Free shipping from 49 € · Handmade in Germany

Privacy policy

Protecting your personal data matters to us. This page explains which data we process when you visit our shop or place an order, why we do so, and what rights you have.

Last updated: October 2026

Download as PDF

1. Controller

The controller responsible for processing personal data on this website is:

  • Meva Patisserie GmbH
  • Eifelstraße 37 b
  • 52224 Stolberg
  • Deutschland
  • Managing directors: Harus Tas, Idris Ekrem Erduran
  • Email: [email protected]
  • Phone: +49 176 243 48 649

2. General information on data processing

We process personal data only to the extent necessary to provide our shop, to fulfil your order, or on the basis of your consent. The legal bases are Art. 6(1)(a) GDPR (consent), Art. 6(1)(b) GDPR (performance of a contract), Art. 6(1)(c) GDPR (legal obligation) and Art. 6(1)(f) GDPR (legitimate interest).

We delete your data as soon as the purpose for storing it no longer applies, unless statutory retention periods require otherwise. Commercial and tax records are kept for six or ten years in accordance with Section 257 HGB and Section 147 AO (German law).

3. Hosting and server log files

Our shop is hosted by DigitalOcean, LLC, 105 Edgeview Drive, Suite 425, Broomfield, CO 80021, USA. The servers are located in a data centre in Frankfurt am Main, Germany. We have concluded a data processing agreement with DigitalOcean under Art. 28 GDPR. As DigitalOcean is a US company, access from the USA cannot be ruled out; DigitalOcean is certified under the EU-US Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). The EU Standard Contractual Clauses have also been agreed. DigitalOcean's privacy policy: https://www.digitalocean.com/legal/privacy-policy

Each time the shop is accessed, information is automatically stored in server log files: IP address, date and time, page requested, amount of data transferred, browser type and version, operating system and the referring page. We use this data to keep the shop stable and secure (Art. 6(1)(f) GDPR); it is deleted after 14 days at the latest, unless it is needed to investigate a security incident.

4. Cookies and local storage

We only use strictly necessary cookies and browser storage without which the shop would not work. These are permitted without consent under Section 25(2) no. 2 TDDDG (German law); the legal basis for the associated processing is Art. 6(1)(b) and (f) GDPR. We do not use tracking, analytics or advertising cookies and do not share data with advertising networks.

In detail, we store:

  • _medusa_cart_id: Cart – remembers your cart between page views
  • _medusa_jwt: Login – keeps you signed in to your customer account
  • _medusa_cache_id: Technical identifier – ensures prices and your cart load correctly
  • _medusa_pending_customer: Registration – briefly holds your input while you create an account
  • meva_cookie_consent: Cookie notice – stores in your browser's local storage that you have seen the notice

5. Customer account

You can create a customer account. For this we process your name, email address, a password (stored only in encrypted form) and, optionally, your phone number and addresses. The legal basis is Art. 6(1)(b) GDPR. You can have your account deleted at any time via your account settings or by email; order data is retained for the statutory retention periods.

6. Orders and contract fulfilment

To fulfil your order we process your name, delivery and billing address, email address, phone number (optional), order details and payment information. Processing is carried out to perform the purchase contract under Art. 6(1)(b) GDPR.

For delivery we pass your name and delivery address to our shipping partner. If you have given consent, we also share your email address or phone number so the carrier can notify you about the delivery status (Art. 6(1)(a) GDPR).

7. Payment providers

Depending on the payment method you choose, the data required for payment (name, amount, currency, order number and, for card payments, the card details) is transmitted directly to the respective payment provider. We do not store full card details ourselves. The legal basis is Art. 6(1)(b) GDPR. Card payments and Apple Pay are processed via Stripe. The payment providers are independently responsible for their processing; see their privacy notices for details.

8. Contacting us

If you contact us by email or phone, we store your details to handle your enquiry and any follow-up questions. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, otherwise Art. 6(1)(f) GDPR. We delete the data once your matter has been fully resolved and no retention obligations apply.

Through the contact form you send us your name, email address, topic, optionally an order number and your message. We store these details in our email inbox on our own server (see section 3) in order to reply to you; the same legal bases and deletion periods apply. To protect against spam, we evaluate your IP address and email address in the server's memory for at most 15 minutes to limit the number of messages; they are not stored permanently for this purpose.

Through the enquiry form on our wholesale page you send us your company name, type of business, delivery country, optionally your VAT ID, the approximate quantity, how often you would order and optionally a preferred date and a message, as well as the name, email address and optionally the phone number of the contact person. We use these details to assess the enquiry, send you a quote and stay in touch with you about it. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract); if you enquire on behalf of a company, we process the contact person's data on the basis of our legitimate interest in handling business enquiries (Art. 6(1)(f) GDPR). We store the enquiry in our shop system and in our email inbox (see section 3). If no contract results, we delete it as soon as that is clear; if a contract is concluded, we keep the correspondence as business letters for six years (Section 257 of the German Commercial Code). To protect against spam, we evaluate your IP address and email address in the server's memory for at most one hour to limit the number of enquiries.

After you submit the form, we send an automatic confirmation of receipt to the email address you entered and notify our team of the enquiry by email. We send these emails, and our replies to enquiries, through Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes the sender, recipients and content of the email on our behalf (Art. 28 GDPR). As Resend is a US company, the transfer to the USA is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Resend's privacy policy: https://resend.com/legal/privacy-policy

9. Fonts

The fonts used in the shop are served from our own server. No connection to Google or any other third party is established when the fonts are loaded.

10. Google Maps

On our contact page we use Google Maps to show where our workshop is. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland. The map only loads once you click “Show map”. Only then does your browser connect to Google's servers; Google receives in particular your IP address and information about your browser and may set cookies.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG, which you give by clicking. You can withdraw it at any time with effect for the future by reloading the page – the map will then no longer be loaded. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists.

More information: https://policies.google.com/privacy

11. Data security

Our shop is delivered exclusively over an encrypted connection (TLS/HTTPS). We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access.

12. Your rights

You have the following rights regarding your personal data:

  • Access to the data we hold about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR)
  • Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

  • Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
  • Kavalleriestraße 2-4, 40213 Düsseldorf
  • https://www.ldi.nrw.de

14. Changes to this privacy policy

We update this policy when our shop or the legal situation changes. The version published here applies.