Legal

Privacy Policy

As of October 2026

This is a convenience translation. Only the German version is legally binding.

1. Controller

The controller responsible for processing personal data on this website, in the order portal and in our business operations is:

Taste Base GmbH
Bruchsaler Straße 10
10715 Berlin, Germany
E-mail: info@tastebase.de
Represented by the managing directors Silas Söllner, Paul Menne and Jon Gässler.

2. General

We process personal data only where the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) or the German Telecommunications Digital Services Data Protection Act (TDDDG) permit it. This policy describes which data we process for which purposes, on which legal basis, to whom it is passed and how long we keep it.

Mandatory information. You are not legally obliged to provide us with any data. Without the fields marked as mandatory, however, we cannot handle an enquiry, send samples or carry out an order.

No automated decisions. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). This also applies where an AI assists us in our work (section 13).

3. Hosting

Our website and the interface of the order portal are hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit our website, STRATO processes various data on our behalf as a processor (see server log files). The legal basis is our legitimate interest in providing our website securely and efficiently (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with STRATO.

4. Server log files

When the website is accessed, the hosting provider automatically records information transmitted by your browser in what are known as server log files: IP address, date and time of access, file requested, volume of data transferred, the previously visited page, browser type and version, and the operating system. STRATO obscures the IP address in the log files. This data is used for technical provision, troubleshooting and defence against attacks and is not merged with other data sources. We only look at it when needed, for example in the event of a fault; STRATO makes it available to us for around six weeks, and we do not store it permanently. Legal basis: Art. 6(1)(f) GDPR.

Security reports from your browser. Our website specifies from which sources content may be loaded (Content Security Policy). If a page were to breach these rules, your browser may report this to us automatically. From such a report we store only the time, the page concerned (without parameters), the rule concerned, the origin of the content (domain only) and the location in the page code – no IP address and no information about your browser or device. The reports help us detect errors and attacks and are deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR.

5. Contact form and sample requests (tasting box)

If you write to us via the contact form or request samples via the tasting box, we process the details you provide: name, business, address (street, house number, postcode, city), e-mail address and/or telephone number, your request, the products you are interested in where applicable, and your message. Name, business, address and at least one way of contacting you (e-mail or telephone) are mandatory; for sample requests via the tasting box the e-mail address is also mandatory because we arrange shipping through it. You also confirm with a tick that you are enquiring as a business or food service operation (B2B); we store this confirmation with the enquiry. If you e-mail us directly, we process the details in your message in the same way.

We use the details to answer your enquiry, to send samples and to arrange shipping and timing with you. For this purpose we pass the delivery address on to the commissioned parcel service or freight forwarder. We store enquiries in our internal processing system (database at Supabase, section 13), where our team handles them. If we reply to you by e-mail, the correspondence is kept in our e-mail inbox (Microsoft 365, section 13). If this leads to a conversation about working together, we keep your business and you as the contact person in our sales records (section 12).

Protection against abuse. To keep automated spam enquiries out, the form contains a field that is invisible to people and sends along when the page was loaded and when the enquiry was submitted (according to your browser’s clock). If an enquiry arrives less than three seconds after loading, we ask you to send it again. We use these times only for this check and do not store them. In addition, our database accepts only a limited number of website enquiries per hour and at most three per e-mail address (without e-mail: per telephone number) within 24 hours; for this it compares new enquiries with those already stored. We do not collect any additional data for this. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in protection against spam and abuse).

The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps at your request) and Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries and initiating business relationships). If an enquiry is not followed by any further contact, we review no later than 12 months after the last contact whether we still need it and delete the details relating to you if we do not. Documents we are required to keep for tax or commercial law reasons are retained for the statutory period (section 14).

How you found us

With an enquiry via the contact form or the tasting box we store how you reached us. This shows us how prospective customers find us.

Without consent we only use what your browser sends to our server anyway when you submit the enquiry: the address of the page containing the form, including any campaign details in the link (e.g. “utm_source=chatgpt.com” if you arrived directly on that page via a link from ChatGPT). We do not access your device for this. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in evaluating our contact channels).

