Privacy policy

PRIVACY POLICY

Data Protection

Welcome to the Prepmymeal website. As the controller within the meaning of the General Data Protection Regulation (GDPR), we are obliged to comply with the statutory data protection provisions. The protection of your personal data, together with fair and transparent data processing, is naturally of great importance to us. Below we provide all the information you need to review and exercise your data protection rights.

1. Who is responsible for the processing of data?

The controller is:

Prepmymeal GmbH

Unterlindau 28

60323 Frankfurt

info@prepmymeal.de

2. How can I contact the Data Protection Officer?

You can reach our Data Protection Officer at:

Prepmymeal GmbH

Unterlindau 28

60323 Frankfurt

info@prepmymeal.de

3. For what purposes and on what legal basis do we process personal data?

If you are a Prepmymeal customer, open a customer account with us, take part in prize draws or bonus promotions, or otherwise get in touch with us, we receive personal data from you.

In general, we process data on the basis of the following legal grounds:

pursuant to Art. 6(1)(a) GDPR, where you have given us your express consent to the processing of data, e.g. where we may contact you by telephone for advertising purposes or for customer-satisfaction enquiries;

pursuant to Art. 6(1)(b) GDPR, where processing is necessary for the performance of our contractual obligations, e.g. where we use your email address to confirm the delivery date for your next meal box;

pursuant to Art. 6(1)(c) GDPR, where processing is necessary for compliance with a legal obligation, e.g. where we verify your age and identity prior to conclusion of a contract;

pursuant to Art. 6(1)(f) GDPR, where we process your data on the basis of a legitimate interest of ours or of a third party, e.g. where we use your email address to send you our newsletter, or for the advertising-optimised design of our website.

3.1 Data processing on our website

Our website uses the shop provider Shopify (www.shopify.com). Its privacy policy is available at: https://www.shopify.com/legal/privacy

3.1.1 Delivery of your meals / customer account

We are pleased to be able to supply you with our healthy dishes going forward. When you place an order, you may open a customer account with us. In order to deliver your meal boxes as requested, we store your contact details, your order and delivery time, and your payment information. You may voluntarily provide your telephone number so that we can contact you should delays or problems arise in the delivery of your meals. We may also use your telephone number, on the basis of the consent given by you at the conclusion of the contract, for advertising purposes among other things (please see § 10(1) of our Terms and Conditions for the precise scope of your consent). You may withdraw your consent at any time in accordance with § 10(3) of our Terms and Conditions.

Orders placed by companies (B2B)

Where a company places an order with Prepmymeal (e.g. via our B2B shop), we process the personal data of the contact persons acting on behalf of the company (e.g. name, business email address, telephone number, position) as well as the company's corporate data (company name, billing address, VAT identification number).

This processing is carried out for the performance of the contract concluded with the company pursuant to Art. 6(1)(b) GDPR and, to the extent it goes beyond mere contract performance (e.g. billing, communication in connection with the business relationship), on the basis of our legitimate interest in managing the business relationship pursuant to Art. 6(1)(f) GDPR. To verify eligibility to purchase our B2B offerings, we further process the VAT identification number provided. This is carried out in fulfilment of tax-law obligations pursuant to Art. 6(1)(c) GDPR.

3.1.2 Payment for Prepmymeal meals

Depending on the payment method you select, your payment data is transmitted to the relevant payment service provider. Responsibility for your payment data lies with the payment service provider. Information on the controller responsible for each payment service provider, the contact details of their data protection officers, and the categories of personal data processed by the payment service providers can be found at the following addresses:

PayPal (Europe) S.à.r.l. et Cie., Luxembourg, privacy policy: paypal.com/de/webapps/mpp/ua/privacy-full

Stripe, Inc., USA, privacy policy: https://stripe.com/de/privacy

3.1.3 Contacting Prepmymeal

You may submit questions to us and send us messages via the contact form, our email address, our telephone number, or our chat. We process your data in this context solely in order to communicate with you via your chosen channel and to respond to your enquiry.

