Privacy Policy

2. Website hosting and email

Our website and email are hosted by ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Hosting involves processing connection and request data, including IP address, access time, requested page, browser information and technical errors, to deliver and protect the website. Email hosting processes the messages and associated communication data we send and receive.

Necessary website operation and security are based on our legitimate interests under Article 6(1)(f) GDPR. Contract-related communication relies on Article 6(1)(b), or Article 6(1)(f) for business representatives. Hosting logs are retained only as needed for security and troubleshooting, with incident-related data retained for the duration of the investigation. The actual hosting log schedule must match these purposes.

3. Enquiries, subscriptions and payment

We use the contact and business information you provide to answer requests, arrange demonstrations, manage subscriptions and supply support. Necessary contract processing is based on Article 6(1)(b) GDPR; business-contact administration on Article 6(1)(f); legal record-keeping on Article 6(1)(c).

The website’s email contact widget prepares a message in your own email application. We receive it when you send it. Please do not send unnecessary sensitive guest information in an enquiry.

For Indonesian payments, PT kami creative solutions handles local payment collection through its bank account on behalf of vaublock GmbH. PT and the relevant banks process payer details, payment amount and transaction references for collection, reconciliation and applicable financial record-keeping. Local payment handling is distinct from access to reservation data.

4. Google appointment booking

The intro-call link takes you to Google Calendar. Our booking account belongs to vaublock GmbH and uses miriam@vaublock.de. We receive the name, contact information, selected appointment and any details you submit to arrange and conduct the call. The calendar is linked rather than embedded.

Google processes information under its own service arrangements, including connection data when you visit its service. See Google’s Privacy Policy. We use appointment information to take requested pre-contractual steps or manage business communication.

5. Cookies, consent and currency preference

We use necessary browser storage for website operation and managing consent choices. Optional analytics is used only after consent. You may accept or reject optional analytics and later withdraw consent through the website’s cookie settings. Withdrawal does not affect processing lawfully carried out before withdrawal.

The currency selector stores the chosen USD or IDR value in local storage under vaubook-currency. In the current export it has no automatic expiry and remains until cleared or replaced. It stores a display preference, not payment details.

The consent interface uses Cookiez. Consent-required access to your device relies on Section 25(1) TDDDG and, for personal data, Article 6(1)(a) GDPR. Strictly necessary storage may rely on the applicable Section 25(2) exception. The consent interface must list the actual cookies and durations in use.

6. Google Analytics

With your consent, Google Analytics helps us understand how visitors use the website, including viewed pages, interaction events, referring sources and device/browser information. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, provides the service for EEA customers; processing can involve Google entities and infrastructure outside the EEA.

Analytics may use browser identifiers and cookies such as _ga and property-specific _ga_… cookies. Our selected configuration is analytics only: Google Signals, advertising personalisation and User-ID are disabled; user/event data retention is set to two months and analytics cookie expiry to two months. These settings must be applied to the live property before this notice is published.

Google Analytics must not load or send analytics requests before consent. Declining analytics does not prevent access to the website. Use cookie settings to withdraw consent and stop further collection. Details of Google’s processing are available in Google’s Privacy Policy.

7. Locally hosted fonts and images

Fonts and images are served from our own website infrastructure. The intended configuration does not request font files from Google Fonts. This requires removal of the remote Google Fonts stylesheet in the existing export and local hosting of the fonts.

8. Restaurant guest information

Restaurants determine the purposes and settings for their guest reservations and provide their own privacy notices. Reservation information may include name, telephone number, email, date and time, party size, seating preference, source, status and notes. Optional guest records may include birthday day/month.

vaubook processes this information on the restaurant’s instructions under a data processing agreement. Restaurants must establish an appropriate basis for their processing, limit notes to necessary information and handle sensitive dietary or health information appropriately. Restaurant Overview and Insights are operational reports, not website advertising analytics.

Please direct requests about a restaurant reservation to that restaurant. We assist the restaurant with data-subject requests in accordance with the processing agreement.

9. Providers and Indonesian access

The reservation service uses infrastructure and communication/security services described in its service documentation, including AWS hosting in Singapore, Brevo email functions and Cloudflare Turnstile abuse prevention. The current provider entities, locations and processing arrangements must be recorded in the service’s subprocessor list.

PT kami creative solutions, Jl Kelabamoding, 80571 Tegalallang, Bali, Indonesia, represented by its owner and managing director Miriam Boerner, has full system access for the agreed operational and support services. This can include access to personal data from Indonesia. Access must be limited to authorised personnel acting under confidentiality obligations and documented instructions.

Indonesian bank processing for payment collection is separate from this operational access. The location of a bank account does not provide a lawful basis for international access to guest information.

10. International processing

Processing in Singapore, access from Indonesia and relevant Google services may involve international transfers. For data subject to EEA transfer rules, the applicable recipient and transfer basis must be established before access or transfer occurs.

Where an applicable adequacy decision covers the recipient and processing, that decision may be used. Otherwise appropriate safeguards, such as European Commission standard contractual clauses together with the required transfer assessment and supplementary measures, must be established. Contact info@vaublock.de for information or a copy of the relevant safeguards. This text does not itself establish or certify those arrangements.

11. Retention

Information is retained for its stated purpose and deleted when no longer needed, unless a legal duty or a justified legal-claims requirement necessitates further retention. We do not retain all information indefinitely under a general reference to local law.

Enquiries and appointment records are deleted when the enquiry or follow-up is complete unless they become relevant to an ongoing contract or legal claim. Contract and payment records are retained according to the applicable record category and law. In Germany this can mean ten years for certain accounting records, eight years for accounting vouchers and six years for commercial correspondence, with the statutory starting rules and any legally required extensions applying. PT retains its legally required Indonesian transaction records under the rules applicable to that entity.

Restaurant guest data follows the restaurant’s documented retention instructions. At contract end the agreed return and retrieval process applies, followed by deletion of active data within 30 days and expiry of residual backups within 90 days, except where a legal obligation requires retention. Backup data remains outside ordinary use. Google Analytics retention follows section 6.

12. Your rights

Where the GDPR applies, you may request access, correction, deletion, restriction or portability where their conditions are met. You may withdraw consent and object to legitimate-interest processing based on your circumstances; you may object to direct marketing at any time. You may complain to a competent supervisory authority, including the North Rhine-Westphalia data protection authority.

For our own processing, contact Miriam Boerner through info@vaublock.de. Restaurant guest requests should be addressed to the restaurant. Applicable rights under Indonesian law remain unaffected. Required contract information is necessary to supply the requested service; optional information may be omitted.