Privacy
We process personal data only as needed to provide reservations and orders, in line with the GDPR (DSGVO).
What we collect
- Reservation: name, email, phone, party size, date/time.
- Order: the above plus delivery address (for delivery).
Processors
Hosting & database: Vercel, Supabase (EU). DNS, CDN and inbound email routing: Cloudflare. Email dispatch: Resend. Address search & delivery-zone calculation: Photon (Komoot GmbH, Germany) — the address you type is transmitted to compute the delivery area and fee. Map: Google Maps (Google Ireland Ltd.) — loaded only after you consent or click the map placeholder; your IP address is then transmitted to Google. Payments: Stripe. Staff push notifications: delivered via the push service of the respective browser vendor (Google, Apple, Mozilla). Messaging and telephony (WhatsApp/SMS/phone): Twilio (USA, EU standard contractual clauses). AI phone assistant: ElevenLabs (USA, EU standard contractual clauses). Chat widget: loaded from an external chat platform only after you consent — the provider then receives your IP address and whatever you type into the chat. Transfers to the USA are based on the EU Commission's adequacy decision for the EU-US Data Privacy Framework, and additionally on EU standard contractual clauses where a recipient is not certified under it.
Legal basis & retention
Reservations and orders are processed to perform the contract (Art. 6(1)(b) GDPR); the newsletter with your consent (Art. 6(1)(a)). We keep order data as long as required for processing and statutory retention (tax law, generally 7 years); newsletter data until you unsubscribe.
Your rights
You may request access, rectification, erasure, restriction, portability or object at any time, and withdraw consent: hallo@bella-vista.at. You also have the right to lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).