Privacy Policy

1. Controller

We are not legally required to appoint a data protection officer. For any data protection question, or to exercise your rights, please contact the address above or [email protected].

2. Hosting

This website is hosted on DigitalOcean's App Platform (DigitalOcean LLC, New York, USA) in a data centre in Frankfurt am Main, Germany. DigitalOcean processes the data arising when the site is accessed on our behalf (Art. 28 GDPR). The legal basis is our legitimate interest in secure, efficient delivery (Art. 6(1)(f) GDPR). Any transfer to the USA is based on the EU Standard Contractual Clauses.

3. Server log files

When the site is accessed, information transmitted by your browser is processed automatically: IP address, date and time, the page requested, the referrer URL, and browser/operating-system details. This serves technical delivery and security (Art. 6(1)(f) GDPR).

4. Content delivery network (Cloudflare)

For secure, fast delivery we use the CDN of Cloudflare, Inc. (San Francisco, USA). Your IP address is processed to deliver content and defend against attacks such as DDoS (Art. 6(1)(f) GDPR). Any transfer to the USA is based on the EU Standard Contractual Clauses.

5. Partner enquiries (restaurant contact form)

When you submit the contact form for restaurants, we process the details you enter there: business name, contact person, email address, phone number, town and your message. We use this information solely to handle your enquiry and to talk to you about a possible partnership.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give on submitting the form, together with the performance of pre-contractual steps taken at your request (Art. 6(1)(b) GDPR). You may withdraw your consent at any time with effect for the future — an informal email to [email protected] is enough.

Your enquiry is sent to our sales mailbox by email. We also record it in our CRM so that it does not get lost: this creates a contact, an associated deal and a note holding the content of your message. For both we use Brevo (Sendinblue GmbH, Cologne) as a processor (processing on our behalf, Art. 28 GDPR).

We keep partner enquiries for as long as they are needed to handle the request and for a possible collaboration. If no collaboration comes about, we delete the enquiry after two years at the latest, unless statutory retention obligations require otherwise.

6. The Lieferking apps

We offer two mobile apps: Lieferking (for customers placing orders) and Lieferking Partner (for restaurants managing orders). Data arising in the apps is processed via our backend, operated on DigitalOcean LLC infrastructure in a data centre in Frankfurt am Main, Germany (processing on our behalf, Art. 28 GDPR). Sign-in and authentication are handled by our identity service (FusionAuth), which we operate on our own infrastructure. The following sections apply to both apps unless a specific app is named.

7. Account and contract data

To register and use the apps we process your name, email address, phone number and – in the customer app – your delivery address(es) and order history. We need this data to maintain your account, broker and process orders, and communicate with you. The legal basis is performance of the user/order contract (Art. 6(1)(b) GDPR).

8. Location data (customer app only)

If you allow it, the customer app processes your precise device location to determine your delivery address and show nearby restaurants. Sharing is optional – you can also enter your address manually and revoke the location permission at any time in your device settings. The legal basis is your consent (Art. 6(1)(a) GDPR).

9. Payment processing (customer app only)

For online payments we use the payment provider Stripe (Stripe Payments Europe, Ltd., Ireland). Your payment data (e.g. card details) is sent directly to Stripe and processed by Stripe under its own responsibility; we do not store full payment data. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). For details, see Stripe's privacy policy.

10. Diagnostics and analytics (Firebase)

To keep the apps stable and improve them we use Google Firebaseservices (Google Ireland Limited, Ireland): Crashlytics for crash and error reports, Analytics for anonymised usage statistics, and Cloud Messaging (see next section). This processes diagnostic data and a random app-instance/installation ID. No advertising ID is usedand there is no tracking for advertising purposes. The legal basis is our legitimate interest in a stable, secure and user-friendly app (Art. 6(1)(f) GDPR).

11. Push notifications

To inform you about the status of your orders, we send push notifications via Firebase Cloud Messaging. A device-specific push token is processed for this. The legal basis is performance of the contract and our legitimate interest in order handling (Art. 6(1)(b) and (f) GDPR). You can disable notifications at any time in your device settings.

12. Reviews (customer app only)

You can rate restaurants. We store your review together with the timestamp and a reference to your account in order to display reviews and ensure quality (Art. 6(1)(f) GDPR).

13. Printer connection (partner app only)

The partner app can print orders on a thermal printer connected via Bluetooth or Wi-Fi. Communication with the printer is purely local; no personal data is transmitted to us for this purpose.

14. Deleting your account and data

You can delete your account at any time – directly in the app (customer app: Profile → Delete account; partner app: Settings → Delete account) or by email to [email protected]. This deletes your account along with the associated profile, contact and address data, favourites and order history. You can find detailed instructions on our support page.

15. Retention

We retain personal data only for as long as necessary for the stated purposes. Account and contract data are removed when your account is deleted. Invoice and accounting data for completed orders are retained for up to 10 yearsdue to statutory retention obligations (§ 147 AO, § 257 HGB) and deleted once that period expires. Server log files are usually deleted or anonymised after a short period.

16. Transfers to third countries

Some of the services named (in particular Google/Firebase and Stripe) may also process data in the USA. Where data is transferred to a third country, we rely on appropriate safeguards – the EU Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

17. Your rights

You have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing (Art. 21 GDPR)
• withdraw consent (Art. 7(3) GDPR)

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Last updated: July 2026