Zum Inhalt springen
Rezeptrechner

Legal

Privacy Policy

English translation for information only

Last updated: 18.10.2026

Legal notice: This English text is a translation provided for information purposes only. The only legally binding version is the German Datenschutzerklärung. In case of any discrepancy between the two versions, the German version prevails.

This privacy policy informs you about the type, scope and purpose of the processing of personal data (hereinafter "data") in connection with the provision of our services and within our online offering and the websites, functions and content connected with it, as well as external online presences such as our social media profiles (hereinafter jointly referred to as the "online offering"). With regard to the terms used, such as "processing" or "controller", we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

Rezeptrechner SaaS GmbH
c/o Heidorn
Kanalstraße 7
22085 Hamburg
Germany

Email: [email protected]
Phone: +49 (0) 151 7421 2060

Managing directors: Tina Heidorn, Christian Heidorn
Commercial register: HRB 196962, Hamburg Local Court (Amtsgericht Hamburg)
VAT ID: DE461046667

Types of data processed

  • Master data (e.g. personal master data, names or addresses).
  • Contact data (e.g. email, phone numbers).
  • Content data (e.g. text entries, photographs, videos).
  • Usage data (e.g. websites visited, interest in content, access times).
  • Meta and communication data (e.g. device information, IP addresses).

Categories of data subjects

Visitors and users of the online offering (hereinafter we also refer to the data subjects collectively as "users").

Purpose of processing

  • Providing the online offering, its functions and content.
  • Answering contact requests and communicating with users.
  • Security measures.
  • Reach measurement / marketing
  • Analysis and publication of anonymised, aggregated statistics for information, research and marketing purposes.

Terms used

"Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically every handling of data.

"Pseudonymisation" means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.

"Profiling" means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

"Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

"Processor" means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

Relevant legal bases

The term "recipe" refers to a combination of at least two ingredients together with a unit and a quantity.

In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. For users within the scope of the General Data Protection Regulation (GDPR), i.e. the EU and the EEA, the following applies unless the legal basis is stated in this privacy policy:

The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR;

The legal basis for processing to provide our services and perform contractual measures, and to answer enquiries, is Art. 6(1)(b) GDPR;

The legal basis for processing to comply with our legal obligations is Art. 6(1)(c) GDPR;

Where processing of personal data is necessary to protect the vital interests of the data subject or of another natural person, Art. 6(1)(d) GDPR serves as the legal basis.

The legal basis for processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller is Art. 6(1)(e) GDPR.

The legal basis for processing to safeguard our legitimate interests is Art. 6(1)(f) GDPR.

The processing of data for purposes other than those for which they were collected is governed by Art. 6(4) GDPR.

The processing of special categories of data (pursuant to Art. 9(1) GDPR) is governed by Art. 9(2) GDPR.

Security measures

In accordance with the legal requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data as well as access to, input, transfer, securing of availability and separation of the data. We have also established procedures that ensure the exercise of data subject rights, the deletion of data and responses to threats to the data. Furthermore, we take the protection of personal data into account as early as the development or selection of hardware, software and processes, in accordance with the principle of data protection by design and by default.

Cooperation with processors, joint controllers and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors, joint controllers or third parties), transfer data to them or otherwise grant them access to the data, this is only done on the basis of a legal permission (e.g. if a transfer of the data to third parties, such as payment service providers, is necessary to perform a contract), if users have consented, if a legal obligation requires it, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

If we disclose or transfer data to other companies of our group of companies or otherwise grant them access, this is done in particular for administrative purposes as a legitimate interest and, beyond that, on a basis that complies with the legal requirements.

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA) or the Swiss Confederation), or if this happens in the context of using third-party services or disclosing or transferring data to other persons or companies, this only takes place if it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we process data in a third country, or have it processed there, only if the legal requirements are met. This means, for example, that processing takes place on the basis of special safeguards, such as an officially recognised finding of a level of data protection equivalent to the EU (e.g. for the USA through the EU-U.S. Data Privacy Framework) or compliance with officially recognised special contractual obligations (in particular EU Standard Contractual Clauses).

Rights of data subjects

You have the right to obtain confirmation as to whether data concerning you are being processed, and to access these data as well as further information and a copy of the data in accordance with the legal requirements.

