Legal

Privacy Policy

As of September 2026

This is a convenience translation. Only the German version is legally binding.

1. Controller

The controller responsible for data processing on this website is:

Taste Base GmbH
Bruchsaler Straße 10
10715 Berlin, Germany
E-mail: info@tastebase.de
Represented by the management.

2. General

The protection of your personal data matters to us. We process your data exclusively on the basis of the statutory provisions (GDPR, BDSG, TDDDG). In this policy we inform you about the key aspects of data processing in the context of our website.

3. Hosting

Our website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit our website, STRATO processes various data on our behalf as a processor (see server log files). The legal basis is our legitimate interest in providing our website securely and efficiently (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with STRATO.

4. Server log files

When the website is accessed, the hosting provider automatically records information transmitted by your browser in what are known as server log files: IP address, date and time of access, file requested, volume of data transferred, browser type and version, and the operating system. This data is used for technical provision and security and is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR.

5. Contact form and sample requests (tasting box)

If you send us an enquiry via the contact form, we process the data you provide (name, e-mail address, telephone number where given, and your message) in order to handle your enquiry.

For a sample request via the tasting box, we additionally process the name of your business, the delivery address, your telephone number where given and the selected products in order to ship the samples and to arrange shipping and timing with you. For this purpose we pass the delivery address on to the commissioned shipping company. We also store requests in our internal processing system, which runs on Supabase (server location Frankfurt am Main, see section 7).

Tasting box in your browser (local storage)

The products you add to the tasting box are stored only in your browser (local storage, key “tb-probierbox”) so that your selection is kept when you move between pages. This data only leaves your device when you submit the request. You can empty the selection at any time or delete it via your browser settings. The legal basis is Section 25(2) no. 2 TDDDG, as the storage is strictly necessary for the function you have requested.

Business and address suggestions (Google Maps)

In the contact form and in the tasting box request window we suggest matching businesses and addresses while you type in the “Business” and “Street” fields; one click fills in the business name, street, house number, postcode and city. For this, your browser sends your input in these fields to our server (Supabase, data centre in Frankfurt am Main). From there we forward only the search text you entered to the Google Places service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework). Your IP address is not transmitted to Google, and no Google service is loaded in your browser. We do not store the search queries. The legal basis is our legitimate interest in simple and error-free address entry (Art. 6(1)(f) GDPR) and the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR). You do not have to use the suggestions; all fields can also be filled in by hand. Further information: policies.google.com/privacy.

Storage in Airtable (transfer to the USA)

We use the Airtable service provided by Formagrid Inc., 155 5th Street, San Francisco, CA 94103, USA, to manage enquiries. Your details are transmitted via our server to Airtable and stored there. This may involve a transfer to the USA. The basis for this is the European Commission's standard contractual clauses and participation in the EU-US Data Privacy Framework. Further information: airtable.com/company/privacy.

The legal basis is the initiation or performance of a (pre-)contractual relationship (Art. 6(1)(b) GDPR) and our legitimate interest in handling enquiries efficiently (Art. 6(1)(f) GDPR). We delete the data as soon as your enquiry has been conclusively dealt with and no statutory retention obligations apply.

6. Order portal and customer account

We operate an order portal for business customers at tastebase.de/bestellportal/. Access is set up by us only; there is no self-registration. We process: company name, first and last name of the contact person, e-mail address, telephone number, delivery and billing address, delivery instructions and all order, delivery and invoice data.

The legal basis is performance of the contract or the taking of pre-contractual steps (Art. 6(1)(b) GDPR). Invoices and accounting records are additionally subject to statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB) and are kept for ten years. We delete the access account itself on request at any time; commercial records remain unaffected.

Passwords: you set your password yourself via an invitation or reset link. It is stored only as a cryptographic hash. Neither we nor our service providers can view or recover it.

7. Technical operation of the order portal (Supabase)

The database, user management and file storage of the order portal run on the Supabase platform (Supabase Inc., 970 Toa Payoh North, Singapore). The data is held exclusively in the eu-central-1 region (Frankfurt am Main, Germany). Supabase acts as a processor under a contract pursuant to Art. 28 GDPR. Legal basis: Art. 6(1)(b) and (f) GDPR (performance of the contract and secure, efficient operation).

8. Payment processing (Stripe, SEPA Direct Debit)

Online payments in the order portal are handled by Stripe Payments Europe, Ltd., The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland. If you choose an online payment method, you are directed to a payment page operated by Stripe.

Your bank details never reach us. You enter your IBAN, account holder name and card details directly with Stripe; we only receive a payment reference, the payment method used, the payment status and — for SEPA Direct Debit — a mandate reference. We never see the full bank details.

With SEPA Direct Debit you grant a direct debit mandate during checkout. The invoice amount is then collected from your account within the next few banking days; we notify you of the amount and the collection in advance by e-mail (pre-notification). Stripe appears as the payment service provider on your bank statement.

Legal basis: Art. 6(1)(b) GDPR. Stripe processes payment data partly as an independent controller in order to meet its own legal obligations, in particular anti-money laundering and fraud prevention. Details: stripe.com/privacy.

9. E-mail delivery from the order portal (Resend)

Automated e-mails from the order portal — order confirmations, payment notices, invitation and password links — are sent via Resend (Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA). We process your e-mail address, salutation and name as well as the content of the message; delivery runs via servers in the EU (eu-west-1 region, Ireland).

A data processing agreement pursuant to Art. 28 GDPR is in place with Resend, including the EU Standard Contractual Clauses for the transfer to the US parent company. Legal basis: Art. 6(1)(b) GDPR.

10. Cookies and web analytics (Google Analytics, Google Ads)

By itself, this website sets no cookies. Fonts and images are embedded directly in the page, so no external content (such as Google Fonts) is loaded. Only your decision on the cookie notice is stored locally in your browser (localStorage, key “tb-consent”) so that we do not have to ask you again on every visit. This is technically necessary and requires no consent.

In addition, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use it to understand how our pages are found and used, in order to improve them.

Only with your consent. Google Analytics is loaded only once you have explicitly agreed in the cookie notice. Until you do, no connection to Google is established and no analytics cookies are set. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Google Ads. Our Analytics property is linked to a Google Ads account. With the same consent we therefore also release the advertising signals of Google Consent Mode (ad_storage, ad_user_data, ad_personalization). This allows Google to attribute an action on our site (e.g. a submitted enquiry) to a Google Ads advertisement and to serve ads based on your visit. Without your consent these signals remain disabled and no advertising cookies are set. The legal basis is again your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG; withdrawal applies to both services together.

Data processed. With your consent, Google sets cookies (including “_ga” and “_ga_XP62W4D9RV”) and processes in particular: pages viewed and time spent, date and time of access, approximate location at country and region level, device type, browser and operating system, the referring page and a pseudonymous user ID. The IP address is truncated before it is stored (IP anonymisation). We do not combine this data with other sources and cannot identify you personally from it.

Transfer to the USA. A transfer of data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR are in place.

Retention. Google deletes event-level and user-level data after 14 months automatically. The cookies themselves expire after 2 years at the latest.

Withdrawal. You may withdraw your consent at any time with effect for the future via Open cookie settings. You can also prevent collection using Google’s browser add-on: tools.google.com/dlpage/gaoptout. Further information on privacy at Google: policies.google.com/privacy.

11. Your rights

You have the following rights in relation to your personal data:

An informal message to info@tastebase.de is sufficient to exercise them.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information.

13. Currency of this policy

This privacy policy is current as of June 2026. As the website develops or legal requirements change, it may become necessary to update it.

← Back to home