Privacy Policy
This is the privacy policy of 都一处 (Duyichu), the restaurant at No. 36 Qianmen Street, Dongcheng, Beijing, whose official website this is. It explains, in plain language, what personal information we handle, why, how long we keep it, who it reaches, and the rights you have — including sections written for visitors in the EEA/UK, China, and the United States. In short: we ask for as little as possible, we never sell it, and we run no advertising or analytics trackers.
这是 都一处（Duyichu） 的隐私政策——本店位于北京市东城区前门大街 36 号，本网站为其官方网站。本政策以通俗的语言说明：我们处理哪些个人信息、为何处理、保存多久、会被谁接触，以及您享有的权利，并专门为欧洲经济区/英国、中国和美国的访客撰写了对应章节。简而言之：我们只索取最少的信息，绝不出售，也不设置任何广告或分析追踪。
Last updated: August 2026 · Version 2.0 · provided in English and Chinese
最后更新：2026 年 8 月 · 版本 2.0 · 提供中文与英文版本
1. Who we are
The data controller (in China, the personal-information handler) is the 都一处 (Duyichu) restaurant, No. 36 Qianmen Street, Dongcheng, Beijing, China. This site is published with the restaurant's authorisation. You can reach us about anything on this page — including to exercise your rights — at reservations@duyichu.com or +86 10 6301 2841.
The registered operating entity and any regulatory filing (e.g. an ICP 备案 number) will be added here before any public commercial launch. For now this site is a demonstration hosted on Cloudflare.
2. What information we collect
Almost nothing is required to browse. You only give us personal information when you choose to — by creating an account, booking a table, or subscribing to news. The table below lists everything we handle and why.
| Information | Where it comes from | Why we use it | Legal basis (EEA/UK) | Kept for |
|---|---|---|---|---|
| Account details — email, first & last name, phone (optional) | You, when you create an account | To create and run your account; to sign you in | Your consent | Until you delete your account |
| Password — stored only as a one-way hash, never in plain text | You set it; our server hashes it | To verify it's you at sign-in | Your consent | Until you delete your account |
Sign-in session — the dyc_sess cookie | Set when you sign in | To keep you signed in between pages | Strictly necessary | 30 days, or until you sign out |
| Verification codes — a 6-digit code | Generated when you register or reset a password | To confirm your email address | Your consent / security | 15 minutes |
| Reservation requests — name, contact, date, party size, notes | You, via the booking form | To arrange your table | Steps you request before a service | Not stored on this site — composed into an email you send |
| Newsletter email — your address (optional) | You, if you subscribe | To send you news you asked for | Your consent | Until you unsubscribe |
| Wishlist & bag — items you save | Your own browser (localStorage) | To remember your selections | Necessary for the feature | On your device only |
| Language & cookie choice | Your own browser (localStorage) | To open the site in your language and remember your cookie answer | Necessary for the feature | On your device only |
We do not collect: advertising or tracking identifiers, location data, biometric data, or payment-card details (no payment is taken on this website — see the Terms).
3. How and why we use your information
We use the information above only for the purposes it was given: to provide and secure your account, to arrange reservations and gift enquiries, to answer you, and — if you asked — to send you news. We do not profile you, make automated decisions about you, or use your information for advertising.
Our lawful bases (where the concept applies, e.g. the EEA/UK) are your consent (accounts, newsletter), taking steps you request (reservations, gift enquiries), our legitimate interest in keeping the site secure and working, and legal obligation where one applies. You can withdraw consent at any time (see section 10).
4. Cookies and similar technologies
We use only essential cookies and browser storage — no advertising, analytics, or third-party tracking cookies, so there is nothing non-essential to consent to. The one true cookie, dyc_sess, is set only when you sign in. The full list, with durations, is in our Cookie Policy.
6. International transfers
The site runs on Cloudflare's global network, so your information may be processed on servers outside your own country, including outside China or the EEA. Where the law requires it, such transfers are protected by appropriate safeguards (for example the European Commission's Standard Contractual Clauses, or a separate consent for cross-border transfer under China's PIPL). Contact us for details of the safeguards that apply to you.
7. How long we keep it
We keep account information only for as long as your account exists. Delete your account and it is removed immediately. Sign-in sessions expire after 30 days; one-time verification codes expire in 15 minutes; reservation details are not stored on this site at all. On-device items (wishlist, bag, language) live in your browser until you clear them.
8. How we protect it
Passwords are never stored in readable form: we keep only a one-way PBKDF2-SHA256 hash with a unique random salt per person, so no one — including us — can read your password back. The whole site is served over encrypted HTTPS; the sign-in cookie is HttpOnly, Secure, and same-site. No system is perfectly secure, but we design to keep the amount of data small and well-protected.