3.1.4 Participation in prize draws

If you take part in one of our prize draws, we collect the data necessary to conduct the prize draw. This is generally an individual entry (e.g. a comment or a photograph) together with your name and contact details. We may transfer this data to our prize-draw partners, e.g. in order to deliver your prize to you. Data processing and disclosure may vary depending on the prize draw and is therefore specifically described in the respective terms of participation. Participation in the prize draw, and the associated collection of data, is of course voluntary.

3.1.5 Sending our newsletter

Prepmymeal offers you various ways to subscribe to our newsletter, e.g. upon registration or via our homepage.

Promotional information will only be sent to your email address as part of our newsletter if you are an existing customer or have consented to the use of your email address for this purpose. Naturally, in either case you may withdraw your consent to receiving newsletters at any time, e.g. by clicking the unsubscribe link in the newsletter, updating your communication settings in your customer account, or by notifying us at info@prepmymeal.de.

For the dispatch of our newsletter we use the provider Klaviyo (www.klaviyo.com). Its privacy policy is available at: https://www.klaviyo.com/privacy/dpa

3.1.6 Other advertising by Prepmymeal

Prepmymeal uses the email address and postal address provided by the purchaser to inform them by email and by post about our own similar products and services. Should you no longer wish to receive promotional information by email or post, you may object to the promotional use of your contact details at any time with effect for the future, at no cost other than the transmission costs at basic rates.

In addition, you may receive promotional information by telephone where you have given us your express consent to this effect as part of registration (see § 10(1) of our Terms and Conditions). This consent may likewise be withdrawn by you at any time.

You may submit your objection and/or withdrawal by the following means: by telephone (06926940965), in writing (Prepmymeal GmbH, Unterlindau 28, 60323 Frankfurt am Main), or via our contact form at www.prepmymeal.de/kontakt/. In addition, where you hold a customer account, you may at any time change your communication preferences in the customer account area with regard to receipt of the newsletter.

3.1.7 Employee portal for meal orders

Corporate customers may set up access for their employees to a dedicated employee portal through which employees can confirm the withdrawal of meals from the freezer with a single click. In this connection, we process the personal data of the respective employees, in particular name, email address, and the login credentials (login link/code) transmitted by email as part of passwordless authentication. Delivery is made exclusively to the company address specified by the employer, not to private delivery addresses. Individual dietary preferences are not stored or filtered.

For the purposes of billing and budget control of the meal budget provided by the company, we generate consumption reports per employee for the respective company. These contain the employee's name, email address, and a day-by-day breakdown of withdrawals (date, category of meal obtained, e.g. "bowl dish" or "XL bag").

The processing and transmission of this data to the respective company is carried out for the performance of our contract with the company (billing of the meal budget) pursuant to Art. 6(1)(b) GDPR, and, insofar as it goes beyond that, on the basis of our legitimate interest in verifiable performance billing pursuant to Art. 6(1)(f) GDPR. Any further processing of this data by the company itself, in particular in the context of the employment relationship, is the responsibility of the company as an independent controller; Prepmymeal and the respective company are, in this respect, each independent controllers for their own respective processing steps, and not joint controllers within the meaning of Art. 26 GDPR.

We store the data arising in connection with the employee portal for as long as the respective user account in the employee portal exists, or until the end of the cooperation with the respective company, subject to statutory retention obligations.

3.2 Is my usage data processed for website-optimisation purposes and for usage-based online advertising?

Prepmymeal uses cookies, which, in compliance with statutory requirements, are used to create pseudonymous usage profiles, and also to make the use of our website as optimal as possible. We may evaluate these usage profiles in order to understand the use of our website, to determine target groups for our products, and thereby to optimise our offerings. Where we create pseudonymous usage profiles, we do not directly link this data to you and are therefore unable to attribute specific activities to you.

Cookies are small text files that are stored on your computer when you visit our website and that allow your browser to be recognised again. Cookies store information such as your language setting, the duration of your visit to our website, or entries you have made there. This avoids the need to re-enter all necessary data on each use. In addition, cookies enable us to recognise your preferences and to tailor our website to your areas of interest.

Most browsers accept cookies automatically. If you wish to prevent the storage of cookies, you can select "do not accept cookies" in your browser settings. Please refer to your browser manufacturer's instructions for details on how to do this. You may delete cookies already stored on your computer at any time. Please note, however, that our website may be usable only to a limited extent without cookies. Alternatively, you can prevent the collection and transmission of your data (in particular your IP address), as well as its processing, by disabling the execution of JavaScript in your browser or by installing a tool such as "NoScript".

