Privacy Policy

Note: The German version of this page is legally binding.

1. Controller

Mbake – Inhaber: Marko Zink
Am Judenfriedhof 9, 56743 Mendig
Phone: +49 175 6671452
Email: info@m-bake.de

2. Hosting (Netlify)

This website is hosted by Netlify, Inc. (San Francisco, USA). When you access the pages, Netlify processes technically necessary data (IP address, date and time of access, pages accessed) in server log files. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in stable and secure operation). We have a data processing agreement with Netlify, including EU standard contractual clauses.

3. Contact form (Netlify Forms)

If you use our contact form, the data you enter (name, email, phone if provided, message) is transmitted to us via Netlify Forms and stored to process your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR.

4. Online shop and customer account (Supabase)

For orders and optional customer accounts we use the Supabase platform. We process the order and contact data you provide (name, email, address, company and phone number where applicable) as well as, upon registration, your login credentials (email, password – the latter stored exclusively as a cryptographic hash). The data is processed to fulfil the order (Art. 6(1)(b) GDPR) and retained for as long as required by statutory retention obligations.

No payment is processed on this website; billing takes place afterwards by invoice.

5. Email notifications

When an order is placed, an internal notification email is generated for us. If an external delivery service is actively configured for this (planned: Resend, Inc.), it processes the data necessary for delivery (recipient address, subject, message text) on our behalf.

6. Cookies and local storage

This website does not use tracking or marketing cookies. The shopping cart is stored exclusively locally in your browser (localStorage). When signing in with a customer account, your browser stores a technical session token (Art. 6(1)(b) GDPR).

7. Fonts (Google Fonts)

We embed the fonts “Archivo Black” and “Inter” from Google Fonts via the Google CDN. In doing so, your IP address is transmitted to Google LLC (USA). The legal basis is Art. 6(1)(f) GDPR (consistent, high-performance display).

8. Mbake app (iOS)

In addition to this website, we operate an iOS app for job and dispatch management. It is aimed at our employees and service technicians, not at shop customers. It processes:

  • Account and master data: Name, email address and role of the signed-in user, as well as the operational job-management data (customers, branches, jobs, service reports, items, invoices). The legal basis is Art. 6(1)(b) and (f) GDPR; for employee data, additionally § 26 BDSG (German Federal Data Protection Act).
  • Location data: During an active job, the app measures the distance driven and the time taken in order to automatically record mileage and travel times – even with the screen locked, as long as the job is active. Recording starts and ends solely with the job and can be revoked at any time in the iOS settings. There is no continuous location monitoring.
  • Camera and photo library: Only when you take or select a picture. Uploaded files are stored with Cloudflare R2.
  • Push notifications: For alerts about new shop orders, we store the device identifier (APNs token) together with the signed-in user. It is deactivated on sign-out. Delivery takes place via the Apple Push Notification service (Apple Inc.).

As a processor, we use Supabase (database, authentication; data centre EU/Frankfurt) and Cloudflare R2 (file storage) for this purpose. An overview is available in the app under “Settings → Legal”.

9. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21), as well as the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).