Privacy Policy
1. Controller
The controller responsible for data processing on this website is:
Taste Base GmbH
Bruchsaler Straße 10
10715 Berlin, Germany
E-mail: info@tastebase.de
Represented by the management.
2. General
The protection of your personal data matters to us. We process your data exclusively on the basis of the statutory provisions (GDPR, BDSG, TDDDG). In this policy we inform you about the key aspects of data processing in the context of our website.
3. Hosting
Our website is hosted by STRATO AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When you visit our website, STRATO processes various data on our behalf as a processor (see server log files). The legal basis is our legitimate interest in providing our website securely and efficiently (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with STRATO.
4. Server log files
When the website is accessed, the hosting provider automatically records information transmitted by your browser in what are known as server log files: IP address, date and time of access, file requested, volume of data transferred, browser type and version, and the operating system. This data is used for technical provision and security and is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR.
5. Contact form
If you send us an enquiry via the contact form, we process the data you provide (name, e-mail address, telephone number where given, and your message) in order to handle your enquiry.
Storage in Airtable (transfer to the USA)
We use the Airtable service provided by Formagrid Inc., 155 5th Street, San Francisco, CA 94103, USA, to manage enquiries. Your details are transmitted via our server to Airtable and stored there. This may involve a transfer to the USA. The basis for this is the European Commission's standard contractual clauses and participation in the EU-US Data Privacy Framework. Further information: airtable.com/company/privacy.
The legal basis is the initiation or performance of a (pre-)contractual relationship (Art. 6(1)(b) GDPR) and our legitimate interest in handling enquiries efficiently (Art. 6(1)(f) GDPR). We delete the data as soon as your enquiry has been conclusively dealt with and no statutory retention obligations apply.
6. Order portal and customer account
We operate an order portal for business customers at tastebase.de/bestellportal/. Access is set up by us only; there is no self-registration. We process: company name, first and last name of the contact person, e-mail address, telephone number, delivery and billing address, delivery instructions and all order, delivery and invoice data.
The legal basis is performance of the contract or the taking of pre-contractual steps (Art. 6(1)(b) GDPR). Invoices and accounting records are additionally subject to statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB) and are kept for ten years. We delete the access account itself on request at any time; commercial records remain unaffected.
Passwords: you set your password yourself via an invitation or reset link. It is stored only as a cryptographic hash. Neither we nor our service providers can view or recover it.
7. Technical operation of the order portal (Supabase)
The database, user management and file storage of the order portal run on the Supabase platform (Supabase Inc., 970 Toa Payoh North, Singapore). The data is held exclusively in the eu-central-1 region (Frankfurt am Main, Germany). Supabase acts as a processor under a contract pursuant to Art. 28 GDPR. Legal basis: Art. 6(1)(b) and (f) GDPR (performance of the contract and secure, efficient operation).
8. Payment processing (Stripe, SEPA Direct Debit)
Online payments in the order portal are handled by Stripe Payments Europe, Ltd., The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland. If you choose an online payment method, you are directed to a payment page operated by Stripe.
Your bank details never reach us. You enter your IBAN, account holder name and card details directly with Stripe; we only receive a payment reference, the payment method used, the payment status and — for SEPA Direct Debit — a mandate reference. We never see the full bank details.
With SEPA Direct Debit you grant a direct debit mandate during checkout. The invoice amount is then collected from your account within the next few banking days; we notify you of the amount and the collection in advance by e-mail (pre-notification). Stripe appears as the payment service provider on your bank statement.
Legal basis: Art. 6(1)(b) GDPR. Stripe processes payment data partly as an independent controller in order to meet its own legal obligations, in particular anti-money laundering and fraud prevention. Details: stripe.com/privacy.
9. E-mail delivery from the order portal (Resend)
Automated e-mails from the order portal — order confirmations, payment notices, invitation and password links — are sent via Resend (Resend, Inc., 2261 Market Street, San Francisco, CA 94114, USA). We process your e-mail address, salutation and name as well as the content of the message; delivery runs via servers in the EU (eu-west-1 region, Ireland).
A data processing agreement pursuant to Art. 28 GDPR is in place with Resend, including the EU Standard Contractual Clauses for the transfer to the US parent company. Legal basis: Art. 6(1)(b) GDPR.
10. Cookies and web analytics (Google Analytics)
By itself, this website sets no cookies. Fonts and images are embedded directly in the page, so no external content (such as Google Fonts) is loaded. Only your decision on the cookie notice is stored locally in your browser (localStorage, key “tb-consent”) so that we do not have to ask you again on every visit. This is technically necessary and requires no consent.
In addition, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). We use it to understand how our pages are found and used, in order to improve them.
Only with your consent. Google Analytics is loaded only once you have explicitly agreed in the cookie notice. Until you do, no connection to Google is established and no analytics cookies are set. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
Data processed. With your consent, Google sets cookies (including “_ga” and “_ga_XP62W4D9RV”) and processes in particular: pages viewed and time spent, date and time of access, approximate location at country and region level, device type, browser and operating system, the referring page and a pseudonymous user ID. The IP address is truncated before it is stored (IP anonymisation). We do not combine this data with other sources and cannot identify you personally from it.
Transfer to the USA. A transfer of data to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework; in addition, standard contractual clauses pursuant to Art. 46(2)(c) GDPR are in place.
Retention. Google deletes event-level and user-level data after 14 months automatically. The cookies themselves expire after 2 years at the latest.
Withdrawal. You may withdraw your consent at any time with effect for the future via Open cookie settings. You can also prevent collection using Google’s browser add-on: tools.google.com/dlpage/gaoptout. Further information on privacy at Google: policies.google.com/privacy.
11. Your rights
You have the following rights in relation to your personal data:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object to processing (Art. 21 GDPR)
An informal message to info@tastebase.de is sufficient to exercise them.
12. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Berlin Commissioner for Data Protection and Freedom of Information.
13. Currency of this policy
This privacy policy is current as of June 2026. As the website develops or legal requirements change, it may become necessary to update it.