Privacy Policy
1. Controller and general information
This privacy policy informs you about the nature, scope and purposes of the processing of your personal data by our company, in particular when you visit our restaurant “wienerin” (Petersplatz 1, 1010 Vienna) and our website www.wienerin.org.
Controller within the meaning of the General Data Protection Regulation (GDPR):
Supersberger Gastronomie GmbH, Stadtbahnbogen 24, 1080 Vienna, Austria, email: office@wienerin.org, phone: +43 1 532 13 80
We have not appointed a data protection officer, as we are not legally required to do so. If you have any questions about data protection, you can reach us using the contact details above.
2. Purposes of data processing
This privacy policy applies to all processing that concerns you as a prospective customer, guest, website visitor or newsletter subscriber. We process your data for the following purposes:
- our business operations (restaurant and bar)
- online table reservations via the teburio service
- marketing (including information by electronic mail and text message)
- newsletter
- contact form on the website and other enquiries (e.g. by email)
- provision of our website (technically necessary cookies, embedded content)
We do not use any analytics, tracking or advertising tools on our website (in particular no Google Analytics, no Google Tag Manager and no remarketing services). We do not carry out profiling or automated decision-making within the meaning of Art. 22 GDPR.
3. Business operations (restaurant and bar)
In connection with your interest in or use of our services, we process:
- master data (e.g. first and last name, address, email address, phone number)
- data relating to your reservation or the service requested (e.g. date, time, number of guests, food and drink preferences)
- for celebrations and group bookings, additionally the data required for quotations and invoicing
In some cases we do not receive your data directly from you but from another person, for example when another guest makes a reservation that includes you. In this case we assume that this person has informed you about this privacy policy.
Legal bases
- performance of a contract or implementation of pre-contractual measures (Art. 6(1)(b) GDPR)
- your consent, if you have given it to us (Art. 6(1)(a) GDPR)
- compliance with legal obligations, for example under tax and company law (Art. 6(1)(c) GDPR)
- our legitimate interests, e.g. in providing good guest service and protecting our legal interests (Art. 6(1)(f) GDPR)
Storage period
- We store accounting data (books, records and receipts within the meaning of § 132 of the Austrian Federal Fiscal Code, BAO) for 7 years.
- We store data based on your consent until you withdraw it, but no longer than 3 years after our last contact.
- We store data of prospective customers whose enquiry does not lead to a reservation or booking for no longer than 3 years after our last contact.
- We delete all other data no later than 3 years after our last contact.
If longer retention is necessary to establish, exercise or defend legal claims, we keep the data until the proceedings have been finally concluded.
4. Online reservations via teburio
For table reservations we use the teburio reservation system provided by Teburio GmbH, Alan-Brooke-Weg 6, 33102 Paderborn, Germany. Teburio processes your reservation data exclusively on our behalf; we have concluded a data processing agreement with Teburio GmbH in accordance with Art. 28 GDPR.
When you book online, or when we record a reservation you make by phone or in person, we process the following data via teburio in particular:
- first and last name, email address, phone number
- date, time and number of guests of the reservation
- comments and requests you provide voluntarily (e.g. occasion, seating preference)
- reservation history (e.g. attendance, cancellation) and technical booking data (e.g. time of booking, IP address)
Your data is used to create and manage the reservation and to send you confirmations, reminders and notifications of changes by email (and, where applicable, text message). The legal basis is the implementation of pre-contractual measures or the performance of a contract (Art. 6(1)(b) GDPR). Without this information we cannot accept a reservation.
Teburio uses a service provider based in the EU as a sub-processor for sending emails. Please do not include any health data in the comments (e.g. allergies) that is not necessary for the reservation. If you nevertheless provide such information, we process it solely in order to take it into account during your visit, on the basis of your explicit consent (Art. 9(2)(a) GDPR).
Credit card guarantee: For certain reservations or events, a credit card guarantee or prepayment may be required. The payment data is processed directly by the payment service provider Stripe (Stripe Payments Europe Ltd., Dublin, Ireland); we do not receive complete card details. The legal basis is Art. 6(1)(b) GDPR.
Feedback after your visit: After your visit we may ask you by email to leave a review. This is based on our legitimate interest in improving our services (Art. 6(1)(f) GDPR). You can object to this at any time, for example via the link in the email.
We store reservation data in accordance with the periods set out in section 3 and delete it no later than 3 years after your last visit. Further information can be found in Teburio’s privacy policy.
5. Marketing (including electronic mail and text messages)
In order to inform you about our events and services, we may process your name, address, email address, phone number, date of birth and data relating to your most recent reservation or enquiry.
- We base postal advertising and electronic marketing to existing customers on our legitimate interest in presenting our services to you (Art. 6(1)(f) GDPR). We only send electronic advertising to existing guests within the limits of § 174(4) of the Austrian Telecommunications Act 2021 (TKG 2021): if we have received your contact details in connection with a service, we are advertising our own similar services, and you are given the opportunity to refuse this free of charge both when your details are collected and with every message.
- We only send other electronic direct marketing (e.g. by email, text message or messenger) with your prior consent (Art. 6(1)(a) GDPR, § 174 TKG 2021).