With your consent to statistics (section 6), our site additionally reads, when you enter it, which website you came from (e.g. a search engine or an AI assistant), which campaign details the link contained and on which page you entered, and keeps this in your browser for the duration of your visit (session storage, key “tb-herkunft”; deleted when the tab is closed or when you withdraw consent). This information is only sent to us if you submit an enquiry. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

We store this information together with your enquiry in our processing system and delete it together with the enquiry.

Tasting box in your browser (local storage)

The products you add to the tasting box are stored only in your browser (local storage, key “tb-probierbox”) so that your selection is kept when you move between pages. This data only leaves your device when you submit the request. You can empty the selection at any time or delete it via your browser settings. The legal basis is Section 25(2) no. 2 TDDDG, as the storage is strictly necessary for the function you have requested.

Business and address suggestions (Google Places)

In the contact form and in the tasting box request window we suggest matching businesses and addresses while you type in the “Business” and “Street” fields; one click fills in the business name, street, house number, postcode and city. For this, your browser sends your input in these fields to our server (Supabase, data centre in Frankfurt am Main). From there we forward only the search text you entered to the Google Places service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; a transfer to Google LLC in the USA is possible (EU-US Data Privacy Framework). Your IP address is not transmitted to Google, and no Google service is loaded in your browser. To limit mass queries, our server counts the requests per visitor: for this it does not store your IP address in plain text but only as an encrypted check value (HMAC) from which it cannot be recovered without our secret key; we delete these counter readings after two days. We do not store the search queries themselves. If the address search is at capacity, a notice appears and you enter the address by hand. The legal basis is our legitimate interest in simple and error-free address entry (Art. 6(1)(f) GDPR) and the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR). You do not have to use the suggestions; all fields can also be filled in by hand. Further information: policies.google.com/privacy.

6. Cookies, statistics and ad measurement (Google Analytics, Google Ads)

By itself, this website sets no cookies. Fonts, images and videos are hosted on our own server; without your consent no third-party content (such as Google Fonts) is loaded and no connection to Google is established.

Your choice in the cookie notice. On your first visit we ask you with three equally weighted buttons:

There is no personalised advertising in any case, not even with “Accept all” (details below).

We store your decision in your browser (local storage, key “tb-consent”) so that we do not have to ask you again on every visit. The entry remains until you change your decision or delete the website data in your browser. The legal basis is Section 25(2) no. 2 TDDDG (strictly necessary) and Art. 6(1)(c) in conjunction with Art. 7(1) GDPR (proof of consent).

Statistics with Google Analytics. We use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use it to understand how our pages are found and used, in order to improve them.

Only with your consent. Google Analytics is loaded only once you choose “Accept all” or “Statistics only” in the cookie notice. Until you do, no connection to Google is established and no cookies are set. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Data processed. With your consent, Google sets cookies (including “_ga” and “_ga_XP62W4D9RV”) and processes in particular: pages viewed and time spent, interactions such as clicks on buttons and links, downloads, scroll depth and the submission of an enquiry (without its content), date and time of access, approximate location (country, region, city), device type, browser, operating system and language setting, the referring page and a pseudonymous user ID. According to Google, Google Analytics 4 does not store IP addresses but uses them only briefly to determine the approximate location. We do not combine this data with other sources and cannot identify you personally from it.

Ad measurement with Google Ads (only with “Accept all”). Our Analytics property is linked to our Google Ads account. Only if you choose “Accept all” do we additionally release the Google Consent Mode signals ad_storage (storing advertising cookies) and ad_user_data (sending usage data to Google for ad measurement). Google can then measure whether an enquiry on our site goes back to one of our Google Ads advertisements (conversion measurement) and may set advertising cookies for this (names starting with “_gcl_”). Where Google uses the data for its own purposes, Google is itself responsible for this. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

No personalised advertising. The ad_personalization signal always remains declined, even with “Accept all”, and personalisation is switched off in the link between Google Analytics and Google Ads. We therefore do not use your visit to show you personalised advertising or remarketing. With “Statistics only”, ad_storage and ad_user_data also remain declined; no advertising cookies are set.

How you found us, for enquiries. With your consent to statistics our site – without Google – remembers for the duration of your visit which website or link brought you to us and sends this along if you send us an enquiry (details in section 5). No cookie is set for this; instead there is an entry in your browser’s session storage (“tb-herkunft”), which is deleted when the tab is closed or when you withdraw consent.

