Privacy policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Mayra Gastro GmbH
represented by the Managing Director Burak Okumus
Achalmstraße 38
71088 Holzgerlingen
Germany

Email: info.mga@wearemayra.com
Phone: +49 151 64518409

The other pages on wearemayra.com (holding, careers, news) are the responsibility of Mayra Group GmbH (for applications for our positions see below); its privacy policy applies there.

2. General information on data processing

As a matter of principle, we process the personal data of our users only to the extent necessary to provide a functional website as well as our content and services. Processing takes place only with the user's consent or where the processing is permitted by statutory provisions.

3. Provision of the website and server log files

Each time our website is accessed, our hosting provider automatically collects information that your browser transmits (so-called server log files):

• IP address of the requesting device
• Date and time of access
• Name and URL of the file retrieved
• Volume of data transferred
• Notification of successful retrieval
• Browser type and version, operating system
• Referrer URL

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in security and stability). The data is deleted after a maximum of 30 days.

4. Hosting

This website is provided via Lovable (gridaco s.r.o. / Cloudflare). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. The servers are located within the European Union or operate while maintaining an adequate level of data protection.

5. Job applications

We advertise our vacancies on the careers page of wearemayra.com. The job board and applicant management are operated on our behalf by Mayra Group GmbH (Art. 28 GDPR). We are the controller for applications for positions at Mayra Gastro GmbH and for speculative applications in which you select Mayra Gastro GmbH as your preferred company; these notes apply.

We process the details from the application form (name, email address, optionally phone number and LinkedIn profile, cover letter, desired type of employment, where applicable answers to questions about the position) and your documents (CV, optionally a photo and further attachments). In the course of the process, interview appointments, notes of the persons involved and, where applicable, the agreement on a trial work day are added. The purpose is to carry out the application process; the legal basis is Art. 6 (1) (b) GDPR (initiation of an employment relationship). Only the persons involved in filling the position have access.

After submitting, you receive a confirmation of receipt with a personal link through which you can view the status of your application and withdraw it. To protect against misuse, we only store your IP address in hashed form.

At the push of a button by a responsible person, your CV may be transmitted to Anthropic, PBC (USA) in order to transfer details such as education and work experience into the applicant file. The transfer takes place on the basis of the EU standard contractual clauses (Art. 46 (2) (c) GDPR). A human reviews the result; no automated procedure decides on your application (Art. 22 GDPR).

If your application is rejected or you withdraw it, we automatically delete the data including all documents six months later; we retain it for this period to defend against possible claims under the German General Equal Treatment Act (Art. 6 (1) (f) GDPR). If an employment relationship is established, we transfer the necessary details to the personnel file.

6. Catering enquiry and email contact

If you contact us via the catering enquiry or by email, we process your details (contact person, email address, where applicable phone and company, date, time, place and number of guests of the event, selected package, message) solely to process your enquiry and to prepare an offer. For this purpose your enquiry is created in our internal ticket system. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures at your request).

If an order is placed, we retain the documents in accordance with the retention periods under commercial and tax law (up to 10 years). Otherwise we delete the data as soon as it is no longer required for processing.

7. Guest feedback

Via the feedback page (e.g. via QR code in the restaurant) you can send us a star rating and optionally a text. You only provide an email address if you would like a reply and expressly consent to this. Ratings of 1–3 stars or with text are created as a case in our internal ticket system so that the team can follow up. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in improving our offering), and for contacting you Art. 6 (1) (a) GDPR (consent). We only store your IP address in hashed form to limit multiple submissions.

8. Crusty Club (email newsletter) and promotion pages

If you sign up for the Crusty Club (including via a promotion page), we process your email address, optionally your first name, the language, the time of sign-up and confirmation and the source of the sign-up (e.g. QR code or campaign parameters). Sign-up uses the double opt-in procedure: you receive an email with a confirmation link, and only then do we send you offers and news from Crusty Slices. The legal basis is your consent (Art. 6 (1) (a) GDPR).

We only count opens and clicks of our mailings in aggregate per mailing, without reference to you personally. You can withdraw your consent at any time via the unsubscribe link in every email or by sending us a message; your address will then be removed from the mailing list.

9. Collaborations with creators

Creators can apply for a collaboration via the collaboration page. We process the name, where applicable the real name, email address, optionally phone, profiles and reach on the platforms provided, topics, location, message and media kit link. You confirm the email address via a link. The purpose is to review and initiate a collaboration; the legal basis is Art. 6 (1) (b) GDPR. If no collaboration results, we delete the details as soon as they are no longer required for this purpose.

