reservation,
– requested reservation date,
– required reservation time,
– Number of people,
– other reservation requests and notes,
– voluntarily submitted information,
– in the case of job applications, in particular contact details, information regarding the desired position, educational or professional details, application documents and any other transmitted information,
– where applicable, data of underage applicants,
– technical data such as IP address, browser type, browser version, operating system, referrer URL, time of access and pages visited,
– Information required for the technical security and operation of the website.
We generally only process personal data that is necessary for the respective purpose or that you provide to us voluntarily.
4. Purposes of processing
We process personal data in particular for the following purposes:
– for the technical provision of our website,
– to ensure the security and stability of our website,
– for processing general contact enquiries,
– for processing reservation enquiries,
– for communicating with our guests,
– for processing follow-up questions,
– for processing job applications,
– for carrying out recruitment procedures,
– for the preparation and implementation of employment or training relationships,
– to prevent spam, abuse and fraudulent activities,
– to fulfil legal obligations,
– for the purposes of our legitimate interests,
– to improve our service,
– for processing feedback,
– as well as – provided that the legal and competition law requirements are met – for a one-off retrospective contact after an actual restaurant visit, in particular to obtain feedback and the opportunity for a voluntary review.
5. Legal bases for processing
We only process personal data if there is a legal basis for doing so.
Depending on the processing operation, the following legal bases come into consideration in particular:
Art. 6 para. 1 lit. a GDPR – Consent
Processing is carried out on the basis of your freely given consent.
You can withdraw consent at any time with future effect.
The lawfulness of the processing carried out prior to the withdrawal remains unaffected hereby.
Article 6(1)(b) GDPR – Contract and pre-contractual measures
Processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract.
This concerns in particular reservation requests and the associated communication, insofar as these are necessary for the preparation or performance of a contractual relationship.
Article 6(1)(c) GDPR – Legal obligation
The processing is necessary for the fulfilment of a legal obligation to which we are subject.
Article 6(1)(f) of the GDPR – Legitimate interests
The processing is necessary to safeguard our legitimate interests or the interests of a third party, unless your interests or fundamental rights and freedoms take precedence.
Our legitimate interests may include, in particular, the secure and efficient provision of our website, the processing of enquiries, communication with guests, the prevention of misuse and the improvement of our services.
Article 6(1)(f) of the GDPR applies only insofar as the legal conditions for its application are actually met.
The respective legal bases are explained in more detail for each of the processing operations.
6. Contact forms and general enquiries
Depending on the features offered, contact and enquiry forms may be provided on our website. This can relate in particular to general contact enquiries, enquiries about our services, follow-up questions or other communications sent to us.
If you use such a contact form, we process the personal data entered by you into the form.
These may include, in particular:
– First name and surname,
– e-mail address,
– Phone number,
– Details of the request,
– The content of your message,
– as well as any other information you voluntarily provide to us.
The information required on each form is indicated by the labels on the relevant form fields.
Processing is carried out for the purpose of processing and responding to your enquiry, for any necessary follow-up communication and, where applicable, for the implementation of pre-contractual measures or the performance of a contract.
Insofar as the processing is necessary for the performance of pre-contractual measures or the fulfilment of a contract, it is based on Article 6(1)(b) of the GDPR.
In other cases, processing is carried out on the basis of Article 6(1)(f) of the GDPR, provided that we have a legitimate interest in processing and responding to your enquiry.
Our legitimate interest lies, in particular, in ensuring proper and efficient communication with prospective clients, guests, applicants and other individuals interested in our services.
Insofar as consent is required for the specific processing, the processing is carried out on the basis of Art. 6(1)(a) GDPR. Given consent may be withdrawn at any time with effect for the future.
The data you submit via a contact form will generally only be stored for as long as is necessary to process your request. The data will subsequently be deleted, unless statutory retention periods or other legal reasons prevent its deletion.
