Privacy Policy

1. Controller

Anh Lê Duy, trading as Simply Yellow Catering
Emser Str. 25
10719 Berlin
Germany

Email: catering@simplyyellow.de
Phone: +49 1578 5147523

2. Catering inquiries

When you submit the inquiry form, we process your name, email address, telephone number, selected service and menu preferences, event date, expected guest count, postal code, and any optional company, time, staffing, or free-text details you provide.

We use this information to answer your request, clarify your requirements, and prepare a possible catering offer. The processing is necessary for steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). If your message is a general business inquiry rather than a pre-contractual request, we process it to communicate with you and operate our business efficiently on the basis of our legitimate interests (Article 6(1)(f) GDPR).

Fields marked as required are needed to understand and answer the inquiry. Without them, the form cannot be submitted.

3. Delivery, hosting, and abuse protection

MailerSend processes inquiry messages on our behalf as an email service provider. Vercel hosts the website and serverless inquiry endpoint and may process technical request information, including IP address, request time, requested resource, and browser or system information, to deliver and secure the service.

To protect the public form and mail service from automated abuse, the server creates a keyed, pseudonymous identifier from the requesting IP address. The identifier and short-lived counters are kept only in the working memory of the inquiry endpoint, are not stored permanently, are not passed to any further service and never include the inquiry contents. They enforce per-connection and global request limits. Burst counters expire within 15 minutes, daily counters within 24 hours, and all counters are deleted at the latest when the endpoint restarts. In addition, the Vercel firewall limits the number of inquiry requests per IP address. This processing supports our legitimate interest in service availability, fraud prevention, and sender-reputation protection (Article 6(1)(f) GDPR).

These providers receive only the data needed for their respective service. Where processing takes place outside the European Economic Area, applicable contractual and statutory transfer safeguards are used.

4. Browser storage and cookies

The website stores your consent-preference decision in local storage and in a SameSite=Lax cookie for six months so it does not need to ask on every visit. This storage is necessary to provide the privacy setting you requested (§ 25(2) TDDDG). At the date of this policy, the site does not activate analytics, marketing, or embedded third-party content categories.

While you complete the multi-step inquiry, a draft may be stored in session storage in the current browser tab for up to 24 hours. It can include the information you enter, stays on your device until submission, expiry, or the end of the browser session, and is cleared after a confirmed successful submission.

5. Retention

Inquiry messages are kept only for as long as needed to answer the request, prepare or perform a contract, comply with applicable statutory record-keeping duties, or establish, exercise, or defend legal claims. When none of those purposes applies, the information is deleted or anonymized.

Browser-preference and draft periods are described above. Rate-limit counters expire automatically within their stated short windows. Hosting and email-provider operational records are retained according to the provider settings and applicable legal requirements.

6. Your rights

Subject to the legal conditions, you may request access, correction, deletion, restriction, or portability of your personal data. You may object to processing based on legitimate interests. You may also lodge a complaint with a data-protection supervisory authority.

For privacy requests, contact catering@simplyyellow.de. The competent Berlin authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, email mailbox@datenschutz-berlin.de.

7. Direct-contact links

Email, telephone, and WhatsApp links are ordinary outbound links. The website does not embed WhatsApp content or transmit inquiry details to WhatsApp automatically. If you choose a link, the selected provider or application processes the information you send under its own terms and privacy policy.

8. Changes to this policy

We update this policy when the website, service providers, or legal requirements change. The date above identifies the current published version.