Legal

Privacy notice.

We inspect cafés and bars very closely, but your data as little as possible. This page explains which data is processed when you visit toopicky.de, why, and what your rights are. If in doubt, the German version applies.

1. Controller

Responsible for data processing on this website:

Öyküm Deniz Yeşilbağ
Voltastraße 23
60486 Frankfurt am Main, Germany
Email: [email protected]

2. Hosting and server log files

This website is delivered via Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technically necessary data, in particular your IP address, date and time, the address requested, browser and operating system. This is needed to deliver the website and to protect it against attacks.

The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework, which the transfer to the USA relies on (Art. 45 GDPR). We have a data processing agreement with Cloudflare.

3. Cookieless visitor counting (Cloudflare Web Analytics)

We count page views with Cloudflare Web Analytics. This tool sets no cookies and stores nothing on your device. We only see aggregated numbers, for example how often a page was viewed and roughly which country visits come from, never individual people.

The legal basis is our legitimate interest in understanding the use of our website in a simple, data-minimising way (Art. 6(1)(f) GDPR).

4. Google Analytics (only with your consent)

If you click “Accept” in the cookie notice, we use Google Analytics 4 by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Without your consent, Google Analytics is not loaded.

• Purpose: understanding how our website is used, for example which Picky Reports and series are read and which links are clicked, and improving our content based on that.
• Data: pages viewed, clicks, approximate location (city/country), device, browser, where the visit came from (for example Instagram). According to Google, IP addresses of users in the EU are only used to determine approximate location and are not stored.
• Cookies: Google Analytics stores cookies (for example “_ga”) that are valid for up to 2 years.
• Retention at Google: 14 months.
• What we don't use: Google Signals, advertising features and personalised ads.
• Data sharing: we allow Google to use aggregated, anonymised data for industry benchmarks and modelling, for technical support and for recommendations about our account. Sharing for Google's own products and services is switched off.
• Transfer to the USA: possible. Google is certified under the EU-US Data Privacy Framework (Art. 45 GDPR). We have a data processing agreement with Google.
• Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

You can withdraw your consent at any time with effect for the future: Open cookie settings

5. Storage in your browser

Without your consent we only store two small entries in your browser's storage (localStorage), needed for functions you trigger yourself:

• tp-cerez: your choice in the cookie notice, so it doesn't appear on every visit.
• tp-dil: the language you chose via DE/EN.

The legal basis is Section 25(2) no. 2 TDDDG (strictly necessary for a service you requested). You can delete these entries at any time in your browser settings.

6. Inspection request form (Tally)

For suggestions (“request an inspection”) we use a form by Tally BV, Belgium. The form is only loaded when you click “Or fill it in right here”; only then is data sent to Tally. According to Tally, form data is stored in Europe.

We receive your details about the place and, if you choose to give it, your email address. We only use the email address to tell you whether we will inspect your suggestion. No newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR). We delete the data once it is no longer needed, at the latest after 12 months.

7. Contact by email

If you write to us ([email protected] or [email protected]), we process your email address and the content of your message in order to reply. Our mailbox is provided by united-domains GmbH (Germany). The legal basis is our legitimate interest in answering your message (Art. 6(1)(f) GDPR), or Art. 6(1)(b) GDPR if it concerns a collaboration.

8. Links to Instagram and TikTok

Our website only contains plain links to our Instagram and TikTok profiles, no embedded content. Data is only transferred when you click a link and open the platform; their privacy policies apply there.

9. Fonts

Our fonts are hosted on our own server. No connection to Google Fonts or any other font provider is made when the page loads.

10. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can withdraw consent at any time. Just write to [email protected].

You can also lodge a complaint with a data protection authority, for example the Hessian Commissioner for Data Protection and Freedom of Information (HBDI), Postfach 3163, 65021 Wiesbaden, Germany.

11. Encryption

This website uses SSL/TLS encryption, recognisable by “https://” in the address bar.

Last updated: November 2026