Privacy policy
Thank you for visiting this website. Protecting your data matters to us. Below we explain which data is processed when you visit this site, for what purpose and on what legal basis.
This statement covers this website. Processing that takes place in the restaurant itself — for example when you book by phone or pay your bill — is governed by the rules that apply there.
1. Controller
The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation is:
Restaurant Pegasos
Breite Straße 94
38855 Wernigerode
03943 633433
sukhmanjot2017@gmail.com
We have not appointed a data protection officer, and we are not legally required to do so. For any questions about data protection, please use the contact details above.
2. In principle
This website works without analytics services, without advertising networks and without guest accounts. Simply opening and reading the pages — home, menu, legal notice, privacy — establishes no connection to any third-party provider. All images, fonts and design files are served from our own server.
Only two third-party services can be embedded at all, and both only after you have explicitly clicked to load them: the resmio booking form and the interactive OpenStreetMap map. Each is described separately below.
3. Hosting and server logs
This website runs on infrastructure provided by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes the data on our behalf as a processor; a data processing agreement under Art. 28 GDPR is in place.
Each time the site is opened, technically necessary connection data is processed: your IP address, the date and time of the request, the address requested, the referring page, the volume of data transferred, the status of the request and details of your browser and operating system. This data is required in order to deliver the site, keep it stable and secure and fend off attacks.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and trouble-free operation of the website. This connection data is not combined with other sources and is not used to identify you as an individual.
The database holding the menu and settings is located in the Western Europe region. Where Cloudflare processes data outside the European Union, the transfer is based on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.
4. Encrypted transmission
This site is served exclusively over encrypted HTTPS. You can recognise this by the padlock symbol in your browser's address bar. Content you send us therefore cannot be read by third parties in transit.
5. Cookies and storage on your device
Visiting the public pages sets no cookies for analytics, profiling or advertising. There is no consent banner because there is nothing to consent to as long as you are only reading.
If you click “Load the booking form” or “Load interactive map”, your browser stores a record of that consent in local storage. It contains nothing but a yes — no information about you personally. Its purpose is to spare you from clicking again on every visit and to allow us to demonstrate your consent. The legal basis for storing it is § 25(2)(2) TDDDG, because the record is necessary for the service you expressly requested. You can remove it at any time by clearing this site's data in your browser.
In the admin area, which only the operator uses, a technically necessary session cookie is set after signing in. It serves solely to keep that session active and expires on sign-out. It is of no relevance to visitors of this website.
6. Table reservations via resmio
On the home page we offer a booking form provided by resmio GmbH, Karl-Liebknecht-Straße 32, 10178 Berlin, Germany. This form is not loaded automatically. Unless you explicitly click “Load the booking form”, no connection to resmio is established and no data is transmitted there.
We measured why this restraint is necessary: on loading, the resmio form sets eight cookies, five of them belonging to Google Analytics, plus the Facebook pixel. We have no control over those cookies — they are not ours. That is precisely why we do not load the form without asking.
After your click, your IP address and technical details of your browser and device are transmitted to resmio. The legal basis for this is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. If you then make a reservation, resmio processes the data you enter — typically your name, contact details, date, time and number of guests — on our behalf, so that we can hold your table. The legal basis for this is Art. 6(1)(b) GDPR.
You may withdraw your consent at any time with future effect by clearing this site's data in your browser. This does not affect the lawfulness of processing carried out up to that point. If you would rather not use resmio, we are equally happy to take your reservation by phone. Further details are set out in the resmio privacy policy at resmio.com/de/datenschutz.
7. Map and directions
The map section on the home page is a plain image served from our own server. Opening the page therefore establishes no contact with any third party.
Only when you explicitly click “Load interactive map” is a movable map loaded from the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Your IP address and technical browser details are transmitted to their servers in the process. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. An adequacy decision of the European Commission is in place for the United Kingdom. Their privacy policy is available at osmfoundation.org/wiki/Privacy_Policy.
8. Links to other providers
In several places we link to other providers in the ordinary way: to Lieferando for orders, and to Google Maps and Apple Maps for directions. These are plain links. As long as you do not click them, no data is transmitted. If you do follow such a link, you leave this website; from that point the privacy policy of the provider in question applies, and we have no influence over their processing.
9. Contacting us
If you call us or send us an email, we process the information you provide in order to deal with your enquiry. The legal basis is Art. 6(1)(b) GDPR where the matter concerns entering into or performing a contract, otherwise Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries. You are under no obligation to provide this data; without it, however, we cannot deal with your enquiry.
10. Recipients of your data
We do not pass your data on for advertising purposes and we do not sell it. Access is limited to: our hosting provider Cloudflare as a processor; resmio GmbH, but only if you have loaded the booking form; and, in individual cases, public authorities where we are legally obliged to disclose.
11. Retention periods
We store personal data only for as long as is necessary for the respective purpose or as statutory retention periods require. The technical connection data from hosting is stored briefly and then deleted automatically. Enquiries by email or telephone are deleted once they have been dealt with conclusively and no commercial or tax retention obligation applies. The consent record in your browser remains until you delete it.
12. Your rights
You have the following rights in relation to us:
- Information about whether and which data we process about you (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data, unless a retention obligation applies (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Release of your data in a commonly used format (Art. 20 GDPR)
- Objection to processing we base on a legitimate interest (Art. 21 GDPR)
An informal message to the contact details above is enough to exercise them.
13. Withdrawing consent
If you have consented to processing — for example by loading the booking form or the map — you may withdraw that consent at any time with future effect (Art. 7(3) GDPR). The lawfulness of processing carried out before withdrawal is unaffected.
14. Right to object
Where we process data on the basis of a legitimate interest under Art. 6(1)(f) GDPR, you may object to that processing on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests.
15. Complaint to a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:
Landesbeauftragter für den Datenschutz Sachsen-Anhalt
Leiterstraße 9
39104 Magdeburg
Germany
16. No automated decision-making
No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. We do not score you, we do not build profiles and we do not take any decisions concerning you automatically.
17. Changes to this statement
We will adapt this statement when the site or the legal situation changes. The version published here is the one that applies.
Last updated: 24 August 2026