In accordance with the legal requirements, you have the right to request that data concerning you be completed or that inaccurate data concerning you be rectified.

In accordance with the legal requirements, you have the right to request that data concerning you be deleted without delay or, alternatively, to request restriction of the processing of the data.

You have the right to receive the data concerning you that you have provided to us in accordance with the legal requirements and to request their transmission to other controllers.

In accordance with the legal requirements, you also have the right to lodge a complaint with the competent supervisory authority.

Right to withdraw consent

You have the right to withdraw any consent you have given with effect for the future.

Right to object

You may object at any time to the future processing of data concerning you in accordance with the legal requirements. In particular, you may object to processing for the purposes of direct marketing.

Cookies and right to object to direct marketing

"Cookies" are small files that are stored on users' computers. Different information can be stored within cookies. A cookie primarily serves to store information about a user (or the device on which the cookie is stored) during or after their visit to an online offering. Temporary cookies, or "session cookies" or "transient cookies", are cookies that are deleted after a user leaves an online offering and closes their browser. Such a cookie may store, for example, the contents of a shopping basket in an online shop or a login status. "Permanent" or "persistent" cookies remain stored even after the browser is closed. For example, the login status can be saved if users return after several days. Such a cookie may also store users' interests, which are used for reach measurement or marketing purposes. "Third-party cookies" are cookies offered by providers other than the controller operating the online offering (otherwise, if they are only its own cookies, they are called "first-party cookies").

We may use temporary and permanent cookies and explain this in our privacy policy.

If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in their browser's system settings. Stored cookies can be deleted in the browser's system settings. Excluding cookies may limit the functionality of this online offering.

A general objection to the use of cookies for online marketing purposes can be declared for many services, especially in the case of tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. In addition, the storage of cookies can be prevented by switching them off in the browser settings. Please note that in this case you may not be able to use all functions of this online offering.

Consent to the use of cookies

We use cookies so that our website works properly. To obtain your valid consent to the use and storage of cookies in the browser you use to access our website, and to document this properly, we use a consent management platform: CookieFirst. This technology is provided by Digital Data Solutions BV, Plantage Middenlaan 42a, 1018 DH, Amsterdam, Netherlands. Website: https://cookiefirst.com (referred to as CookieFirst).

When you access our website, a connection is established with the CookieFirst server to enable us to obtain valid consent from you for the use of certain cookies. CookieFirst then stores a cookie in your browser so that only the cookies you have consented to are activated, and to document this properly. The data processed are stored until the specified storage period expires or you request their deletion. Certain statutory retention periods may apply in deviation from this.

CookieFirst is used to obtain the legally required consent to the use of cookies. The legal basis for this is Article 6(1)(c) of the General Data Protection Regulation (GDPR).

Data processing agreement

We have concluded a data processing agreement with CookieFirst. This is a contract required under data protection law which ensures that the data of our website visitors are processed only in accordance with our instructions and in compliance with the GDPR.

Server log files

Our website and CookieFirst automatically collect and store information in so-called server log files, which your browser automatically transmits to us. The following data are collected:

  • Your consent status or the withdrawal of your consent
  • Your anonymised IP address
  • Information about your browser
  • Information about your device
  • The date and time of your visit to our website
  • The URL of the web page on which you saved or updated your consent settings
  • The approximate location of the user who saved their consent preferences
  • A universally unique identifier (UUID) of the website visitor who clicked the cookie banner

No monetisation of your content and no AI training

We process recipes, ingredients, prices and other content that you create in your user account in order to provide our services to you, and we analyse it in order to improve our offering. For this purpose we also use service providers and third-party tools that process the content solely on our behalf. We do not sell or rent your content, we do not make it available to third parties for their own purposes, and we do not use it to train or fine-tune AI models. Our service providers may not use your content for these purposes either.

Analyses and statistics (anonymised and aggregated)

We are entitled to analyse the data arising from the use of our online offering in anonymised and aggregated form and to publish the results. This includes in particular analyses of average nutritional values, recipe and ingredient structures, prices and cost-of-goods ratios, and the usage behaviour of individual sectors (e.g. bakeries, restaurants, communal catering, catering). The analyses are not used to train AI models and are not sold to third parties.

