Privacy Policy
This English translation is provided for your convenience. Only the German version is legally binding.
Controller
The controller responsible for processing your data on this website is:
Mo.Ra Hospitality GmbH
Represented by: Rakesh Nagaraj (Managing Director)
Auf dem Haigst 46
70597 Stuttgart, Germany
Phone: +49 711 67439989
For data protection enquiries: info@mora-hospitality.com
Hosting & server logs
Our website is hosted by Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA) and delivered via the Cloudflare network. Cloudflare also manages our domain's DNS entries and protects the website against attacks and overload.
When you visit the website, technical access data is generated: IP address, time, the URL accessed and information about your browser (user agent). We need this data for secure and stable operation. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing the website securely and quickly). The data is only stored for as long as necessary for operation and security.
We have a data processing agreement with Cloudflare pursuant to Art. 28 GDPR. Processing may also take place in the USA. Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the EU Standard Contractual Clauses apply. More information: https://www.cloudflare.com/privacypolicy/
The details you enter in the waitlist form are also forwarded via Cloudflare's servers to our mailing service provider Brevo (see "Waitlist & email notifications").
Google Tag Manager
We use Google Tag Manager by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is an administration tool through which we integrate statistics and marketing tools. It does not set any cookies itself and does not analyse usage data. However, loading Tag Manager technically requires your IP address to be transmitted to Google; a transfer to the USA is also possible (Google is certified under the EU-US Data Privacy Framework). Which tools become active via Tag Manager depends solely on your choice in the consent banner: without your consent, no statistics or marketing tools are triggered. The legal basis for loading Tag Manager is our legitimate interest in managing these tools in a data-minimising, consent-based way (Art. 6(1)(f) GDPR).
Google Analytics 4
If you agree to "Statistics", we may use Google Analytics 4 (Google Ireland Limited) to understand how the website is used. Google Analytics processes usage data and technical information. Google Analytics is not triggered before you consent. Google Analytics sets cookies (e.g. "_ga") and processes IP addresses to derive location; according to Google, they are not stored permanently. The retention period for event data is set to 14 months.
If you arrive via a QR code or a link from our advertising, the address contains a note on the source (e.g. "utm_source=flyer"). This shows us which advertising works – without identifying you personally.
A transfer to the USA is possible; Google refers, among other things, to the EU-US Data Privacy Framework. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25 TDDDG.
Meta Pixel
If you agree to "Marketing", we use the Meta Pixel by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, D04 X2K5, Ireland. It measures whether visits and waitlist sign-ups result from our advertising on Facebook and Instagram, and helps us show ads to suitable audiences. The pixel sets cookies (e.g. "_fbp") and transmits usage data – such as pages viewed and events like signing up for the waitlist – to Meta. Meta may link this data to your Facebook or Instagram account and also use it for its own purposes.
We are jointly responsible with Meta for collecting and transmitting the data to Meta (Art. 26 GDPR); Meta is solely responsible for any further processing. You can find the agreement at https://www.facebook.com/legal/controller_addendum. A transfer to the USA is possible; Meta is certified under the EU-US Data Privacy Framework. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and § 25(1) TDDDG. More information: https://www.facebook.com/privacy/policy
Waitlist & email notifications
When you sign up for the waitlist, we process your first name and email address and, optionally, your phone number for text message notifications. This is how we inform you about the opening and the start of reservations. We use Brevo (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France) for sending.
You will first receive an email to confirm your sign-up (double opt-in). Only after your confirmation are you on the waitlist. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time via the unsubscribe link in our messages or by emailing us. We delete your data after you withdraw consent or when the purpose of the waitlist ends, unless statutory obligations prevent this.
Brevo stores the data on servers in the EU. To protect against misuse, we automatically check sign-ups, for example for automated entries.
In our emails, Brevo analyses whether a message was opened and which links were clicked. This shows us whether our messages arrive and are of interest. This analysis is part of your waitlist consent and ends when you unsubscribe.
Contact by email or phone
If you contact us by email or phone, we process your details (e.g. name, email address, phone number and the content of your enquiry) to handle your request. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or its initiation (e.g. a reservation), otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR). We use Google Workspace (Google Ireland Limited) for email. We delete your data as soon as your request has been dealt with and no statutory retention obligations apply.
Links to other websites
On our site you will find links to Google Maps, Instagram, Facebook and – once available – our reservation service. Only when you click on such a link do you leave our website. The provider of the target page is responsible for processing your data there.
Your rights
Under Art. 15–21 GDPR you have, in particular, the right of access, rectification, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests. You can withdraw any consent you have given at any time with effect for the future. To do so, write to us at the email address given above.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.
Last updated
October 2026
Social media
We are present on Instagram and Facebook. Our website only contains simple links to them – as long as you don't click on them, no data is transmitted to Meta. If you visit our pages on Instagram or Facebook, Meta Platforms Ireland Ltd. processes your data in accordance with its own privacy policy.
We are jointly responsible with Meta for the statistics on our pages ("Insights") (Art. 26 GDPR); you can find the agreement at https://www.facebook.com/legal/terms/page_controller_addendum. The easiest way to exercise your rights is directly with Meta. The legal basis is our legitimate interest in communicating with our guests (Art. 6(1)(f) GDPR).