Privacy policy

Last updated: 6 October 2026

1. Who is responsible

Julie Stoelzel, The Zest Catering, Hannoversche Straße 88a, 21079 Hamburg, Germany. Email: contact@thezest.eu

For any question about your data, write to us at that address.

2. Visiting this website

Hosting. This website runs on Squarespace (Squarespace Ireland Ltd., Dublin). When you open a page, technical data your browser sends is processed automatically: IP address, date and time, the page requested, browser and operating system. This is needed to deliver the website and keep it secure (Art. 6(1)(f) GDPR). Squarespace processes this data on our behalf under a data processing agreement. Its parent company is based in the United States; transfers there are covered by the EU–US Data Privacy Framework and Standard Contractual Clauses.

Fonts. To display our typefaces, the website loads fonts from Adobe Fonts (Adobe Systems Software Ireland Ltd.) and, on some pages, Google Fonts (Google Ireland Ltd.). Your browser connects to their servers and transmits your IP address. We do this for a consistent appearance (Art. 6(1)(f) GDPR). Both providers are certified under the EU–US Data Privacy Framework.

SEO extension. We use an extension by TinyIMG (Lithuania) to optimise the website for search engines. It loads a script from TinyIMG's servers, which transmits your IP address (Art. 6(1)(f) GDPR).

3. Cookies and similar technologies

Essential cookies. Squarespace sets cookies that are needed to load the website securely and to remember your cookie choice. They do not require consent (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).

Performance and analytics (only with your consent). If you allow "Performance and Analytics" in the cookie banner, we use Google Analytics 4 (Google Ireland Ltd., Dublin) and Squarespace Analytics to understand how visitors use the website: pages viewed, the site you came from, approximate location, device and browser, and whether an enquiry was sent. Google Analytics is only loaded after you consent and does not store IP addresses. Google Analytics data is kept for a maximum of 14 months (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Advertising (only with your consent). If you allow "Advertising", we use the Meta Pixel (Meta Platforms Ireland Ltd., Dublin). It shows us whether visitors come from our ads on Instagram or Facebook and whether they send an enquiry, so we can measure our ads and show them to people likely to be interested. Meta may link this information to your Instagram or Facebook account. For collecting and transmitting this data, we and Meta are joint controllers (Art. 26 GDPR); Meta's further processing is governed by its own privacy policy (§ 25(1) TDDDG, Art. 6(1)(a) GDPR).

Google and Meta may also process data in the United States; both are certified under the EU–US Data Privacy Framework.

Your choice. You decide in the cookie banner when you first visit. You can change or withdraw your consent at any time with the "Cookie Preferences" button at the bottom of every page. Withdrawing consent does not affect processing that took place before.

4. Quote requests and contact

When you fill in our quote form or email us, we process the details you give us: name, email address, phone number, city, event date, number of guests, occasion, service format, venue or address, dietary requirements, budget range and your message. We use them to answer your enquiry and prepare your quote (Art. 6(1)(b) GDPR).

Information about allergies or intolerances can be health data. We only process it with your explicit consent, which you give by ticking the box in the form (Art. 9(2)(a) GDPR), and only to plan your menu safely. You can withdraw your consent at any time with effect for the future.

Form entries are stored by Squarespace and forwarded to us by email. Our email is hosted by Hostpoint AG in Switzerland, a country the European Commission recognises as providing an adequate level of data protection.

5. Bookings

If you book with us, we process your contact, event and billing details to deliver your event and invoice it (Art. 6(1)(b) GDPR). We keep invoices and booking records for as long as German commercial and tax law requires (Art. 6(1)(c) GDPR). You can pay by bank transfer or via a card payment link; your bank or the payment provider processes the payment data. Dietary information is shared only with the team preparing your event.

6. News and updates

If you tick "Sign up for news and updates" in a form, we use your email address to send you occasional news from The Zest (Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every email or by writing to us.

7. Instagram

This website links to our Instagram profile. Nothing is loaded from Instagram until you click the link. After that, the privacy policy of Meta Platforms Ireland Ltd. applies.

8. How long we keep data

Enquiries that do not lead to a booking are deleted 12 months after our last contact. Booking records and invoices are kept for the statutory retention periods (up to 10 years). Newsletter data is kept until you unsubscribe.

9. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), to object to processing based on legitimate interests (Art. 21), and to withdraw consent at any time (Art. 7(3)). Write to contact@thezest.eu.

You can also complain to a data protection authority, for example the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), Ludwig-Erhard-Straße 22, 20459 Hamburg, or the authority where you live (in Spain: the Agencia Española de Protección de Datos).

10. Good to know

You are not obliged to give us your data, but without it we cannot prepare a quote. We do not use automated decision-making within the meaning of Art. 22 GDPR.

We update this policy when our services or the law change. The current version is always on this page.