Privacy Policy for the NeoTaste GmbH website

We take the protection of your personal data seriously. This information applies to the processing of your personal data when you visit and use our website. It does not automatically apply to the NeoTaste app or other services, insofar as separate privacy notices are provided for these.

1. Data Controller

The data controller within the meaning of the EU General Data Protection Regulation (‘GDPR’) is:

NeoTaste GmbH
Schönhauser Allee 180
10119 Berlin
Germany

Telephone number: 01575/1903854
Email: support@neotaste.app

2. Data Protection Officer

You can contact our Data Protection Officer at datenschutz@neotaste.app or at the postal address given above, adding ‘The Data Protection Officer’ to the address.

3. Data processing on our website

In connection with your visit to our website, the personal data described below is processed.

3.1 Web hosting and server log files

When you visit our website, we process personal data to ensure the smooth, functional and secure operation of the website. In particular, the following data may be processed in server log files:

  • IP address of the device accessing the website

  • Operating system, browser type, browser version and language setting

  • Date and time of access

  • URL accessed and amount of data transferred

  • URL of the previously visited website (referrer URL)

  • Internet service provider of the accessing system

  • Status messages and technical error data

Our website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. As part of the hosting service, Vercel processes the data technically necessary for the delivery and operation of the website. This processing is technically necessary to provide you with our website and to ensure its stability, security and performance. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, stable and user-friendly operation of our website.

We have entered into a data processing agreement with Vercel. Where personal data is transferred to third countries, in particular to the USA, this is done on the basis of the EU Standard Contractual Clauses and, where applicable, the European Commission’s Adequacy Decision under the EU-US Data Privacy Framework.

The log data generated in the course of hosting is deleted or anonymised as soon as it is no longer required for the purposes stated. Longer storage only takes place insofar as this is necessary to investigate security incidents, to defend against attacks or due to statutory retention obligations.

3.2 Contacting us

If you contact us by email, via a contact form or by other means, we will process the data you provide. This may include, in particular, your name, your email address, your telephone number, details of your enquiry and the content of your message.

If your enquiry serves to initiate or fulfil a contract, the legal basis is Article 6(1), first sentence, point (b) of the GDPR. In other cases, we process your data on the basis of our legitimate interest in handling and responding to your enquiry in accordance with Article 6(1), first sentence, point (f) of the GDPR. Where you provide information voluntarily or expressly consent to further processing, the legal basis is Article 6(1), first sentence, point (a) of the GDPR.

Your personal data will be deleted, subject to statutory retention periods, as soon as your enquiry has been fully processed and no further communication with you is required or requested by you. Where the communication is relevant to a contractual relationship, retention periods under commercial and tax law may apply.

4. Service providers and additional functions

4.1 Cookies and similar technologies

When you use our website, cookies, local storage entries, pixels, tags and similar technologies may be stored on or read from your device. Cookies are small pieces of text information assigned to your browser or device. In particular, they may be used to provide the website from a technical perspective, to store consent decisions, to measure reach, to detect errors or to display interest-based advertising.

We use technologies that are technically essential on the basis of Section 25(2)(2) of the TDDDG. Where personal data is processed in this context, the legal basis is Article 6(1), first sentence, point (f) of the GDPR; our legitimate interest lies in the technically sound and secure provision of the functions you have expressly requested.

We only use technologies that are not technically necessary, and the associated processing of personal data, with your consent in accordance with Section 25(1) of the TDDDG and Article 6(1), first sentence, point (a) of the GDPR. You may withdraw or amend your consent at any time with future effect via the data protection or cookie settings available on the website. Withdrawal does not affect the lawfulness of processing carried out up to that point. Further details on the technologies used, their providers, purposes and retention periods can also be found in our Consent Manager.

4.2 Consent management with iubenda

We use the Consent Manager provided by iubenda s.r.l., Via San Raffaele 1, 20121 Milan, Italy (‘iubenda’). This service enables us to query, store, document and take into account your preferences regarding services that are not technically necessary during subsequent visits.

