Website Privacy Policy

Planet A Foods GmbH

Below, we inform you about the processing of your personal data on our website and about the rights you have in this regard.

This privacy policy applies to the processing of your personal data by the controller named in the section "Controller". Different responsibilities may apply to individual processing operations, for example where personal data is processed on behalf of our customers. Where this is the case, we will point this out explicitly at the relevant place.

1. Controller

Unless stated otherwise at the relevant place in this privacy policy, the controller within the meaning of Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), responsible for the processing of your data ("Controller") is:

Planet A Foods GmbH
Fraunhoferstr. 11a
82152 Planegg
Germany

(hereinafter also referred to as "Planet A Foods").

You can contact us at any time with any questions regarding data protection or to exercise your data subject rights at the following email address: sales@forplaneta.com

2. Data Protection Officer

We have appointed the following data protection officer:

Kertos GmbH
Brienner Straße 41
80333 Munich
Germany
dataprivacy(at)kertos.io

3. Legal Bases

Depending on the type and purpose of processing, the following legal bases of the GDPR may apply:

4. Provision and Operation of the Website

Purpose of processing

When you visit our website, we process technically necessary data in order to display the website to you and to ensure its stability and security. In doing so, your device automatically transmits information to our server, which is temporarily stored in so-called server log files.

We process your IP address and other technical access data such as the date and time of access, the browser used and its version, the operating system and the page accessed.

Legal basis for processing

Art. 6(1)(f) GDPR.

Our legitimate interest lies in the technically error-free provision, stability and security of our website.

5. Contacting Us

Purpose of processing

When you contact us, for example via the email addresses provided on our website or by phone, we process your information in order to handle your inquiry and in case of follow-up questions.

The email links on our website (for example sales@forplaneta.com) open the email program on your own device. No data is transmitted to us via these links; we only receive your message once you send the email.

The contact form on our contact page and the sample request form on our Cocoa Booster page work differently: when you submit one of them, the details you entered (name, business email address, company and, if provided, your topic and message or, for a sample request, role, country, application, cocoa powder type, annual volume and your requirements) are sent directly to our internal sales system. There we store your request as a new contact or add it to the existing record of you or your company (see section 6), and, for sample requests, our sales team is notified by email. To prevent misuse of the form, we store a one-way hashed form of your IP address, used only to limit repeated submissions; we do not store the IP address itself.

We process your name, your contact details and any other information arising from your inquiry.

Legal basis for processing

Art. 6(1)(b) GDPR, insofar as your inquiry is aimed at the conclusion or performance of a contract.

Art. 6(1)(f) GDPR.

Our legitimate interest lies in the effective handling of inquiries addressed to us.

6. Customer and Prospect Management ("CRM")

6.1 Customer Management and Business Development

Purpose of processing

We process personal data of prospects, customers and their contact persons in order to initiate, manage and maintain business relationships. For this purpose, we store and organize this data in Salesforce. This includes handling inquiries, preparing offers, supporting existing customers and documenting communication and the status of processing.

We process your master and contact data (e.g. name, company, position, business email address and phone number) as well as communication and contract data arising in the course of the business relationship.

Legal basis for processing

Art. 6(1)(b) GDPR, insofar as the processing is necessary for the conclusion or performance of a contract or in order to take steps prior to entering into a contract.

Art. 6(1)(f) GDPR.

Our legitimate interest lies in the efficient organization and management of our business relationships and in the audit-proof documentation of communication.

6.2 Scheduling Appointments

Purpose of processing

You can contact us by email and arrange appointments with us, for example if you are interested in or have questions about our products.

We process your name, your business email address and the information you provide about your request and the desired appointment.

Legal basis for processing

Art. 6(1)(b) GDPR, insofar as the appointment serves to take steps prior to entering into a contract.

Art. 6(1)(f) GDPR.

Our legitimate interest lies in the efficient organization and conduct of appointments and product demonstrations with prospects and customers.

7. Company Presence on Social Networks

Purpose of processing

We maintain presences on social networks such as LinkedIn in order to communicate with prospects and customers and to provide information about our services. If you visit one of our presences, the respective platform operator processes your personal data. We have no influence on this processing, which the platform operators carry out under their own responsibility.

We process the data that you share with us via the respective platform, for example when you interact with our content or contact us.

With regard to the processing of statistical usage data for our LinkedIn presence (so-called page or usage statistics), we and LinkedIn are joint controllers within the meaning of Art. 26 GDPR. The joint controllership concerns in particular the collection and analysis of usage data to create statistics, while the platform operator assumes primary responsibility for handling data subject rights and fulfilling information obligations. You can find the essential content of the joint controllership agreements in LinkedIn’s privacy policy.

