Reserve a table

Privacy Policy

Privacy policy for Electric Social / The Loft Berlin GmbH — controller, cookies, tracking, and processors.

Privacy Policy

Last updated: August 2026

1. Controller

The controller responsible for personal data processing on this website is:

The Loft Berlin GmbH (brand: Electric Social)
Grunerstr. 13
10179 Berlin
Germany

Phone: +49 (0) 30 213002140
Email: alex@electric-social.com

2. Hosting and delivery

This website is served via Cloudflare Pages (CDN and hosting). When you load pages, the host processes technical connection data (including IP address, time, requested URL, referrer, user agent) as needed to deliver, secure, and stabilise the site.

  • Processor: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (and affiliated EU/EEA entities where applicable)
  • Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, reliable operation)
  • Third-country transfers: USA — safeguarded by Cloudflare’s contractual guarantees (including Standard Contractual Clauses / DPA) where required

Access logs are retained only as long as needed for operations, security, and troubleshooting.

3. Cookies and consent

We use cookies and similar technologies.

  • Strictly necessary cookies (e.g. storing your cookie choice) may be set under § 25(2) TDDDG and Art. 6(1)(f) GDPR.
  • Analytics, marketing, and personalisation cookies/tags are used only with your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Consent is collected via the TermsFeed cookie banner. You can change or withdraw your choice at any time via “Cookie Preferences” / “Cookie-Einstellungen” in the footer. Withdrawal applies going forward.

We use Google Consent Mode so that, until you consent, settings such as analytics_storage and ad_storage remain denied by default.

4. Contact and application forms

Forms on this site (contact, careers, etc.) let you send us messages. At least a valid email address is required; other fields are optional. We process the data only to handle your enquiry or application.

  • Legal basis: Art. 6(1)(b) GDPR (pre-contractual / enquiry) and/or Art. 6(1)(a) where you separately consent to marketing
  • Processor (form backend / anti-spam): SpamBlock (spamblock.io / related operator), including api.spamblock.io and pixel.spamblock.io

Retention: until your request is resolved, then as required by statutory retention rules where applicable.

5. Online reservations (SevenRooms)

Table and experience bookings use embedded widgets or links from SevenRooms. When you book in the widget, reservation data (e.g. name, email, phone, date, party size, preferences) is processed by SevenRooms — typically directly by SevenRooms as (joint) controller or booking service provider. Please also read SevenRooms’ own privacy notices.

  • Provider: SevenRooms, Inc. (and affiliates)
  • Our purpose: Enabling and managing reservations for Electric Social
  • Legal basis: Art. 6(1)(b) GDPR (contract / pre-contractual steps); embed technology may also rely on legitimate interest (f) or consent where third-party cookies are involved

6. Analytics, advertising, optimisation, and other services

After consent (or where otherwise permitted), Google Tag Manager (GTM-5MPMTZJ3) and direct embeds may activate the services below. Some GTM tags may be paused; this list covers configured / embedded processors for the website.

6.1 Google Tag Manager, Google Analytics 4, Google Ads

  • Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent Google LLC, USA
  • Purpose: Tag management, reach measurement, conversion and campaign measurement
  • Legal basis: Consent (Art. 6(1)(a) GDPR), unless strictly technical

6.2 Meta Pixel (Facebook / Instagram)

  • Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; Meta Platforms, Inc., USA
  • Purpose: Campaign and event measurement (e.g. booking intent)
  • Legal basis: Consent

6.3 TikTok Pixel

  • Provider: TikTok Technology Limited, Ireland / TikTok Inc., USA (depending on configuration)
  • Purpose: Campaign and event measurement
  • Legal basis: Consent

6.4 Microsoft Clarity

  • Provider: Microsoft Ireland Operations Limited / Microsoft Corporation, USA
  • Purpose: Usage analysis (e.g. session insights)
  • Legal basis: Consent

