Privacy policy

Café Río Lejos
Last updated: 2026

1. Controller

Controller pursuant to Art. 4(7) GDPR:
Cafe Rio Lejos Deutschland
Dr. Marianne Rosiny
Hohenhewenstr. 85
D-78224 Singen
Germany

Email: info@cafe-rio-lejos.com
Website: https://cafe-rio-lejos.com

If you have any questions regarding data protection, you may contact us at the email address above.

2. General Information on Data Processing

We process personal data only to the extent necessary to provide our website, our preorder shop, and related services.

We process personal data on the following legal bases:

• Art. 6(1)(b) GDPR – Contract performance (orders, customer service)
• Art. 6(1)(c) GDPR – Legal obligations (tax & accounting retention)
• Art. 6(1)(f) GDPR – Legitimate interests (website security, technical stability)
• Art. 6(1)(a) GDPR – Consent (cookies, analytics, newsletter)

For the storage or access of information on your device (cookies), §25 TDDDG (Germany) and the EU ePrivacy Directive apply.

3. Website Hosting (Strato)

Our website is hosted by:

Strato GmbH
Otto-Ostrowski-Straße 7,
10249 Berlin
Deutschland / Germany

Strato processes personal data (e.g., IP address, server logs) on our behalf for the purpose of providing the website.

A Data Processing Agreement (Art. 28 GDPR) has been concluded.

Server Log Files

When visiting our website, the following data may be automatically processed:

• IP address
• Date and time of request
• Browser type and version
• Operating system
• Referrer URL
• Accessed pages

Purpose: Security, stability, troubleshooting
Legal basis: Art. 6(1)(f) GDPR
Retention: Typically 7–30 days

4. Online Shop & Preorder System (WooCommerce)

We use WooCommerce to process preorders.

Data processed during orders:

• Name
• Billing & shipping address
• Email address
• Order details
• Payment reference
• Bank transfer confirmation

Direct Bank Transfer

If you choose direct bank transfer:

• Your bank processes the payment.
• We process payer name, transfer reference, amount, and date to match payment to order.

We do not store your banking credentials.

Legal basis:

• Art. 6(1)(b) GDPR (contract)
• Art. 6(1)(c) GDPR (legal accounting obligations)

Retention

Invoices and accounting data are retained in accordance with German commercial and tax law for up to 10 years.

5. Elementor & Crocoblock (JetPlugins)

We use:

• Elementor (Pro) for page building
• Crocoblock JetPlugins (JetEngine, JetWooBuilder, JetFormBuilder, etc.)

These tools operate primarily on our server.

If forms are used, the data entered (e.g., name, email, message) is processed to respond to inquiries.

Legal basis:

• Art. 6(1)(b) GDPR (pre-contract communication)
• Art. 6(1)(f) GDPR (efficient website management)

If Elementor cloud services are used, data processing may occur outside the EU under appropriate safeguards (SCCs).

6. Data Retention

We store personal data only as long as necessary:

• Orders & invoices: up to 10 years (German tax law)
• Customer inquiries: typically up to 3 years
• Newsletter data: until consent withdrawal
• Analytics data: according to GA4 retention settings

7. Your Rights Under GDPR

You have the right to:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent at any time (Art. 7(3) GDPR)

To exercise your rights, contact: info@cafe-rio-lejos.com

8. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority.

If the company is registered in Germany, the competent authority is the Data Protection Authority of the federal state in which the company is established.

9. Security Measures

We implement technical and organizational measures including:

• HTTPS / TLS encryption
• Secure hosting infrastructure
• Access restrictions
• Regular updates
• Role-based backend access

10. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy to reflect legal or technical changes.