In addition, you can disable the use of cookies by third-party providers by accessing the opt-out tool of the Network Advertising Initiative. We and the providers will, however, continue to receive statistical information as to how many users visited our website and when.

We would like to explain certain individual services in more detail below:

3.2.1 Google Analytics

Our website uses Google Analytics, a service provided by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland ("Google"). Google Analytics enables us to evaluate your use of the website in order to compile analyses of website activity and to make use of further services connected with website and internet use.

Please note that on this website, Google Analytics has been extended by the code "gat.anonymizeIp();" to ensure anonymised collection of IP addresses (so-called IP masking). Your IP address is shortened by Google beforehand within Member States of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and shortened there. The IP address transmitted by your browser as part of Google Analytics is not merged with other Google data. Further information on terms of use and data protection is available at https://www.google.com/analytics/terms/de.html and at https://www.google.de/intl/de/policies/.

In addition to the options already mentioned above, you can prevent the collection of data by Google by downloading and installing the browser add-on. Clicking the following link will also set an opt-out cookie that prevents future collection of your data when visiting this website: Disable Google Analytics.

In connection with Google Analytics, we additionally use the Google Conversion Tracking service. This enables us to record the behaviour of our website visitors. For example, it shows us how often the contact form was completed. It likewise shows us how many clicks on advertisements from external sources (AdWords, LinkedIn, Xing, Bing) led to our website.

3.2.2 Facebook Custom Audience Pixel

This website uses Custom Audience Pixel, a service of Facebook Inc., USA. Custom Audience Pixel is a JavaScript code that we have integrated on each of our web pages. We use Custom Audience Pixel to collect information regarding how visitors use our website. This pixel collects and reports to Facebook information about the user's browser session, a hashed version of the Facebook ID, and the URL being viewed. Every Facebook user has a unique, device-independent Facebook ID that allows us to address and recognise users across multiple devices on the Facebook social network, so that we can re-target our visitors for advertising purposes through Facebook ads. User information is deleted after 180 days, until the user visits our website again. Accordingly, no personal information about individual website visitors is disclosed to Prepmymeal, and website customer audiences can only be specifically targeted with advertisements by us once they have reached a meaningful size.

For further information about Facebook and its privacy settings, please refer to the privacy notices and terms of use of Facebook Inc.

4. Is my data disclosed to third parties?

In order for Prepmymeal to be able to process your data in accordance with the purposes described above, it may be necessary for other recipients to view and process your data.

4.1 External service providers (processors)

Your data is disclosed to service partners insofar as they act on our behalf and support Prepmymeal in the provision of its services. For example, we have engaged a service partner to dispatch our newsletter.

Processing of your personal data by engaged service providers is carried out within the framework of processing pursuant to Art. 28 GDPR.

4.2 Other service providers, partners and third parties

Prepmymeal may work together with further partners where this is necessary for the performance of our service offerings or where we are legally obliged to disclose data. This may, by way of example, include the following partners or third parties:

Transport companies (for orders)

Partner companies in the field of meal production

Partner companies in the field of customer verification

Partner companies in the field of data storage and processing, and of sending emails and other (electronic) messages

Partner companies offering certain IT services, such as customer-management and customer-feedback solutions

Partner companies for the dispatch of newsletters

Partner companies in the field of marketing

Partner companies for the conduct of prize draws

Credit institutions and payment service providers

Partner companies in the field of receivables management

Social networks

Disclosure to public authorities or pursuant to judicial order

5. Is my data processed outside the EU/EEA, and how is data protection ensured?

We attach importance to processing your data within the EU/EEA. It may nonetheless occur that we engage service providers who process data outside the EU/EEA. In such cases, we ensure that an adequate level of data protection is established prior to the transfer of your personal data. This means that a level of data protection comparable to the standards within the EU is achieved through EU standard contractual clauses or an adequacy decision such as the EU–U.S. Privacy Shield.

6. How long is my data stored?

We delete the personal data of the data subject as soon as the purpose of storage no longer applies and no statutory retention periods preclude deletion.