6.5 HubSpot

  • Provider: HubSpot Ireland Limited / HubSpot, Inc., USA
  • Purpose: CRM / marketing snippet (when active via GTM)
  • Legal basis: Consent and/or contract, depending on use

6.6 VWO (Visual Website Optimizer)

  • Provider: Wingify Software Private Limited, Delhi, India (product: VWO)
  • Purpose: A/B testing and site optimisation (SmartCode in the page head)
  • Legal basis: Consent and/or legitimate interest in optimisation — aligned with cookie consent

6.7 Ahrefs Web Analytics

  • Provider: Ahrefs Pte. Ltd., Singapore
  • Purpose: Website analytics (analytics.ahrefs.com)
  • Legal basis: Consent and/or legitimate interest, consistent with consent setup

6.8 TermsFeed (cookie banner)

  • Provider: TermsFeed (consent / compliance tooling)
  • Purpose: Collecting and storing cookie preferences
  • Legal basis: Art. 6(1)(c)/(f) GDPR with TDDDG (legal obligation / proof of consent)

6.9 Klaviyo (if enabled)

  • Provider: Klaviyo, Inc., USA
  • Purpose: Email / marketing automation (GTM tag may be paused)
  • Legal basis: Consent

6.10 CDN for libraries (jsDelivr)

We load styles and scripts (e.g. calendar, gallery) via the jsDelivr CDN. Your IP address may be transmitted to the CDN operator.

  • Purpose: Delivering static assets
  • Legal basis: Art. 6(1)(f) GDPR

7. Processors and key recipients

Service Typical role Purpose
Cloudflare, Inc. Processor Hosting / CDN / security
Google Ireland Ltd. / Google LLC Processor / controller for Ads features GTM, GA4, Ads
Meta Platforms Ireland Ltd. / Meta Platforms, Inc. Joint / independent controller (pixel) Ads measurement
TikTok Technology Ltd. / TikTok Inc. Joint / independent controller (pixel) Ads measurement
Microsoft / Clarity Processor UX analytics
HubSpot Ireland Ltd. / HubSpot, Inc. Processor CRM / marketing
Wingify / VWO Processor Testing & optimisation
Ahrefs Pte. Ltd. Processor Web analytics
TermsFeed Processor Cookie consent
SpamBlock Processor Forms / anti-spam
SevenRooms, Inc. (Joint) controller / reservation provider Online booking
Klaviyo, Inc. Processor (if active) Email marketing
jsDelivr Recipient of technical data CDN

Sub-processors of the above (e.g. Google/AWS cloud infrastructure) follow each vendor’s current DPA and sub-processor lists. On request we can point you to the agreements that apply to us (AVV / DPA).

8. Sharing and third countries

We share personal data with third parties only if you consented, if it is needed to perform a contract, if we are legally obliged, or if we have a legitimate interest that is not overridden by your interests.

Transfers to the USA or other third countries use EU Standard Contractual Clauses and vendors’ supplementary measures where required.

9. Retention

We keep personal data only as long as needed for the purposes above or as required by law. Consent-based tracking data stops on withdrawal or per each tool’s deletion rules.

10. Your rights

Under the GDPR you have the right to:

  • Access (Art. 15)
  • Rectification (Art. 16)
  • Erasure (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Withdraw consent (Art. 7(3))
  • Lodge a complaint with a supervisory authority (Art. 77), e.g. the Berlin Commissioner for Data Protection and Freedom of Information

To exercise these rights, email alex@electric-social.com.

11. Objection (Art. 21 GDPR)

Where we rely on legitimate interest (Art. 6(1)(f)), you may object on grounds relating to your particular situation. You have an unconditional right to object to processing for direct marketing.

12. Security

We use TLS/HTTPS and appropriate organisational and technical measures to protect data against loss, manipulation, and unauthorised access.

13. Updates

This privacy policy is effective August 2026. We update it when needed; the current version is this page.