Transfer to the USA. A transfer of data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); in addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR are in place.

Retention. Google Analytics deletes event-level and user-level data automatically after 14 months. The Google Analytics cookies expire after 2 years at the latest, the Google Ads advertising cookies after 90 days.

Withdrawal. You can change your decision at any time and withdraw consent with effect for the future via Open cookie settings or the “Cookie settings” link in the footer of every page. If you choose “Decline” there, we remove the Google Analytics and Google Ads cookies (“_ga…”, “_gid”, “_gat…”, “_gcl_…”) from your browser, delete the stored information on how you found us and stop loading Google immediately. If you choose “Statistics only”, we remove the advertising cookies (“_gcl_…”) and switch off ad measurement. You can also delete cookies in your browser at any time. Further information on privacy at Google: policies.google.com/privacy.

7. Google Search Console and IndexNow

To see how our pages appear in Google Search, we use Google Search Console (Google Ireland Limited). Google only provides us with aggregated figures there, such as how often a page was shown and clicked for which search terms. No Google code is loaded on our website for this, and we cannot draw any conclusions about individual visitors from it.

When we publish or change pages, we report their addresses to participating search engines (e.g. Microsoft Bing) via the open IndexNow protocol. Only page addresses are transmitted, no data about visitors.

8. Links to Instagram and LinkedIn

We refer to our profiles on Instagram and LinkedIn only with simple links; no data is transferred to these networks when you visit our website. Only when you click a link are you taken to the respective provider (Meta Platforms Ireland Limited or LinkedIn Ireland Unlimited Company), whose privacy notices then apply. For the statistics these providers make available to us about our profiles, we may be jointly responsible with them (Art. 26 GDPR).

9. Order portal and customer account

We operate an order portal for business customers at tastebase.de/bestellportal/. We set up access ourselves; there is no self-registration. We process there: company name, first and last name of the contact person, e-mail address, telephone number, delivery and billing address, delivery instructions, the language selected, as well as your orders, deliveries, invoices and payments and the related communication.

The legal basis is performance of the contract or the taking of pre-contractual steps (Art. 6(1)(b) GDPR). Invoices, accounting records and business letters are subject to statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with § 147 AO, § 257 HGB and § 14b UStG; periods in section 14). We delete your access account on request at any time, otherwise at the end of the business relationship; commercial records remain unaffected.

Passwords: you set your password yourself via an invitation or reset link. It is stored only as a cryptographic hash. Neither we nor our service providers can view or recover it. If you request a new link or change your password, you and we may be notified of this by e-mail for security reasons; the password itself is never included.

Storage in your browser

So that you stay signed in and your basket and language choice are kept, the portal stores entries in your browser’s local storage (sign-in, basket, language). The portal does not set cookies. The legal basis is Section 25(2) no. 2 TDDDG, as the storage is strictly necessary for the functions you use. The sign-in ends when you sign out; you can delete all entries via your browser settings.

E-mails, invoices and documents

You receive e-mails about your orders: the order confirmation, the acceptance or rejection of an order, the delivery confirmation with invoice, signed delivery note and product data sheet, invoices and, where applicable, cancellation invoices, notices about payments and direct debits, and payment reminders and dunning letters. We send invoices as PDF files by e-mail; a copy of every message goes to our own inbox. We use Resend to send them (section 13). Your documents are also kept in protected storage that only we and you, for your own orders, can access.

Digital signature on delivery

When the goods are handed over, the person receiving them can confirm receipt with their finger on a Taste Base mobile device. We store the image of the signature, the time and – if given – the name of the person signing. The signature is inserted into the delivery note (PDF), which you receive by e-mail with the delivery confirmation. The purpose is to prove that and when the goods were handed over. The legal basis is Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (legitimate interest in proof of delivery). We keep the signature and delivery note together with the corresponding invoice (section 14).

Delivery by freight forwarder or parcel service

If we do not deliver ourselves, we pass the details needed for delivery to the commissioned freight forwarder or parcel service: company name, contact person, delivery address, telephone number, delivery instructions and delivery date. The legal basis is Art. 6(1)(b) GDPR.