At Prepmymeal, we generally delete data as follows:

Applicant data: no later than six months after receipt of the application

Contract data: after termination of the Prepmymeal subscription, insofar as no statutory retention periods, e.g. under the German Commercial Code (Handelsgesetzbuch) or the German Fiscal Code (Abgabenordnung), preclude deletion. These retention periods may, in individual cases, be up to ten years.

7. What rights do I have and how can I exercise them?

Every customer, or any other person affected by data processing, has the right of access pursuant to Art. 15 GDPR, the right to rectification pursuant to Art. 16 GDPR, the right to erasure pursuant to Art. 17 GDPR, the right to restriction of processing pursuant to Art. 18 GDPR, the right to object pursuant to Art. 21 GDPR, and the right to data portability pursuant to Art. 20 GDPR.

The right of access and the right to erasure are subject to the limitations under §§ 34 and 35 BDSG (German Federal Data Protection Act).

In addition, there is a right to lodge a complaint with the competent data protection supervisory authority.

Any consent given to the processing of personal data may be withdrawn by you vis-à-vis us at any time. This also applies to the withdrawal of declarations of consent given to us prior to the applicability of the General Data Protection Regulation, i.e. before 25 May 2018. Please note that withdrawal takes effect only for the future. Processing carried out prior to withdrawal remains unaffected.

You may submit your objection and/or withdrawal by the following means: by telephone (06926940965), in writing (Prepmymeal GmbH, Unterlindau 28, 60323 Frankfurt am Main), or via our contact form at www.prepmymeal.de/kontakt/.

Should you no longer wish to receive our newsletter, you may at any time end your subscription by clicking the unsubscribe link at the end of each newsletter.

Tracify

We use the web analytics service Tracify on our website, or on parts of our website, in order to record how our website is used by its visitors and to evaluate and optimise the effectiveness of our advertising and marketing measures. Tracify is a web analytics service of Tracify GmbH, Munich, Germany. Tracify GmbH acts in this respect as a processor on our behalf on the basis of a data processing agreement pursuant to Art. 28 GDPR.

Tracify enables analysis of website usage and the customer journey without storing cookies or other information on the user's device, but solely on the basis of browser and device information, such as the user's IP address, the configuration of the respective user agent (user agent string), screen resolution, installed fonts and plug-ins, and the processor of the respective device.

The information transmitted to Tracify is fully and irreversibly anonymised immediately upon transmission, such that any link to an individual is excluded. Only anonymised, aggregated information is analysed.

Data processing in connection with the use of Tracify takes place entirely within Germany; no data is transferred to unsafe third countries without an adequate level of data protection.

The legal basis for the use of Tracify is our legitimate interest pursuant to Art. 6(1)(f) GDPR in the needs-based design of the website and in the evaluation and optimisation of our marketing measures.

Google Tag Manager

We use the service known as Google Tag Manager, provided by Google. "Google" is a group of companies comprising Google Ireland Ltd. (the provider of the service), Gordon House, Barrow Street, Dublin 4, Ireland, as well as Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, and other affiliated companies of Google LLC.

We have concluded a data processing agreement with Google. Google Tag Manager is an auxiliary service and itself processes personal data only for technically necessary purposes. Google Tag Manager is responsible for loading other components, which may in turn collect data. Google Tag Manager does not itself access this data.

Further information on Google Tag Manager can be found in Google's privacy policy.

Please note that US authorities, such as intelligence services, may, on the basis of US laws such as the Cloud Act, potentially gain access to personal data that is inevitably exchanged with Google over the internet protocol (TCP) as a result of the use of this service.

Hotjar

We use Hotjar in order to better understand the needs of our users and to optimise the offering and experience on this website. Using Hotjar's technology, we gain a better understanding of our users' experiences (e.g. how much time users spend on which pages, which links they click, what they like and dislike, etc.), which helps us to tailor our offering to our users' feedback. Hotjar uses cookies and other technologies to collect data about the behaviour of our users and their devices, in particular the device's IP address (collected and stored only in anonymised form during your use of the website), screen size, device type (unique device identifiers), information about the browser used, location (country only), and the language preferred for displaying our website. Hotjar stores this information on our behalf in a pseudonymised user profile. Hotjar is contractually prohibited from selling the data collected on our behalf.