Data submitted via a contact form will only be disclosed where this is necessary to process your enquiry, where there is a legal obligation to do so, or where there is another legal basis for such disclosure.
Please do not submit particularly sensitive personal data via general contact forms unless this is necessary for your enquiry.
7. Reservation requests
When you request a table reservation via our website, we process the personal data you provide in order to handle your reservation request and to communicate with you.
These may include, in particular:
– First name,
– Surname,
– e-mail address,
– Phone number,
– required date,
– requested time,
– Number of people,
– any other comments or requests.
Your data will be processed in order to handle your booking enquiry, to contact you, and to prepare and carry out the requested booking.
Where processing is necessary for the purposes of taking steps prior to entering into a contract or for the performance of a contract, it is carried out on the basis of Article 6(1)(b) of the GDPR.
Insofar as the processing is not necessary for the performance of a contract or for pre-contractual measures, it may be based on Art. 6(1)(f) GDPR, provided that the legal requirements for this are met.
Our legitimate interest lies in particular in the proper processing and management of reservation requests as well as in communication with our guests.
The data submitted via the reservation form will not be stored for longer than is necessary to process the request and carry out the reservation, unless there are statutory retention obligations or other legal reasons for longer storage.
A booking enquiry submitted via the form does not automatically constitute a binding booking confirmation. A binding booking is only finalised upon receipt of the relevant confirmation or following the applicable booking procedure.
8. Contact by email or telephone
If you contact us by email or telephone, we will process the personal data you provide, including the information arising from your enquiry.
Your data is processed for the purpose of dealing with your enquiry and communicating with you as necessary.
Insofar as the contact relates to the performance of a contract or pre-contractual measures, the processing is based on Article 6(1)(b) GDPR.
In all other cases, processing may be based on Article 6(1)(f) GDPR, provided that we have a legitimate interest in processing and responding to your enquiry.
In so far as consent is required, processing is carried out on the basis of Art. 6 (1) (a) GDPR.
The data will be deleted as soon as the purpose of processing ceases to apply and there are no statutory retention obligations or other legal reasons preventing further storage.
9. Applications and application form
On our website, we offer the opportunity to apply for vacancies, training and employment opportunities, or to submit a speculative application.
In principle, individuals who have not yet reached the age of 18 may also apply, provided that the respective activity is permitted for minors under statutory regulations.
If you submit an application to us via our application form, by email or by any other means, we will process the personal data you provided as part of the application.
These may include, in particular:
– First name and surname,
– Address,
– e-mail address,
– Phone number,
– where applicable, age or date of birth, insofar as this is necessary for the application process,
– desired workspace,
– preferred employment type,
– possible start date,
– details of school education, training, career history and qualifications,
– application documents, in particular CV and references,
– other information voluntarily provided by you.
The processing is carried out for the purpose of conducting the application process, reviewing your application, communicating with you, and making a decision on the establishment of an employment or training relationship.
The legal basis for the processing of applicant data is Section 26(1) sentence 1 of the Federal Data Protection Act (BDSG) in conjunction with Art. 88 of the GDPR, insofar as the processing is necessary for the decision on the establishment of an employment relationship or for the implementation of pre-contractual measures.
In accordance with Section 26(8) of the Federal Data Protection Act (BDSG), applicants are expressly included within the definition of ‘employee’ set out in that provision.
This also applies to underage applicants.
In so far as consent is required for individual processing operations, the processing is based on Art. 6(1)(a) GDPR.
We only process personal data that is necessary for the application process or that you provide to us voluntarily.
Please do not submit any special categories of personal data within the meaning of Art. 9 GDPR as part of your application, unless this is necessary for the application process and a corresponding legal basis exists for it.
Your application documents will, as a rule, only be made available to those persons who are involved in the processing of applications and the personnel decision.
Disclosure to third parties only occurs if there is a legal basis for this or if it is necessary for the purposes of the application process.
