Privacy policy
Last updated: September 10, 2026
1. Controller
DachsDelivery Group GbR, Fritz-Salm-Str. 18, 68167 Mannheim, info@dachsdelivery.com.
2. Data we process
Order data (dishes, delivery address, notes), contact data (name, phone, optional email), minimal technical server data (logs, IP address) and local storage in your browser (language, theme, cart, orders).
3. Purposes and legal bases
Performance of the contract and order handling (Art. 6(1)(b) GDPR); statutory tax and accounting obligations (Art. 6(1)(c) GDPR); security and operation of the service as a legitimate interest (Art. 6(1)(f) GDPR).
4. Cookies and local storage
We use only technically necessary cookies and localStorage: language preference (NEXT_LOCALE), light/dark theme, cart and orders. No analytics, marketing or profiling cookies, no tracking.
5. The mobile app
The app follows the same rules as the website, with three further processing operations. Notifications: if you turn them on, the phone gives us a token used only to tell you how your order is going, and deleted when you sign out. Location: asked for only when you use it, and used to find who delivers where you are; for riders it is shared with the customer only while a delivery is under way. Photos: only for the restaurants, and only the ones they pick for the menu. The app contains no analytics or advertising tools; when something breaks it sends us the error message and the kind of device, without your name and without your identifier.
6. External providers and processors
Supabase (database, authentication and file storage) — project region: eu-west-1 (Dublin, EU); Cloudflare (hosting for the site and the API, content delivery network); Stripe Payments Europe (card payments and payouts to the restaurants), with possible data transfer based on the standard contractual clauses; Resend (sending transactional email); Expo, together with Apple (APNs) and Google (FCM), for push notifications; Google (sign-in with a Google account, only if you use it); OpenStreetMap and Nominatim (map tiles and address search). A data processing agreement is or will be in place with each provider (Art. 28 GDPR).
7. Retention
We keep order data for as long as needed for fulfilment and within statutory retention periods (typically up to 10 years), then delete or anonymise it.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection (Art. 15–21 GDPR). To exercise them, write to info@dachsdelivery.com.
9. Right to complain
You may lodge a complaint with the competent supervisory authority, e.g. the data protection authority of your federal state (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg).
10. Changes
We may update this policy; the current version is always available on this page.