Privacy Policy

This Privacy Policy explains what happens to your data when you visit our website or send us a catering enquiry. It is short, because there is little to tell: this site sets no cookies, embeds nothing from third-party servers, and therefore needs no consent banner. Who runs the site is set out in the imprint.

This is a translation for your convenience. German law governs this website, and in case of doubt the German version prevails.

Controller

The controller for the processing of your data is:

Bento Boutique, owner Thi Lai, Weserstraße 31, 60329 Frankfurt am Main, Germany

Phone: +49 69 24249888 · Email: post@bento.boutique

We are not required to appoint a data protection officer: our business is too small, and processing personal data is not part of our core activity.

What this website deliberately does not do

So that you do not have to go looking, none of the following happens here:

• no cookies and no comparable form of recognition
• no advertising or tracking pixels, no profile of your behaviour
• no fonts, maps or videos loaded from third-party servers
• no sharing of your data for advertising purposes, with anyone

That is why you see no consent banner on this site. It is not an oversight but a consequence: where nothing requires consent, there is nothing to consent to.

Visiting this website

When you open a page, your browser transmits technically necessary information to our server — your IP address, the date and time, the address requested, the amount of data transferred, and details about your browser and operating system. Without it the page could not reach you.

• Purpose: delivering the website, keeping it running, defending against attacks
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in a working and secure website
• Recipient: Cloudflare as our host, acting as a processor under Art. 28 GDPR
• Retention: this information is processed only briefly and is not combined with other data. We keep no server logs of our own and evaluate none.

Cloudflare is a US company. Pages are delivered from servers in its European network; processing in the United States cannot be ruled out technically. Where it occurs, the transfer is based on the EU-US Data Privacy Framework, to which Cloudflare has certified, and additionally on the European Commission’s standard contractual clauses.

Your catering enquiry

The form on the catering page asks for exactly what we need in order to quote. Only your name, an email address for our reply and the date and guest count of your event are required. Everything else is optional and marked as such in the form — including company, phone number, budget range, your message, and a note on whether vegetarian or vegan catering matters and for what share of your guests. These details help us get the quote right; your enquiry is complete without them.

• Purpose: handling your enquiry and preparing a quote
• Legal basis: Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract
• Recipient: Brevo, our email service provider, whose servers are located in the European Union, acting as a processor under Art. 28 GDPR
• Retention: we delete your enquiry once it has been dealt with and no statutory retention obligation applies. If it leads to an order, commercial and tax law require us to keep the records for six and ten years respectively.

This website does not store what you enter. Your details are received, passed on to us immediately as an email, and then not filed anywhere — there is no database your enquiry ends up in. What remains is the email in our inbox.

You are welcome to call or email us instead. The form is an offer, not a condition.

Protection against automated submissions

To keep our inbox free of machine-generated enquiries, the form contains one field that is invisible to you, and we check whether enough time passed between opening and submitting for a person to have filled it in. Neither involves a third-party service or any assessment of your behaviour; there is no captcha.

• Purpose: preventing automated form submissions
• Legal basis: Art. 6(1)(f) GDPR
• Recipient: none — the check runs on our own server, no third party is involved
• Retention: none — the check happens during submission and leaves nothing behind

Audience measurement

To see which pages get read, we use Cloudflare Web Analytics. It works without cookies, without any identifier for your device, and without recognising you across page views. No profile is created and no individual is analysed; we only ever see totals.

• Purpose: understanding which content is in demand, so we can improve the site
• Legal basis: Art. 6(1)(f) GDPR
• Recipient: Cloudflare as a processor, with the same third-country context described above
• Retention: no personal data and no device identifier arise that could be retained. What remains are aggregate figures with no link to a person; they can no longer be traced back to anyone.

The language notice

If your browser is set to English, we show you a one-off notice that this page is also available in English. If you dismiss it, your browser remembers that locally on your device so that it does not appear again.

This note is not a cookie: it is never transmitted to us, never leaves your device, and is never evaluated by us. It disappears as soon as you clear your browser’s site data.

Storing anything on your device is governed separately from the GDPR by German law and generally requires consent. The exception in Section 25(2)(2) of the German Telecommunications and Digital Services Data Protection Act (TDDG) applies here: the note is strictly necessary so that we do not show you the dismissed notice again on every page — which is exactly what you asked for by dismissing it. That is why no consent is needed, and why this site shows no consent banner.

Fonts, images and videos

Every font, image and video on this website sits on our own server and is delivered from there. Your browser opens no connection to Google Fonts, YouTube or any other outside provider. Videos start only when you start them — nothing is loaded before that.

We embed no map. To show you where to find us, we use an ordinary link to Google Maps; only when you click it do you leave our website.

Links to other providers

Our site links to Google Maps, Instagram, Facebook and WhatsApp. They are ordinary links: they set nothing, load nothing and transmit nothing unless you click them. Only afterwards does processing by that provider begin, governed by their own privacy notices.

Your rights

You have the following rights in relation to us at any time:

• Access to whether and which data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data, unless a retention obligation applies (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a commonly used format (Art. 20 GDPR)
• Objection to processing we base on a legitimate interest (Art. 21 GDPR)

An informal message to post@bento.boutique is enough. You need give no reason, and it costs you nothing.

Right to lodge a complaint

If you believe we are processing your data unlawfully, you may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information in Wiesbaden. We would rather you came to us first — but the right is yours regardless.

Changes to this policy

If something changes about our website or the law, we update this policy. The version published here, with the date given below, is always the one that applies.

Last updated: 7 September 2026