Where we engage external service providers to process applications technically, this is done in compliance with data protection requirements and – where necessary – on the basis of a data processing agreement in accordance with Article 28 of the GDPR.
If no employment contract is concluded, applicant data is generally deleted no later than six months after the completion of the respective application process, unless a longer retention period is required due to legal obligations, the defence of legal claims, or valid consent.
Longer storage for consideration for future job vacancies only takes place if there is an appropriate legal basis for doing so.
10. Processing of personal data of children and young people
Our website can also be used by minors. This particularly applies to minors who apply for a training position or job via our website or who contact us in connection with an application.
We process personal data of children and young people exclusively where there is a legal basis for doing so and the processing is necessary for the respective purpose.
In the case of applications from minors, the relevant data protection, employment and apprenticeship legislation applies. Where the processing is necessary for the purpose of deciding whether to enter into an employment or apprenticeship relationship, it may, in particular, be based on the applicable provisions of Section 26 of the Federal Data Protection Act (BDSG).
Separate consent from parents or other legal guardians is not required for processing that is permitted by law and necessary for the application process simply because the applicant is a minor.
Insofar as consent is required for individual processing operations outside the necessary execution of the application procedure, we observe the respective applicable statutory requirements regarding the capacity of minors to give consent and, where necessary, obtain the consent of the legal representatives.
We restrict the processing of minors' personal data to the data necessary for the respective purpose, paying particular attention to the principles of data minimisation, purpose limitation, transparency and storage limitation in accordance with Art. 5 GDPR.
In particular, we ask that you do not provide any personal data relating to other children or young people via our contact, booking or application forms, unless this is necessary for the enquiry in question.
When minors apply, additional information or documentation may be required depending on the type of employment or training sought.
This may, in particular, relate to information that is required under labour, training, youth protection or other statutory provisions for the establishment or performance of an employment or training relationship.
Insofar as the cooperation or consent of a legal representative is required for the establishment of an employment, training or other contractual relationship, this will be obtained in the further course of the procedure.
As a general rule, the personal data of underage applicants is only made accessible to the persons involved in processing the application and making the personnel decision.
Transfer to third parties only takes place if there is a legal basis for this or if the transfer is necessary for the implementation of the application procedure or the subsequent employment or training relationship.
The personal data will only be stored for as long as is necessary for the respective purpose and no statutory retention obligations or other legal reasons preclude deletion.
11. Spam protection for forms
To prevent abusive automated input, our forms may include a simple mathematical security question or a comparable technical protection measure.
This measure serves exclusively to prevent spam, abuse and automated form submissions.
Insofar as personal data is processed in this context, this is done exclusively for this purpose and on the basis of the relevant statutory provisions.
No additional advertising or user profiles are created by such a security check.
12. Contact after a restaurant visit – feedback and review request
If you have visited our restaurant and we have received your email address in connection with a reservation or other business communication, we may use this email address – provided that the applicable data protection and competition law requirements are met – for a one-off subsequent contact.
You can get in touch, particularly shortly after your visit to the restaurant.
The purpose of the contact is in particular:
– to ask about satisfaction with the restaurant visit,
– to give our guests a simple way to provide direct feedback,
– to receive indications of potential improvements,
– and to give our guests the opportunity to leave a voluntary, honest review of our restaurant, for example on Google.
The review request is voluntary.
We exclusively request an honest review and do not influence the content of a review.
In particular, we do not ask for or expect a positive review.
Legal basis
In so far as the processing is based on our legitimate interest and the legal requirements for this are met, the processing is carried out on the basis of Article 6(1)(f) of the GDPR.
Our legitimate interest consists in particular in determining our guests' satisfaction, receiving feedback, further developing the quality of our services and providing our guests with an easy way to give feedback on their actual restaurant visit.
When balancing interests, we take into particular consideration that the contact:
– relates to an actual restaurant visit,
– takes place shortly after this visit,
– is generally carried out once,
– relates specifically to the guest's experience at our restaurant,
– does not constitute regular newsletter communication.
