Privacy policy
This is a translation for convenience. The German version is the binding one.
This privacy policy covers our website antico-duomo.de and our reservation book at reservierung.antico-duomo.de.
Controller
Dom Cafe Gastro Augsburg GmbH (Ristorante Antico Duomo), Frauentorstraße 2, 86152 Augsburg, Germany, represented by its managing director Rafaele Mehmeti. Phone +49 821 50817300, email info@antico-duomo.de.
Server and hosting
This website and our reservation book run on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, which Granit Mehmeti operates for us. The server is located in a Hetzner data centre in Finland, within the EU. Both process the data only on our behalf and on our instructions (data processing under Art. 28 GDPR).
Visiting the website
When you visit the website, your browser sends technically necessary data to our server, in particular your IP address, the address requested, date and time, and information about your browser and operating system. We need this data to deliver the pages to you and to run the server securely. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a working and secure website. The connection is encrypted with HTTPS.
We do not keep access logs with IP addresses or browser details. When a technical error occurs, for example when you leave the page while a video is still loading, the server writes a message with the address requested to its error log. Your IP address appears there only shortened (for IPv4 the last two parts are removed, for IPv6 everything after the first two blocks), and no browser details at all, so we cannot link the message to a person. The reservation book also notes, for each request to its interface, only the type and path of the request (without query parameters), the time, the result and the duration, likewise without IP address or browser details. These logs are limited to 30 MB per service; once the limit is reached, the oldest entries are deleted. We look at the logs only to fix errors.
Cookies and browser storage
This website sets no cookies and uses no analytics or advertising services. So that you return to the place you were reading when you go back, your browser remembers the scroll position in its session storage (sessionStorage). This entry contains no information about you and disappears when you close the tab. It is strictly necessary for the page to work as you expect when you navigate (Section 25(2) no. 2 TDDDG).
Our reservation page at reservierung.antico-duomo.de/reservieren likewise sets no cookies, does not remember a scroll position and sets up no cache (service worker). If you opened the page before, a service worker set up back then may keep caching the page's program files in your browser, without any information about you; you can remove it by deleting the site data for reservierung.antico-duomo.de in your browser. Apart from that, cookies and a service worker are used there only on the login page for our staff (see "Staff login").
Fonts, images and videos
We serve fonts, images and videos from our own server. We do not load content from Google, Instagram or other providers, except for the spam protection in the reservation form on antico-duomo.de and the login page for our staff (see below). The references to Google Maps, Google reviews and our Instagram profile are plain links: only when you click them do you leave our website, and the privacy notice of that provider applies.
Online reservations
When you request a table using the form on this website, we process your name, your phone number with country code, your email address, the number of guests, date and time, the time of your request and whether you used the German or the English page. We need this information to handle your reservation, assign you a table and reach you if we have questions. Without it, online booking is not possible; you can call us instead.
Our web server passes your request straight to our reservation book, which runs on the same server and automatically checks the request against our opening hours and free tables. From there you receive emails about your reservation: an acknowledgement and, depending on how things go, a confirmation, a change or cancellation, a message that no table is available or that a table has become free after all, or a note if the time you chose cannot be booked online. We send these emails from our mailbox at IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. They contain your name and the details of the reservation, not your phone number.
If the reservation book is unavailable, the form does not accept the request and asks you to call us.
You can also request a table directly in our reservation book at reservierung.antico-duomo.de/reservieren. There you enter your name, phone number with country code, email address, number of guests, date and time and, if you like, a note (field "Notiz"), for example a seating wish or that you need a high chair. Please do not put any health information there; it is best to discuss allergies directly with our staff. Your browser sends the request straight to the reservation book, which also stores the time of your request. After that, everything works as described above, with the same emails. If the reservation book is unavailable, the page does not accept the request.
The legal basis is Art. 6(1)(b) GDPR: we need the information to handle your reservation request and carry out the reservation. With the tick box in either form you only confirm that you have read this notice; no consent is needed.
Storage period
In the reservation book, name, phone number, email address and notes are deleted automatically 180 days after the reservation date. Only data that no longer identifies anyone remains, such as date, time, number of guests and the country of the phone code, which we use for our planning. Emails that the reservation book has sent or taken over from our mailbox (see "Contact by email or phone") are deleted 180 days after they were sent or received.
The website itself does not keep your details. To limit requests (next section) it stores for each request only date, time and number of guests plus two check values, and deletes this entry automatically after 48 hours.
Protecting the form against misuse
So that nobody can use the form for mass requests, we accept at most three requests per hour from one connection and at most three requests per day for one email address. For this, the website computes one check value each from your IP address and your email address, using a secret key that exists only in the server's memory and is created anew at every restart. Only these check values are stored; the IP and email address cannot be recovered from them. We delete them after 48 hours. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protection against spam and misuse.
For requests made directly at reservierung.antico-duomo.de/reservieren, the reservation book accepts at most ten requests per hour from one connection. For this it keeps your IP address and the times of your requests only in the server's memory; they are not written to disk and are deleted again about an hour after your last request. The form also contains a field that people cannot see; if it is filled in, we discard the request without storing it. Here too, the legal basis is Art. 6(1)(f) GDPR.
Spam protection with Cloudflare Turnstile
In the reservation form on antico-duomo.de we use Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile checks whether a human is filling in the form. As soon as you click into a field of the form, your browser loads a script from Cloudflare, which sends technical data such as your IP address, browser details and the page you are on to Cloudflare. If you do not use the form, nothing is loaded from Cloudflare. When you submit the form, we also send your IP address and the check result to Cloudflare for verification. Turnstile does not set cookies for advertising or analytics. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting the form from automated requests. Access to your device is strictly necessary for the form you are using to work securely (Section 25(2) no. 2 TDDDG). More information: cloudflare.com/turnstile-privacy-policy.