Anonymisation and aggregation: The analysis is based exclusively on combined data sets. Results are only published if the underlying data set covers a sufficient number of mutually independent users and the results do not allow any conclusions to be drawn about individual persons, user accounts, businesses, recipes, ingredients or prices. Results are checked for re-identifiability before publication; analyses that do not meet these requirements are not published.

No personal data: Published analyses do not contain any personal data within the meaning of Art. 4(1) GDPR. If and as long as data are still personal or pseudonymised, they are processed for these purposes exclusively on the basis of our legitimate interest in informing our users, prospective customers and the public and in improving our offering pursuant to Art. 6(1)(f) GDPR. You may object to this processing in accordance with Art. 21 GDPR; an objection has no effect on anonymised analyses that have already been published, as these no longer contain any personal data.

Hosting and content delivery network (CDN) – Cloudflare

To provide this website securely, quickly and reliably, we use the services of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare"). Cloudflare provides a globally distributed content delivery network with hosting, security and DNS functions.

Cloudflare acts as a reverse proxy: all data traffic between your browser and our website is technically routed through Cloudflare's servers. In doing so, Cloudflare processes access data, in particular your IP address, the website or file accessed, the date and time of access, the amount of data transferred and information about your browser and operating system. This serves to deliver the content, speed up loading times and defend against attacks (e.g. DDoS) and misuse.

The legal basis is our legitimate interest in providing our online offering securely and efficiently pursuant to Art. 6(1)(f) GDPR.

A transfer of data to the USA cannot be ruled out; Cloudflare is certified under the EU-U.S. Data Privacy Framework and has additionally agreed to EU Standard Contractual Clauses. Further information can be found in Cloudflare's privacy policy at https://www.cloudflare.com/privacypolicy/.

Videos – Cloudflare Stream

On our website we embed videos via the Cloudflare Stream service (Cloudflare, Inc., address as above). When a page with an embedded video is accessed, a connection to Cloudflare's servers is established and your IP address and technical access data are transmitted so that the video can be delivered. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in an appealing presentation of our online offering). The Cloudflare information on third-country transfers given above applies.

Partner programme – Digistore24 Promocode

We operate a partner programme through Digistore24 GmbH, St.-Godehard-Straße 32, 31139 Hildesheim, Germany ("Digistore24"). Partners recommend our software via special links. So that we can attribute a referral to the right partner and settle the agreed commission, we embed a script from Digistore24 ("Promocode") on our website. When a page is accessed, this script is loaded from Digistore24's servers; your IP address is transmitted to Digistore24 in the process.

If you arrive on our website via a partner link, the script reads the partner ID from the address, stores it in your browser (cookie or local storage on our domain) and appends it to the link when you switch to the Digistore24 order form. The ID does not contain any information about you, only which partner made the recommendation. Without a partner link, no ID is stored.

The legal basis is our legitimate interest in settling accounts with our sales partners pursuant to Art. 6(1)(f) GDPR. Storage in the browser is limited to 180 days; you can delete it at any time via your browser settings. Further information can be found in Digistore24's privacy policy: https://www.digistore24.com/page/privacy.

Deletion of data

The data we process are deleted or their processing is restricted in accordance with the legal requirements. Unless expressly stated in this privacy policy, the data stored by us are deleted as soon as they are no longer required for their intended purpose and there are no statutory retention obligations preventing deletion.

If the data are not deleted because they are required for other, legally permissible purposes, their processing is restricted. This means the data are blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.

Changes and updates to the privacy policy

Please check the content of our privacy policy regularly. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an action on your part (e.g. consent) or other individual notification.

Registration function

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed on the basis of Art. 6(1)(b) GDPR for the purpose of providing the user account. The data processed include in particular the login information (name, password and an email address). The data entered during registration are used for the purposes of using the user account and its purpose.

Users may be informed by email about information relevant to their user account, such as technical changes. When users have terminated their user account, their data relating to the user account are deleted, subject to any statutory retention obligation. It is the users' responsibility to back up their data before the end of the contract after termination. We are entitled to irretrievably delete all data of the user stored during the term of the contract.

