Privacy and Cookie Policy

Data Controller

Restaurant Sankt Peder
Sankt Peders Vej 2
2900 Hellerup
CVR: 36029374

Collection of personal data

We only collect personal data that is necessary to provide our services, manage reservations, and respond to enquiries. Personal data is collected and processed in accordance with applicable data protection law.

Table reservations

When you make a reservation, we may process:

Name
Email address
Phone number
Reservation details, such as date, time, and number of guests
Any comments or special requests

Reservations are handled through an external booking system, DinnerBooking, which processes information on our behalf.

Enquiries and contact forms

When you send an enquiry or contact us, we may process:

Name or company name
Email address
Phone number
Event type
Preferred date and arrival time
Number of guests
Room preference
Menu selections and additions
Practical notes you choose to provide

The free-text field is intended for ordinary and practical event notes. Please do not submit national identification numbers or information about health, allergies, religion, or other sensitive or private matters through the form.

If we receive unnecessary sensitive personal data, we will generally delete it when we become aware of it, unless we have a lawful and necessary reason to retain it.

Purpose and legal basis

We process information to:

Respond to enquiries and communicate with you
Manage reservations (including sending reservation confirmations and updates via email)
Plan and carry out events

The processing for reservations and events is based on fulfilling our agreement with you (GDPR Article 6(1)(b)). The processing of general enquiries is based on our legitimate interest in responding to your request (GDPR Article 6(1)(f)).

Retention and deletion

Enquiries are stored in StaticForms for 30 days and can be deleted manually before they expire. Enquiries forwarded to our email are deleted when they are no longer necessary to handle the enquiry or event, unless longer retention is necessary for documentation, accounting, or legal claims.

We will only keep your other personal information for as long as necessary for the purposes set out in this privacy notice, unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it. Invoicing and payment details are retained in accordance with applicable bookkeeping laws.

Suppliers and processors

We use StaticForms to receive, validate, store, and forward enquiries from the contact form to our email address. StaticForms processes form information on our behalf as a data processor.

The enquiry is received by Restaurant Sankt Peder and is accessible only to relevant staff.

We use Cloudflare Turnstile to protect the form against spam and automated abuse. In doing so, Turnstile may process technical information about the browser, device, IP address, and connection.

Suppliers process information on our behalf only when necessary to provide their services and under our strict instructions. Where required, we enter into data processing agreements with relevant suppliers.

Transfer of data to countries outside the EU/EEA

We have enabled European data residency with StaticForms, so form data is stored in the EU. Account data, email delivery, and operational logs may still be processed in the United States. Transfers outside the EU/EEA are protected by relevant transfer mechanisms and safeguards, including the EU Commission's Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework.

Security

Your personal data is stored on secure networks and can only be accessed by a limited number of employees who require access to the data in their daily work.

In case of a suspected data breach, Sankt Peder will take necessary actions to investigate, contain, and manage the incident, as well as make relevant notifications to the Danish Data Protection Agency (Datatilsynet) and affected individuals.

Your rights

You have the right to:

Access information we process about you
Have incorrect information corrected
Have information deleted
Object to processing
Restrict processing in certain cases
Lodge a complaint with the Danish Data Protection Agency (Datatilsynet)

Cookies and similar technologies

The website uses necessary technologies to make the site and forms work properly.

The contact form uses Cloudflare Turnstile to protect against spam and automated submissions. Turnstile may process technical information about your browser, device, and connection to assess whether the form is being used by a human.

We do not use marketing cookies, advertising tracking, or profiling tools.

Updates to this policy

We may update this policy if our website, suppliers, or data processing changes.

Back to Home