Privacy
This page summarises how we process personal data on https://www.cafeherzog.at (Next.js on Vercel). The authoritative establishment is in Austria; the German page Datenschutz (German) mirrors the same substance.
1. Controller
Herzog Gastro FlexKapG, Herrengasse 6, 8010 Graz, Österreich. Email: office@cafeherzog.at. Phone: +43 316 375537.
Company register details, VAT number, and representation: see our imprint.
2. Hosting
The site is hosted by Vercel Inc. (USA). Vercel processes technical data needed to deliver and secure the site (e.g. IP address, request time, browser). Legal basis: Art. 6(1)(f) GDPR (legitimate interests). See Vercel Privacy Policy.
Where personal data is transferred to a third country (in particular the USA), we rely on appropriate safeguards within the meaning of Art. 46 GDPR, such as the EU-US Data Privacy Framework (where the recipient is certified) and/or the EU Commission's standard contractual clauses. See each provider's privacy notice for details.
3. Consent banner
We store your choice in the browser's localStorage under herzog-consent-v1 (essential = “Necessary only”, all = “Accept all”). Clear site data for this domain to withdraw consent.
- Necessary only: loads embedded Google Maps on the contact page and the reservation iframe (Asello) where needed.
- Accept all: additionally enables Google Analytics 4 (Google Tag / Consent Mode), optional Google Ads conversion measurement, Vercel Web Analytics, Vercel Speed Insights, Microsoft Clarity (if configured), and (if configured) Sentry error reporting.
The legal basis for processing based on consent is Art. 6(1)(a) GDPR in conjunction with § 25 TTDSG (Austria), where applicable.
The Open reservation in a new tab link works even if you have not chosen in the banner yet (lower friction). The embedded reservation on our site only loads after Necessary only or Accept all.
| Technology | Scope | Purpose | Duration / note |
|---|---|---|---|
| herzog-consent-v1 | First party (localStorage) | Stores your banner choice | Until you clear site data for this domain |
| Vercel hosting / CDN | Vercel Inc. (USA) | Delivery, security, TLS | Per Vercel (access logs etc.) |
| Google Maps (embed) | Google Ireland Ltd. | Map on /en/contact | After “Necessary only” or “Accept all”; see Google |
| Asello (iframe) | Reservation partner | Embedded booking | After “Necessary only” or “Accept all”; see partner |
| Google Analytics 4 / Google Tag | Google Ireland Ltd. | Audience measurement; Consent Mode before full consent | Fully active only after “Accept all”; reduced before consent |
| Google Ads (optional) | Google Ireland Ltd. | Ad / conversion measurement if configured | Only when configured and after “Accept all” |
| Vercel Analytics / Speed Insights | Vercel Inc. | Usage & performance | Only after “Accept all” |
| Microsoft Clarity | Microsoft Ireland Operations Ltd. | Usage analytics (if configured) | Only after “Accept all”; see Microsoft |
| Sentry (if enabled) | Functional Software Inc. | Error diagnostics | Only after “Accept all” |
| Stripe Checkout | Stripe Payments Europe Ltd. | Shop payments | Only on checkout.stripe.com during payment |
4. Google Maps
Google Ireland Limited may process data (including IP addresses) when the map loads. Embedded after you choose Necessary only or Accept all. Google Privacy Policy.
5. Reservations (Asello)
Reservation pages embed our POS/reservation partner (Asello) in an iframe. The partner processes data under its own notice. Legal bases: Art. 6(1)(b) GDPR (pre-contract/contract) and Art. 6(1)(f) GDPR (functional reservations).
6. Shop (Stripe)
Checkout is processed by Stripe Payments Europe Ltd. and affiliates. We receive status information required to fulfil the purchase. See stripe.com/privacy.
7. Supabase (content & admin)
We use Supabase for structured content and authenticated editors (magic link). Technical metadata and editor account data may be processed. See supabase.com/privacy.
8. Analytics (accept all only)
Google Analytics 4 (via Google Tag), optional configured Google Ads conversion measurement, Vercel Web Analytics, Speed Insights, and Microsoft Clarity (if configured) run only after you choose Accept all. Before acceptance, Google Analytics runs in reduced Consent Mode without full analytics cookies. Legal basis: consent, Art. 6(1)(a) GDPR / § 25 TTDSG where applicable.
9. Sentry (optional)
If enabled and you choose Accept all, error reports may be sent to Sentry to improve stability. sentry.io/privacy.
10. Contact by email or telephone
When you contact us by email or phone, we process the information you provide to handle your request. Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps / contract) and/or Art. 6(1)(f) GDPR (responding to inquiries). Providing your data is voluntary; without the contact details you choose, we cannot respond. We delete the data once retention is no longer necessary, unless statutory retention obligations require otherwise.
11. Your rights
You have the right to access your personal data, to rectify inaccurate data, to erase data, to restrict processing, and to data portability (where the conditions are met). Where processing is based on consent, you may withdraw consent with effect for the future.
Where we process data on the basis of Art. 6(1)(f) GDPR (legitimate interests), you have the right to object on grounds relating to your particular situation (Art. 21 GDPR). To exercise your rights or ask questions, please use the contact details in section 1.
You may lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (DSB), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at.
We do not use solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR.
Last updated: 12 May 2026