Privacy notice

Controller

Crunchies Hot Chicken GmbH, Lindwurmstraße 110, 80337 Munich, Germany. Contact: info@crunchieshotchicken.com. This notice covers our website and Crunchies app.

Account, orders and rewards

We process your name, email address, optional phone number, account identifier, orders, payment status, pickup details, points and stamps to provide your account, orders and loyalty programme. The legal basis is performance of the relevant contract (GDPR Article 6(1)(b)). Your account and rewards work without marketing consent.

Payments

Stripe processes payment information. We receive transaction identifiers and payment status rather than complete card details. See stripe.com/privacy. Payments concern physical food and drinks.

Optional marketing emails

Offers and news from Crunchies Hot Chicken GmbH require separate voluntary consent (GDPR Article 6(1)(a)). Registration or an order is not marketing consent. When you request email updates in your profile, we send a confirmation link valid for 24 hours. The subscription only activates after confirmation. We record the email address, consent wording and version, language, request, confirmation and withdrawal timestamps. You can withdraw in your profile or using the unsubscribe link. Withdrawal does not affect prior lawful processing. Order, account and security emails are independent. This confirmation flow is intended for the new app version; subscriptions are unavailable until sending is activated.

Technical providers

Vercel hosts the website and app API. Supabase provides account authentication and the database. Resend delivers order and confirmation emails. Providers receive the data needed for their functions. Their privacy information is available at vercel.com/legal/privacy-policy, supabase.com/privacy and resend.com/legal/privacy-policy. Processing outside the EEA is subject to the applicable international-transfer requirements.

Devices, notifications and Apple Wallet

The app stores your session and selected language and appearance on your device; iOS session data uses protected device storage. Team leader reminders and kitchen notifications are separately enabled and do not constitute marketing consent. Kitchen push uses a device token, account and location association, language and delivery status through Expo and Apple Push Notification Service. Wallet cards are created on request; card and device identifiers are used for updates. See expo.dev/privacy and apple.com/legal/privacy. Browser design previews use fictional data.

Employee features

Authorised employee features process shifts, availability, absence requests and team tasks for employment administration. The personal earnings view estimates gross pay from your own published shifts and current pay rates; it is not confirmed time tracking or a payslip. Employees cannot view other employees’ pay. Employment processing is governed by Section 26 BDSG and applicable requirements for sensitive data. Role restrictions also protect kitchen order information.

Security and technical logs

Technical request data, including IP addresses, request times and device/browser information, supports operation, troubleshooting and abuse prevention (GDPR Article 6(1)(f)). We restrict access by account and role and use protected transport. This does not mean that all risks can be eliminated.

Retention and deletion

Data is retained as needed for its purpose and applicable legal obligations. You can request customer-account deletion in the app profile with password confirmation. Open orders are completed first. The cleanup removes account associations and personal order fields; anonymous transaction totals and items can remain for documentation. Statutory retention and payment-provider obligations remain applicable. Marketing preferences and evidence linked to the account are deleted with it. Remove any saved Wallet card from your device. Employee-account requests go to management. Contact us for retention questions.

Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction, portability or object to processing. You can complain to a data protection authority, including the authority in your place of residence or work. Contact info@crunchieshotchicken.com.

Updated 15 October 2026