GDPR Compliance Information

Introduction

If you are located in the European Union (EU) or European Economic Area (EEA), the General Data Protection Regulation (GDPR) grants you specific rights regarding your personal data. This page explains those rights and how MenuMate complies with GDPR requirements.

Data Controller

For the purposes of GDPR, the data controller is:

Alexandra Gerken
Email: menumate@posteo.no
Service: MenuMate

Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: You consent to our processing of your data when you create an account
• Contract Performance: Processing is necessary to provide the MenuMate service to you
• Legitimate Interests: We have a legitimate interest in improving our service and preventing fraud

What Personal Data We Collect

We collect and process the following personal data:

• Name: To identify you within your canteen community
• Email Address: For account creation, authentication, and communication
• Ratings and Reviews: Content you voluntarily post about dishes
• Canteen Affiliation: The canteen you are associated with
• User ID: A unique identifier for technical purposes
• Usage Data: How you interact with the app (features used, dishes viewed)

Your GDPR Rights

1. Right to Access (Article 15)

You have the right to request access to your personal data and receive a copy of the data we hold about you.

2. Right to Rectification (Article 16)

You have the right to correct inaccurate or incomplete personal data. You can update your name and email directly in your account settings.

3. Right to Erasure / "Right to be Forgotten" (Article 17)

You have the right to request deletion of your personal data. When you request account deletion, we will delete your name and email address within 30 days. Please note:

• Ratings and reviews are already stored in anonymized form and will be retained for statistical purposes
• We may retain certain data where required by law or for legitimate interests (e.g., fraud prevention)

4. Right to Restriction of Processing (Article 18)

You have the right to request that we restrict processing of your personal data in certain circumstances, such as while we verify the accuracy of data you have contested.

5. Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format (e.g., JSON or CSV) and to transfer it to another service provider.

6. Right to Object (Article 21)

You have the right to object to processing of your personal data where we rely on legitimate interests as our legal basis for processing.

7. Right to Withdraw Consent

Where processing is based on consent, you have the right to withdraw your consent at any time. This does not affect the lawfulness of processing before consent was withdrawn.

8. Right to Lodge a Complaint

You have the right to lodge a complaint with your local data protection authority if you believe your data protection rights have been violated.

How to Exercise Your Rights

To exercise any of your GDPR rights, please contact us at:

Email: menumate@posteo.no

Please include:

• Your full name and email address associated with your MenuMate account
• The specific right you wish to exercise
• Any additional information needed to process your request

We will respond to your request within 30 days as required by GDPR. In complex cases, we may extend this period by up to 60 additional days and will inform you of the extension.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

• Active Accounts: Data is retained while your account is active
• Deleted Accounts: Personal identifiers (name, email) are deleted within 30 days of account deletion
• Anonymized Data: Ratings and statistical data are stored in anonymized form and may be retained indefinitely
• Legal Requirements: Data may be retained longer if required by law

Data Transfers

Your personal data may be transferred to and processed in countries outside the EU/EEA, specifically:

• United States: Firebase (Google Cloud Platform) servers
• Other Countries: Where Google operates data centers

When transferring data outside the EU/EEA, we ensure appropriate safeguards are in place:

• Google is certified under the EU-US Data Privacy Framework
• Google uses Standard Contractual Clauses (SCCs) approved by the European Commission
• Google implements appropriate technical and organizational security measures

Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption in transit (HTTPS/TLS)
• Secure password hashing
• Access controls and authentication
• Regular security updates
• Firebase security infrastructure

Automated Decision-Making

MenuMate does not use automated decision-making or profiling as defined by GDPR Article 22.

Children's Data

MenuMate is not intended for children under 16 years of age (or the applicable age of digital consent in your country). We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

Data Breach Notification

In the event of a data breach that poses a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach
• Notify affected users without undue delay if the breach poses a high risk
• Provide information about the nature of the breach and steps taken to address it

Third-Party Data Processors

We use the following third-party processors:

• Firebase / Google Cloud Platform: Hosting, authentication, and database services

We have ensured that all processors comply with GDPR requirements and have appropriate data processing agreements in place.

Important Notice: Data Visibility

Privacy Protection: Your ratings and reviews are anonymized and de-identified before being displayed to other users. Other users can see ratings and reviews within your canteen community, but they cannot identify who posted them. Your name is not displayed alongside your ratings.

Contact and Complaints

Data Controller:
Alexandra Gerken
Email: menumate@posteo.no

To Lodge a Complaint:
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with your local data protection supervisory authority. In Germany, this is your state's data protection authority (Landesdatenschutzbeauftragte).

Updates to This Policy

We may update this GDPR information from time to time. Material changes will be communicated to you via email or through the app. The "Last updated" date at the top of this page shows when changes were made.