Conditions under competition law
Insofar as such a subsequent email is classified as advertising within the meaning of Section 7 of the German Unfair Competition Act (UWG), it will only be sent if the statutory requirements applicable to this are met.
In particular, we will only send electronic mail for advertising purposes where there is appropriate consent or another legally permissible basis under the applicable competition law regulations.
The permissibility under data protection law pursuant to the GDPR and the permissibility under competition law pursuant to Section 7 of the UWG are to be assessed independently.
The email address will not be automatically used for a newsletter or regular promotional communication on the basis of such a one-off contact.
You may object to the use of your personal data for direct marketing purposes at any time.
13. Withdrawal of consent
Insofar as we process personal data on the basis of your consent, you can revoke your consent at any time with future effect.
The cancellation can be made without any specific form, for example by email to:
info@syrtaki-bocholt.de
The lawfulness of the processing carried out prior to the withdrawal remains unaffected hereby.
14. Right to object under Article 21 GDPR
If the processing of your personal data is based on Art. 6 (1) (e) or (f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation.
If personal data is processed for direct marketing purposes, you have the right to object at any time to such processing.
Following an objection, the personal data concerned will no longer be processed for direct marketing purposes, unless there is another legal basis for doing so.
15. Your rights as a data subject
Subject to the statutory requirements, you have in particular the following rights:
Right of access under Article 15 GDPR
You have the right to obtain access to the personal data we process, as well as further information stipulated by law.
Right to rectification pursuant to Art. 16 GDPR
You have the right to demand the rectification of inaccurate personal data.
Right to erasure pursuant to Article 17 GDPR
You can request the erasure of your personal data under the statutory conditions.
Right to restriction of processing pursuant to Art. 18 GDPR
Under the legal conditions, you can request the restriction of the processing of your personal data.
Right to data portability pursuant to Art. 20 GDPR
Subject to the statutory conditions, you have the right to receive personal data that you have provided to us and which we process automatically on the basis of consent or for the performance of a contract in a structured, commonly used and machine-readable format.
Right to withdraw consent pursuant to Art. 7(3) GDPR
You can withdraw consent at any time with future effect.
16. Right to lodge a complaint with a supervisory authority
In accordance with Article 77 of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes data protection regulations.
For North Rhine-Westphalia, the authority in particular is:
State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia (LDI NRW).
The contact details of the competent supervisory authority can be accessed via their official website.
17. SSL/TLS encryption
This website uses SSL or TLS encryption for security reasons.
You can recognise an encrypted connection by the fact that your browser's address bar starts with „https://“ and a padlock symbol is displayed.
When encryption is enabled, the data you transmit to us cannot, as a general rule, be easily read by third parties.
However, we would point out that complete security of data transmission on the internet cannot be guaranteed.
18. Cookies and similar technologies
Our website may use cookies and similar technologies.
Cookies are small text files or comparable information that can be stored on your device.
Technically necessary cookies may be used insofar as they are required for the operation of the website, the provision of a digital service expressly requested by you, or the security of the website.
Non-technically necessary cookies and comparable technologies are only used to the extent that valid consent has been given.
In so far as consent is required, processing is carried out on the basis of Art. 6 (1) (a) GDPR.
For storing information on your terminal equipment or accessing information already stored there, the requirements of Section 25 of the TDDDG must also be observed.
Where we use a consent management system, you can adjust your settings there at any time and withdraw any consent given with future effect.
The precise use of cookies depends on the technologies actually deployed on our website.
19. Server log files
When visiting our website, information may be automatically collected and stored in so-called server log files by the hosting provider.
These may include, in particular:
– browser type and browser version,
– operating system used,
– Referrer URL,
– Hostname of the accessing computer,
– time of the server request,
– IP address,
– volume of data transferred,
– HTTP status code,
– accessed resources.
The processing serves in particular the technical provision, stability and security of our website as well as the detection and prevention of attacks and misuse.
