CookForMe

Privacy Policy

Last updated: 24 October 2026

This policy explains what personal data we process when you visit cookforme.org or send us a request, why we do it, and what rights you have. We keep it short: we collect only what we need to cook for your family.

1. Who is responsible

Addy Spot UG (haftungsbeschränkt), Brüsseler Straße 8, 13353 Berlin, Germany
Managing director: Andrii Mamchur
Email: [email protected]

CookForMe is a brand of Addy Spot UG (haftungsbeschränkt). We are not required to appoint a data protection officer. For any privacy question, write to [email protected].

2. Visiting the website

When you open our website, our hosting provider's servers automatically process technical data your browser sends: IP address, date and time, page requested, referrer, browser and operating system. We need this to deliver the website and to protect it against abuse and attacks.

  • Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, working website.
  • Storage: server logs are deleted after 30 days at the latest, unless a security incident requires us to keep specific entries longer.

We use no analytics, no tracking, no advertising cookies, no social media plugins and no external fonts. All fonts and images load from our own server.

3. The request form

When you fill in the form "A few details about your family", we process:

  • your name and WhatsApp phone number;
  • the number of people we cook for;
  • your food allergies, diet, disliked ingredients, favourite cuisines and spice level;
  • the time you gave your consent.

Purpose: to prepare your free, personalised menu, to contact you about it on WhatsApp and, if you book, to plan and carry out the cooking. When you book, we also ask for your address, cooking date and invoice details.

Legal basis

  • Art. 6(1)(b) GDPR: steps you asked for before a possible contract, and the contract itself.
  • Information about allergies and some diets can reveal health data. We process it only with your explicit consent, which you give by selecting "I agree" in the last step: Art. 9(2)(a) GDPR.

Your consent is voluntary, and you can withdraw it at any time by writing to [email protected] or on WhatsApp. Withdrawal doesn't affect processing that already happened. Without this information we can't safely plan a menu for your family, so we can't send you one.

Who sees it: only our founders, and the professional chef who cooks for you. The chef receives only what's needed for the menu and the session: your name, phone number, address (once you book), allergies and preferences. Our chefs are bound to confidentiality. The data is stored on our hosting provider's servers (section 6). When a new request arrives, we send ourselves a notification email that contains only your name.

How long we keep it

  • If you don't book: we delete your request 6 months after our last contact.
  • If you book: we keep your data for as long as you are our customer. After that, we delete it within 6 months.
  • Invoices are kept for 8 years, because tax and commercial law require it (§ 147 AO, § 257 HGB, § 14b UStG). Invoices contain no allergy or diet data.

4. Saving your answers in your browser

So you don't lose your answers if you close the page or reload it, the form saves them in your browser's local storage on your own device. They stay on your device and are only sent to us when you press "Send". After a successful send, they are deleted from your browser. You can also delete them at any time in your browser settings (site data for cookforme.org).

  • Legal basis: § 25(2) No. 2 TDDDG. This storage is strictly necessary for the form you are using.

If you use a shared device, clear the site data after filling in the form.

"Stands with Ukraine" banner. If you close the banner at the top of the page, we store a small cookie ("cfm-ukraine") in your browser for 3 months, so the banner stays closed. It contains no personal data and is never used for tracking.

  • Legal basis: § 25(2) No. 2 TDDDG. The cookie only remembers a choice you made on our website.

5. Contact by WhatsApp and email

We contact you on WhatsApp, using the WhatsApp Business app, on the number you gave us. If you write to us by email, we process your email address and your message.

  • Legal basis: Art. 6(1)(b) GDPR.

WhatsApp is provided by WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, part of Meta. When we message you, WhatsApp processes your phone number, the messages and metadata under its own privacy policy (https://www.whatsapp.com/legal/privacy-policy-eea). Data may be transferred to the USA. Meta is certified under the EU–U.S. Data Privacy Framework, which the European Commission recognises as providing adequate protection (Art. 45 GDPR). Messages are end-to-end encrypted. If you'd rather not use WhatsApp, tell us and we'll use email or phone instead.

6. Service providers

We use these providers. Each processes data only on our instructions, under a data processing agreement (Art. 28 GDPR):

  • DigitalOcean, LLC (USA): hosting of the website and database, in a data centre in Frankfurt, Germany. DigitalOcean is certified under the EU–U.S. Data Privacy Framework. Standard Contractual Clauses apply as a fallback (Art. 45 and 46 GDPR).
  • STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany: our business mailbox. Our internal notification and password emails are sent from it, only to our founders. They contain your name and a link to your request, and no allergy or diet data.

7. Security

All connections use HTTPS encryption. The database is encrypted at rest and is accessible only to the website and to our founders, with personal logins. We keep backups for a few days, and deleted data disappears from them when they rotate.

8. Your rights

You have the right to:

  • access your data (Art. 15 GDPR);
  • correct it (Art. 16);
  • have it deleted (Art. 17);
  • restrict its processing (Art. 18);
  • receive it in a portable format (Art. 20);
  • withdraw your consent at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): where we process data based on legitimate interest (section 2), you can object at any time for reasons arising from your particular situation.

To use any of these rights, write to [email protected].

You can also complain to a data protection authority. Ours is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, [email protected]

9. No automated decisions

We don't use automated decision-making or profiling (Art. 22 GDPR).

10. Changes

We update this policy when our website or services change. The current version is always on this page.