Skip to content
Café · Confiserie · since 1686

Privacy policy

Thank you for visiting our website. In accordance with Art. 13 GDPR, we inform you below about which personal data is processed when you visit this website. This website does not set cookies, does not use any analytics or tracking services and does not embed external fonts, maps or social media content.

1. Controller

Prinzess Giebelen KG
represented by Claudius Giebelen
Rathausplatz 2
93047 Regensburg
Germany

Phone: +49 (0) 941 59 53 10
Email: kontakt@cafe-prinzess.de

2. Hosting

This website is hosted by Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland. The servers are located in Switzerland. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the provider. The European Commission has issued an adequacy decision for Switzerland (Art. 45 GDPR); the level of data protection there is therefore considered equivalent to that of the EU.

3. Server log files

When you access the website, your browser automatically transmits information that is stored in server log files:

This processing serves to deliver the website, to ensure stability and security and to defend against attacks. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the secure and error-free operation of the website. This data is not merged with other data sources. We do not create our own access logs of website visits. Logging takes place at infrastructure level by our hosting provider Infomaniak in order to maintain the operation of the platform and to defend against attacks. Insofar as Infomaniak processes this data for its own network and information security purposes, Infomaniak acts as an independent controller in this respect; details, including the retention period, can be found in Infomaniak's privacy policy.

4. Catalogue downloads and delivery of images (Sanity)

The content of this website is managed via the content management system Sanity. The catalogues offered for download (PDF files) and the images on the website are delivered directly via Sanity's content delivery network (CDN). The provider is Sanity US Inc., 351 California Street, Suite 650, San Francisco, CA 94104, USA; its affiliated company is Sanity AS, Trondheimsveien 2K, 0560 Oslo, Norway.

When you view an image or download a catalogue, your browser connects to Sanity's servers. Technically necessary data is processed in this context, in particular your IP address, the date and time of the request, the requested file and browser and device information. Sanity also stores the IP address in order to detect and prevent abusive access. No registration or other data is required for the download.

The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in the fast, reliable and secure provision of the content. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Sanity. As the provider is based in the USA and Sanity may use sub-processors in other third countries, personal data is transferred to a third country. This transfer is based on the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR), which form part of the data processing agreement with Sanity. Further information can be found in Sanity's privacy policy.

5. SSL/TLS encryption

For security reasons, this website uses SSL or TLS encryption. You can recognise an encrypted connection by “https://” in your browser's address bar.

6. Contact by email or phone

If you contact us by email or phone, we process the information you provide (e.g. name, email address, phone number and the content of your enquiry) in order to handle your request. The legal basis is Art. 6 (1) (b) GDPR if your enquiry relates to a contract or pre-contractual measures, otherwise Art. 6 (1) (f) GDPR; our legitimate interest lies in responding to your enquiry. For email communication, we use Microsoft Exchange Online provided by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Microsoft. Insofar as data is transferred to Microsoft Corporation in the USA, this is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Microsoft is certified, and additionally on the EU standard contractual clauses (Art. 46 (2) (c) GDPR). Emails are transmitted with transport encryption, provided the recipient's system supports it. We delete your data once your request has been dealt with conclusively and no statutory retention obligations apply.

7. Links to other websites

This website contains links to third-party websites. Data is only transmitted to the respective provider once you click on such a link. The operator of the respective website is solely responsible for the data processing on that website.

8. Retention period

We process personal data only for as long as is necessary for the respective purpose or as required by statutory retention periods (in particular under commercial and tax law). The data is deleted thereafter.

9. Your rights

You have the right at any time to:

To exercise your rights, an informal message to the contact details given in section 1 is sufficient.

Right to object pursuant to Art. 21 GDPR: Insofar as we process your data on the basis of Art. 6 (1) (f) GDPR, you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

10. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
(Bavarian State Office for Data Protection Supervision)
Promenade 18
91522 Ansbach, Germany
www.lda.bayern.de

11. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

12. Validity of this privacy policy

As of: November 2026. We will update this privacy policy if the website or the legal requirements change.

This English version is provided for convenience only. In the event of any discrepancy, the German version shall prevail.