Privacy Policy

Here we explain which personal data we process on our website and for what purposes.

1. Controller

Konstantin Milonas
mein-kuechenexperte (sole proprietor)
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany

Phone: +49 (0)711 39080786
E-mail: [email protected]

2. Data Protection Officer

We have not appointed a data protection officer, as there is currently no legal obligation to do so.

3. Overview: Legal Bases

We process personal data only where a legal basis exists. Typical legal bases include:

  • Art. 6(1)(b) GDPR (pre-contractual measures/contract) - e.g., consultation, offer, appointment, order.
  • Art. 6(1)(f) GDPR (legitimate interests) - e.g., IT security, operation of the website.
  • Art. 6(1)(a) GDPR (consent) - e.g., for optional tools/integrations.

4. Website Access (Hosting, Server Log Files)

When you access our website, our server processes technically required data (server log files) to deliver and secure the website:

  • IP address
  • Date/time
  • Requested page/file
  • Referrer URL
  • Browser type/version, operating system
  • Status code, amount of data transferred

Purpose: Operation, stability and security (e.g., defense against attacks).
Legal basis: Art. 6(1)(f) GDPR.
Storage period: Log files are stored only as long as required for security analysis and then deleted/anonymized (typically a few days).

5. Cookies, Consent and "Cookie settings"

Our website may use cookies and similar technologies (e.g., localStorage, pixels, scripts) to provide functions. Additional rules under section 25 TDDDG apply to the storage of information on your end device and to access to such information.

5.1 Technically necessary technologies

Technologies strictly required to operate the website (e.g., security functions) may be used without consent.
Legal basis: Art. 6(1)(f) GDPR and section 25(2) TDDDG (where applicable).

5.2 Optional technologies (e.g., external content such as Zeeg)

We only use optional technologies if you have consented in advance. This includes, in particular, external content/tools that may trigger additional cookies/connections to third parties (e.g., appointment booking).
Legal basis: Art. 6(1)(a) GDPR and section 25(1) TDDDG.

Open cookie settings Browser deletion notes

Withdrawal/change: You can change or withdraw consent at any time with future effect - via the cookie settings or through your browser (see below).

6. Contact (contact form, e-mail, phone)

If you contact us, we process your data to handle your request and for follow-up questions.

Processed data:

  • Name
  • E-mail address
  • Phone number (if provided)
  • Subject/message and content you send to us

Mandatory information: Fields marked with "*" are required so we can process your request. Without this information, we generally cannot respond.

Purpose & legal basis: Processing of (pre-)contractual inquiries, Art. 6(1)(b) GDPR; otherwise Art. 6(1)(f) GDPR (communication interest).

Storage location & processing: Your contact data is transmitted to and stored in our e-mail inbox (OVH Mail). To optimize processing, data may be exported in a structured format (e.g., CSV file) and processed locally.

Storage period: Contact inquiries are stored for the duration of processing and correspondence. After completion, data is deleted unless a contract is concluded. If a contract is concluded, statutory retention periods apply (e.g., 6 years under section 257 HGB, 10 years under section 147 AO for tax-relevant documents).

7. File Upload

Via the upload page, you can send us documents (e.g., floor plans, photos, offers).

Processed data:

  • Name, e-mail, phone
  • Message (optional)
  • Uploaded files and information contained therein
  • Technical metadata generated during upload (e.g., timestamp)

Note: Please do not upload sensitive data (e.g., health data) and, where possible, redact personal data that is not needed.

Purpose & legal basis: Consultation/planning and preparation of an offer or contract, Art. 6(1)(b) GDPR.

Storage location & processing: Uploaded files are transmitted to and stored in our e-mail inbox (OVH Mail). To optimize processing, data may be exported in a structured format (e.g., CSV file) and processed locally.

Storage period: Uploaded files and related contact data are stored for the duration of project consultation, planning and implementation. After project completion or if no contract is concluded, data is deleted within 6 months unless statutory retention obligations apply (e.g., 6 years under section 257 HGB, 10 years under section 147 AO for tax-relevant documents).

8. Appointment Booking via Zeeg

We use Zeeg for appointment bookings. When opening the booking calendar, a connection to the provider is established.

Provider:
Zeeg (appointment booking platform)
Website: https://zeeg.me

Which data is typically processed?

  • Appointment/booking data (selected appointment, time zone)
  • Contact/communication data (e.g., name, e-mail, phone if applicable)
  • Answers to booking questions (if configured)
  • For paid appointments: payment status/billing information; payment data may be processed by the respective payment service provider.
  • Technical data (e.g., IP address, device/browser) depending on integration

Purpose & legal basis:

  • Appointment organization and execution (Art. 6(1)(b) GDPR)
  • Integration as external content (if not technically necessary): consent (Art. 6(1)(a) GDPR) and section 25(1) TDDDG

Third-country transfer: Depending on technical delivery, processing outside the EEA may occur. In such cases, processing only takes place where requirements under Art. 44 et seq. GDPR are met.

Alternative: If you do not wish to use Zeeg, you may request an appointment by e-mail.

9. AI Chatbot (OpenAI)

We provide an AI-powered chatbot on our website. Use is voluntary. When you open and use the chatbot, your inputs are processed to generate responses.

9.1 Processed data

  • Chat content (your messages)
  • Chat ID (unique session identifier for conversation assignment)
  • Contact data if you provide it in the chat
  • Technical data (e.g., timestamps; possibly IP address depending on technical delivery)
  • Local storage (e.g., chat history in localStorage), where technically used

9.2 Purposes

  • Answering questions and initial consultation
  • Preparation of contact requests/quote requests (if you use the chat for this purpose)
  • IT security and abuse prevention

9.3 Legal bases

Consent (Art. 6(1)(a) GDPR): for voluntary use of the chatbot as an optional tool.
Pre-contractual measures/contract (Art. 6(1)(b) GDPR): if the chat content relates to initiation/performance of consultation services.
Legitimate interests (Art. 6(1)(f) GDPR): for IT security (e.g., defense against abuse).

