Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

LANCH GmbH
Schönhauser Allee 180
10119 Berlin, Germany
Represented by: the managing directors Nono Konopka and Jonas Meynert
Email: info@lanch.com

2. Overview

We process personal data only to the extent necessary to operate this website or to handle your enquiry. This website does not set cookies, does not use any analytics or marketing tools and does not embed third-party content (e.g. videos, maps, social media plugins). The fonts and images used on this website are served through the website’s hosting infrastructure. They are not embedded from external services such as Google Fonts or external image platforms.

3. Hosting and provision of the website

This website is operated and hosted via the Lovable platform (Lovable Labs Incorporated, 1 Lincoln St, Boston, MA 02111, USA; European entity: Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden). Lovable uses its own sub-processors for hosting, server functions and the database, in particular Cloudflare (delivery) and Supabase (database).

When you visit the website, the server processes technically necessary data that your browser transmits automatically: IP address, date and time of access, page visited, referrer URL, browser type and version, and operating system. This data is needed to deliver the website and to ensure its security and stability (e.g. to fend off attacks). It is not combined with other data sources.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and error-free provision of the website. Server log data is stored only for as long as necessary for these purposes. We have concluded a data processing agreement with Lovable pursuant to Art. 28 GDPR.

4. Ghost Kitchen partner form

On our Ghost Kitchen page, restaurant owners can register their interest in a partnership with us. We process:

• Required: name, email address
• Optional: phone number, country, street, house number, postcode, city, name of your restaurant, message
• Added automatically: time of submission, language version and page from which the enquiry was sent, an internal ID

Purpose: We use this information to review your enquiry, contact you and prepare a possible collaboration as a Ghost Kitchen partner.

Legal basis: Our legitimate interest in reviewing and responding to incoming business enquiries (Art. 6(1)(f) GDPR). Where you yourself request specific pre-contractual steps towards a possible partnership, Art. 6(1)(b) GDPR additionally applies.

Process and recipients: Your information is transmitted to our server in encrypted form, validated there and stored in the Lovable Cloud database (based on Supabase); the database is located in Ireland. It is then forwarded server-side to the automation service n8n Cloud provided by n8n GmbH, Novalisstr. 10, 10115 Berlin, Germany (according to n8n, data is processed in Frankfurt am Main), and from there into a spreadsheet in Google Workspace provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which our team uses to handle partner enquiries.

Retention: We store your information for as long as necessary to handle your enquiry and to prepare a possible collaboration. If you request erasure, we delete your data unless statutory retention obligations apply. If a partnership is concluded, we store the data for the duration of the collaboration and beyond that only where statutory retention obligations apply (e.g. under German commercial or tax law).

5. Contact by email

If you contact us by email, we process your email address and the content of your message in order to respond. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR (our interest in responding to enquiries). We delete the data once your request has been dealt with, unless retention obligations apply.

6. Cookies and local storage

This website does not set cookies and does not store any information on your device that is not strictly necessary for its technical provision. A cookie banner is therefore not used.

7. Links to social networks and delivery platforms

Our website links to our profiles on Instagram and TikTok and to our offers on Lieferando, Uber Eats, Wolt and foodora. These are simple links, not embedded plugins: no data is transmitted to these providers when you merely visit our website. Only when you click a link are you taken to the provider's site, where its own privacy policy applies.

8. Job applications

Applications cannot be submitted via this website.

9. Transfers to third countries

Some of our service providers (Lovable, Cloudflare, Supabase, Google) are based in the USA or have group companies there. Where data is processed outside the EU/EEA, this is based on an adequacy decision of the European Commission (EU-US Data Privacy Framework, where the provider is certified) or on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

10. Your rights

You have the following rights with regard to your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6(1)(f) GDPR, you may object to the processing at any time on grounds relating to your particular situation.

To exercise your rights, simply send an informal message to info@lanch.com.

11. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The supervisory authority responsible for us is: the Berlin Commissioner for Data Protection and Freedom of Information.

12. Obligation to provide data and automated decision-making

You are not obliged to provide us with personal data. Without your name and email address, however, we cannot process your partner enquiry. No automated decision-making including profiling (Art. 22 GDPR) takes place.

13. Data security

The website is delivered exclusively via an encrypted connection (HTTPS/TLS). Form data is validated server-side and stored in a database to which visitors have write-only, not read, access.

14. Changes

We update this privacy policy when our website or the legal requirements change. The version published here applies.