Privacy Policy

This is a translation for convenience. Only the German version is legally binding.

1. Controller

Erkan Mehmet Bahadir, sole proprietorship trading as "Authentic Core Technologies"
Campus A1 2, 66123 Saarbrücken, Germany
E-mail: kontakt@chefim.de
Contact form: https://chefim.de/kontakt

This policy applies to the website chefim.de and the sign-up page connect.chefim.de; section 6a also explains the restaurant dashboard and courier link. The order pages of the restaurants are covered by the privacy policy of the respective restaurant.

2. Hosting and delivery of the website

The website is hosted by Hetzner Online GmbH in Germany. All requests pass through Cloudflare, Inc., which delivers the website and protects it against attacks as our processor. In doing so, Cloudflare processes your IP address, the page you request and technical information about your browser, and stores requests according to its own retention periods. From these requests Cloudflare creates aggregated, cookie-free traffic statistics. Processing in the USA is possible and is safeguarded by the EU-US Data Privacy Framework or standard contractual clauses.

Legal basis: Art. 6(1)(f) GDPR (secure and stable operation of the website).

We do not keep our own access log with IP addresses for chefim.de or the sign-up page.

3. Cookies and similar technologies

• lang: stores your language choice (German/English) for 1 year. It is set only if you use the language switch.
• Cloudflare security cookie (e.g. __cf_bm, about 30 minutes): used to block automated attacks. For this purpose Cloudflare may also insert a small check script.
• Meta cookies: only on the sign-up page, and only after you click the button to connect with Facebook (see section 7).

The first two cookies are necessary for a service you requested or for secure operation and do not require consent (Section 25(2) TDDDG).

We do not use any analytics or advertising tools of our own. No analytics script runs in your browser.

4. Restaurant directory

On chefim.de we show an overview of restaurants that use Chefim. Being listed is switched off by default and can only be switched on by the restaurant itself in its settings. The listing shows the name, a short description, cuisine, town, logo, opening hours, open/closed status and a link to the order page. This is information about the business. It contains personal data only if the restaurant itself enters such data in these fields.

Legal basis: Art. 6(1)(b) GDPR (contract with the restaurant).

5. Contact

You can reach us by e-mail or through our contact form. We process your details to handle your request and reply by e-mail.

Contact form. Your entries (name, e-mail address, message) are sent as a notification to our own notification server (push.chefim.de, Hetzner, Germany). That server deletes them automatically after 48 hours. From there they are delivered to the notification app on the operator's smartphone.

For delivery to the smartphone, only a notice without any content is sent via the public service ntfy.sh and the Apple push service. Your details are not transmitted in this way.

Your details are not stored in a database and are not logged. The form sets no cookies and loads no scripts from third parties. We do not use a captcha.

To protect against misuse (e.g. automated mass requests), we limit the number of requests. For this, your IP address is kept only in the server's working memory, for at most one hour, and is then discarded. It is not written to disk.

E-mail. Our mailbox kontakt@chefim.de is operated by interneX GmbH, Lagerstraße 15, 3950 Gmünd, Austria. If you write to us by e-mail, or if we answer your form request by e-mail, the correspondence is stored there. No data is transferred to countries outside the EU in this process.

Storage period. We keep form messages and the related e-mail correspondence for up to 12 months after the request has been closed, so that we can deal with follow-up questions, and then delete them. If it concerns a contract with us or the preparation of one, we keep it in line with the statutory retention periods (in particular Section 257 of the German Commercial Code, HGB).

Legal basis: Art. 6(1)(b) GDPR (where a contract is concerned) or Art. 6(1)(f) GDPR (other requests).

Reporting illegal content: You can use the contact form to report content on the restaurants' pages that you consider illegal (Article 16 Digital Services Act). We process the reported page, your explanation and — if you provide them — your name and e-mail address in order to review the report, to confirm receipt and inform you of our decision, and to inform the restaurant concerned. We pass your name and e-mail address on to the restaurant only where this is strictly necessary. Transmission and retention as described above. Legal basis: Art. 6(1)(c) GDPR in conjunction with Article 16 DSA.

