Privacy

Data controller

Ludwig Center GmbH
Brandenkopfstraße 3
76189 Karlsruhe, Deutschland

Represented by managing director Andreas Ludwig.
0170 4519477
gastro@skandidorf.de

Website and technical operation

Our hosting provider Vercel processes the IP address, access time, requested address, browser and device information and technical errors to deliver this website and detect faults or abuse. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in a secure, reliable website. Technical logs are retained for troubleshooting and security within the service’s retention periods, then deleted unless a specific security incident requires longer retention. We do not maintain an additional permanent archive of visitor logs.

Images, fonts and the silent background video are served through our hosting. No external video player is embedded.

Technical error monitoring

We use Rollbar to detect technical faults. Our server sends only predefined error categories, the affected feature, the operating environment and the software version. Names, contact details, booking and order contents, free text, personal links and visitor IP addresses are not sent to Rollbar. The browser connects only to our own server for this purpose; there is no session recording, additional tracking cookie or visitor profile. Technical alerts go to our responsible administrator.

Rollbar processes these technical reports in the USA. The selected plan retains events for up to 30 days. Rollbar privacy information

Table reservations

To arrange your reservation we process your name, email address, phone number, visit date, arrival time, guest count and optional requests. Supabase also stores table assignments, booking status and arrival counts. Approved staff can handle the reservation according to their role. The legal basis is Article 6(1)(b) GDPR for preparing and fulfilling the reservation. Required fields are necessary to process online bookings. Optional requests are not a condition of booking; please do not enter diagnoses or sensitive health information in free-text fields. Discuss allergies with us personally.

Submitting the form creates a provisional booking. Resend emails you a confirmation link. Your booking is confirmed only after you explicitly confirm it. Without confirmation, the tables are released after no more than 15 minutes. You can request the link again within that period and cancel using a separate cancellation link. Confirmed online bookings receive a single reminder about 24 hours before arrival; short-notice bookings do not receive this additional reminder. These messages serve the reservation only, not advertising.

After your confirmation and in the event of a subsequent cancellation, reservation and contact details are sent via Resend to gastro@skandidorf.de, with a copy to Nico Ludwig. Your personal confirmation and cancellation links are not forwarded. A protected delivery queue stores a copy of the relevant message data for reliable retries. Manual retention reviews also need to cover these copies and operational mailboxes.

Group enquiries and contact

Group enquiries send your contact and event details via Resend to our catering team, with a copy to Nico Ludwig. You receive a separate acknowledgement. Celebrations are agreed personally; enquiries do not create an automatic table booking. We handle email and telephone enquiries to respond and prepare offers under Article 6(1)(b) GDPR, or Article 6(1)(f) GDPR for our legitimate interest in answering other messages.

Voucher orders

For voucher orders we process your name, email address, voucher value, delivery choice and, for postal orders, the delivery name, street, house number, postcode and town. Order details are sent via Resend to our team, with a copy to Nico Ludwig, and you receive a confirmation. Collection is paid for at the restaurant. Postal orders receive bank transfer details and a locally generated Girocode. Payment and payment verification take place outside this website; the voucher is issued after payment is received. During testing all messages go exclusively to Nico Ludwig. Voucher orders are handled through email and are not stored in the table reservation database.

The legal basis for reservations, orders, confirmations and fulfilment is Article 6(1)(b) GDPR. For postal delivery, the necessary address details are shared with the postal service handling delivery. Statutory business and accounting records are retained under Article 6(1)(c) GDPR in conjunction with section 257 HGB and section 147 AO. We cannot confirm an online order without a name and email address; a delivery address is required only for postal delivery. No customer account, marketing consent or details of the person receiving the gift are required.

Online withdrawal

When you use the withdrawal function, we process your name, the email address for the receipt, information identifying the contract and, if relevant, the affected part of the order. The statement, receipt time, reference and delivery status are stored in a separate Supabase table that is not publicly accessible. Resend sends the declaration and receipt emails, and our team handles the request. A reason for withdrawal is not required. The legal bases are Article 6(1)(b) GDPR for reversing the contract and Article 6(1)(c) GDPR in conjunction with section 356a BGB for the statutory withdrawal function and receipt. Hashed request identifiers support abuse prevention under Article 6(1)(f) GDPR.