When our registration and login functions are used and when the user account is used, we store the IP address and the time of the respective user action. This storage is based on our legitimate interests and those of the users in protection against misuse and other unauthorised use. These data are generally not passed on to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so pursuant to Art. 6(1)(c) GDPR. The IP addresses are anonymised or deleted after 7 days at the latest.

AI connection (MCP)

Users can connect their Rezeptrechner / CaterCalc account to third-party AI assistants, currently in particular Claude (Anthropic PBC), ChatGPT (OpenAI OpCo, LLC), Gemini (Google Ireland Limited or Google LLC) and Langdock (Langdock GmbH, Berlin). The connection uses the Model Context Protocol (MCP) and is only established after the user has expressly approved it. On the instruction of the user or of the assistant the user employs, data from the user account may be transmitted, in particular recipes, ingredients, quantities, prices, allergens and other business data stored in the account. Through the same interface, assistants can also make changes in the account on the user's instruction.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract for the AI connection requested by the user). With regard to the data it receives, the provider of the respective assistant acts as an independent controller; its own privacy policy applies to its processing. We have no influence on how the assistant further processes the data transmitted. The user can end the connection at any time in their account settings.

For the connection, we store the approval granted (access and refresh tokens of the connected assistant, or an access key created by the user) as well as the time of the connection and of its last use, until the user disconnects or revokes the key. Files that an assistant has us create on the user's instruction (e.g. Excel import templates) are stored for download for no more than 60 minutes at Cloudflare (R2, storage location EU) and are then deleted automatically.

For the operation, security and troubleshooting of the interface, we log every call with the account identifier, the function called, the time, the result or error status, the duration, a shortened summary of the call parameters, the type of calling program and the IP address, which we store only in pseudonymised form as a cryptographic hash. These log data are deleted automatically after 90 days. For failed calls and for a small sample of successful calls, we additionally store shortened excerpts of the request and the response, from which access credentials are removed; these error logs are deleted automatically after 14 days. We keep summarised daily statistics without personal reference for up to 365 days. The legal basis for this logging is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the interface).

The information on transfers to third countries given above applies. Anthropic, OpenAI and Google may process data in the USA; where the respective provider is certified under the EU-U.S. Data Privacy Framework or has agreed to EU Standard Contractual Clauses, the transfer takes place on that basis. Langdock is based in Germany but may forward requests to AI model providers outside the EU.

Contacting us

When users contact us (e.g. via contact form, email, phone or social media), the information they provide is processed to handle and process the contact request pursuant to Art. 6(1)(b) GDPR (in the context of contractual or pre-contractual relationships) or Art. 6(1)(f) GDPR (other enquiries). Users' information may be stored in a customer relationship management system ("CRM system") or a comparable enquiry management system.

We delete the enquiries when they are no longer required. We review whether they are still required every two years; statutory archiving obligations also apply.

Documentation pages

On our documentation pages (handbook and other help pages) and in the help inside the application, you can optionally ask an AI assistant questions and rate individual articles. To answer, we transmit your question, the conversation so far and the content of the relevant help page to OpenRouter, Inc. (USA), which forwards the request to an AI model provider. No information from your user account (e.g. name, email address, recipes or prices) is transmitted. Please do not enter personal data in your questions. We delete stored questions after 90 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in providing quick help with our offering). Processing in the USA cannot be ruled out.

AI-assisted labelling suggestions

For suggestions on the diet and origin labelling of custom ingredients (e.g. vegan, vegetarian), we transmit only the ingredient name, the catalogue key and the declared allergens to TypeSafe AI, Inc. (USA). No reference to the user account, and no names, email or IP addresses, are transmitted; personal data are not part of this transfer. Users should therefore not include personal information in ingredient names.

Newsletter

With the following information, we inform you about the content of our newsletter, the registration, dispatch and statistical evaluation procedures, and your rights to object. By subscribing to our newsletter, you agree to receive it and to the procedures described.

Content of the newsletter: We send newsletters, emails and other electronic notifications containing advertising information (hereinafter "newsletter") only with the consent of the recipients or a legal permission. If the content of the newsletter is specifically described when registering, this description is decisive for the users' consent. Otherwise, our newsletters contain information about our products and related information (e.g. safety notices), offers, promotions and our company.