9. Children
This site and its accounts are intended for adults. We do not knowingly collect personal information from children — under 14 in line with China's PIPL, and we treat under-16s with the same care where the GDPR applies. If you believe a child has created an account, please tell us and we will delete it.
10. Your rights
Wherever you are, you can access, correct, or delete your information and withdraw consent. The fastest way to erase everything is the “Delete my account” button in your account; you can also unsubscribe from news in one click, or write to us. Below are the specific rights that apply by region.
European Economic Area & United Kingdom (GDPR / UK GDPR)
You have the right to access, rectify, erase, restrict, and object to our processing, to data portability, and to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority (in the UK, the ICO). Where we rely on legitimate interests, you can object; where we rely on consent, withdrawing it won't affect processing already done.
China (PIPL)
As the personal-information handler, we process your data on the basis of your consent. You have the right to know, decide, access, copy, correct, and delete your information, to withdraw consent, and to ask us to explain our rules. Cross-border transfers are made only with a separate consent and appropriate safeguards. You may complain to the Cyberspace Administration of China (CAC).
United States (California CCPA/CPRA & other states)
We do not sell or “share” (for cross-context advertising) your personal information, and we collect no sensitive personal information beyond your account credentials. You have the right to know the categories we collect (see the table above), to access and delete your information, to correct it, and not to be discriminated against for exercising these rights. To exercise them, email us; an authorised agent may act for you with proof of authority. Residents of Virginia, Colorado, Connecticut, and Utah have comparable rights.
Everywhere else
The core rights above — access, correction, deletion, and withdrawing consent — are available to everyone, through your account or by writing to us.
11. Changes to this policy
We may update this policy as the site evolves; the current version always lives on this page with its date and version number. If we make a material change to how we handle your information, we will make it prominent.
12. Contact us
For any question, or to exercise any right, write to reservations@duyichu.com, call +86 10 6301 2841, or visit us. We aim to respond to rights requests within 30 days.
1. 我们是谁
数据控制者（在中国称为个人信息处理者）为都一处（Duyichu）餐厅，地址：中国北京市东城区前门大街 36 号。本网站经餐厅授权发布。就本页任何事宜——包括行使您的权利——您都可以通过 reservations@duyichu.com 或 +86 10 6301 2841 与我们联系。