The legal basis is Article 6(1)(f) of the GDPR.
Our legitimate interest lies in the secure, stable and technically reliable provision of our online service.
The data will be deleted as soon as it is no longer required for the stated purposes, unless legal or security-related reasons justify longer storage.
20. Map display
On our website, we use a map display based on OpenStreetMap to show our location.
The technical rendering of the map can be done using the JavaScript library Leaflet.
CARTO services can be used for the technical provision of the map display.
The map display serves to present our location in a user-friendly manner and to help our guests find their way around.
When using an externally loaded map display, technically necessary connection data, in particular the IP address and other technical information, may be transmitted to the respective technical service providers.
Insofar as consent is required for the specific technical integration, the processing is carried out on the basis of Article 6(1)(a) GDPR and in compliance with Section 25 TDDDG.
Insofar as the map display is strictly necessary for a digital service explicitly requested by you, the statutory exception to the requirement for consent may apply in this regard.
The specific technical integration is decisive for the data protection assessment.
21. Google Maps and route planning
On our website, we offer the option to access route planning or location display via a link using Google Maps.
If you click on the corresponding link, for example „Open route in Google Maps“, you will be redirected to Google Maps.
Until the link is clicked, this external link generally does not integrate Google Maps into our website.
From the time of forwarding, the processing of personal data is carried out by Google under its own data protection responsibility.
In this context, your IP address and other technical data in particular may be processed.
Depending on the use of Google Maps, location information, search queries, device information and other usage-related information may also be processed.
We have no control over the nature, scope and further use of the data processed by Google.
Processing by Google is governed by the privacy policy and settings of the respective Google service or user account.
Further information on the processing of personal data by Google can be found in Google's privacy policy.
Further information on OpenStreetMap can be found in the OpenStreetMap privacy policy.
Further information on CARTO can be found in CARTO's privacy policy.
22. Google Analytics
Insofar as Google Analytics is actually used on this website, such use takes place solely in accordance with the technical configuration actually deployed and – where necessary – following prior consent.
The provider is Google Ireland Limited.
Google Analytics can use cookies and similar technologies to collect and statistically evaluate information about the use of our website.
Where consent is required for this, the processing is carried out on the basis of Article 6(1)(a) GDPR and in compliance with Section 25 TDDDG.
Consent that has been given can be revoked at any time via the cookie settings provided by us.
The specific technical configuration, retention period and potential transfer of personal data to third countries depend on the version and configuration of Google Analytics actually used.
If Google Analytics is not used on our website, this section does not apply.
23. Google reCAPTCHA
Insofar as Google reCAPTCHA is actually used on our website, this service can be employed to protect forms against spam, abuse and automated entries.
reCAPTCHA can process technical information about the device used and the use of our website to assess whether an entry is made by a human or by automated processes.
Insofar as consent is required for the deployment, the processing is carried out on the basis of Art. 6(1)(a) GDPR and in compliance with Section 25 TDDDG.
If Google reCAPTCHA is not used on our website, this section does not apply.
24. Google Fonts
Insofar as Google Fonts are used on our website, the fonts are integrated locally on our web server where possible.
With a local installation, no connection to Google servers is established to load the fonts.
If fonts are exceptionally loaded externally from Google servers, your IP address in particular may be transmitted to Google.
Insofar as consent is required for this, the external integration takes place solely in accordance with the applicable statutory provisions.
The specific technical integration is decisive for the data protection assessment.
If Google Fonts are integrated exclusively locally, no personal data is transmitted to Google for the purpose of retrieving the fonts.
25. External links to social networks and review platforms
Our website may contain links to external websites and online services, in particular to Google, Google Maps, Google reviews, Tripadvisor, Facebook, Instagram or X.
As far as they are merely external links, simply visiting our website does not generally establish a connection to the respective social networks or platforms.
Only when you click on such a link will you leave our website and be redirected to the respective external website.