Double opt-in and logging: Registration for our newsletter takes place in a so-called double opt-in procedure. This means that after registering you receive an email asking you to confirm your registration. This confirmation is necessary so that nobody can register with someone else's email address. Newsletter registrations are logged in order to be able to prove the registration process in accordance with the legal requirements. This includes storing the time of registration and confirmation as well as the IP address. Changes to your data stored with the dispatch service provider are also logged.

Registration data: To register for the newsletter, it is sufficient to provide your email address. Optionally, we ask you to provide a name so that we can address you personally in the newsletter.

The newsletter is sent, and its success measured, on the basis of the recipients' consent pursuant to Art. 6(1)(a) and Art. 7 GDPR in conjunction with Section 107(2) TKG or, where consent is not required, on the basis of our legitimate interests in direct marketing pursuant to Art. 6(1)(f) GDPR in conjunction with Section 107(2) and (3) TKG.

The registration process is logged on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR. Our interest is in using a user-friendly and secure newsletter system that serves our business interests and meets users' expectations, and that also allows us to prove consent.

Cancellation / withdrawal – You can cancel your subscription to our newsletter at any time, i.e. withdraw your consent. You will find a link to cancel the newsletter at the end of each newsletter. We may store unsubscribed email addresses for up to three years on the basis of our legitimate interests before deleting them in order to be able to prove consent previously given. The processing of these data is limited to the purpose of a possible defence against claims. An individual deletion request is possible at any time, provided that the former existence of consent is confirmed at the same time.

Newsletter – Mailchimp

Newsletters are sent using the dispatch service provider "MailChimp", a newsletter platform of the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. You can view the dispatch service provider's privacy policy here: https://mailchimp.com/legal/privacy/. The Rocket Science Group LLC d/b/a MailChimp is certified under the EU-U.S. Data Privacy Framework and thereby guarantees compliance with the European level of data protection (https://www.dataprivacyframework.gov/list). EU Standard Contractual Clauses have additionally been agreed. The dispatch service provider is used on the basis of our legitimate interests pursuant to Art. 6(1)(f) GDPR and a data processing agreement pursuant to Art. 28(3) sentence 1 GDPR.

The dispatch service provider may use the recipients' data in pseudonymous form, i.e. without attribution to a user, to optimise or improve its own services, e.g. for technical optimisation of dispatch and presentation of the newsletters or for statistical purposes. However, the dispatch service provider does not use the data of our newsletter recipients to write to them itself or to pass the data on to third parties.

Newsletter – success measurement

The newsletters contain a so-called "web beacon", i.e. a pixel-sized file that is retrieved from our server or, if we use a dispatch service provider, from its server when the newsletter is opened. During this retrieval, technical information such as information about the browser and your system, as well as your IP address and the time of retrieval, is collected first.

This information is used for the technical improvement of the services based on the technical data, or of the target groups and their reading behaviour based on their retrieval locations (which can be determined with the help of the IP address) or access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened and which links are clicked. For technical reasons, this information can be attributed to individual newsletter recipients. However, it is neither our intention nor, if used, that of the dispatch service provider to monitor individual users. Rather, the evaluations help us to recognise the reading habits of our users and to adapt our content to them or to send different content according to our users' interests.

Unfortunately, it is not possible to withdraw from success measurement separately; in this case, the entire newsletter subscription must be cancelled.

Google Analytics

On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use Google Analytics 4, a web analytics service of Google LLC ("Google"). Google Analytics uses cookies or comparable technologies. The information generated about users' use of the online offering is generally transferred to a Google server in the USA and stored there.

Google is certified under the EU-U.S. Data Privacy Framework and thereby guarantees compliance with the European level of data protection (https://www.dataprivacyframework.gov/list). EU Standard Contractual Clauses have additionally been agreed.

Google will use this information on our behalf to evaluate users' use of our online offering, to compile reports on activities within this online offering and to provide us with further services related to the use of this online offering and the internet. Pseudonymous user profiles may be created from the processed data.

Google Analytics 4 does not store or log users' full IP addresses. The IP address transmitted by the user's browser is not merged with other Google data. We use Google Analytics exclusively on the basis of your consent, which you give via our consent management (CookieFirst) and can withdraw at any time with effect for the future. We use the "Consent Mode" function, which links processing by Google Analytics to your consent decision. As long as you have not consented, no analytics cookies are set and no data are transmitted to Google for analytics purposes.

