Privacy Policy
Last updated: October 2026
Thank you for your interest in Munich Culinary. This Privacy Policy explains how we process personal data when you visit our website or submit an enquiry and describes your rights.
1. Controller
München kulinarisch GmbHViktor-Scheffel-Straße 580803 Munich, GermanyManaging Director: Alexander SchmittEmail: alexander@muenchen-kulinarisch.deWebsite: https://munich-culinary.com
2. Legal Bases
Depending on the purpose, processing is based on Article 6(1)(b) GDPR (pre-contractual enquiries and contracts), Article 6(1)(c) (legal obligations), Article 6(1)(f) (legitimate interests, including website security and business communications), or Article 6(1)(a) (consent). Special categories of personal data are subject to Article 9 GDPR.
3. Hosting and Technical Access Data
Our website uses Lovable Cloud. Its project database and server infrastructure use a Lovable-managed Supabase environment in the AWS eu-west-1 region (Ireland). Cloudflare delivers and protects the website. Technical data may include IP address, access time, requested pages, browser and device information, and security and error data. Processing serves reliable website delivery and security under Article 6(1)(f) GDPR. Providers may use subprocessors. Any transfers outside the EEA require an applicable legal transfer mechanism and safeguards.
4. Essential Cookies and Browser Storage
Cloudflare uses the __cf_bm cookie for bot protection, with an approximate 30-minute duration. Our hosting environment additionally sets a technical cookie named __dpl with a lifetime of approximately 24 hours; it is set by the hosting platform, and we have requested confirmation of its precise purpose from the provider. Multi-step enquiry forms may temporarily retain draft information in the browser while the relevant tab is open. Strictly necessary device access or storage may be exempt from consent under Section 25(2) TDDDG.
5. Website Analytics
We use Lovable's integrated visitor analytics to measure visits, page views, traffic sources, approximate countries, browser and device types, and interest in our services. This helps us improve our website and assess marketing performance. The analytics are provided by Lovable as part of the website hosting. We do not currently request consent for these analytics. Processing is based on our legitimate interest in understanding and improving the use of our website under Article 6(1)(f) GDPR. You may object to this processing at any time on grounds relating to your particular situation (Article 21 GDPR).
6. Private Experience Enquiries
We process names, email addresses, optional phone details, selected experience, guest numbers, preferred dates and voluntarily provided preferences or messages to respond, prepare proposals and potentially arrange bookings. The legal basis is Article 6(1)(b) GDPR. An enquiry is not a confirmed booking.
7. Corporate Experience Enquiries
We additionally process company and contact-person details, occasion, group size, preferred dates and customisation requests for business communications and proposals. Depending on the relationship, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR, reflecting our legitimate interest in business relationships.
8. Mobility and Chauffeur Enquiries
We process contact details, requested route, pickup and destination, date and time, passenger numbers, optional flight information, luggage requirements and voluntary additional instructions to review, plan and respond to enquiries and potentially provide agreed services. The legal basis is Article 6(1)(b) GDPR.
9. Health-Related Information
Allergies, medically required dietary requirements and health-related accessibility or mobility needs may reveal health information protected under Article 9 GDPR. Our Experience and Mobility enquiry forms therefore provide a separate, optional field for such information, which only appears once you choose to share it. It can only be submitted together with a separate checkbox through which you give your explicit consent (Article 9(2)(a) GDPR). We process this information solely to plan and carry out your requested experience or journey safely. Providing it is voluntary; your enquiry can be submitted without it. The information is stored with your enquiry together with the time of consent and is included in the internal notification email we receive about your enquiry. It is not repeated in the confirmation email sent to you; for Mobility enquiries, that email only notes that such requirements were shared. We delete this information once it is no longer needed for your enquiry or the service: normally after the experience or journey has taken place, or once an enquiry is cancelled or closed without a booking, unless a specific legal retention requirement applies. We do not retain specific allergies, diagnoses or medical conditions for future bookings. You can withdraw your consent at any time with effect for the future, for example by emailing alexander@muenchen-kulinarisch.de; we will then delete this information. Withdrawal does not affect the lawfulness of processing before withdrawal.
10. Enquiry Storage and Email
Form enquiries are saved in an access-restricted database within Lovable Cloud. We use Resend, a US-based provider, for acknowledgement and internal notification emails. Data required for delivery is processed by Resend; internal emails can include free-text form submissions and potentially sensitive details. The legal basis is Article 6(1)(b) or, for certain business communications, Article 6(1)(f) GDPR.
11. Retention
We retain personal data only as long as necessary or required by law. Enquiries that do not lead to a booking are deleted no later than 24 months after the enquiry is closed or the last relevant contact, unless further retention has a specific lawful basis. Deletion is carried out through a regular internal review process that we initiate ourselves; it is not performed automatically. Health-related information is handled separately from ordinary enquiry and business records: it is deleted promptly once its purpose has ended, as described in Section 9, while the remaining enquiry or booking record is retained as set out above. These deletions are also carried out through our internal review process and are not performed automatically. Bookings and business records may be subject to statutory retention.
12. Marketing
An enquiry does not automatically subscribe you to promotional emails. Marketing communications are sent only with valid consent or another legally permitted basis. Consent can be withdrawn at any time with effect for the future.
13. Recipients
Data is shared only with providers and partners where necessary and lawful for hosting, security, database operation, email communications, enquiry handling or delivery of agreed services. Only necessary information is shared with service partners.
14. Your Rights
Subject to applicable requirements, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), portability (Article 20), objection (Article 21), and withdrawal of consent (Article 7(3)). Contact alexander@muenchen-kulinarisch.de.
15. Complaints
You may lodge a complaint with a data protection authority. The supervisory authority generally responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA): https://www.lda.bayern.de
16. Updates
We may update this Privacy Policy when services, technology or legal requirements change. The published version applies.