Staff access and security

Access requests contain a name, email address and optional message. The responsible administrator decides on approval and role; unapproved self-registration is disabled. Supabase manages sign-in and password verification. Invitations and password-recovery links are sent via Resend, never the password itself. Access, review status and relevant booking actions are recorded for secure administration. The legal bases are section 26(1) BDSG where necessary for employment and Article 6(1)(f) GDPR for access security and abuse prevention.

Sign-in sets a protected, technically necessary session cookie lasting no more than one hour. Browser session storage temporarily supports safe retries of individual staff actions. These necessary storage operations rely on section 25(2)(2) TDDDG. Hashed identifiers derived from IP and email addresses and request counters protect against automated abuse; they are not used to build visitor profiles. Stale counters are intended to be removed after seven days. Automated cleanup is currently disabled, so removal must be arranged separately.

Retention and deletion

• Reservation database: the intended standard retention period for names, email addresses, phone numbers and requests is 90 days after the visit, including cancelled and expired bookings. Automated cleanup is currently disabled; authorised staff must separately arrange the review and any required removal. Dates, guest counts, table assignments and status may remain without contact details for operational reporting.
• Open cases: authorised staff can flag a case for continued retention while an enquiry, complaint or claim remains unresolved. Removing this flag does not trigger automatic deletion. Statutory retention duties for separate accounting and business records are unaffected.
• Email enquiries and group offers are retained for as long as handling the enquiry, running the event and any statutory evidence duties require. Removal from the database does not delete messages in the catering team’s, Nico Ludwig’s or guests’ mailboxes.
• Vouchers and withdrawals: contract-related business correspondence, including order confirmations and withdrawal statements, is generally retained for six years, and accounting vouchers for eight years, starting at the end of the relevant calendar year. The type of record determines retention, not merely receipt of a message. Other collection-reservation and contact details are deleted when handling is complete and the details are no longer needed for outstanding voucher credit, unresolved claims or statutory duties. Deletion is suspended where ongoing proceedings or a statutory exception require longer retention. At the end of the necessary period, data is also deleted from operational mailboxes and the withdrawal register. The 90-day period for table reservations does not apply to these separate records.
• Under its standard retention policy, Resend stores email and delivery-log data for 30 days. Technical backups and legally required records are subject to the respective provider’s additional deletion terms.
• Staff accounts and approvals are retained only while access or a justified security or evidence purpose is needed. Accounts no longer required are disabled and subsequently deleted subject to unresolved cases and statutory duties.

Service providers and international processing

We use Vercel Inc. for hosting and website statistics, Supabase for the database and authentication, and Resend (Plus Five Five, Inc.) for email delivery. They receive the data necessary for their tasks. Processing outside the EU/EEA, particularly in the USA, is possible. The providers supply data-processing terms and EU standard contractual clauses for international transfers. Further information and copies of applicable safeguards are available through the links below or by contacting us.

Vercel · Supabase · Resend

Usage statistics

Vercel Web Analytics collects aggregated page views, device, browser, approximate region and referring website information. It uses no cookies; the technical visitor identifier is discarded after 24 hours. We remove query parameters and fragments before transmission and do not send form entries or booking data as analytics events. Its purpose is website improvement based on our legitimate interest under Article 6(1)(f) GDPR. The remaining statistics do not allow us to identify individual guests.

Google Maps and external links

Google Maps is embedded only after you select “Load Google Maps”. Google Ireland Limited then receives your IP address and technical browser data; transfer to Google LLC in the USA is possible. The legal basis is your consent under Article 6(1)(a) GDPR and section 25(1) TDDDG where device storage or access is involved. “Hide map” stops future embedding but cannot reverse previous transfers. Permission is not stored permanently. Social networks and route planners are otherwise only linked; the destination site’s privacy rules apply when you open them.

Google privacy information

Your rights

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You can withdraw consent at any time with effect for the future. Where processing is based on legitimate interests, you can object on grounds relating to your particular situation. Contact us using the details above. We do not make automated individual decisions or use profiling with legal or similarly significant effects.

You may complain to a data protection supervisory authority, particularly the Baden-Württemberg Commissioner for Data Protection and Freedom of Information, Heilbronner Straße 35, 70191 Stuttgart. Contact the supervisory authority

Last updated: 25 October 2026