rvmasterworks.com +1 941 324 0559
DE EN
Reserve

Privacy policy

Privacy Policy

Information about the processing of personal data when using this website and reservation requests.

Status: 2026-05-27-3

This privacy policy applies to menustern.de, my.menustern.de and affiliated MenuStern services. Services such as Stripe, Google Analytics, Google Tag Manager, Meta Pixel, Meta Conversions API, OpenAI, Telegram, email delivery or CDN/storage are only used if they are technically activated or configured by the customer.

1. Controller

The controller within the meaning of the GDPR is:

JUDIGO UG (limited liability)
Poststraße 18
99610 Sömmerda
Germany
Email: [email protected]
Represented by: Igor Larionov

2. Scope

This privacy policy applies to the websites and services of MenuStern, especially menustern.de, my.menustern.de, subdomains provided by MenuStern such as restaurant.menustern.de, as well as the CRM, website builder, reservation, media, import, translation, and AI features of the platform.

3. Roles: Controller and Processor

For the management of MenuStern customer accounts, contract processing, registration, billing, security, support, and own communication, JUDIGO UG is the controller. For personal data of guests, website visitors, reservation customers or end customers processed by a MenuStern customer via their website or CRM functions, the respective customer is generally the controller. JUDIGO UG processes this data as a processor pursuant to Art. 28 GDPR, insofar as necessary for providing the platform. Additionally, the data processing agreement (DPA) applies.

4. Categories of Personal Data

  • Registration data: project/object name, desired MenuStern address/subdomain, first name, last name, email address, phone number, main language of the website, password stored encrypted or password hash.
  • Account, team and permission data: user roles, invitations, team members, agency/SMM access, permissions, login times, account status, tariff, contract status and consent history.
  • Restaurant, hotel, café and object data: name, address, opening hours, contact details, logo, images, texts, dishes, drinks, prices, allergens/additives, categories, QR menu information, website content, domains and preview links.
  • Upload and media data: PDF, Word, Excel/CSV, photos, menu sources, image and media files as well as extracted content.
  • Reservation, contact and CRM data, if used: name, phone number, email address, reservation date, time, number of persons, message/comment, status, internal notes, hotel or object inquiries.
  • Billing and payment data: billing address, tax number or VAT ID, tariff, booking and payment status, payment references and transaction information provided by the payment service provider.
  • Technical data: IP address, date/time, browser, device, operating system, referrer, log files, session data, security events, audit logs and error messages.
  • Integration data: analytics IDs, Google or Meta configurations, Telegram bot/notification settings, domain/DNS information, API or access tokens, insofar as provided by the customer.
  • Communication data: emails, support requests, form messages, system notifications and newsletter consents.

5. Purposes of Processing

  • Provision, operation, maintenance and security of the SaaS platform.
  • Registration, login, management of accounts, teams, permissions and subdomains.
  • Creation, hosting and publication of restaurant, hotel, café or object websites.
  • Management of digital menus, QR menus, multilingual content, media, files and galleries.
  • Import, structuring, translation, recognition and review of menu contents.
  • Provision of reservation, contact, CRM, notification and integration functions.
  • Billing, contract management and payment processing if paid tariffs are used.
  • Prevention of abuse, error analysis, IT security, auditing and proof of consents.
  • Marketing communication only based on consent or legally permissible existing customer communication.

6. Legal Bases

  • Art. 6 para. 1 lit. b GDPR: contract fulfillment and pre-contractual measures.
  • Art. 6 para. 1 lit. c GDPR: legal obligations, especially tax and commercial retention.
  • Art. 6 para. 1 lit. f GDPR: legitimate interests in security, stability, abuse prevention, product improvement, support, documentation and B2B communication.
  • Art. 6 para. 1 lit. a GDPR: consent, especially for optional marketing communication and non-essential cookies/tracking.
  • Art. 28 GDPR: data processing as processor for personal data processed by customers about guests, website visitors or end customers.

7. Registration and Proof of Consents

During registration, MenuStern processes the entered contact data, project information, the desired subdomain, the main website language and the password stored encrypted. We also store the time, version of accepted legal texts, confirmation of data authorization, optionally given marketing consents, IP address and user-agent to demonstrate compliance with legal requirements.

8. Customer Websites, Subdomains and Preview Links

During registration or configuration, an individual MenuStern address or subdomain can be created, e.g. restaurant.menustern.de. The subdomain may be suggested from the project/object name and adjusted by the user. Preview or test links with access keys can be used for unpublished websites. Such links may only be shared with authorized persons.

9. Reservations, Contact Forms and CRM Data

If customers activate reservation, contact, hotel, object or CRM functions, MenuStern processes the data entered by end customers technically on behalf of the respective customer. The customer decides on purposes, contents, mandatory fields, communication and storage of this data, provided no own obligations of JUDIGO UG exist.

10. Team Access, Agencies and Support Access

Customers can invite team members, agencies, social media managers or other authorized persons as far as the platform supports this. Accesses, roles and activities may be logged for security, traceability and error analysis. Administrative support accesses by JUDIGO UG occur only insofar as necessary for error correction, security, setup, maintenance or fulfillment of contractual obligations.

11. AI-Powered Functions

MenuStern can provide AI-powered functions, for example for recognizing menus from PDF, Word, Excel/CSV or photos, for translation, structuring, content generation, image processing or quality assurance. User-provided content may be automatically analyzed. Users must verify whether uploaded content contains personal data, special categories of personal data or confidential information. Automatically generated results must be checked by users professionally, legally and in terms of content before publication.

MenuStern does not make solely automated decisions with legal effects towards registered users within the meaning of Art. 22 GDPR. AI outputs are aids and do not replace human review by the customer.

12. Payment Processing

If paid tariffs, subscriptions or additional services are used, payment and billing data may be processed by payment service providers such as Stripe. MenuStern usually does not receive complete card data but payment status, transaction references and billing-relevant information.

13. Social Login and External Accounts

If social login functions or external account linkages like Google, Facebook/Meta or LinkedIn are provided and used, we receive the profile data required for login and account creation, e.g., email address, name or technical identifiers. Use is optional and additionally subject to the privacy information of the respective provider.

14. Analytics, Marketing and Integrations

Google Analytics, Google Tag Manager, Google Ads, Meta Pixel, Meta Conversions API or comparable services are only loaded if technically activated and a required consent exists. Customers can configure their own tracking or marketing integrations; the respective customer is generally responsible for their lawful use on customer websites.

15. Cookies and Similar Technologies

We use technically necessary cookies and comparable technologies for login, security, session management, form protection, language settings and operation of the platform. Analytics and marketing cookies or similar technologies are only used if a valid consent exists, if legally required. Details are in the cookie policy.

16. Recipients and Subcontractors

Personal data may be transmitted to technical service providers insofar as necessary for operation, support, hosting, email delivery, payment processing, analysis, security or AI functions. Depending on configuration, these may include:

  • Hosting, server, database, CDN, storage and backup providers.
  • Email, newsletter, notification and support service providers.
  • Payment service providers, especially Stripe, if paid services are used.
  • Analytics and marketing providers like Google or Meta, as activated and permitted by the user or customer.
  • AI, translation, OCR, image processing and content service providers if corresponding functions are used.
  • Communication and messaging services like Telegram, if configured by the customer.
  • Tax advisors, legal advisors, authorities or courts, as legally required.

Contracts are concluded with processors where necessary.

17. Transfers to Third Countries

Data transferred to countries outside the EU/EEA takes place only upon appropriate legal grounds, e.g., adequacy decision of the EU Commission, standard contractual clauses, additional safeguards or explicit consent.

18. Storage Duration

  • Account and contract data are stored for the duration of the contract and subsequently within legal retention periods.
  • Invoice and payment data are regularly retained according to commercial and tax law requirements.
  • Registration and consent proofs are stored as long as necessary to prove lawfulness.
  • Reservation, contact and CRM data are deleted or exported according to customer instructions or after contract end, provided no legal reasons oppose this.
  • Uploads, media, websites and menu data are stored for the duration of use and removed after contract end within technical deletion periods.
  • Log files, audit and security data are generally stored temporarily unless longer storage is necessary for security, error analysis or legal enforcement.
  • Backups may contain data for a limited time due to technical reasons and are overwritten or deleted after the backup cycle.

19. Security

  • HTTPS/TLS encryption.
  • Passwords are not stored in plain text.
  • Role and access controls.
  • Logging of security-relevant events.
  • Validation of uploads, file types and accesses according to technical concepts.
  • Regular updates and technical protective measures.
  • Restriction of administrative access to necessary personnel.

20. Rights of Data Subjects

Data subjects have rights under the GDPR to information, correction, deletion, restriction of processing, data portability, objection as well as revocation of consent with effect for the future. To exercise the rights, a message to [email protected] is sufficient. Where JUDIGO UG processes data only on behalf of a MenuStern customer, we forward requests to the responsible customer or support them in processing.

21. Right to Complain

Data subjects have the right to complain to a data protection supervisory authority, especially in the member state of their habitual residence, workplace or place of the alleged infringement.

22. Changes

We may adjust this privacy policy if functions, service providers or legal requirements change. The current version is always made available on the website.