9.4 Recipients / processors

We use OpenAI services to generate responses. For customers in the EEA/Switzerland, the contractual party is typically OpenAI Ireland Ltd. OpenAI processes content as a processor under contractual arrangements (DPA).

According to OpenAI, data sent through the OpenAI API is not used to train models by default unless an explicit opt-in is provided.

Brevo CRM integration: If you provide contact data or submit an inquiry in chat, this data may be transferred to our CRM system (Brevo, formerly Sendinblue). Brevo processes data as a processor under Art. 28 GDPR.

Provider: Brevo (formerly Sendinblue), Sendinblue GmbH, Koepenicker Str. 126, 10179 Berlin, Germany
Parent company: Sendinblue SAS, 55 rue d'Amsterdam, 75008 Paris, France
Privacy notice: Brevo Privacy Policy
Data processing: Brevo Data Processing Agreement (DPA)

Processed data in Brevo:

  • Contact data (name, e-mail, phone)
  • Chat ID (conversation assignment)
  • Chat content and inquiry information
  • Custom attributes (e.g., kitchen type, budget, project phase)
  • Tags (e.g., "Chatbot-Lead", "Quick-Check-Interest")

Purpose of Brevo integration: Contact management, lead management, sending transactional e-mails (e.g., confirmations, offers), CRM management (deals/opportunities).

9.5 Third-country transfer

Depending on setup, processing outside the EEA may occur (e.g., USA). Under the OpenAI DPA, transfers are based on EU Standard Contractual Clauses (Art. 46 GDPR) and/or, where applicable, an adequacy decision (Art. 45 GDPR). Please note that in case of data transfer to the USA, access by US authorities cannot be completely excluded.

9.6 Storage period

  • At OpenAI: according to OpenAI, content (prompts/responses) may be retained in logs for abuse prevention for up to 30 days and then deleted unless legal obligations require longer retention.
  • In the browser (localStorage): a chat history may be stored locally in your browser and remains there until manually deleted or browser data is removed.
  • By us (e-mail/Brevo CRM): if you provide contact data or submit an inquiry in chat, data is stored in our e-mail inbox and/or Brevo CRM. The storage period depends on purpose:
    • Inquiries without contract conclusion: deletion after correspondence is completed or at the latest after 6 months
    • In case of contract conclusion: statutory retention periods (6 years under section 257 HGB, 10 years under section 147 AO)

9.7 Data security

Data transmission between your browser and our website, and to external services, is encrypted (TLS). The chatbot is technically provided via Cloudflare Workers (EU server location), where configured by us accordingly.

9.8 Further information

10. Payment Processing (Stripe)

We use Stripe to process payments. If you book a paid service, you are redirected to Stripe's secure payment page.

Provider:
Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland
Privacy notice: Stripe Privacy Policy

Processed data:

  • Name, e-mail address
  • Billing address
  • Payment data (credit card data or SEPA bank details)
  • Order information (product, amount)
  • Technical data (IP address, device/browser)

Purpose & legal basis: Payment processing for contract performance, Art. 6(1)(b) GDPR.

Third-country transfer: Stripe may transfer data to the USA. Transfers are based on the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR) and/or EU Standard Contractual Clauses (Art. 46 GDPR).

Storage period: Stripe stores payment data in accordance with legal retention obligations and its own policies. We do not store full payment data ourselves (e.g., full credit card numbers).

Invoicing: After successful payment, Stripe automatically issues an invoice and sends it to you by e-mail.

11. Recipients, data processing agreements

We use service providers that process data on our behalf (Art. 28 GDPR), for example for:

  • Hosting/operation/maintenance of the website
  • E-mail/communication services (OVH Mail)
  • CRM and marketing automation (Brevo)
  • AI-powered chatbot functions (OpenAI)
  • Payment processing (Stripe)
  • Appointment scheduling (Zeeg)
  • IT security/abuse prevention

Further recipients may be involved where required for contract performance or where we are legally obliged to do so.

Access to personal data: Only the controller (Konstantin Milonas) has direct access to data stored in the e-mail inbox and CRM.

12. Transfers to third countries

Data transfer outside the European Economic Area (EEA) only takes place where the requirements of Art. 44 et seq. GDPR are met, e.g., by adequacy decision and/or appropriate safeguards (e.g., EU Standard Contractual Clauses), and where necessary additional protective measures.

13. Storage period

We store personal data only as long as necessary for the relevant purpose. We then delete the data unless statutory retention obligations (e.g., under commercial or tax law) prevent deletion.

14. Your rights

Depending on legal requirements, you have the following rights:

  • Access (Art. 15 GDPR)
  • Rectification (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection (Art. 21 GDPR), if processing is based on legitimate interests
  • Withdrawal of consent (Art. 7(3) GDPR) with effect for the future

To exercise your rights, simply send a message to [email protected].

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority.

Usually competent for us:
State Commissioner for Data Protection and Freedom of Information Baden-Wuerttemberg
Heilbronner Strasse 35, 70191 Stuttgart, Germany
Phone: +49 711 615541-0

16. Data security

We implement technical and organizational measures to protect data (e.g., TLS encryption in transit, access restrictions).

You can delete or block cookies and website data in your browser at any time. Please note that this may limit functionality.

18. Version

18 July 2025