You can additionally prevent the storage of cookies by setting your browser software accordingly.

Further information on data use by Google and on settings and objection options can be found in Google's privacy policy (https://policies.google.com/privacy) and in the settings for the display of advertisements by Google (https://adssettings.google.com/authenticated).

Users' personal data are deleted or anonymised after 14 months.

Audience building with Google Analytics

We use Google Analytics to display the advertisements placed within Google's advertising services and those of its partners only to users who have shown an interest in our online offering or who have certain characteristics (e.g. interest in certain topics or products, determined on the basis of the websites visited) that we transmit to Google (so-called "remarketing" or "Google Analytics audiences"). With the help of remarketing audiences, we also want to ensure that our advertisements match users' potential interests.

Pop-ups and lead forms – Popupsmart

To display pop-ups and notices and to collect enquiries, we use the Popupsmart service of Popupsmart Inc., USA, on the basis of our legitimate interests in informing and addressing our users and in the economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR. For this purpose, Popupsmart embeds a script through which the page visited is loaded and a pop-up or form is displayed.

In particular, your IP address, online identifiers (e.g. cookies), information about the browser and device used, the page visited and interactions with the pop-up or form are processed. If you fill in a form, we process the data you provide there (e.g. email address) to handle your enquiry pursuant to Art. 6(1)(b) or (f) GDPR. Popupsmart acts as our processor on the basis of a data processing agreement pursuant to Art. 28 GDPR. A transfer of data to the USA cannot be ruled out; Popupsmart has agreed to EU Standard Contractual Clauses for this purpose. Further information can be found in Popupsmart's privacy policy: https://popupsmart.com/privacy-policy.

Insofar as pop-ups or forms are not required for the operation of the website, they are only loaded after your consent via our consent management (CookieFirst). You can withdraw this consent at any time with effect for the future.

WordPress blog (rezeptrechner-online.de/blog)

Our blog runs on WordPress and is available at https://rezeptrechner-online.de/blog/. When the blog is accessed, the web server and the services used there process access data, in particular your IP address, the date and time of access, the page accessed, the amount of data transferred and information about your browser and operating system. The legal basis is our legitimate interest in providing the blog securely and stably pursuant to Art. 6(1)(f) GDPR.

We use the Yoast SEO plugin for search engine optimisation and technical markup of the content. Yoast SEO does not set cookies and does not process any data of our visitors; the content is analysed exclusively on our server.

We also use CookieFirst for consent management on the blog. The information on CookieFirst given above applies. In addition, we refer to the blog's privacy policy: https://rezeptrechner-online.de/blog/datenschutzerklaerung/.

Facebook Pixel, Custom Audiences and Facebook Conversion

On the basis of our legitimate interests in the analysis, optimisation and economic operation of our online offering, and for these purposes, our online offering uses the so-called "Facebook Pixel" of the social network Facebook, which is operated by Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or, if you are based in the EU, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook").

Facebook (Meta) is certified under the EU-U.S. Data Privacy Framework and thereby guarantees compliance with the European level of data protection (https://www.dataprivacyframework.gov/list). EU Standard Contractual Clauses have additionally been agreed.

With the help of the Facebook Pixel, Facebook is able, on the one hand, to determine the visitors to our online offering as a target group for the display of advertisements (so-called "Facebook ads"). Accordingly, we use the Facebook Pixel to display the Facebook ads we place only to Facebook users who have shown an interest in our online offering or who have certain characteristics (e.g. interest in certain topics or products, determined on the basis of the websites visited) that we transmit to Facebook (so-called "Custom Audiences"). With the help of the Facebook Pixel, we also want to ensure that our Facebook ads match users' potential interests and are not perceived as annoying. The Facebook Pixel also allows us to track the effectiveness of Facebook ads for statistical and market research purposes by seeing whether users were redirected to our website after clicking on a Facebook ad (so-called "conversion").

Facebook processes the data in accordance with Facebook's data use policy. General information on the display of Facebook ads can be found in Facebook's data use policy: https://www.facebook.com/policy. Specific information and details about the Facebook Pixel and how it works can be found in Facebook's help section: https://www.facebook.com/business/help/651294705016616.

