Privacy policy

This notice explains which data we process when you visit this site or make a reservation — and which storage is created on your device.

Controller

Hannelore Bar GmbH, Kärntnerstraße 12/Top 14/15, 1010 Vienna, office@hannelore-vienna.com. ⟨Data protection officer, if appointed⟩

Reservations

To handle a reservation we process your name, contact channel (email and/or phone number), date, time, party size and any special requests. The legal basis is performance of the contract or pre-contractual steps (Art. 6(1)(b) GDPR). Confirmations, reminders and cancellations are sent via the channel you chose (WhatsApp, email or SMS).

AI-assisted conversations

Enquiries via WhatsApp, telephone, email or the chat window on this site are answered by an AI assistant. This is apparent at the start of the conversation; a human takes over on request. The assistant also reads replies to our reservation emails and emails sent to our reservation address; anything that is not about a reservation is passed on to our team. To maintain quality we store conversation histories and service-relevant notes (e.g. preferred area).

Chat window on this site

The chat window loads and stores nothing until you open it and write. We then process your messages in order to answer them (Art. 6(1)(b) and (f) GDPR — steps prior to a reservation, and legitimate interest in answering enquiries). For the duration of your visit your browser keeps a random identifier so that you can continue the same conversation across pages; it contains no personal data and is discarded when you close the browser. If you would like to reserve a table we ask for your name and email address — without them we can neither confirm a reservation nor reach you about a change. Conversations without a reservation are deleted automatically; a Cloudflare Turnstile check protects the chat against automated abuse.

Google Maps window

On the home page and the contact page we can show you a Google Maps window (Google Ireland Limited). It does NOT load automatically: as long as you do not click “Load map”, no contact with Google takes place. Only your click loads the map; Google then receives your IP address and technical details about your device, and transfer to the USA cannot be ruled out. The legal basis is your consent (Art. 6 (1) (a) GDPR). Your browser remembers the decision for the current visit only — next time we ask again. Without the map, the “Open route” link takes you there; it opens Google Maps only when you click it.

Form protection (Cloudflare Turnstile)

Reservation, event enquiry, newsletter sign-up and the chat window are protected against automated input. A Cloudflare check loads while you fill them in; Cloudflare receives your IP address and technical details about your browser. The check sets no advertising cookies and builds no profile. Legal basis is our legitimate interest in keeping these forms usable (Art. 6(1)(f) GDPR); without the protection they would be unusable within hours.

Recipients and service providers

Your data stays with us unless we have to pass it on to deliver the service. We work with the following providers, who process on our behalf and on our instructions:

• Vercel Inc. — delivery of this website
• Railway Corp. — running the application and database (reservations, guest data)
• Resend — sending confirmations, reminders and the newsletter, and receiving the emails you send to our reservation address or in reply to our emails
• Meta Platforms Ireland Limited (WhatsApp Business) — messages via WhatsApp if you choose that channel
• SMS-Dienstleister — SMS if we cannot reach you otherwise
• Anthropic PBC (Claude) — the language model behind the AI assistance in chat, WhatsApp, email and SMS
• LiveKit Inc. — telephony and speech recognition for the AI assistance on the phone (processed in the EU)
• OpenAI (über LiveKit) — the language model of the AI assistance on the phone, connected via LiveKit
• Mistral AI SAS — summary and classification of a phone call after it ends (processed in the EU)
• ElevenLabs Inc. — speech output of the AI assistance on the phone (the spoken reply text)
• Stripe — payment processing for a pre-order
• Cloudflare (Turnstile) — protecting the forms against automated input
• Telegram Messenger — internal coordination within the team about current reservations
• Sentry (Functional Software Inc.) — operational error logs (technical data, content truncated)

Some of these providers are based in the USA or use subprocessors there. Such transfers rely on the European Commission's standard contractual clauses or certification under the EU-US Data Privacy Framework. Beyond that we only pass on data where the law requires it.

Cookies & local storage

Essential storage is required to operate the site and cannot be switched off. Everything else — statistics and marketing — is loaded only after your consent: without it, no Google or Meta script is embedded and no contact with those providers takes place.

Cookieless audience measurement (Umami)

For basic figures we use Umami on our own infrastructure. Umami sets no cookies, builds no cross-device profiles and stores no plain-text IP addresses. Legal basis: our legitimate interest in privacy-friendly statistics (Art. 6(1)(f) GDPR).

Cookieless audience measurement (Vercel Web Analytics)

We also count page views with Vercel Web Analytics (Vercel Inc., USA; transfers based on the EU-U.S. Data Privacy Framework and standard contractual clauses). When a page is opened, a small script served from our own domain reports its address (without parameters other than campaign tags such as utm_source), the referring page, browser, operating system, device type and country. It sets no cookies and stores nothing on your device. Visits are told apart only by a hash of IP address and browser identifier that expires after 24 hours at the latest; IP addresses are not stored, and you are not recognised across days or devices. It does not measure on pages with personal links (such as waitlist, invoice or offer). Legal basis: our legitimate interest in privacy-friendly statistics (Art. 6(1)(f) GDPR).

Google Analytics 4 (only with consent)

With your consent to “statistics” we load Google Analytics 4 (Google Ireland Limited). Usage data and a truncated IP address are processed; transfer to the USA cannot be excluded. Legal basis: your consent (Art. 6(1)(a) GDPR, § 165(3) TKG).

Google Ads conversion (only with consent)

With your consent to “marketing” we measure whether an ad led to a reservation. We do not transmit email addresses or phone numbers (no advanced matching).

Meta Pixel (only with consent)

With your consent to “marketing” we load the Meta Pixel (Meta Platforms Ireland Limited) to measure advertising performance. No personal parameters are sent here either.

When loading, we set the Google Consent Mode signals (ad_storage, ad_user_data, ad_personalization, analytics_storage) exactly according to your selection. You can change your decision at any time:

Open cookie settings

Retention

We keep reservation data as long as needed for operations and statutory retention duties; conversation content is deleted after ⟨12 months⟩ and inactive guest profiles are anonymised after ⟨24 months⟩.

Your rights

You have the right to access, rectification, erasure, restriction, data portability and objection. You may withdraw consent at any time with effect for the future. The supervisory authority is the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna.