Privacy policy.
This policy is written in plain language because we'd rather you read it than skim it.
Who we are
The controller within the meaning of Art. 4 (7) GDPR is PNC BREAD UG (haftungsbeschränkt) i.Gr., represented by J. Marquardt, Leitzachtalstrasse 126, 83730 Elbach-Fischbachau, Germany.
Contact: hello@pncbread.love · See Imprint for company details.
What data we collect, and why
Just enough to send you bread.
- Name, email, country and number of packs — entered in the order form, so we can prepare your order and send the confirmation. Lawful basis: performance of a contract (Art. 6 (1) (b) GDPR).
- Postal address and payment details — entered on the Stripe checkout page, not on this site. We receive your address for shipping; we never see your card number.
- Anonymous visit statistics — we count page views and order steps in our own database, with the referring website's name and campaign tag if there is one. No cookies and no personal data: your browser keeps a random identifier that changes every day. Lawful basis: legitimate interest (Art. 6 (1) (f) GDPR) in knowing whether the site works.
- Server logs — our host (GitHub Pages) records technical access data such as IP address and time of request to keep the site secure. Lawful basis: legitimate interest (Art. 6 (1) (f) GDPR).
What we don't do
- No advertising, no tracking pixels, no cookies, no third-party analytics.
- We do not sell your data or share it with advertisers.
- Fonts and images are served from our own domain — nothing loads from Google.
Who else sees your data
- Supabase (database, servers in the EU, Ireland) — stores your order.
- Stripe (payment) — processes your payment under its own privacy policy.
- Courier (DHL / DPD or a local courier) — receives your name and address.
- open.er-api.com — to show prices in your currency, your browser fetches today's exchange rates once a day. This request carries your IP address but no personal details. The rates are stored only in your browser.
How long we keep it
- Orders that were never paid: up to 12 months.
- Paid orders: as long as German commercial and tax law requires (up to 10 years).
Your rights under the GDPR
You can ask us to:
- send you everything we have on you (right of access);
- correct anything that's wrong (rectification);
- delete it all (right to erasure);
- stop processing it (restriction);
- export it in a portable format (data portability);
- object to processing.
Email privacy@pncbread.love. We answer within 30 days, usually within a week. You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority competent for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany — lda.bayern.de.
Cookies
This site sets no cookies. It stores the day's exchange rates and the daily statistics identifier in your browser's local storage so it does not have to ask again; you can clear it at any time.
Changes
If we change anything material we'll bump the version number above and email everyone affected before the change takes effect.
The short version. We collect your name, email and shipping address. We use them to send you bread. We don't sell them, and we set no cookies. You can ask us to delete everything any time at privacy@pncbread.love.