6. Registration of restaurants and contract handling

For registration and the contract we process the details of the restaurant operators: name, company name, address, contact details, proof of business status, and contract and billing data. This includes the owner's mobile number: we use it to send dashboard login links and order notifications via WhatsApp; these messages pass through the WhatsApp Business Platform of Meta Platforms Ireland Ltd. (see section 7).

Legal basis: Art. 6(1)(b) GDPR (contract). For invoices: Art. 6(1)(c) GDPR (statutory retention obligations, in particular Section 147 of the German Fiscal Code, AO, and Section 257 HGB).

The data is deleted after the end of the contract unless a statutory retention obligation applies.

6a. Restaurant dashboard and courier link

Restaurant owners open their dashboard (<restaurant>.chefim.de/d) through a personal login link. They request this link via WhatsApp from the owner number stored for the restaurant. Couriers receive a link from the restaurant that is valid for a single delivery only. In this context we process:

• Session cookie mc_session: contains only a random session ID, no name and no phone number. It is valid for 12 hours or until you log out.
• Local browser storage (dash_folded, dashboard only): remembers which sections are expanded or collapsed. It contains no personal data and remains until you clear your browser data.
• Access log: IP address, time, requested page, status code and browser identifier. Login tokens are removed before storage. Entries are deleted after 14 days, or earlier if traffic is high.
• Change log: changes made in the dashboard, and status changes made via the courier link, are recorded with the time, role (e.g. dashboard or courier), type of change and the order concerned. No IP address, name or phone number is recorded. The log is kept for the duration of the contract with the restaurant.
• Misuse protection: to limit requests, the IP address is kept in working memory for at most 10 minutes and is not written to disk.
• Where applicable, Cloudflare's security cookie (see section 3).

The cookie and the local storage are strictly necessary for the service you use (Section 25(2) no. 2 TDDDG).

We process this data, like the end-customer data shown in the dashboard and on the courier link (e.g. name, address), on behalf of the respective restaurant (Art. 28 GDPR). The restaurant is the controller; please contact it to exercise your rights.

7. Connecting the WhatsApp account (Login with Facebook / Embedded Signup)

Restaurants receive a personal link to the sign-up page connect.chefim.de from us. There they connect their WhatsApp Business account through a login window provided by Meta Platforms Ireland Ltd.

No data is sent to Meta when the sign-up page is opened.

• The first click on the connect button loads Meta's program (JavaScript SDK). A notice directly above the button points this out.
• The second click opens Meta's login window.

From the first click onwards, Meta receives your IP address, browser information and possibly Meta cookies. Processing in the USA is possible (EU-US Data Privacy Framework). Meta's automatic event logging is switched off.

After the connection we store only what is needed for operation:

• the IDs of the WhatsApp Business account, the phone number and the business portfolio;
• an access authorisation for the connected account;
• the business phone number and display name shown in the chat.

We do not request or store any data from your personal Facebook profile (name, e-mail, photo).

Through the connection we also set up the restaurant's WhatsApp business profile and change it on request (e.g. profile picture and description), using the details the restaurant gives us for this. This is information about the business that end customers see in WhatsApp.

Legal basis: Art. 6(1)(b) GDPR (preparing and performing the contract); Section 25(2) no. 2 TDDDG (a service you have expressly requested).

8. Data deletion instructions (disconnecting from Meta)

We do not store any profile data from your Facebook account. You can disconnect and have the stored connection data deleted in either of two ways.

1. By e-mail to kontakt@chefim.de with the subject "Disconnect". We remove our application from your WhatsApp account, which makes the access authorisation invalid. We delete the stored connection data within 30 days.
2. Yourself, in Meta Business Suite. In the settings, remove the app "Chefim" under connected apps or business integrations. The access authorisation becomes invalid immediately. We delete the remaining connection data once you notify us.

If a contract is still active, the WhatsApp functions can no longer be used afterwards. Data we must keep for legal reasons (e.g. invoices) is kept until the retention period ends.

9. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Please use the contact details in section 1.

10. Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority, for example the Unabhängiges Datenschutzzentrum Saarland.

Last updated: 9 November 2026