10. Protection against misuse and sending log

To protect against misuse (spam, automated requests), we briefly store your IP address when a form is submitted in order to limit the number of requests per time period. These IP addresses are deleted after 24 hours at the latest. To ensure the traceability of confirmation and notification emails, we keep a technical sending log (recipient email, template, status, timestamp), which is deleted after 12 months. The legal basis in each case is Art. 6 (1) (f) GDPR (legitimate interest in IT security and verifiable sending).

11. AI functions

On the Crusty Slices pages we offer two optional AI functions: the slice advisor (recommendations from our menu) and the catering assistant (pre-fills the catering enquiry form from a short description). These functions are only used if you actively enter text and send it.

Your entry (and, for the advisor, the previous messages of the same conversation) is transmitted together with our menu information to Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA, which processes it on our behalf to generate the answer. Data is transferred to the USA on the basis of the EU standard contractual clauses (Art. 46 (2) (c) GDPR). According to Anthropic, entries via its programming interface are not used to train AI models. We do not store the content of your entries; to protect against misuse, your IP address is briefly stored for rate limiting (deleted after 24 hours at the latest).

The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in offering an optional digital advisory service) and, for the catering assistant, Art. 6 (1) (b) GDPR (pre-contractual measures at your request). Please do not enter any sensitive data (e.g. health data) in these fields. The answers are generated automatically and may be incomplete; information on allergens and ingredients is available from our team on site.

12. Weather notice

On the Crusty Slices page, our server retrieves the current weather for the fixed location of the store (Milaneo Stuttgart) from Bright Sky (open data of the German Weather Service). No data about you is transmitted in the process.

13. Ordering platforms, social networks, Instagram videos

Our pages contain plain links to ordering platforms (e.g. Uber Eats), to Google Maps and to our profiles on social networks. These are ordinary links without embedded content: data is only transferred when you click a link. The respective provider is responsible for processing on these platforms.

Individual videos on the Crusty Slices page come from Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). They are only loaded when you click on the video; before that there is no connection to Instagram. When you click, your IP address and technical details of your browser are transmitted to Meta, possibly also to the USA; Meta may set cookies in the process. The legal basis is your consent given by clicking (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

14. Crusty Slices app

A separate app privacy policy applies to the Crusty Slices app (customer account, crumbs, rewards).

15. Processors / recipients

The website and the underlying platform (database, ticket system, applicant management, email sending) are operated on our behalf by Mayra Group GmbH, Achalmstraße 38, 71088 Holzgerlingen, Germany, pursuant to Art. 28 GDPR. It uses the following service providers for this purpose.

To provide the website and to send emails, the following service providers are used, with each of whom a data processing agreement pursuant to Art. 28 GDPR is in place:

• Lovable / Cloudflare – hosting and provision of the website
• Supabase – database and backend infrastructure (servers in the EU)
• Lovable / Mailgun – sending of emails (confirmations, notifications, Crusty Club)
• Anthropic – AI functions and reading CVs (see above)

16. Fonts

All fonts used on this website are hosted on our own servers. No connection to Google Fonts or other external font providers is established when you visit the website.

17. Local storage

We use your browser's local storage solely to store your selected language (German / English) and your acknowledgement of the notice banner regarding local storage. This storage is technically necessary and takes place on the basis of § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). No tracking, analytics or marketing cookies are used and no transfer to third parties takes place.

18. Cookie-free usage statistics

On individual pages (e.g. link page, Crusty Slices, catering), we count page views and clicks on certain elements without cookies and without personal reference. We store: the page or element concerned, the time, the referring website (domain only) and any campaign parameters contained in the link (e.g. utm_source). IP addresses are not stored; for protection against misuse they are only used in hashed form for a short time. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in the needs-based design of our offering).

19. Your rights as a data subject

You have the following rights vis-à-vis us with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent given (Art. 7 (3) GDPR)

To exercise these rights, simply contact info.mga@wearemayra.com.

20. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data. The supervisory authority responsible for Mayra Gastro GmbH is:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg)
Lautenschlagerstraße 20
70173 Stuttgart
baden-wuerttemberg.datenschutz.de

21. SSL/TLS encryption

For security reasons, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the lock symbol in your browser’s address bar and by the "https://" prefix.

22. Validity and amendment of this privacy policy

This privacy policy is currently valid. As our website develops further, or due to changes in statutory or regulatory requirements, it may become necessary to amend this privacy policy.