Payment reminders and dunning

If an invoice has not been paid by its due date, we remind you by e-mail and send dunning letters where necessary. In doing so we process the invoice and payment data (amounts, due dates, payments received). If a claim remains unpaid, we may in individual cases enforce it through a lawyer, a debt collection agency or the courts and pass on the data required for this. The legal basis is Art. 6(1)(b) and (f) GDPR (enforcement of our claims).

10. Order portal – usage analytics

In the order portal we ask you once on your first visit whether we may analyse how you use the portal (“Yes, I agree” or “No, thanks”). Only if you agree do we record the following data and link it to your customer account:

The portal stores the session identifier in your browser’s session storage (key “tb-portal-sitzung”); it groups the page views of one visit and is deleted when the tab is closed. We do not set cookies for this, we record neither your IP address nor your browser’s identifier (user agent), and we do not embed any third-party services. The data is held in our database at Supabase in Frankfurt am Main (section 13); only our team has access. We do not pass it on to third parties.

Purpose. We use the analysis to improve the order portal and our range and to offer you help if an order was not completed. To do so, we may contact you personally in that case.

The legal basis is your consent under Art. 6(1)(a) GDPR; for storing the session identifier in your browser, additionally Section 25(1) TDDDG. Whether or not you consent has no effect on how you can use the portal and place orders.

Withdrawal. You can change your decision at any time in the portal under “Account” → “Privacy settings” at the bottom of the page (“Switch on” or “Switch off”). Upon withdrawal we delete all usage data relating to you. The lawfulness of processing carried out before the withdrawal is not affected.

Retention. We delete usage data no later than 12 months after it was recorded, immediately upon withdrawal, and together with your customer account when the account is deleted.

Anonymous monthly totals. From the usage data we continuously compile anonymous monthly totals, e.g. how often a product was viewed or added to the basket. They have no link to individual customers, users, sessions or times of day. Because they are no longer personal data, they are kept even after a withdrawal and after the 12 months have expired.

11. Payment processing (Stripe, SEPA Direct Debit)

Online payments in the order portal are handled by Stripe Payments Europe, Ltd., The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland. If you choose an online payment method, you are directed to a payment page operated by Stripe. For this we transmit the order number, the amount, your company name and your e-mail address to Stripe.

Your full bank details never reach us. You enter your IBAN, account holder name and card details directly with Stripe. Stripe creates a customer record for you and stores the payment method used (for SEPA Direct Debit including the mandate) so that you can pay future orders without entering it again; you can remove stored payment methods in the portal under “Account”. From Stripe we only receive: a customer reference and a payment reference, the payment method type, the payment status, the error message if a payment fails, the mandate reference for SEPA Direct Debit, and, for display in the portal, the card brand and the last four digits of the IBAN or card.

With SEPA Direct Debit you grant a direct debit mandate during checkout. The invoice amount is then collected from your account within the next few banking days; we notify you of the amount and the collection in advance by e-mail (pre-notification). Stripe appears as the payment service provider on your bank statement.

Legal basis: Art. 6(1)(b) GDPR. Stripe processes payment data partly as an independent controller in order to meet its own legal obligations, in particular anti-money laundering and fraud prevention. Details: stripe.com/privacy.

12. Business contacts and sales

We approach restaurants, hotels, cafés and other food service businesses to win them as customers, and we maintain contacts with business partners. For this we process data of contact persons in these businesses – including where we have not collected it from you directly (Art. 14 GDPR).

Which data. Name, role in the business, business contact details (e-mail address, telephone number, address of the business), information about the business (e.g. type, size and offering), notes on conversations and on your interest, samples sent, and the history of our contact.

Where the data comes from. From you (conversation, visit to your business, trade fair, business card, e-mail or enquiry via our website), from publicly available sources such as the website, menu and online profiles of your business or trade and map directories, and from recommendations.

Purpose and legal basis. We use the data to initiate and maintain business relationships and to present our products to your business (direct marketing). The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to do business with food service businesses and to stay in touch with them.

Where the data is held. In our sales system (database at Supabase) and in our e-mail inbox (Microsoft 365). An AI assists us with internal processing (section 13). We do not pass the data on to other companies for their advertising purposes.