In particular, your decisions to consent or refuse, the time and version of the consent request, a technical identifier, browser and device information, and your IP address may be processed. The storage of a technical consent identifier on your device is necessary so that your selection does not have to be requested again every time you visit the page.

The legal bases are Article 6(1), first sentence, point (c) of the GDPR for the fulfilment of our data protection obligations regarding documentation and accountability, as well as Article 6(1), first sentence, point (f) of the GDPR and Section 25(2)(2) of the TDDDG for the technically necessary provision of consent management. Our legitimate interest lies in the legally compliant, user-friendly and verifiable management of your choices. The data will be stored for as long as is necessary to take account of and provide evidence of your selection, as well as to defend against any potential legal claims. You can change your selection at any time via the privacy or cookie settings.

4.3 Google Maps

On certain pages, we may embed maps from the Google Maps service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (‘Google’). The map is initially displayed as a deactivated placeholder. As long as you do not activate the map, no connection to Google Maps is established and no data is transmitted to Google via this embedding.

The map is only loaded once you have explicitly activated it. In doing so, your IP address, browser and device information, the page you have accessed, the date and time of access, and – provided you have enabled this on your device – location data may be transmitted to Google. Google may link this data with other information, particularly if you are logged into a Google account.

The storage of information on your device, or access to it, and the subsequent processing of personal data are carried out on the basis of your consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) and Article 6(1)(a) of the General Data Protection Regulation (GDPR). Consent is voluntary and may be withdrawn at any time with future effect via the privacy or cookie settings. Without consent, you may generally continue to use the rest of the website’s content; only the interactive map will then be unavailable.

4.4 moinAI chat widget

We integrate a chat widget provided by knowhere GmbH, Karolinenstraße 9, 20357 Hamburg, Germany (‘moinAI’) to offer you an automated contact and support option. The widget is initially displayed as a deactivated placeholder or button. No chat session is initiated before you activate it, and no content is transmitted to moinAI via the widget.

Once you have activated it, technical device and browser information, a session or recognition ID, and the content you enter into the chat may be processed. Your messages may contain personal data, such as your name, email address, customer number or other details relating to your enquiry. Please do not submit any special categories of personal data via the chat unless this is expressly required and intended. According to the provider, IP addresses are not stored permanently; however, the technical transmission of the IP address is unavoidable for the connection to the server.

The activation and technical integration of the widget are based on your consent in accordance with Section 25(1) of the German Telemedia Act (TDDDG) and Article 6(1)(a) of the General Data Protection Regulation (GDPR). Where you make a contract-related enquiry via the chat, we also process the content you enter in accordance with Article 6(1)(b) of the GDPR. We have entered into a data processing agreement with moinAI. The retention period for chat histories is determined by the deletion period we have set in the moinAI system; thereafter, the content is deleted or anonymised, provided that no statutory retention obligations or the need for further processing of your enquiry preclude this.

4.5 Google Analytics

Subject to your consent, our website uses Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics is used to analyse the use of our website, measure reach, generate reports on website activity and optimise our offering in terms of both technology and content.

In particular, the following data may be processed: a pseudonymous user or client ID, session information, pages visited, interactions and events, referrer URL, approximate location information, browser, device and operating system information, as well as the times and duration of use. Google Analytics regularly uses first-party cookies such as ‘_ga’ and ‘ga<container ID>’ for this purpose. According to Google, IP addresses are not logged or stored by Google Analytics 4; however, they are processed technically for the purposes of transmission and approximate location determination.

The legal basis is your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect via the privacy or cookie settings. The retention period configured for our Google Analytics property for user and event data is shown in the Consent Manager; certain aggregated reports may not be affected by this period. Google is used in accordance with the agreed data protection terms and conditions.

A transfer to Google LLC and other Google companies in the USA cannot be ruled out. Where a transfer to a third country takes place, Google bases this in particular on the adequacy decision relating to the EU-US Data Privacy Framework, provided the respective recipient is certified, and, in addition, on the EU Standard Contractual Clauses.

