1. Controller
The controller is Menus Made Modern GbR, partners Evgeni Laumann and Zakhar Pulmanouski, Bärner Straße 1, 35394 Gießen, Germany. Contact info@menusmademodern.de for privacy enquiries.
This notice covers menusmademodern.de, menusmademodern.org, the handling of business enquiries and our Instagram profile @menusmademodern.de.
2. Purposes and Legal Bases
We process personal data to provide and secure our websites, answer enquiries, prepare and deliver projects, and communicate about our business.
Article 6(1)(b) GDPR applies to contracts with you and pre-contractual steps at your request. Article 6(1)(f) applies to business representatives and general business matters; our legitimate interest is reliable business communication. Article 6(1)(c) applies to legal obligations. Where we separately request consent, Article 6(1)(a) applies.
We do not make solely automated decisions with legal or similarly significant effects or carry out related profiling.
3. Netlify Hosting
Our websites and contact-form processing function are hosted by Netlify, Inc., USA. Netlify processes technical connection and usage data such as IP address, time, requested files, referrer, and browser, device and operating-system details for delivery, troubleshooting and abuse prevention.
The basis is Article 6(1)(f) GDPR and our interest in a secure, reliable website. Netlify may process data in the USA and other infrastructure locations. Technical log retention depends on log type, plan and settings; incident-related data may need longer retention for investigation.
Netlify creates technical access and operational logs. It documents function-log history of at least 24 hours and seven days on certain plans. The Observability view shows HTTP requests for 24 hours on current Free/Personal plans, seven days on Pro, or 30 days on Enterprise. These monitoring windows do not guarantee deletion of all Netlify infrastructure, security or backup copies at that point. Our form function creates no additional form archive and does not deliberately log message content.
Provider information: https://www.netlify.com/privacy/ and https://docs.netlify.com/build/functions/logs/ and https://docs.netlify.com/manage/monitoring/observability/overview/
4. Contact Form and Resend
The contact form processes restaurant name, city, project type, selected services, message, contact preference, name, email address and language. Website or Instagram profile and phone number are optional. Required fields let us understand and answer the enquiry; the form cannot be submitted without them. You can contact us by email instead.
Your details pass through our Netlify function to Resend and then our email inbox. Resend is provided by Plus Five Five, Inc., USA, and processes message content, sender and recipient details, and delivery information. Our application does not create a separate customer database from the form.
Resend stores delivery data, including message content, in the USA. Its published information states that email and log data are generally retained for 30 days on Free, Pro and Scale plans; Enterprise arrangements may differ. Resend separately specifies a seven-day backup retention period. This does not automatically delete the message received in our inbox, which follows our own deletion rule. Resend directs requests for earlier removal of individual messages to its support team. Information: https://resend.com/security/gdpr and https://resend.com/legal/dpa
An additional field, hidden from regular visitors, helps reject automated submissions without loading an external CAPTCHA service. The enquiry bases are in section 2; abuse prevention relies on Article 6(1)(f) GDPR.
5. Email Reception with IONOS and Gmail
Emails addressed to info@menusmademodern.de are first received by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany, and forwarded to our Gmail inbox. IONOS processes sender and recipient details, message content and technical delivery data. Form enquiries are delivered directly to our Gmail inbox by Resend. IONOS information: https://www.ionos.de/terms-gtc/terms-privacy/
We receive and handle business email and form enquiries in a regular consumer Gmail account. Google processes email addresses, content, attachments and communication metadata. For regular Google services in the European Economic Area, Google's privacy notice names Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as controller.
Google also processes data outside the European Economic Area, including in the USA. Processing in connection with our regular Gmail account is subject to Google's privacy policy for regular Google services. Information: https://policies.google.com/privacy?hl=en
6. Retention
Completed general enquiries that do not lead to a project are deleted within six months after communication ends, unless a legal obligation or specific need for legal claims applies. This six-month period is our operational deletion rule, not a statutory minimum.
For commissioned projects, necessary data are processed throughout contract performance. Records subject to legal retention duties are retained for the applicable period. Section 147 of the German Fiscal Code (AO) provides, in particular, six years for business correspondence and eight years for accounting vouchers where applicable to the records concerned. Periods generally begin at the end of the relevant calendar year.
Data must be deleted when their purpose, legal retention duties and necessary storage for establishing, exercising or defending legal claims end. Provider logs follow the criteria and periods in the relevant service sections.
7. Browser Storage and Media
For the project selection you request, the website briefly stores mmm:pending-project-choice in your browser's session storage. The contact form reads and removes it; any remaining entry ends with the browser session.
