1. Controller

The controller for data processing is:
Majesty Developers
Irenenstr. 66, 40468 Düsseldorf, Germany
Email: contact@habesha-catering-nrw.de

2. General Information on Data Processing

2.1 We process personal data only to the extent necessary to provide a functional platform and our catering services. Processing is based on the GDPR, particularly Art. 6(1) (contract fulfillment, consent, legitimate interest).

2.2 Personal data is treated confidentially and shared only with your consent or to comply with legal obligations.

2.3 The platform is available in German and English; this privacy policy applies to both language versions.

3. Collection and Processing of Personal Data

3.1 **When Visiting the Platform:** When accessing our platform, data is automatically collected (log data): IP address, date/time, browser type, operating system, referrer URL. These are anonymized and used for system security and analysis (Firebase Analytics). Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

3.2 **Registration and Booking:** During registration (via Firebase Authentication, email, or Google Sign-In) or booking, we collect: name, email address, phone number, delivery address in NRW, event details (e.g., date, number of guests), menu selection. These are necessary for contract fulfillment (Art. 6(1)(b) GDPR).

3.3 **Payments:** Payment data (e.g., bank details, Stripe data) are processed for billing and shared with payment providers (Art. 6(1)(b) GDPR).

3.4 **Communication:** Email notifications (e.g., booking confirmations) are sent via Firebase Functions. Customers can subscribe to newsletters (opt-in, Art. 6(1)(a) GDPR).

4. Storage Locations and Third Parties

4.1 Data is stored on Firebase (Google Cloud) servers in the EU to ensure GDPR compliance.

4.2 Third parties:
- **Google Firebase:** For authentication, database (Firestore), image storage (Storage), and notifications (Functions). Google complies with GDPR (DPA agreement).
- **Stripe:** For payment processing, if integrated. Stripe complies with GDPR.
- **Google Maps API:** For delivery addresses and tracking (if used).

4.3 Data is not shared with third parties outside contract fulfillment unless consent or legal obligations exist.

5. Storage Duration

5.1 Personal data is stored only as long as necessary for contract fulfillment or legal retention obligations (e.g., 10 years for invoices per HGB).

5.2 Log data is anonymized after 30 days unless needed for security purposes.

5.3 Customers can request data deletion at any time, subject to legal retention obligations.

6. Data Subject Rights

6.1 You have the following rights under GDPR:
- **Access** to your stored data (Art. 15 GDPR)
- **Rectification** of inaccurate data (Art. 16 GDPR)
- **Erasure** of your data (Art. 17 GDPR)
- **Restriction** of processing (Art. 18 GDPR)
- **Data portability** (Art. 20 GDPR)
- **Objection** to processing (Art. 21 GDPR)

6.2 Requests can be sent to: contact@habesha-catering-nrw.de.

6.3 You have the right to lodge a complaint with a supervisory authority (e.g., NRW Data Protection Commissioner).

7. Cookies and Tracking

7.1 The platform uses only technically necessary cookies (e.g., for dark/light mode, language selection, Firebase Auth). These require no consent (Art. 6(1)(f) GDPR).

7.2 For analytics, we use Firebase Analytics (anonymized data). You can disable tracking via opt-out (platform settings).

7.3 No advertising cookies or third-party tracking without consent.

8. Data Security

8.1 We use TLS encryption for data transfers. Firebase servers are secured with measures (e.g., firewalls).

8.2 Access to admin dashboards is protected via Firebase Authentication (Admin role).

8.3 Regular security checks are conducted to prevent data loss.

9. Changes to the Privacy Policy

9.1 We reserve the right to update this privacy policy due to legal or technical changes. Updates will be published on the platform.

9.2 Users will be informed of significant changes via email.