4.6 Google Tag Manager

We use Google Tag Manager provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Tag Manager is used to technically manage and control the triggering of other services and tags on our website. The Tag Manager itself does not, as a rule, create independent user profiles; however, when the service is accessed, technical connection data – in particular the IP address as well as browser and device information – may be transferred to Google. The services loaded via the Tag Manager may, in turn, use cookies or similar technologies and process personal data.

As we only use Google Tag Manager in accordance with your instructions once consent has been given, the legal basis is Section 25(1) of the TDDDG in conjunction with Article 6(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time with future effect via the data protection or cookie settings. The safeguards set out in section 4.5 apply to any transfers to third countries.

4.7 Google Ads Remarketing and Conversion Tracking

Subject to your consent, we use Google Ads features, in particular remarketing and conversion tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. These services help us to measure the effectiveness of our adverts, attribute visits following an advert interaction, and display more relevant adverts to users based on their website interactions.

If you access our website via a Google advert or interact with content marked accordingly, cookies or similar identifiers may be stored. In particular, the following may be processed: ad and click identifiers such as the Google Click ID, cookie or device identifiers, pages visited, interactions, time of access, referrer information, browser and device information, and conversion events defined by us. We generally receive statistical analyses from Google and no information that directly identifies individuals by name. However, Google may link the data to a Google account or other data, provided the conditions for doing so are met.

The legal basis is your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect via the data protection or cookie settings. Depending on the specific configuration, conversion identifiers are typically stored for a limited period, often up to 90 days; the storage periods shown in the Consent Manager are decisive. The safeguards set out in section 4.5 apply to any transfers to third countries.

4.8 Meta Pixel, conversion tracking and lookalike audiences

Subject to your consent, we use the Meta Pixel and other Meta Business Tools provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (‘Meta’). This enables us to measure the effectiveness of adverts on Facebook and Instagram, track so-called conversions, create target audiences for advertising campaigns and have similar target audiences (‘Lookalike Audiences’) generated based on existing target audiences.

In particular, your IP address, browser and device information, cookie and device identifiers, the page visited, referrer information, timestamps, interactions, and event data defined by us – such as page views, registrations or other conversion actions – may be transmitted to Meta. Meta may associate this information with your Facebook or Instagram account and process it for its own purposes, in particular for the personalisation and measurement of advertising. We generally only receive aggregated or statistical reports from Meta.

With regard to the collection and transmission of so-called event data via the Meta Business Tools, NeoTaste and Meta may be joint controllers within the meaning of Article 26 of the GDPR, in accordance with Meta’s terms and conditions. In particular, Meta is responsible for fulfilling data subjects’ rights in relation to the data stored by Meta; however, you may also exercise your rights against us. The subsequent processing by Meta is carried out under Meta’s own responsibility.

The legal basis is your consent in accordance with Section 25(1) of the TDDDG and Article 6(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time with future effect via the data protection or cookie settings. A transfer to Meta Platforms, Inc. in the USA cannot be ruled out. Meta bases such transfers in particular on the adequacy decision relating to the EU-US Data Privacy Framework, provided the recipient is certified, and, in addition, on EU Standard Contractual Clauses.

4.9 HubSpot Tracking, Analytics and Ads

Subject to your consent, we use HubSpot’s tracking, analytics and advertising functions. The provider is HubSpot Ireland Limited, HubSpot House, One Sir John Rogerson’s Quay, Dublin 2, Ireland; technical services may also be provided by HubSpot, Inc. and other affiliated companies.

HubSpot may use cookies and similar technologies to analyse the use of our website, track visits and interactions, evaluate marketing campaigns and optimise advertising activities. In particular, the following data may be processed: IP address, cookie or visitor ID, browser and device information, pages accessed, time and duration of access, referrer URL, clicks, form or campaign interactions, and advertising and conversion information. Provided you have already supplied us with your contact details and the necessary conditions are met, usage data may be linked to an existing data record in our HubSpot system.

