1. Controller
[Company, address, email] (see imprint).
2. Data we process
Account: name, email, phone, password (hashed), language, registration/login times, IP address (abuse protection). Farms: additionally company name, address, tax number/VAT ID, bank details (IBAN, shown only for transfers), certificates. Orders: order content, delivery/pickup details, payment method, status. Location: the postcode you enter (cookie "hplz") for distance calculation – no GPS.
3. Purposes and legal bases
Contract performance and brokering (Art. 6 (1) b GDPR), legal obligations (c), legitimate interests in security and abuse prevention (f).
4. Transfer to farms
Order data (name, contact, delivery address, order content, message) is transmitted to the respective farm as your contract partner. Farms are independent controllers.
5. Cookies
Only technically necessary cookies: "hs" (login, 30 days), "hc" (basket, 7 days), "hplz" (postcode, 180 days), session cookie for notices. No tracking or advertising cookies; no consent required (§ 25 (2) TDDDG).
6. Third parties
Maps: OpenStreetMap tiles (OpenStreetMap Foundation, UK) are loaded from tile.openstreetmap.org when a map is shown; your IP address is transmitted. Fonts: Google Fonts (Google Ireland Ltd.) are loaded on page view; IP transmitted to Google. We are working on local hosting. Email: transactional emails via our mail server. Notifications: order/registration notices to the HOFARO team and optionally the farm via Telegram (Telegram FZ-LLC); order number, farm, amount and products are transmitted, no buyer contact data.
6a. Carriers and SMS
For parcel shipping the farm transmits your name, delivery address and, where applicable, phone/email to the chosen carrier (DHL Paket, DPD, Hermes, GLS) for delivery (Art. 6 (1) b GDPR). If you opt for SMS updates, your mobile number is transmitted to our SMS provider (seven.io, seven communications GmbH & Co. KG, Kiel, Germany); you can revoke consent at any time.
6b. Complaints
For a complaint we store reason, description and an optional photo and forward them to the farm. Photos are deleted 12 months after closure.
6c. Security
Transmission exclusively via TLS (HTTPS). Passwords are stored as scrypt hashes, never in plain text. Sessions are signed cookies valid 30 days. Payment data (farm IBAN) is stored only for display on transfers; we do not process card data. Role-based access (customer, farm, admin), rate limiting, daily encrypted backups in Germany.
7. Hosting
Servers in Germany (Hetzner Online GmbH, Gunzenhausen). Server logs (IP, time, URL) are kept for 14 days.
8. Retention and deletion
You can delete your account yourself under "My account → Delete account" (Art. 17 GDPR); order data is anonymised. Account data until deletion; order data per commercial and tax retention periods (up to 10 years); event logs 12 months.
9. Your rights
Access, rectification, erasure, restriction, data portability, objection (Art. 15–21 GDPR) and complaint to a supervisory authority. Contact: see imprint.
Version: October 2026