You can object to processing based on legitimate interest or withdraw your consent at any time (see section 11). We will then no longer contact you for marketing purposes. This does not affect the lawfulness of processing carried out up to that point; statutory retention obligations (e.g. for invoice data) remain in place.
We store marketing data until you object or withdraw your consent, but no longer than 3 years after our last contact.
6. Contact form and other enquiries
You can send us general enquiries or enquiries about celebrations and groups via the contact form on our website, by email or by phone. In doing so, we process the data you provide, such as your first and last name, email address, phone number and your message.
We use this data exclusively to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (initiation and performance of a contract) or, for general enquiries, our legitimate interest in smooth communication (Art. 6(1)(f) GDPR).
We store this data for no longer than 3 years after our last contact. If the enquiry leads to a contract, the periods set out in section 3 apply.
7. Cookies and website operation
We only use technically necessary cookies on our website; we do not use analytics, tracking or marketing cookies. Cookies are small text files that your browser stores on your device.
Under § 165(3) TKG 2021, technically necessary cookies may be set without consent insofar as they are strictly necessary for the service you have requested. We base the associated data processing on our legitimate interest in a functioning and secure website (Art. 6(1)(f) GDPR).
| Cookie | Set by | Storage period | Purpose |
|---|---|---|---|
| pll_language | Polylang | 1 year | stores the most recently selected language |
You can delete or block cookies in your browser at any time. Some functions of the website may then be restricted. You can change your settings for embedded content (section 8) at any time via “Cookie settings” at the bottom of the page.
Server log files. When you visit our website, your browser automatically transmits technical data to our hosting provider’s server (e.g. IP address, date and time, page accessed, browser and operating system). This data is required to deliver the website and keep it secure (Art. 6(1)(f) GDPR), is not combined with other data and is deleted after 30 days at the latest. We have concluded a data processing agreement with our hosting provider.
8. Embedded third-party services and content
Fonts. The fonts used on our website (including Google Fonts) are stored locally on our server. No connection to Google’s servers is established when a page is loaded.
YouTube videos: We embed videos from YouTube (Google Ireland Limited) in privacy-enhanced mode. A video is only loaded once you have given your consent in the cookie settings or have actively clicked on the video (Art. 6(1)(a) GDPR). Only then is data such as your IP address transmitted to YouTube. If you are logged in to your YouTube account at the time, YouTube may associate the visit with your account.
Google Maps: To provide directions, we may embed maps from Google Maps (Google Ireland Limited). The map is only loaded after you have given your consent (Art. 6(1)(a) GDPR); in particular, your IP address and, where applicable, location data are transmitted to Google.
You can withdraw your consent at any time with effect for the future via “Cookie settings” at the bottom of the page.
9. Social media presence
We maintain a page on Facebook, operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. On our website we only link to this page; no social media plugins are loaded.
If you visit our profiles or write to us there, we process your messages and posts in order to communicate with you (Art. 6(1)(f) GDPR). We are jointly responsible with Meta for the statistics functions (“Page Insights”) (Art. 26 GDPR); Meta bears primary responsibility in accordance with the joint controller agreement. Meta also processes your data for its own purposes and, where applicable, in the USA. Details can be found in Meta’s privacy policy.
10. Recipients and transfers to third countries
We only pass on your data where this is necessary for the purposes stated or required by law. Recipients are in particular our processors, our tax advisers, public authorities in the context of legal obligations, and courts and legal representatives in the event of legal disputes.
| Recipient | Purpose | Registered office / place of processing | Safeguard |
|---|---|---|---|
| Teburio GmbH | Online reservations | Germany (EU) | Data processing agreement |
| Stripe Payments Europe Ltd. (if activated) | Credit card guarantee | Ireland (EU), possibly USA | Data Privacy Framework, standard contractual clauses |
| Google Ireland Limited | reCAPTCHA, YouTube, Google Maps | Ireland (EU), possibly USA | Data Privacy Framework |
| Meta Platforms Ireland Limited | Social media pages | Ireland (EU), possibly USA | Joint controllership, Data Privacy Framework |
For transfers to the USA, we rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (Art. 45 GDPR), insofar as the recipient is certified under it. In addition, EU standard contractual clauses have been agreed (Art. 46(2)(c) GDPR). The adequacy decision is currently under review by the Court of Justice of the EU (Case C-703/25 P); with US companies, access to your data by US authorities cannot be completely ruled out.
11. Your rights
Under the GDPR you have the following rights:
- access to the data stored about you (Art. 15)
- rectification of inaccurate data (Art. 16)
- erasure (Art. 17) and restriction of processing (Art. 18)
- data portability (Art. 20)
- withdrawal of consent you have given, at any time with effect for the future (Art. 7(3))
- Objection (Art. 21): Where processing is based on our legitimate interests, you may object at any time on grounds relating to your particular situation. We will then no longer process your data unless we have compelling legitimate grounds or the processing serves to establish, exercise or defend legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.
To exercise your rights, please contact: office@wienerin.org or +43 1 532 13 80.
If you believe that the processing of your data violates data protection law, you can lodge a complaint with the supervisory authority. In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna.
We will update this privacy policy if our processing activities or the legal situation change. The version published on our website at any given time applies. Last updated: October 2026.
This is a translation for information purposes. In case of doubt, the German version shall prevail.