注册运营主体及任何监管备案（如 ICP 备案号）将在正式公开商业运营前在此补充。目前本网站为托管于 Cloudflare 的演示版本。
2. 我们收集哪些信息
浏览本网站几乎无需提供任何信息。只有在您主动选择时——创建账户、预订餐位或订阅资讯——才会向我们提供个人信息。下表列出我们处理的全部信息及其用途。
| 信息 | 来源 | 用途 | 法律依据（欧洲经济区/英国） | 保存期限 |
|---|---|---|---|---|
| 账户信息——邮箱、名字与姓氏、电话（选填） | 您在创建账户时提供 | 创建并运行您的账户；用于登录 | 您的同意 | 直至您删除账户 |
| 密码——仅以单向哈希存储，绝不明文保存 | 您设置，由我们的服务器进行哈希 | 在登录时核验您的身份 | 您的同意 | 直至您删除账户 |
登录会话——dyc_sess cookie | 登录时设置 | 在页面之间保持登录状态 | 严格必要 | 30 天，或直至您退出登录 |
| 验证码——6 位数字 | 注册或重置密码时生成 | 确认您的邮箱地址 | 您的同意／安全 | 15 分钟 |
| 预订请求——姓名、联系方式、日期、人数、备注 | 您通过预订表单提供 | 为您安排餐位 | 您在接受服务前请求的步骤 | 不在本网站存储——生成一封由您发送的邮件 |
| 订阅邮箱——您的邮箱地址（选填） | 您订阅时提供 | 向您发送您所要求的资讯 | 您的同意 | 直至您取消订阅 |
| 心愿单与购物袋——您保存的商品 | 您自己的浏览器（localStorage） | 记住您的选择 | 功能所必需 | 仅存于您的设备 |
| 语言与 Cookie 选择 | 您自己的浏览器（localStorage） | 以您的语言打开网站，并记住您对 Cookie 的选择 | 功能所必需 | 仅存于您的设备 |
我们不收集：广告或追踪标识、位置数据、生物识别数据，或银行卡信息（本网站不进行任何支付——见《使用条款》）。
3. 我们如何以及为何使用您的信息
我们仅将上述信息用于其被提供时的目的：提供并保护您的账户、安排预订与礼品咨询、回复您，以及——在您要求时——向您发送资讯。我们不会对您进行画像、不对您作出自动化决策，也不会将您的信息用于广告。
在适用"法律依据"概念之处（如欧洲经济区/英国），我们的依据为：您的同意（账户、订阅）、应您请求采取的步骤（预订、礼品咨询）、我们在保障网站安全与正常运行方面的正当利益，以及在适用时的法律义务。您可随时撤回同意（见第 10 条）。
4. Cookie 及类似技术
我们仅使用严格必要的 cookie 和浏览器存储——没有任何广告、分析或第三方追踪 cookie，因此没有需要额外征得同意的非必要项。唯一真正的 cookie dyc_sess 仅在您登录时设置。完整清单及其有效期见我们的《Cookie 政策》。
5. 我们与谁共享
我们不出售您的个人信息，也不为第三方自身的营销目的而共享。我们仅与以下各方共享：
- 我们的托管服务商 Cloudflare, Inc.——其代表我们存储账户数据库并运行网站服务器（作为数据处理者），并遵守其自身的安全与隐私承诺。
- 餐厅的工作人员，以完成您的预订或礼品咨询。
- 有关机关，仅在法律要求，或为保护他人或本店的权利与安全时。
6. 跨境传输
本网站运行于 Cloudflare 的全球网络，因此您的信息可能在您所在国家/地区以外的服务器上处理，包括在中国或欧洲经济区之外。在法律要求之处，此类传输将受适当保障措施保护（例如欧盟委员会的标准合同条款，或依据中国《个人信息保护法》就跨境提供另行取得的单独同意）。如需了解适用于您的保障措施详情，请与我们联系。
7. 我们保存多久
我们仅在您的账户存续期间保存账户信息。删除账户后，信息将立即移除。登录会话在 30 天后过期；一次性验证码在 15 分钟后过期；预订详情根本不在本网站存储。设备端项目（心愿单、购物袋、语言）将保留在您的浏览器中，直至您清除。
8. 我们如何保护
密码绝不以可读形式存储：我们仅保留使用每人唯一随机盐值的单向 PBKDF2-SHA256 哈希，因此任何人——包括我们自己——都无法还原出您的密码。整个网站通过加密的 HTTPS 提供；登录 cookie 为 HttpOnly、Secure 且同站。没有任何系统是绝对安全的，但我们的设计力求将数据量保持在最小并妥善保护。
9. 未成年人
本网站及其账户面向成年人。我们不会在知情的情况下收集未成年人的个人信息——依据中国《个人信息保护法》为不满 14 周岁者，并在适用 GDPR 之处对不满 16 周岁者给予同等谨慎对待。若您认为有儿童创建了账户，请告知我们，我们会予以删除。
10. 您的权利
无论您身在何处，您都可以访问、更正或删除您的信息，并撤回同意。抹除全部信息最快的方式是您账户中的"删除我的账户"按钮；您也可以一键取消订阅，或写信给我们。以下是按地区适用的具体权利。
欧洲经济区与英国（GDPR / UK GDPR）
您有权访问、更正、删除、限制和反对我们的处理，有权进行数据可携，并可随时撤回同意。您也可以向当地监管机构投诉（在英国为 ICO）。在我们依据正当利益处理之处，您可提出反对；在我们依据同意处理之处，撤回同意不影响此前已进行的处理。
中国（《个人信息保护法》）
作为个人信息处理者，我们以您的同意为依据处理您的数据。您有权知情、决定、查阅、复制、更正和删除您的信息，撤回同意，并要求我们对处理规则作出解释。跨境提供仅在取得单独同意并采取适当保障措施后进行。您可向国家网信部门投诉。
美国（加州 CCPA/CPRA 及其他州）
我们不出售、也不为跨情境广告目的"共享"您的个人信息，且除账户凭据外不收集敏感个人信息。您有权知悉我们收集的信息类别（见上表）、访问和删除您的信息、更正信息，并有权在行使这些权利时不受歧视。如需行使，请发邮件给我们；经授权的代理人可在提供授权证明后代您行使。弗吉尼亚、科罗拉多、康涅狄格和犹他州的居民享有相当的权利。
其他地区
上述核心权利——访问、更正、删除以及撤回同意——面向每一个人开放，您可通过账户或写信给我们行使。
11. 政策变更
我们可能随网站的发展而更新本政策；最新版本连同其日期和版本号始终发布于本页。若我们对信息处理方式作出重大变更，我们会予以显著提示。
12. 联系我们
如有任何问题，或需行使任何权利，请写信至 reservations@duyichu.com、致电 +86 10 6301 2841，或到店。我们力求在 30 天内回应权利请求。