Privacy policy

This is a translation for your convenience. In case of discrepancies, the German version prevails.

Last updated: 24 October 2026

Protecting your personal data matters to us. This privacy policy explains which personal data we process when you visit our website, order online, use a customer account or contact us – and what rights you have. The Swiss Federal Act on Data Protection (FADP) applies.

1. Controller

The controller responsible for processing your personal data on this website is:

For questions about data protection and to exercise your rights, contact us at restaurant@hofgut-burgdorf.ch or by post at the address above.

2. What data we process and why

We only process the personal data required for the respective purpose:

2.1 Visiting the website

When you access our website, our hosting provider processes technically necessary data such as IP address, date and time, page requested, amount of data transferred, browser and operating system (server log files). This data is used for the secure and stable operation of the website, error analysis and protection against misuse. It is not combined with other data and is deleted after 30 days at the latest unless it is required to investigate a security incident.

2.2 Online orders (including as a guest)

When you order, we process: first and last name, email address, phone number, for deliveries the delivery address and notes for the driver, ordered products including selected ingredients and remarks, requested time, delivery or pickup, payment method and payment status, discounts applied and, for alcoholic drinks, your confirmation of the minimum age.

Purpose: accepting, preparing, delivering or handing over and invoicing your order, queries about your order (e.g. by phone if the address is unclear), compliance with legal obligations (e.g. bookkeeping, youth protection) and handling complaints. You can view the order number and status via a personal, randomly generated link.

2.3 Customer account

A customer account is optional. If you create one, we additionally store your password (only as a cryptographic hash – we do not know your password), your saved addresses, your language, your order history and – if you have consented – your consent to receive offers by email. To keep you signed in, we set a session cookie (see section 4) and store the browser type of the session so you can review your sign-ins.

Purpose: faster ordering, viewing your orders, "order again", loyalty programme. Once you confirm your email address, we link earlier guest orders with the same email address to your account.

2.4 Loyalty programme, discount codes and reviews

For the loyalty programme (discount tiers or stamp card) we evaluate the number and value of your completed orders and store stamps, rewards and their redemption. For discount codes we use your email address to check whether a code has already been redeemed. If you review an order, we store the rating and comment; they are only published after our review and only with your first name and the initial of your last name.

2.5 Emails

We send you emails required for the contract or your account (e.g. email confirmation, password reset, confirmation of account deletion). We only send offers and news if you have expressly consented; you can withdraw this consent at any time in your account or by emailing us.

2.6 Contacting us

If you contact us by phone or email, we process your details to respond to your request. We delete this data once it is no longer needed unless statutory retention obligations apply.

2.7 Security and abuse prevention

To protect against misuse (e.g. automated orders or sign-in attempts) we limit the number of requests. For this we briefly store an irreversible hash of the IP address or email address and the time; these entries are deleted regularly. Changes in the administration area are logged for traceability.

3. Payment

You pay in cash or by card on handover. Card payments are processed via the card terminal and the respective payment service provider; we do not receive full card details. If an online payment method (e.g. TWINT) is offered later, we will update this privacy policy beforehand.

4. Cookies and local storage

We only use technically necessary cookies and storage – no analytics, tracking or advertising cookies:

• Session cookie "hofgut_session": keeps you signed in to your customer account (max. 30 days, ends after 14 days of inactivity or when you sign out).
• Session cookie for the administration area (restaurant staff only).
• Language setting (German/English).
• Your browser's local storage: cart contents and – for the current browser session only – your entries in the order form so nothing gets lost. This data stays on your device.

You can delete or block cookies in your browser; the customer account and the cart will then not work or only partially.

5. No analytics or advertising services, no embedded third-party content

We do not use web analytics (e.g. Google Analytics), advertising networks or social media plugins. Fonts are loaded from our own server. The "directions" link only opens Google Maps when you click it; from then on, Google's privacy policy applies.

6. Disclosure to third parties and processors

We do not sell your data or pass it on for advertising. We use the following service providers who process personal data on our behalf and according to our instructions:

• Vercel Inc., San Francisco (USA) – website hosting (server functions in Frankfurt am Main, Germany); Render Services, Inc., San Francisco (USA) – database, server location Frankfurt am Main (Germany)
• Hostpoint AG, Rapperswil-Jona (Switzerland) – email mailboxes and sending of emails
• Card payment on handover: operator of the card terminal or payment service provider (responsible for payment processing)

Deliveries are made by our own staff. We only disclose data to authorities if we are legally required to do so.

7. Transfers abroad

Our data is stored in a data centre in Germany; according to the Swiss Federal Council, Germany provides adequate data protection. The hosting providers (Vercel, Render) are based in the USA, so access from the USA cannot be ruled out. Emails are processed by Hostpoint in Switzerland. For such disclosures we rely on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) or, where the provider is certified, on the Swiss-U.S. Data Privacy Framework.

8. Retention and deletion

• Order and accounting data is kept for 10 years in accordance with statutory requirements (Art. 958f of the Swiss Code of Obligations).
• Customer account: until you delete it. On deletion we remove your profile, addresses, sessions and stamp account; orders are kept for legal reasons without any link to the account.
• Email confirmation links are valid for 48 hours, password reset links for 1 hour.
• Consent to receive offers by email: until withdrawn.
• Server log files: no longer than 30 days (see section 2.1).

9. Data security

We protect your data with appropriate technical and organisational measures, including encrypted transmission (HTTPS/TLS), an encrypted database connection, storing passwords only as hashes (Argon2id), role-based access restrictions and logging of changes in the administration area.

10. Your rights

Under data protection law you have in particular the following rights:

• Access to the personal data we hold about you (Art. 25 FADP) – you can download your data at any time in your customer account.
• Rectification of incorrect data (Art. 32 FADP) – much of it you can change yourself in your account.
• Erasure or objection to processing, unless legal obligations prevent it – you can delete your account yourself.
• Receiving or transferring your data in a common electronic format (Art. 28 FADP).
• Withdrawal of consent with effect for the future.

An email to restaurant@hofgut-burgdorf.ch is sufficient. We may ask for proof of identity. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).

11. Persons in the EU

Our offer is aimed at customers in the Burgdorf region. Where the EU General Data Protection Regulation (GDPR) applies in individual cases, we base processing on the performance of the contract (Art. 6(1)(b) GDPR), legal obligations (c), our legitimate interest in secure operation (f) or your consent (a); you have the corresponding rights under the GDPR.

12. Changes

We may amend this privacy policy if our offer or the legal situation changes. The version published on this website applies.