Privacy policy.

1. Who is responsible for processing your data

This information concerns visits to this website and contact initiated through it. Personal data is information relating to an identified or identifiable person, such as an email address or IP address.

2. Website delivery and security

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. On each visit, the hosting provider processes technically necessary connection data: IP address, date and time, requested address or file, volume of data transferred, HTTP status, the previously visited page where applicable, and browser and operating system information.

This processing serves to deliver content, maintain stability, analyse errors and prevent attacks. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the secure operation of our website. The website cannot be displayed without transmitting the necessary connection data.

Vercel operates an international delivery network. Data may be processed in the USA and by infrastructure providers it uses. Vercel states that it participates in the EU-US Data Privacy Framework. Transfers covered by this framework rely on the adequacy decision under Article 45 GDPR; Vercel also describes standard contractual clauses in its data protection agreements. Information on these safeguards and recipients is provided in Vercel’s data processing agreement and Vercel’s privacy notice.

Connection and security data is retained for as long as necessary to provide the website, investigate disruptions or attacks and fulfil legal obligations. The specific retention period depends on the type of data and the hosting features used. We do not create our own visitor profiles from this data.

3. Cookies and your privacy choices

Cookies are small files in your browser. Similar storage technologies, particularly local storage, can also store information on your device. We use our own locally served mechanism to manage consent; no external consent provider is contacted.

Under the key lupercia:privacy:v1 your browser stores your acceptance or rejection for each service, the time of your decision, the expiry date and the version of the consent information. This choice contains no user identifier generated by us and is not sent to our own consent server. It applies for 180 days unless you change it earlier or delete your browser data. We then ask again; a new material change to the services also requires a new choice.

This necessary choice is stored and read under Section 25(2)(2) TDDDG so that we can respect your requested privacy settings. The associated processing is based on Article 6(1)(f) GDPR: our interest in reliably implementing your decision. If your browser prevents storage, your choice applies only to the current page visit.

Optional embeds rely on Article 6(1)(a) GDPR and, where information is stored on or read from your device, Section 25(1) TDDDG. No service is preselected. “Reject all” is available without additional steps. Scrolling or simply continuing to browse does not count as consent.

Change or withdraw consent

You can change your choices using the button below or at any time at the bottom of the page. “Reject all” withdraws consent for both optional services; the individual switches and “Save choices” let you decide separately. The embeds are then removed and will no longer load on future visits. This does not affect the lawfulness of processing before withdrawal (Article 7(3) GDPR).

Removing an embed does not automatically delete data already stored by the provider. We cannot technically remove third-party cookies ourselves. You can delete them through your browser settings and exercise your right to erasure with the provider.

4. Deutsche Welle’s Instagram video

On the “Maria” page, we offer a DW Volos feature via Instagram. The provider for users in the European Economic Area is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The embed provides a filmed insight into Maria and mate culture at Lupercia.

A connection to Instagram is established only when you allow “Instagram video”. Meta may then process your IP address, browser and device data, the page visited and interactions with the player. Meta may use cookies and similar technologies, use information for its own analytics and advertising, and link it to your Instagram account if you are logged in. Loading the player requires consent regardless of whether you subsequently start playback.

The embed is provided on the basis of your consent as described in section 3. Data may be transferred to Meta companies and service providers outside the EEA, particularly in the USA. Meta explains the adequacy decisions and standard contractual clauses used for this in its privacy notice. Meta is responsible for its subsequent own processing, linking to an account and deletion.

Meta determines retention periods according to the type of data, purpose of use, account settings and legal requirements. Cookie lifetimes and settings are described in Instagram’s cookie policy. Information on recipients, transfers, retention periods and your rights is available in Meta’s privacy policy for Instagram.

5. Instagram feed via Elfsight

For the gallery on the “Maria” page, we use Elfsight SL, C. de la Constitució 17, AD700 Escaldes-Engordany, Andorra. The feed shows glimpses of the tea room and loads only when you allow “Instagram feed via Elfsight”.

Elfsight receives technical data, in particular your IP address, operating system and browser type. According to the provider, this connection data is stored for seven days for error detection and security. The cookie elfsight_viewed_recently on core.service.elfsight.com prevents repeat counting within 15 seconds according to the provider, and has a correspondingly short lifetime. Content may be obtained from other delivery servers; when opening Instagram content, Instagram’s privacy information also applies.

The legal basis for the embed and optional access to your device is your consent under section 3. Elfsight is based outside the EU in Andorra, which is covered by an EU adequacy decision. Further international transfers may take place where additional providers are involved. The provider’s information explains the processing and services involved.

Further information: Elfsight’s privacy policy and Elfsight’s information on cookies and privacy.

6. Contact by email or phone

When you contact us, we process the contact details and content you provide, such as your name, email address, phone number and enquiry. This serves to respond and, where applicable, prepare or carry out a reservation or order. We handle contract-related enquiries on the basis of Article 6(1)(b) GDPR; other enquiries are handled on the basis of our legitimate interest in responding under Article 6(1)(f) GDPR.

Recipients may include email and telecommunications providers used for the relevant communication. We retain enquiries until they have been fully handled and beyond that only where required by statutory retention duties or the establishment or defence of legal claims. Mandatory retention is based on Article 6(1)(c) GDPR. Without the information needed to handle your enquiry, we may be unable to respond.

7. Links to other websites

Google Maps, Instagram and the press articles mentioned under “Tea room” are provided as ordinary links. Displaying these links does not itself transmit your data to the linked providers. You leave our website only when you open them; their privacy information then applies. Sections 4 and 5 apply to embeds you have expressly allowed.

8. Your rights

Subject to the applicable legal requirements, you have the following rights:

• Access to your personal data (Article 15 GDPR);
• Rectification of inaccurate data and completion of incomplete data (Article 16 GDPR);
• Erasure and restriction of processing (Articles 17 and 18 GDPR);
• Data portability where automated processing is based on consent or a contract (Article 20 GDPR);
• Withdrawal of consent with effect for the future (Article 7(3) GDPR).

To exercise your rights, simply send a message to mdc.moreno@gmail.com or the postal address above. We do not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR on this website.

Complaints to a supervisory authority

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, particularly in your usual place of residence, workplace or the place of the alleged infringement. In North Rhine-Westphalia, you can contact the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf, at poststelle@ldi.nrw.de. Other ways to get in touch: LDI NRW.