Contact by email or phone
When you call us or write an email, we process your details to deal with your request. The legal basis is Art. 6(1)(b) GDPR if it concerns a reservation, a celebration or another contract, otherwise Art. 6(1)(f) GDPR; our legitimate interest is then to answer enquiries from guests and business partners. We enter reservations made by phone in our reservation book, where the period under "Storage period" applies.
Our emails are kept in our mailbox at IONOS SE. The reservation book is connected to this mailbox and fetches new emails regularly. If it recognises a reservation request or a reply about a reservation, on its own or with the help of OpenAI (see below), it takes over the sender, subject and text of the email as well as name, contact details and the requested reservation into the reservation book. For other emails it only records that it has already checked them (there is one exception, described below). If it cannot read or process an email, it keeps the sender and subject, and after a processing error also the text, so that we can check it by hand; the period under "Storage period" applies here too. We delete emails in the mailbox once your matter is settled and no statutory retention obligation applies any longer (six years for business letters, Section 257 HGB, Section 147 AO).
To read details in emails that it cannot find on its own, the reservation book uses an AI language model from OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (details on the transfer to countries outside the EU below). It first evaluates every email on its own. It passes on to OpenAI only individual emails that look like a table reservation: if it has recognised a reservation request or change but the date, time or number of guests is missing, or if it would otherwise skip an email whose subject or text contains a word such as "reservation" or "table for", a request for a table, or a cancellation or change with a booking number. Never sent to OpenAI are emails from the address of this mailbox itself and emails containing a word from our block lists, for example on advertising and invoices, health, staff and job applications, authorities and courts, banking and credit, reviews, and out-of-office and delivery notices. For emails from reservation platforms, the block lists apply only in part, and not at all when details are missing from a booking recognised there. The block lists are word lists, not a guarantee: emails with a reservation word and no blocked word, such as booking confirmations from other providers or differently worded out-of-office replies, may still be sent to OpenAI.
OpenAI receives the subject and at most the first 6,000 characters of the text: for emails from guests, only their own text without quoted earlier messages, as far as the reservation book recognises them as quotes, and for emails from reservation platforms, the whole text. We never send files marked as attachments or attached emails, and we do not send the sender's address or name separately; OpenAI sees them only if they appear in the subject or the text. From this, OpenAI reads details such as date, time, number of guests, name and contact details. The reservation book uses these details without our staff checking them first: it enters a reservation with them or changes or cancels an existing one, and you receive the same automatic emails as usual. If OpenAI finds even a single detail such as a name or a time in an email, the reservation book keeps the sender, subject and text of that email as it does for a reservation request, even if the email was not about a reservation at all. Please therefore do not send us any health information by email; it is best to discuss allergies by phone or directly with our staff.
According to OpenAI, it does not use the data to train its models and keeps it for up to 30 days to detect abuse; longer only if required by law or if necessary to prevent harm. The legal basis is Art. 6(1)(b) GDPR if the email concerns a reservation, otherwise Art. 6(1)(f) GDPR; our legitimate interest is to recognise reservation requests in incoming emails reliably and quickly.
Reviews on the home page
On the home page we show excerpts from public Google reviews, with only the first name and the initial of the surname of their authors. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is showing visitors to our website what people write about us on Google. We show an excerpt only while the review is public on Google and check the selection at least once a year. If you do not want to be named there, send us a short message and we will remove the excerpt.
Staff login
The bare address reservierung.antico-duomo.de shows the login to our reservation book. It is only for our staff; you do not need it to make a reservation. For the login we use the Clerk service of Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA. If you open this page, your browser loads a script from Clerk; Clerk receives technical data such as your IP address and browser details, and sets cookies that the login needs. The page also sets up a service worker that caches the reservation book's program files in your browser so that it can be installed as an app and show notifications; this cache contains no information about you. The reservation page loads nothing from Clerk. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure access to the reservation book. The cookies and the service worker are strictly necessary for the login and the reservation book to work (Section 25(2) no. 2 TDDDG).
Recipients
Your data is received only by the service providers named in this policy: Granit Mehmeti and Hetzner for the server, IONOS for our emails, OpenAI and its service providers for reading emails, Clerk for our staff login, Cloudflare for spam protection. We do not sell data and do not pass it on for advertising.
Transfer to countries outside the EU
Clerk and Cloudflare are based in the USA. The transfer is based on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which both companies are certified. What the reservation book sends to OpenAI is also processed in the USA: OpenAI Ireland passes this data on to OpenAI OpCo, LLC in the USA and to other service providers, including in other countries outside the EU (list of OpenAI's service providers). This is based on EU standard contractual clauses (Art. 46(2)(c) GDPR) or, for some countries, an adequacy decision of the European Commission (Art. 45 GDPR). The text of the standard contractual clauses is available on EUR-Lex.
Automated decisions
We make no decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Art. 22 GDPR). The reservation book enters reservations on its own and can also change or cancel them on its own after an email. In doing so, it goes by what the request or email says and by our opening hours and free tables. If it has misunderstood an email, please contact us and we will correct the reservation by hand. We do not create profiles.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Please contact us at the address above.
You can also lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.
Right to object (Art. 21 GDPR)
Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.
Last updated: October 2026