This translation is provided for convenience. The German version is legally binding.
VinoVista: Information under Regulation (EU) 2023/2854 (Data Act)
Version 1.0 · As of 8 October 2026
1. Provider and scope
digital cuisine GmbH & Co. KG, Hanomagstraße 9, 30449 Hannover, provides the VinoVista platform as a data processing service within the meaning of Art. 2(8) of Regulation (EU) 2023/2854. This page fulfils the information obligations under Art. 26 (switching and data export) and Art. 28 (international access and transfer). Contractual provisions on switching are set out in clause A.11 of the usage agreement.
Contact for switching requests, export requests and enquiries: support@cuisine.digital.
2. Switching to another provider and data export (Art. 26)
2.1 Procedure
- The customer requests the switch in text form by contacting support@cuisine.digital with two months' notice.
- Within 30 calendar days after the notice period expires (the transitional period), digital cuisine provides the exportable data as a downloadable archive and provides reasonable assistance with switching. If switching is technically unfeasible within this time, digital cuisine notifies the customer within 14 working days, giving reasons and specifying a transitional period of no more than seven months.
- The customer can retrieve the data for up to 30 calendar days after the transitional period expires. Production data is deleted three months after the contract ends, unless statutory retention obligations prevent this.
- No switching charges apply, including for assistance with switching.
2.2 Methods
- Standard export (end of contract and switching): On request, digital cuisine creates an archive (ZIP) containing one CSV file and one JSON file per data type listed in section 2.4, together with a field description. It is provided via a time-limited, password-protected download link.
- Ongoing exports in the back office: Orders as an Excel file for each period, financial report as an Excel file for each period and business location, list of items as CSV. These exports are available to the customer at any time.
- Application programming interface: Currently available as a preview version (clause A.10.5 of the usage agreement), with no entitlement to continued provision. digital cuisine issues API keys on request.
2.3 Formats
- CSV: UTF-8 with BOM, semicolon delimiter, CRLF line endings, header row with field names, date and time according to ISO 8601, amounts in cents as integers or in euros with a decimal point (specified for each file).
- JSON: UTF-8, one array of objects per file, field names as in the field description, foreign keys as numeric IDs.
- Files: Images and PDF documents are included as files in the archive and referenced by file name in the records.
- Field description: README in the archive with field name, type, meaning and relationships between the files.
2.4 Register of exportable data
Current register of data structures and formats
2.5 Known limitations
- Payment data, invoices and credit notes are held by the payment service provider in the customer's account (currently Stripe). VinoVista exports the reference numbers; the customer obtains the documents directly from their Stripe account.
- Email sending logs and newsletter contact lists are held by the email service provider in the customer's account (Brevo) and can be retrieved there directly by the customer.
- Images are supplied as files, not within the data files.
- Reports and dashboards are calculated at runtime and are not exported; the underlying booking and order data is included in the export.
- Application and access logs from operations are not exported.
- The platform's source code, data models, interface definitions, designs and documentation cannot be exported (clause A.3.1 of the usage agreement).
- Several data types have no direct customer key (end customers, orders, vouchers, event types). They are associated via the business location, item or redemption, as indicated in the "Association with the customer" column. End customers who have made bookings with several contracting partners are supplied to each of those partners.
3. International governmental access and transfer (Art. 28)
3.1 Jurisdiction of the infrastructure used
| Service | Provider, registered office | Processing location | Jurisdiction | Data |
|---|---|---|---|---|
| Server, database, backups | Hetzner Online GmbH, Gunzenhausen | Data centre in Germany | Germany, EU | all customer data |
| Reverse proxy, DDoS protection, TLS | Cloudflare, Inc., San Francisco | worldwide network | USA; transfer on the basis of the EU-U.S. Data Privacy Framework or, alternatively, standard contractual clauses | Connection data (IP address, timestamp, address accessed) |
| Support mailbox and ticket system | Microsoft Ireland Operations Ltd., Dublin | EU (EU Data Boundary) | Ireland, EU | Content of support requests |
| AI-assisted processing of support requests | Anthropic, PBC, San Francisco | USA | USA; transfer on the basis of standard contractual clauses (Art. 46(2)(c) GDPR) under Anthropic's Data Processing Addendum; no use for training | Content of support requests, platform data queried |
| Development and maintenance | digital cuisine solutions, S.L., Jerez de la Frontera | only remote access to the systems in Germany, no data storage in Spain | Spain, EU | access on a case-by-case basis |
The customer operates services they have commissioned themselves and connected to the platform under their own responsibility: payment service provider (Stripe), email sending and newsletter lists (Brevo, customer's account), analytics services (Google Tag Manager) and cookie banners.
Platform data (database, uploaded files, backups) is stored exclusively in Germany. Processing outside the EU or EEA takes place only through the named providers and only subject to the conditions of Art. 44 et seq. GDPR.
3.2 Measures against unlawful access by authorities from third countries
Technical
- Encrypted transmission (TLS) on all connections, including between components.
- Access control through user accounts with roles and permissions for each business location. Administrative access to the infrastructure is restricted to named individuals using multi-factor authentication.
- Logging of administrative changes and access.
- Daily backups with seven days' retention, exclusively in Germany.
- No replication or storage of platform data (database, uploaded files, backups) outside Germany. The reverse proxy terminates TLS and forwards traffic but does not store customer data.
Legal
- Data processing agreements under Art. 28(4) GDPR with all subprocessors.
- For providers in third countries: an adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses, including the obligation to review and challenge governmental requests and to inform the commissioning party.
- digital cuisine is subject to German law. A disclosure request from an authority in a third country is binding on digital cuisine only if it is based on an international agreement (such as mutual legal assistance) or has been implemented in German or EU law.
Organisational
- Every governmental request is reviewed by management and the data protection officer before data is disclosed. Disclosure takes place only where there is a binding obligation, to the minimum extent possible and after a review of its lawfulness.
- The affected customer is informed before disclosure, insofar as this is legally permissible; otherwise, as soon as it becomes permissible.
- Documentation of every request and every disclosure.
- Appointed data protection officer: Carina Paulsen, carina.paulsen@cuisine.digital.
4. Version
Version 1.0, as of 8 October 2026. Changes to export formats, data types or providers are recorded here with the date.
Change log
- 8 October 2026: Initial publication.