Privacy Policy

Last updated: 11 November 2026. This policy applies to the website, including the locally embedded gin configurator, workshop booking system and gift voucher order form.

Data controller

Tapas Atelier OG
Franz-Josef-Platz 14
6330 Kufstein, Austria
Email: info@tapasatelier.com
Phone: +43 660 42 75 751

Visiting the website and hosting

When you access the website, the web server processes technically necessary connection data, in particular your IP address, the time of access, the requested address and browser information. This is used to deliver the website, resolve errors and protect against misuse. The legal basis is our legitimate interest in a secure and functional website under Article 6(1)(f) of the GDPR.

This website is provided on the web server used by Tapas Atelier. Technical service providers may process connection data for this purpose. For details of the hosting provider, recipients and retention of server logs, please contact the controller at info@tapasatelier.com.

Cookies, fonts and analytics

The website loads images, fonts, icons and libraries from our own web server. No Google Fonts, CDN, analytics or advertising services are integrated. There are no marketing cookies, and your activation choices are not saved in local browser storage.

The small Christmas notice continues to appear when you move between pages or reload them until you deliberately close it using “×”. Only when you close it does your browser save the year of the dismissed season and a dismissal marker in Local Storage, so the notice does not appear again that season. No user identifier or usage profile is created; the entry is not transmitted to us or to third parties. It remains until you delete the website data in your browser and is replaced when you close the notice in a new Christmas season. If browser storage cannot be read, the notice remains hidden; if storage is full, closing it applies only to the currently open page.

The restaurant information pages do not themselves set application cookies. The gin configurator and workshop booking system load directly from our own server on their respective pages, with no additional activation required. The technically necessary session cookie TAPAS_PUBLIC is used when these applications load, as well as when you activate or directly open the gift voucher order form. It contains a random identifier, not names or order data, and protects forms against unauthorised requests. The cookie is restricted to the domain being accessed and the website path, cannot be read by JavaScript (HttpOnly), is protected with SameSite=Lax and, when using HTTPS, can only be transmitted over an encrypted connection (Secure).

The cookie has no fixed expiry time and is normally deleted at the end of the browser session; restoring a session may retain it. After 30 minutes of inactivity, the session is reset on the next request; stored session files are cleaned up by the server. Sessions contain form security tokens and, where applicable, a temporary confirmation message. Necessary cookies do not require tracking consent; the legal basis for processing is Article 6(1)(f) of the GDPR and, for bookings and orders, also Article 6(1)(b) of the GDPR.

Under “Cookies & Online Features” in the footer, you can activate the embedded gift voucher order form and close it again. Your choice applies only to the currently open page. Deactivation does not delete orders already submitted or close separately opened windows. The gin configurator and workshop booking system do not need an activation switch. You can delete cookies in your browser; the forms will not work without the necessary session cookies.

Workshop bookings, gin configurator and gift vouchers

All three applications remain on this website. Opening them does not send any form data as an order. Only when you submit a form do we process the information required for your enquiry or contract: your name, email address, telephone number and billing/delivery address where applicable, workshop date and booking details, gin recipe and labelling, or gift voucher amount. Free-text fields are optional; please do not enter sensitive data in them.

Data is processed to take steps before entering into a contract and to perform the contract under Article 6(1)(b) of the GDPR. Article 6(1)(c) of the GDPR applies to legally required retention. No additional advertising consent is required to place an order. Required fields are marked in the forms.

Recipients and confirmation emails

The controller and authorised persons have access to the data where necessary to provide the service, as do the hosting and email service providers we engage. Confirmation emails are sent via MailerSend (SMTP service) to the address you provide, with an internal copy sent to Tapas Atelier. The service provider processes your email address, name, message content and technical sending data. No additional copies of orders are sent to an IT support address.

Information from the email service provider: MailerSend Privacy Policy. This external link transmits connection data only when clicked. Please contact the controller for details of contractually agreed recipients, subprocessors, processing locations and, where applicable, safeguards for transfers to third countries under Articles 44 et seq. of the GDPR.

Retention periods

Booking, order and proof-of-sending data is stored only for as long as required for processing, enquiries and legal claims. Accounting records are generally subject to the Austrian statutory retention period of seven years; longer periods may be required if proceedings are ongoing. Data that is no longer needed must be deleted or anonymised. Please contact the controller for specific retention periods for server logs and sending logs.

Contact and external links

If you contact us by email or phone, we process the information you provide to respond to you on the basis of Article 6(1)(b) or (f) of the GDPR. Links to social networks and map services are not automatically loaded embeds. The relevant provider’s privacy policy additionally applies only when you click a link.

Your rights

Within the limits of the law, you have the right to access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation. Where processing is based on consent, you may withdraw that consent with effect for the future. To do so, contact info@tapasatelier.com.

You may lodge a complaint with a data protection supervisory authority, in particular the Austrian Data Protection Authority. There is no automated decision-making with legal effect and no profiling for advertising.