Retention. If no business relationship results, we review no later than 24 months after the last contact whether we still need the details to initiate a business relationship. If we do not, we delete the details relating to you personally (e.g. name, personal e-mail address and phone number); details about the business itself may remain. If you become a customer, the periods for customer data apply (section 14). If you object, we delete your data without delay; we keep only your name and the contact channel on a suppression list so that we do not contact you again.

Objection. You can object to this processing at any time without giving reasons, most easily by e-mail to info@tastebase.de (see also your right to object).

13. Recipients and service providers

We only pass on personal data where this is necessary for the purposes set out in this policy. Recipients are:

Database and server functions (Supabase)

We run the database, user management, file storage and server functions for the order portal, enquiries and sales on the Supabase platform. Our contractual partner is Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513, which belongs to the group of Supabase Inc., based in the USA. The data is held in the eu-central-1 region (Frankfurt am Main, Germany). Access from third countries, for example for maintenance and support, cannot be ruled out; it is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of the data processing agreement. Legal basis: Art. 6(1)(b) and (f) GDPR (performance of the contract and secure, efficient operation).

Sending of transactional e-mails (Resend)

Automated e-mails from the order portal (section 9) as well as invitation and password links are sent via Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA). We process your e-mail address, salutation and name, the content of the message and its attachments; delivery runs via servers in the EU (eu-west-1 region, Ireland). Resend is certified under the EU-US Data Privacy Framework; the EU Standard Contractual Clauses apply in addition. Legal basis: Art. 6(1)(b) GDPR.

E-mail, Teams and file storage (Microsoft 365)

We run our e-mail inboxes, internal communication (Microsoft Teams) and file storage (OneDrive, SharePoint) with Microsoft 365 from Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. All e-mails you send us and documents relating to enquiries, quotes and orders are held there. Microsoft processes the data as a processor; a transfer to Microsoft Corporation in the USA is possible and is safeguarded by its certification under the EU-US Data Privacy Framework and by EU Standard Contractual Clauses. Legal basis: Art. 6(1)(b) and (f) GDPR (communication with you and organisation of our business).

AI assistance (Anthropic)

The AI model Claude assists us with the internal handling of enquiries, e-mails and business contacts. It summarises messages, assigns them, drafts replies and transfers contact details (for example from business cards) into our sales system. This involves processing the content of the respective messages and notes and the contact details they contain. The provider is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, acting as processor; processing may take place at its parent company Anthropic, PBC in the USA. This transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the data processing agreement. Anthropic does not use our data to train its models. Decisions are always made by a person from our team. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in prompt and careful handling).

Bookkeeping and tax advice

We keep our books with BuchhaltungsButler (BuchhaltungsButler GmbH, c/o Factory Berlin, Rheinsberger Straße 76/77, 10115 Berlin, Germany). Invoices and receipts with the names and addresses of our customers and business partners and our bank transactions are held there. BuchhaltungsButler acts as a processor. Our tax advisers receive the documents needed for annual financial statements and tax returns. Legal basis: Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB, and Art. 6(1)(f) GDPR (proper bookkeeping).

Transfers to third countries

Some service providers belong to groups of companies based in the USA or in Singapore. Where we transfer data to a company certified under the EU-US Data Privacy Framework, this is based on the European Commission’s adequacy decision (Art. 45 GDPR). Otherwise we use the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can request a copy of the Standard Contractual Clauses from us.

14. Retention periods

We keep personal data only for as long as is necessary for the respective purpose or required by law:

The statutory retention periods begin at the end of the calendar year in which the document was created (§ 147(4) AO, § 257(5) HGB). During this time we restrict processing to storage.

15. Your rights

You have the following rights in relation to your personal data:

An informal message to info@tastebase.de is sufficient to exercise them. So that your data does not reach unauthorised persons, we may ask you to verify your identity.

Your right to object under Art. 21 GDPR

Where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing – for example to present our products to your business – you may object to this at any time without giving reasons. We will then no longer use your data for this purpose.

No particular form is required, the easiest way is an e-mail to info@tastebase.de.

16. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany, www.datenschutz-berlin.de.

17. Currency of this policy

This privacy policy is current as of October 2026. We update it when our website, the order portal, our service providers or the legal requirements change. The version published here applies.

← Back to home