No formal Data-Protection Officer is required. Nevertheless, we have designated an internal contact point: Data protection contact – datenschutz@mhdapp.com | +49 176 262 208 30 A written assessment documenting why Art. 37 (1) GDPR / § 38 BDSG do not apply is on file and reviewed yearly.

1. 1.Operate user account & app – Contract Art. 6 (1)(b)
2. 2.Subscriptions, invoices, payments – Contract Art. 6 (1)(b); Legal obligation Art. 6 (1)(c) GDPR; §§ 257 HGB / 147 AO
3. 3.Transactional messages – Contract Art. 6 (1)(b)
4. 4.Expiry reminders and notifications about your own products by email – Performance of the contract, Art. 6 (1)(b) GDPR. These reminders are the core service, and are therefore enabled by default; you can switch them off at any time in your account settings. We send no marketing emails.
5. 5.Barcode look-ups via Open Food Facts API – Contract Art. 6 (1)(b)
6. 6.Fraud-prevention & IT-security – Legitimate interest Art. 6 (1)(f)

We use exclusively technically necessary cookies and necessary storage on your device (§ 25(2) no. 2 TDDDG): for secure login, CSRF protection, the interface language and colour scheme you select, and to record your cookie decision. We use no analytics, statistics or marketing cookies and embed no third-party tracking. The legal basis for the subsequent processing is Art. 6(1)(b) and (f) GDPR (provision of the requested service, IT security). We record your cookie decision server-side with a truncated IP address, browser identifier, timestamp and the selected categories (Art. 7(1) GDPR).

We never sell personal data. Standard Contractual Clauses are kept on file as a contingency should a recipient leave the DPF.

Backups are stored AES-256 encrypted at Hetzner (Germany) and automatically deleted after 14 days.

• •Encrypted transport: all connections exclusively over TLS/HTTPS
• •Passwords are never stored in plaintext, only as bcrypt hashes
• •AES-256 encrypted backups (daily, 14-day retention, restore tested)
• •Role-based access control per workplace (Owner, Admin, Editor, Viewer)
• •The database is reachable only locally and is not exposed to the internet
• •Hosting with Hetzner Online GmbH in Germany; Hetzner’s data centres are ISO/IEC 27001 certified (the provider itself holds no such certification)
• •Payment data is processed exclusively by Stripe (PCI-DSS Level 1) and never reaches our systems
• •Two-factor authentication is mandatory for the provider's admin access; it is not currently available for regular user accounts
• •The full technical and organisational measures, including the known limitations, are disclosed in Annex III of the Data Processing Agreement

You can exercise at any time and free of charge: Access, Rectification, Erasure, Restriction, Portability, Objection to legitimate-interest processing, Withdrawal of consent. We respond within one month (Art. 12 (3) GDPR). Identification may be required. Contact: datenschutz@mhdapp.com. Obligation to provide data: Fields marked "required" in our forms are contractually necessary. Without them we cannot open or maintain your account; all other fields are optional.