Privacy Policy

The Box Donut Berlin | Intended effective date 1 September 2026 | Draft with details to confirm

1Controller

OJ The Box Donut GmbH, Kastanienallee 36A, 10435 Berlin, Germany. Commercial register: Charlottenburg Local Court, HRB 287068 B. Email for privacy enquiries: julialencse@theboxdonut.de.
Data protection officer: Julia Lencse, email: julialencse@theboxdonut.de.
This notice applies to theboxdonut.de, including its German and English pages. It describes the processing of personal data when you visit the website or submit a catering enquiry through the website form. Processing in our physical shop is outside its scope.

2Website delivery and server logs

When you visit our website, your browser sends technical data needed to deliver the site to our server. This may include your IP address, the date and time, the page or file requested, the referring URL, browser and device details, and response status codes. We use these data to deliver the website, maintain its stability and security, and investigate errors. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is operating a secure and reliable website.
Hetzner hosts our website. Where Hetzner processes personal data on our behalf, this is governed by an agreement under Article 28 GDPR. Namecheap is used for domain management.
Server logs are retained for [INSERT SPECIFIC NUMBER OF DAYS] and then deleted unless a particular security incident requires longer retention. The 365-day period for catering enquiries does not automatically apply to server logs.

3Catering enquiries submitted through the form

If you use our catering form, we process the information you enter: company (if supplied), preferred date, first name, last name, email address, telephone number, and your message about the occasion. This may also include technical submission data and the time of submission. Please do not identify individuals when describing health or dietary requirements in the free-text field; an aggregate count of guests with a particular dietary requirement is sufficient.
We use this information to handle your enquiry, communicate with you and, where relevant, prepare a quotation. The legal basis is Article 6(1)(b) GDPR where we take steps at your request before entering into a contract. For general business correspondence, follow-up and documenting how an enquiry was handled, Article 6(1)(f) GDPR may apply; our legitimate interest is the orderly handling of enquiries. The acknowledgement shown with the form confirms that you have seen this notice; we do not rely on a blanket extra consent to process your enquiry.
Your information is stored in Fluent Forms on our WordPress server and sent to us by email through Google Workspace. It is not added to a CRM, marketing automation or a newsletter. We need the required contact details to respond to your enquiry; otherwise we cannot handle it.
We normally delete catering enquiries from Fluent Forms and our email inbox 365 days after handling is complete, unless a statutory retention duty or a specific legal claim requires longer retention. If a contract is concluded, documents relevant to the contract, accounts or tax may be kept for the periods required by applicable law.

4Email correspondence and Google Workspace

If you contact us by email, or a form enquiry reaches us by email, we process your sender address, message and the metadata needed to deliver it. The purpose and legal basis depend on the correspondence, in particular Article 6(1)(b) or (f) GDPR. We use Google Workspace for business email. For users in the European Economic Area, the provider is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The retention period in section 3 applies to catering enquiries received by email; other correspondence is kept according to its purpose and any applicable statutory duties.
Google services may process data outside the European Economic Area or allow access from there. Where a transfer to a third country takes place, we rely on the applicable safeguards under Chapter V GDPR, such as an adequacy decision for certified recipients or standard contractual clauses. The relevant Google contractual terms must be checked before publication. You may request information about the safeguards applicable to your data using the contact address above.

5Cookies and consent management

Our website uses cookies and similar technologies that are technically necessary, such as WordPress functionality checks, signed-in administrator sessions, administrator settings and storage of your privacy choice (lw_cookie_consent). They support website operation or the recording and observance of your choice. Where information is stored on or read from your device and the technology is strictly necessary, Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) applies. Depending on the purpose, any subsequent processing of personal data is based on Article 6(1)(f) or (c) GDPR.
Non-essential technologies, such as an embedded Google map, are loaded only after your active consent. The legal bases are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can reject non-essential technologies and withdraw consent at any time for the future using the “Cookie Settings” button. Withdrawal does not affect processing carried out before it.
The cookie settings show the names, providers, purposes and storage periods of the technologies used. These details must match the technologies actually deployed. The retention period for the consent record is [INSERT PERIOD].

6Google Maps

We display a map using Google Maps, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map loads only after you consent. Google may then receive your IP address and browser, device and usage information, and may use its own technologies. The purpose is to show our location and help you find us. The legal bases for accessing your device and the associated processing are Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can withdraw consent as described in section 5. See section 4 for possible processing in third countries. Further information: https://policies.google.com/privacy.

7Reviews, media and external links

We display excerpts from selected public Google reviews on our own website. A reviewer’s shortened first name may be shown. Even without a surname, a quotation may in some cases be attributable to an individual. We do this to show prospective visitors genuine experiences of our business. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is presenting our services. You may object to this processing on grounds relating to your particular situation.
Links to Instagram, Google Maps and delivery platforms take you to third-party websites. You visit their services only if you follow the link; their privacy notices then apply. Videos embedded on this website are delivered from our web server.

8Recipients and international transfers

Depending on how you use the website, Hetzner as host, Google Workspace for email and, after consent, Google for Maps may receive personal data. Only responsible members of our team and any maintenance contractors who need access can access the data, subject to appropriate contractual arrangements. Merely visiting our website does not send data to the operators of sites linked through ordinary external links. The information on international transfers in section 4 also applies to the Google services mentioned there.

9Your rights

Subject to the GDPR, you have the rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), and data portability (Article 20). You may object to processing based on legitimate interests for reasons relating to your particular situation (Article 21). You may withdraw consent at any time for the future (Article 7(3)). Please contact julialencse@theboxdonut.de to exercise your rights.
You may also lodge a complaint with a data protection supervisory authority, in particular the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany; email: mailbox@datenschutz-berlin.de; https://www.datenschutz-berlin.de/. We do not make decisions based solely on automated processing within the meaning of Article 22 GDPR or carry out related profiling.