Privacy policy

This English translation is provided for your convenience. Only the German version is legally binding.

Thank you for visiting our website. On this page, you can find out which personal data we process when you visit this website and when you send us a reservation request, for what purposes and on what legal basis, and what rights you have.

1. Controller

Taverna Korfu (owner: Andreas Kallioras)
Ketzerbach 21, 35037 Marburg, Germany
Phone +49 6421 68 13 86, email info@korfu-marburg.de

If you have any questions about data protection, please contact us using these details.

2. Hosting and visiting the website

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Each time the website is accessed, Vercel processes technically necessary data: IP address, date and time, the address requested, the amount of data transferred, the referrer, and browser and operating system. This is necessary in order to deliver the website, secure the connection and fend off attacks. Server-side functions run in the Frankfurt am Main region; images, videos and pages are delivered via Vercel’s global network. Vercel stores this log data for a short time only and does not combine it with other data.

The legal basis is our legitimate interest in a secure and stable website (Art. 6(1)(f) GDPR). Vercel processes the data on our behalf as a processor (Art. 28 GDPR).

The connection to this website is encrypted (TLS). Fonts, images and videos are loaded from our own website, not from third-party servers. We do not use any analytics, tracking or advertising tools.

3. Cookies and browser storage

We do not set any cookies for guests. We store the choice you make in the Google Maps notice only in your own browser (local storage), so that the notice does not appear again every time you visit. For the duration of your visit, your browser also remembers that the logo animation has already been shown. Both are strictly necessary to provide the service you have requested (§ 25(2) no. 2 TDDDG) and are not transmitted to us.

In the protected admin area, our staff use a technically necessary session cookie after logging in.

4. Google Maps (only with your consent)

On the “Contact & Directions” page, we can show a map from Google Maps. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is only loaded once you select “Accept” in the notice or click “Show map”. Only then does your browser connect to Google, transmitting your IP address, among other things; Google may also set cookies. This may involve a transfer of data to Google LLC in the USA.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw your consent at any time with effect for the future via the “Privacy settings” link at the bottom of the page. Further information: Google’s privacy policy.

The “Get directions” link and the link to our Instagram profile are ordinary links. Only when you click on them do Google Maps or Instagram (Meta Platforms Ireland Limited) open; the privacy policies of these providers apply there.

5. Reservation requests

When you request a table or an offer for a larger group online, we process: date, time, number of people, first name and surname, email address, your message to us and – for group requests, if you provide it – your phone number. We use this data to review your request, set aside a table for you and let you know by email that we have received your request and whether we can confirm it or have to decline it.

The legal basis is taking steps prior to entering into a contract with you and performing that contract (Art. 6(1)(b) GDPR). We need all details that are not marked as “optional” in order to process your request. Without them, an online request is not possible; however, you can always book by phone.

For table requests, we also store the fact that you have agreed to our reservation terms (and which version of the terms). If you do not turn up for a confirmed reservation without cancelling, we may mark the reservation as a “no-show”. In that case, we keep your details in order to charge the no-show fee and, if necessary, enforce it (Art. 6(1)(b) and (f) GDPR).

To protect against automated abuse, we limit the number of requests. For this purpose, we temporarily store an irreversible check value derived from your IP address or email address – not the addresses themselves. These counters are deleted after two days at the latest. The legal basis is our legitimate interest in a secure reservation system (Art. 6(1)(f) GDPR).

Requests are stored in a database operated by Neon Inc., USA, on servers located in Frankfurt am Main. Neon processes the data on our behalf (Art. 28 GDPR). Only our logged-in staff have access to the requests.

6. Emails

We send the automatic emails about your request (acknowledgement of receipt, confirmation or rejection) and the notification to our restaurant from our own mailbox info@korfu-marburg.de, hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. The provider processes the emails on our behalf (Art. 28 GDPR). If your email program displays the logo in our emails, it loads the logo from our website; this generates the log data described in section 2.

If you contact us by email or phone, we process your details in order to respond to your enquiry (Art. 6(1)(b) GDPR for reservations, otherwise Art. 6(1)(f) GDPR).

7. Storage period

• Reservation requests are deleted automatically and completely from our database 3 days after the reserved date – this includes declined requests and requests that were not processed. Associated confirmation links and email dispatch jobs are deleted at the same time. We keep reservations marked as a “no-show” for no longer than 90 days after the reserved date; once the no-show fee has been paid or the matter has been settled, we delete them earlier.
• Abuse-prevention counters are deleted after two days at the latest.
• Emails in our mailbox are deleted as soon as they are no longer needed for processing, unless statutory retention obligations (for example under commercial or tax law) require us to keep them.
• Backups of the database are kept by the provider for a limited period; after that, they are automatically overwritten.

8. Transfers to third countries

Vercel, Neon and Google are companies based in the USA or with parent companies there. Insofar as data is transferred to the USA in this context, the transfer is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), where the provider is certified under it, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

9. Your rights

You have the right at any time to

• obtain access to the data we hold about you (Art. 15 GDPR),
• have inaccurate data rectified (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR) and its processing restricted (Art. 18 GDPR),
• receive your data in a portable format (data portability, Art. 20 GDPR),
• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this at any time on grounds relating to your particular situation. We will then no longer process the data unless there are compelling legitimate grounds for doing so.

An informal message to info@korfu-marburg.de is all it takes for any of these requests.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (the Hessian Commissioner for Data Protection and Freedom of Information), Wilhelmstraße 7, 65185 Wiesbaden, Germany (postal address: Postfach 31 63, 65021 Wiesbaden).

10. No automated decision-making

Decisions on your reservation request are made by people in our team. There is no automated decision-making, including profiling (Art. 22 GDPR).

Last updated: October 2026