Privacy policy

1. Who is responsible

The controller for the processing of your personal data on this website is:

Email: hello@chefladou.com

You can reach us at this address with any question about data protection.

2. Overview

chef ladou is an online cooking course. We process your data to show you the website, provide your account and your course, handle purchases and appointments, answer your questions and — only if you agree — measure how the website is used and send you notes by email. We do not sell data or use it for advertising on other websites.

3. Hosting and server logs

The website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). On every visit Vercel processes technically necessary data: IP address, date and time, the page requested, the referrer, and your browser and operating system. This is needed to deliver the website securely and reliably.

The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). For transfers to the USA see section 13.

4. Cookies and storage on your device

Without your consent we only set what the website technically needs:

• ladou-locale — remembers your language (German or English). Kept for 1 year.
• cl_consent — remembers your choice in the privacy notice. Kept for 1 year.
• Sign-in cookies (from Supabase, starting with “sb-”) — keep you signed in while you are logged in.
• Your browser’s local storage — your privacy choice and drafts of your notes and workbook answers. They stay on your device until you delete them.

The legal basis is § 25(2) no. 2 TDDDG and, for the related processing, Art. 6(1)(b) and (f) GDPR. Anything else — the analytics in section 11 — only runs with your consent.

5. Your account and your course

When you create an account we store your email address and your password (encrypted only). While you take the course we store your progress, your workbook answers, your notes and your ingredient markings. When you start, you can voluntarily tell us about your kitchen, your household, your preferences and any allergies or intolerances.

Information about allergies and intolerances is health data. We only process it if you enter it yourself, and only to tailor the course to you (Art. 9(2)(a) GDPR). You can change or delete it at any time.

Accounts and course data are stored with Supabase Inc. (970 Toa Payoh North #07-04, Singapore 318992). The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR).

6. Orders and payment

Payments are handled by Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). You enter your payment details directly with Stripe; we never see them. From Stripe we receive your name, email address, the product, the amount and the payment status. Stripe also sends the receipts.

The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We keep order and invoice data for as long as commercial and tax law require (up to 10 years, Art. 6(1)(c) GDPR).

7. Kitchen Check and live cooking

For a Kitchen Check we store your appointment and your answers to the questions about your kitchen and your week, so the session is prepared. Afterwards we save the recommendations to your account. For live cooking we store your registration for the session.

Sessions take place online via [video conferencing service]. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

8. Contact form and email

When you write to us we store your name, email address, topic and message in order to reply. You receive a short confirmation by email. The legal basis is Art. 6(1)(b) GDPR where your message concerns a purchase or contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete enquiries once they are settled and no retention duty applies.

9. Notes from the kitchen (newsletter)

When you sign up we store your email address, the time and place of sign-up and your language, and now and then send you a short note. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time — via the link in every email or by writing to hello@chefladou.com.

10. Customer management

We transfer enquiries, bookings and purchases into our own customer management system (Orbit), so we keep track and can reply reliably. Orbit is run for us on Vercel and Supabase. The legal basis is Art. 6(1)(b) and (f) GDPR.

11. Analytics — only with consent

If you agree in the privacy notice, we use PostHog (PostHog Inc., servers in the EU) to understand how the website is used: which pages are viewed, which buttons are clicked and — in session recordings — how visitors move through pages. Form fields, your notes and your workbook are masked and never recorded.

The legal basis is your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can withdraw it at any time via “Privacy choices” at the bottom of every page; after that nothing is measured.

12. Sending email, course videos and course files

We send emails such as confirmations and course messages through Resend (Resend, Inc., USA). Course videos are delivered through Cloudflare Stream (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA); Cloudflare processes your IP address and playback data to play the video.

Course files such as workbooks, checklists and images are stored with Cloudflare R2 (the same provider). Those files are stored in the European Union. You open them through links that expire after a short time, and Cloudflare processes your IP address when you do.

The legal basis for both is Art. 6(1)(b) GDPR (performing the course contract).

13. Transfers outside the EU

Some of the providers named above are based in the USA or Singapore or may access data from there. We have data processing agreements with all of them. Transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

14. How long we keep data

We keep data only as long as we need it for its purpose: account data until you delete your account; order and invoice data until the statutory retention periods end; enquiries until they are settled; newsletter data until you unsubscribe.

15. Your rights

You have the right to

• access the data we hold about you (Art. 15 GDPR),
• rectification (Art. 16 GDPR) and erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw consent with effect for the future (Art. 7(3) GDPR).

Right to object: where we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Just write to hello@chefladou.com or use the contact form. You may also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live or where we are based.

16. What you must provide; no automated decisions

For an account and a purchase we need your email address; without it we cannot provide the course. Everything else is voluntary. We do not make automated decisions within the meaning of Art. 22 GDPR.

17. Changes

When our website or the services we use change, we update this policy. The version published here applies.