Storage and access for this expressly requested function rely on section 25(2)(2) of the German TDDDG. Where personal data are involved, Article 6(1)(f) GDPR and our interest in a functioning contact process apply.
The current website does not implement analytics or marketing cookies, Google Analytics, Meta Pixel or similar tracking. Fonts, images, videos and 3D files are delivered through our website hosting, without external font or media widgets such as Google Fonts or YouTube.
8. Instagram
We operate https://www.instagram.com/menusmademodern.de/ to present our services and communicate. The EEA provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
For messages or comments we process your profile name, visible profile details, content and interactions to respond. The legal bases in section 2 apply. Our interest in public communication is presenting our business and exchanging information with prospective clients.
Meta also processes device, usage and interaction data for its own platform purposes, including in the USA. Where Meta supplies profile statistics (Insights) and joint controllership applies, the relevant arrangements govern responsibilities. You can exercise rights with us or Meta; Meta can generally handle platform-internal data directly.
Meta information and relevant arrangements: https://privacycenter.instagram.com/policy/ and https://www.facebook.com/legal/terms/page_controller_addendum
Our websites do not embed an Instagram feed or Meta Pixel. You can contact us independently by email and form. Enquiry copies held by us follow section 6; public comments and platform copies also follow Instagram's deletion options and retention rules.
9. Agreed Video Calls
Google Meet or Zoom may be used for individual video calls by prior agreement. The invitation identifies the service. Google Meet is a Google service; Zoom is provided by Zoom Communications, Inc., USA. Processing may include participant name, email address, IP address, connection details and audio, video, screen and chat content you choose to share.
Article 6(1)(b) GDPR applies to contractual discussions; Article 6(1)(f) applies to business representatives and other business conversations. You control your camera and microphone. We do not initiate recordings of individual calls or maintain a call archive. We do not use automatic transcripts or AI-generated records to document conversations.
We do not store customer documents in Google Drive. Even without call recordings, the communication providers process participant, connection and media data needed to conduct the call. Their technical logging depends on the service used; our decision not to make recordings is therefore not a guarantee that the provider stores no data.
Provider information: https://policies.google.com/privacy?hl=en and https://www.zoom.com/en/trust/privacy/privacy-statement/
10. Recipients and International Transfers
Enquiries are handled by the relevant people at Menus Made Modern GbR. Other recipients are the described providers and their subprocessors. Disclosure to authorities or advisers is limited to legal obligations or necessary exercise of our rights.
Netlify, Resend, Google, Meta and, when used, Zoom may process data outside the EU or European Economic Area. Resend stores sending data in the USA; selecting a European sending region alone does not limit storage to Europe.
Netlify states that its data processing agreement is incorporated into its standard terms. Resend states that its data processing agreement takes effect on account creation and includes EU Standard Contractual Clauses for international transfers. Both providers also describe the EU-US Data Privacy Framework as a transfer mechanism where its requirements are met. The applicable basis depends on the specific service and agreement.
Google identifies the EU-US Data Privacy Framework as a mechanism for relevant transfers to Google LLC and covered US subsidiaries. For transfers not covered by an adequacy decision, Google describes the use of standard contractual clauses. Zoom likewise describes the Data Privacy Framework and, for relevant other transfers, standard contractual clauses or other mechanisms provided by law. The requirements applicable to the particular service, recipient and processing operation determine which mechanism applies. Provider information: https://policies.google.com/privacy/frameworks?hl=en and https://www.zoom.com/en/trust/privacy/privacy-statement/
Meta Platforms, Inc. participates in the EU-US Data Privacy Framework. Reliance on this mechanism for Instagram transfers requires the particular US recipient and relevant categories of data to be covered by a valid certification. Certification information: https://www.dataprivacyframework.gov/participant/4452
Provider terms: https://www.netlify.com/pdf/netlify-dpa.pdf and https://resend.com/legal/dpa. Request information or copies of safeguards relevant to our processing at info@menusmademodern.de.
11. Your Rights
Subject to legal conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17) and restriction (Article 18). Data portability under Article 20 applies to automated processing based on consent or contract.
You may withdraw consent at any time with future effect without affecting the lawfulness of earlier processing. Email info@menusmademodern.de to exercise your rights.
Under Article 77 GDPR you can complain to a supervisory authority, particularly where you live, work or believe an infringement occurred. Our local authority is the Hessian Commissioner for Data Protection and Freedom of Information: https://datenschutz.hessen.de/
12. Right to Object
For processing based on Article 6(1)(f) GDPR, you may object under Article 21(1) on grounds relating to your particular situation. We will stop unless we demonstrate overriding compelling legitimate grounds or the processing is needed to establish, exercise or defend legal claims.
You may object to direct marketing at any time without giving particular reasons.