The legal basis for storing or retrieving non-essential information on your device and the subsequent processing is your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect via the privacy or cookie settings. We have entered into a data processing agreement with HubSpot.

Processing in the USA cannot be ruled out. According to its own statements, HubSpot, Inc. participates in the EU-US Data Privacy Framework. In addition, the data processing agreement contains EU Standard Contractual Clauses for relevant transfers to third countries. The retention period depends on the respective function, the cookie configuration and the retention periods specified in our consent manager; data is deleted or anonymised as soon as it is no longer required for the stated purposes and there are no legal obligations to the contrary.

4.10 Sentry Error Logging

Subject to your consent, we use Sentry, a service for error analysis and technical monitoring of the website. The provider is Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA (‘Sentry’). Sentry helps us to detect, trace and resolve technical errors, crashes and performance issues.

In the event of an error, the following data may be processed in particular: error messages and stack traces, the time of the error, the URL or affected function, browser, device and operating system information, technical identifiers and the IP address. Depending on the specific error situation, further technical context data may be included. We configure Sentry in accordance with the principle of data minimisation and avoid the transmission of content, contact or account data as far as possible.

The legal basis, in accordance with your instructions, is your consent pursuant to Section 25(1) of the TDDDG and Article 6(1), first sentence, point (a) of the GDPR. You may withdraw your consent at any time with future effect via the privacy or cookie settings. We have entered into a data processing agreement with Sentry. According to the provider, error events are generally stored for 30 days, unless further storage is required to resolve an active error. In this case, the data will be deleted once the error has been successfully resolved.

Processing in the USA cannot be ruled out. According to Sentry, transfers to third countries are based on the EU-US Data Privacy Framework and, in addition, on EU Standard Contractual Clauses.

5. Recipients and transfers to third countries

In addition to the providers mentioned in this privacy policy, recipients of personal data may include, in particular, hosting, IT, security, communications, analytics and marketing service providers. Where service providers process personal data exclusively on our behalf, we enter into a data processing agreement with them in accordance with Article 28 of the GDPR. In other cases, providers may be controllers either independently or jointly with us; this is explained in the context of the respective processing activity.

In the case of certain services, personal data may be transferred to countries outside the European Union and the European Economic Area, in particular to the USA. Such transfers will only take place if the conditions set out in Articles 44 et seq. of the GDPR are met. These may include an adequacy decision by the European Commission, in particular for certified US companies under the EU-US Data Privacy Framework, or EU standard contractual clauses, including supplementary safeguards.

6. Your rights

You have the right to request confirmation as to whether we are processing personal data relating to you. If this is the case, you have the right, in accordance with Article 15 of the GDPR, to access this data and the information provided for by law. Furthermore, subject to the relevant legal requirements, you are entitled in particular to the following rights:

  • The right to have inaccurate data rectified or incomplete data completed (Article 16 of the GDPR)

  • Right to erasure of personal data (Article 17 of the GDPR)

  • Right to restriction of processing (Art. 18 GDPR)

  • Right to data portability (Art. 20 GDPR)

  • Right to object to processing based on Article 6(1)(e) or (f) of the GDPR (Article 21 of the GDPR)

  • Right to withdraw consent at any time with effect for the future (Article 7(3) of the GDPR)

If we process your personal data for the purposes of direct marketing, you may object to such processing at any time without giving reasons. This also applies to any associated profiling. Following your objection, we will no longer process your personal data for these purposes.

To exercise your rights, please contact us at the address given in section 1 or at datenschutz@neotaste.app. Where the processing is based on consent, the lawfulness of the processing carried out prior to withdrawal remains unaffected.

You also have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection regulations (Article 77 of the GDPR). In particular, you may contact the supervisory authority for your usual place of residence, your place of work or the place where the alleged infringement occurred.

7. Updates and amendments to the privacy policy

We reserve the right to amend this Privacy Policy should our website, the services we use or the legal requirements change. The version currently published on our website shall apply.

Current version: 22 July 2026