Controller
The controller under the General Data Protection Regulation (GDPR) is Chaihut UG (haftungsbeschränkt), Dortmunder Straße 25, 48155 Münster, Germany, represented by managing director Saeeb Mahfoud.
Contact details are provided at the beginning of this policy. According to our available company records, no data protection officer has currently been appointed.
Why we process data
We process personal data only where necessary to provide and protect this website, answer general and event enquiries, provide services that you expressly open, or meet legal obligations.
Depending on the activity, the legal bases include GDPR Article 6(1)(b) (contract or pre-contractual enquiry), (c) (legal duty), (f) (legitimate interests), and (a) (consent).
Hosting and server logs
The existing Chaihut website identifies Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus as its host. Hosting with Hostinger is planned for the replacement website. The contracting entity and actual processing arrangements must be verified against the hosting contract before launch.
When you visit the site, technical server logs may contain IP address, time of access, requested URL, browser or operating system and referring page.
We rely on GDPR Article 6(1)(f) for secure and stable operation. Exact log-retention settings must be confirmed with the hosting provider.
Cookies and local preferences
The website uses browser localStorage under chaihut-theme to remember your light or dark appearance. It also uses sessionStorage under chaihut-discovery-popup-seen-v2 to remember during the current browser session whether the internal Chaihut Updates popup has already opened automatically. These preferences are not transmitted to an external service by the setting itself.
Where storage is strictly necessary, Section 25(2) TDDDG and, where personal data are involved, GDPR Article 6(1)(f) may apply. Any future consent-requiring technologies must be subject to appropriate consent before activation.
Contact and event enquiries
When you contact us by email, telephone or WhatsApp, we process your contact details and message in order to respond.
When you submit the event-enquiry form, your browser sends the event details and contact information over HTTPS to our form endpoint hosted with Hostinger. These details include the occasion, date, location, estimated guests, times, food and drink preferences, name, email address, telephone number and any optional information. The backend sends the enquiry by authenticated SMTP through Hostinger Email to info@chaihut.de and sets your email as Reply-To. We do not use these details for advertising.
To prevent automated or excessive submissions, the server checks a hidden anti-spam field and limits submission frequency. It keeps a keyed hash of the originating IP address and submission timestamps in a non-public directory, counting only submissions from the previous 15 minutes. GDPR Article 6(1)(b) applies to pre-contractual enquiries and Article 6(1)(f) to technical abuse prevention. Enquiry contents are deleted when no longer needed unless statutory retention duties apply. The cleanup of technical anti-abuse records must be finalised before production launch.
Google Maps on request
On the Where to find us page, the external Google Map is not loaded automatically. Clicking Load map activates a connection to Google, which may transmit IP address, browser and device data.
The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For further processing, please consult Google's privacy information.
Social media and external links
We link to Instagram, Facebook, TikTok, WhatsApp, Google Maps and the separate Chaihut shop. Following these links takes you to another provider, which may process data about your visit.
Simple links do not automatically load an embedded social-media feed. Consult the provider's privacy policy for details.
Information dialogs and updates
The current topic-help and Chaihut Updates buttons open internal information dialogs, not an external chat or subscription service.
The former WordPress marketing, newsletter and chat integrations are not used on the replacement website. It does not provide a loyalty or members area, or a newsletter registration. This policy must be updated before any additional service is enabled.
Retention
We retain personal data only as long as necessary for its purpose or as required by law. Email correspondence may be retained where commercial or tax rules require it.
You can reset the local colour preference in the site's privacy settings or remove it in your browser. Server-log periods are subject to the confirmed hosting configuration.
Your rights
Subject to applicable rules, you have the rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent for the future.
Please contact info@chaihut.de to exercise your rights.
- Access, GDPR Art. 15
- Rectification, Art. 16
- Erasure, Art. 17
- Restriction, Art. 18
- Portability, Art. 20
- Objection, Art. 21
- Withdrawal of consent
Right to object
If processing is based on GDPR Article 6(1)(f), you may object for reasons arising from your particular situation. You can object to processing for direct marketing at any time.
Right to complain
You may lodge a complaint with a data-protection supervisory authority. In North Rhine-Westphalia this is Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, poststelle@ldi.nrw.de, https://www.ldi.nrw.de.
Data security
We use appropriate technical and organisational safeguards. HTTPS for the production website is checked as part of the hosting and migration review.
Changes to this policy
We update this policy if the law, website technology or services change. The version published on this website is the current one.
Updated: October 2026