You can object to collection by the Facebook Pixel and the use of your data to display Facebook ads. To set which types of advertisements are shown to you within Facebook, you can visit the page set up by Facebook and follow the instructions on usage-based advertising settings there: https://www.facebook.com/settings?tab=ads. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.

You can also object to the use of cookies for reach measurement and advertising purposes via the opt-out page of the Network Advertising Initiative (http://optout.networkadvertising.org/) and additionally the US website (http://www.aboutads.info/choices) or the European website (http://www.youronlinechoices.com/uk/your-ad-choices/).

Online presences in social media

We maintain online presences within social networks and platforms in order to communicate with customers, prospective customers and users active there and to inform them about our services.

Please note that users' data may be processed outside the European Union. This may result in risks for users, for example because it could make it more difficult to enforce users' rights. With regard to US providers certified under the EU-U.S. Data Privacy Framework, we point out that they thereby undertake to comply with EU data protection standards.

Furthermore, users' data are generally processed for market research and advertising purposes. For example, usage profiles can be created from users' usage behaviour and resulting interests. The usage profiles can in turn be used, for example, to place advertisements within and outside the platforms that presumably correspond to users' interests. For these purposes, cookies are generally stored on users' computers in which users' usage behaviour and interests are stored. Data may also be stored in the usage profiles independently of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).

Users' personal data are processed on the basis of our legitimate interests in effectively informing and communicating with users pursuant to Art. 6(1)(f) GDPR. If users are asked by the respective platform providers for consent to the data processing described above, the legal basis of the processing is Art. 6(1)(a) and Art. 7 GDPR.

For a detailed description of the respective processing and the options to object (opt-out), we refer to the providers' information linked below.

In the case of requests for information and the assertion of user rights, we also point out that these can be asserted most effectively with the providers. Only the providers have access to users' data and can take appropriate measures and provide information directly. If you nevertheless need help, you can contact us.

Integration of third-party services and content

On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use content or service offerings from third-party providers within our online offering in order to integrate their content and services, such as videos or fonts (hereinafter uniformly referred to as "content").

This always requires that the third-party providers of this content perceive the users' IP address, as without the IP address they could not send the content to their browser. The IP address is therefore required to display this content. We endeavour to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on users' devices and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our online offering, and may also be combined with such information from other sources.

Use of Facebook social plugins

On the basis of our legitimate interests (i.e. interest in the analysis, optimisation and economic operation of our online offering within the meaning of Art. 6(1)(f) GDPR), we use social plugins ("plugins") of the social network facebook.com, which is operated by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook").

These may include, for example, content such as images, videos or texts and buttons with which users can share content from this online offering within Facebook. The list and appearance of the Facebook social plugins can be viewed here: https://developers.facebook.com/docs/plugins/.

Facebook (Meta) is certified under the EU-U.S. Data Privacy Framework and thereby guarantees compliance with the European level of data protection (https://www.dataprivacyframework.gov/list).

When a user calls up a function of this online offering that contains such a plugin, their device establishes a direct connection with Facebook's servers. The content of the plugin is transmitted by Facebook directly to the user's device and integrated by it into the online offering. User profiles may be created from the processed data. We therefore have no influence on the scope of the data that Facebook collects with the help of this plugin and inform users according to our state of knowledge.

By integrating the plugins, Facebook receives the information that a user has accessed the corresponding page of the online offering. If the user is logged in to Facebook, Facebook can assign the visit to their Facebook account. When users interact with the plugins, for example by clicking the Like button or posting a comment, the corresponding information is transmitted directly from their device to Facebook and stored there. If a user is not a member of Facebook, it is still possible that Facebook learns and stores their IP address. According to Facebook, only an anonymised IP address is stored in Germany.

The purpose and scope of the data collection and the further processing and use of the data by Facebook, as well as the related rights and settings options to protect users' privacy, can be found in Facebook's privacy notice: https://www.facebook.com/about/privacy/.

If a user is a Facebook member and does not want Facebook to collect data about them via this online offering and link it to their member data stored on Facebook, they must log out of Facebook and delete their cookies before using our online offering. Further settings and objections to the use of data for advertising purposes are possible within the Facebook profile settings: https://www.facebook.com/settings?tab=ads or via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.