From this point onwards, the respective provider is responsible for the processing of personal data in accordance with its own data protection regulations.
We have no influence on the nature, scope and purpose of the data processing by these third-party providers.
26. Google reviews
Our website may contain a link to our Google listing or to a way to leave a Google review.
Such a link is basically an external link.
Simply visiting our website does not, in principle, establish a connection to Google unless a Google service is technically integrated.
Only when you click on the corresponding link will you be redirected to Google.
From this point on, the processing of personal data is carried out by Google under its own data protection responsibility.
We have no control over which personal data Google processes when you use its review service.
Leaving a review is voluntary.
We solely request an honest review and do not influence its content.
27. Integrated content and third parties
Insofar as content, services or functions from third parties are integrated on our website, the respective data processing takes place solely within the framework of the statutory requirements applicable for this purpose.
This concerns in particular:
– Map and map display services,
– external linking services,
– Analysis and statistics services,
– Security and spam protection services,
– media content,
– where applicable, further technical services.
Non-essential third-party services are loaded only after the corresponding consent has been given, as required by law.
The exact processing depends on the specific technical integration actually used.
28. Disclosure of personal data
Personal data will only be passed on to third parties if there is a legal basis for doing so.
A transfer may be necessary in particular:
– for processing and carrying out a reservation,
– for processing a contact enquiry,
– for the purpose of carrying out a recruitment procedure,
– for carrying out an employment or training relationship,
– to fulfil legal obligations,
– for the technical provision and security of our website,
– to prevent abuse and security threats,
– based on your consent,
– or on the basis of a legitimate interest in accordance with Art. 6 (1) (f) GDPR.
Insofar as we use service providers who process personal data on our behalf, their deployment takes place – where necessary – on the basis of a data processing agreement in accordance with Art. 28 GDPR.
29. Transfer to third countries
A transfer of personal data to countries outside the European Union or the European Economic Area only takes place if the legal requirements of Articles 44 et seq. GDPR are met.
This can be particularly relevant when using certain services from internationally operating providers.
Provided an adequacy decision by the European Commission exists or appropriate safeguards such as standard data protection clauses are used, a transfer takes place on this basis, provided the statutory requirements are met.
Further information can be found in the respective sections of this privacy policy.
30. Retention period and erasure
We generally only store personal data for as long as is necessary for the respective processing purpose.
If the purpose of storage ceases to apply, the data will be deleted, unless statutory retention obligations or other legal grounds prevent deletion.
In particular, retention obligations under commercial and tax law remain unaffected.
Data from contact and reservation enquiries is generally deleted as soon as the enquiry has been finally processed and no further storage is required.
Application data will be deleted in accordance with the statutory requirements applicable to application procedures.
Data used for a one-off subsequent contact after a restaurant visit will not be stored for longer than is necessary for the respective purpose.
Statutory retention periods may preclude earlier deletion.
31. Data security
We deploy appropriate technical and organisational security measures to protect personal data against loss, destruction, manipulation and unauthorised access.
Our security measures are regularly reviewed and updated in line with technological developments and organisational capabilities.
Please note that absolute security cannot be guaranteed, particularly with regard to communication by email, despite technical security measures.
32. No automated decision-making
Automated decision-making including profiling pursuant to Art. 22 GDPR does not, as a matter of principle, take place within the context of our website and the processing operations described in this privacy policy.
Should this change in future, we will update the privacy policy accordingly.
33. Obligation to provide personal data
There is generally no statutory or contractual obligation to provide personal data, unless expressly stated otherwise in individual cases.
However, certain details may be required in order for us to process an enquiry, make a reservation or review an application.
If required information is not provided, the respective request may not be processed, or may not be processed fully.
Which details are required in individual cases follows from the respective form or communication.
34. Changes to this privacy policy
We reserve the right to amend this privacy policy should this become necessary due to legal, technical or organisational changes.
The current version of the privacy policy can be accessed on our website.
Last updated: July 2026
