Privacy

Last updated: October 2026

1. Data controller

Curry am Schloss Dresden GmbH
Schlossstraße 1
01067 Dresden

Represented by Managing Director Kathrin von Canal
Email: [email protected]
Phone: +49 (0)351 40768888

2. General information on data processing

We process personal data confidentially and in accordance with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the Telecommunications Digital Services Data Protection Act (TDDDG) and this privacy policy.

3. Hosting and server log data

When you access this website, the hosting provider processes technically necessary data in server log files. This may include your IP address, date and time of the request, requested page, referrer URL, browser type and operating system. Processing is carried out to provide the website securely and reliably on the basis of Art. 6(1)(f) GDPR. Log data is retained only for as long as required for security, troubleshooting or legal obligations.

4. Cookies and consent management

The website uses technically necessary cookies for basic functions, security and language settings. Optional statistics cookies for Google Analytics are used only with your consent. You can change your choice at any time via “Cookie settings” in the footer. Necessary storage is based on Section 25(2) TDDDG; subsequent processing is based on Article 6(1)(f) GDPR.

5. Language selection

We use TranslatePress to provide the German and English versions of the website. A local language preference may be stored so that your selected language is retained on your next visit. This storage is functionally necessary.

6. Contact form, email and telephone

If you contact us through the contact form, by email or by telephone, we process the information you provide – in particular your name, email address, optional telephone number and message – solely to respond to your enquiry. The contact form is provided by Contact Form 7. The information is sent to us by email; by default, Contact Form 7 does not permanently store submissions in the website database.

The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to initiating or performing a contract; otherwise Art. 6(1)(f) GDPR applies on the basis of our legitimate interest in responding to enquiries. We delete the data once it is no longer required for this purpose and no statutory retention obligations apply.

7. Local Contact Form Spam Protection

To protect our contact form against automated submissions and spam, we use a local protective mechanism. It uses a simple calculation question and an invisible input field (honeypot), limits repeated submissions within a short period, and identifies typical advertising and link-spam patterns, including in the name field. No data is transmitted to external CAPTCHA providers for this purpose, and no additional cookies are set.

To limit repeated submissions, the visitor's IP address is not stored in plain text. Instead, it is converted into a non-reversible identifier and temporarily stored for no longer than 15 minutes. Processing is based on Art. 6(1)(f) GDPR due to our legitimate interest in protecting our website and contact form against misuse and spam.

8. External Links to Google and Instagram

Our website contains ordinary links to Google Maps, the Google review page and Instagram. No maps, social media plugins or content from these providers are embedded automatically. Only when you click such a link do you leave our website; data may then be transmitted to the relevant provider. The provider’s privacy policy applies to any subsequent processing.

9. Web Analytics and External Fonts

With your consent, we use Google Analytics 4 to statistically analyse how our website is used. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data includes page views, sessions, referring pages, browser and device details, and approximate location information. Pseudonymous identifiers in the _ga and _ga_* cookies help distinguish visits; their standard lifetime is up to two years, although browsers may shorten it. According to Google, Google Analytics 4 does not store IP addresses.

The Google measurement code is loaded only when you consent to the Statistics category. Without this consent, this integration does not measure visits using Google Analytics. The legal bases are your consent under Article 6(1)(a) GDPR and, for storage or access on your device, Section 25(1) TDDDG. You can withdraw your consent at any time for the future via “Cookie settings” in the footer.

When Google processes data, it may also transfer it to the USA and other countries. Further information is available in Google’s privacy policy and Google Analytics 4 privacy information.

We do not load fonts from external font providers; the system fonts used are supplied by your device.

10. Your Rights

Subject to the statutory requirements, you have the right in particular to:

• access your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing (Art. 21 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority. In particular, you may contact the Saxon Commissioner for Data Protection and Transparency.

11. Data Security

We use an encrypted HTTPS connection and appropriate technical and organisational measures to protect data against loss, manipulation and unauthorised access.

12. Changes to This Privacy Policy

We update this privacy policy when legal requirements or the services used change. The version published on this page at the time applies.