Legal basis for processing

Art. 6(1)(f) GDPR.

Our legitimate interest lies in effective external presentation and communication with prospects and customers.

8. Marketing & Direct Advertising

We process your personal data in order to send you information about our products, offers and services, and we carry out measures for advertising purposes, customer retention and the optimization of our offers. This is done, for example, in the form of emails and letters. In addition, we carry out market and opinion research, for example in the form of surveys. The legal basis for this is our legitimate interest in improving our products and services pursuant to Art. 6(1)(f) GDPR. Where we obtain your separate consent for such measures, your consent pursuant to Art. 6(1)(a) GDPR is the legal basis.

Where we contact you for advertising purposes without an existing business relationship between us, in particular when advertising by email, we do so exclusively on the basis of your prior explicit consent pursuant to Art. 6(1)(a) GDPR. The same applies to advertising phone calls to consumers, which we only make with your prior explicit consent. Advertising calls to businesses are only made on the basis of presumed consent. You can withdraw your consent at any time with effect for the future, for example via the method stated when you gave your consent or by sending us an informal message. The lawfulness of the processing carried out until the withdrawal remains unaffected.

If, on the other hand, you have already purchased goods or services from us, we use the email address provided in that context to send you advertising for our own similar products. The legal basis is our legitimate interest pursuant to Art. 6(1)(f) GDPR. In doing so, we rely on the exception for existing customers under Art. 13(2) of Directive 2002/58/EC (ePrivacy Directive) in conjunction with the respective national implementing laws; in Germany, this is Section 7(3) of the Act Against Unfair Competition (Gesetz gegen den unlauteren Wettbewerb, "UWG"). This use only takes place as long as you have not objected to it. We inform you of your right to object both when collecting your data and with every further advertising contact.

9. Job Applications

9.1 Processing Your Application & Conducting Interviews

Purpose of processing

As part of the application process, we process your personal data in order to receive, process and evaluate your application centrally, to assess your suitability for the advertised position and to conduct the application process properly and in a candidate-friendly manner. We review your information and documents, such as your CV, cover letter, references and other proof of qualifications, and compare them with the requirements of the respective position. Where necessary to assess your qualifications, tests, case studies or similar may also be carried out, the results of which are taken into account in the decision.

To receive and process your application centrally, we use an online application portal. For this purpose, we use Personio.

During the application process, you may be invited to personal, telephone or virtual interviews. Virtual interviews may take place by phone or via online meeting tools. To coordinate and invite you to these interviews, to clarify any questions, to request additional information or documents and to inform you about the current status of your application, we may contact you using the contact details you have provided.

We may process your master data, qualification data and any voluntary data you provide.

Legal basis for processing

Art. 6(1)(b) GDPR.

Art. 6(1)(f) GDPR.

Our legitimate interest lies in enabling a fast and efficient application process and thereby increasing candidate satisfaction.

9.2 Onboarding as an Employee

Purpose of processing

If you are hired and an employment contract is concluded, the personal data required to start the employment relationship is transferred to our HR management system. This data is processed to establish the employment relationship and subsequently for the purposes stated in the privacy notice for employees in order to perform the employment contract, for example to provide work equipment, devices, system access and the like.

We may process your master data, qualification data and voluntary data. We also process financial data as well as social security and tax data for the purpose of payroll accounting and to comply with statutory documentation and reporting obligations.

Legal basis for processing

Art. 6(1)(b) GDPR.

Art. 6(1)(c) GDPR in conjunction with the respective statutory provision.

9.3 Talent Pool

Purpose of processing

If you consent to being included in our talent pool, we store and process your personal data in order to inform you specifically by email, SMS or WhatsApp about future job openings and positions matching your profile after the application process has ended. You can withdraw your consent at any time with effect for the future.

We may process your master data, qualification data, communication data and voluntary data.

Legal basis for processing

Art. 6(1)(a) GDPR.

10. Cookies & Similar Technologies

We use cookies and similar technologies (hereinafter "cookies") on our website. Cookies are small text files that are stored on your device by your browser. Cookies do not run programs and do not install malware. Similar technologies include web storage (local/session storage), fingerprinting, tags and pixels. If cookies or similar technologies are blocked, the functionality of our website may be limited or certain functions of the website may not be fully available. When you first visit our website, you will be informed in detail about the use of such technologies.

10.1 Necessary Cookies

Purpose of processing

The following cookies are required for the technically error-free provision and secure operation of our website.

Legal basis for processing

Art. 6(1)(f) GDPR in conjunction with Section 25(2) of the Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, "TDDDG").

Our legitimate interest, or our overriding interest as justification, lies in the technical provision and secure operation of our website.

10.2 Optional Cookies

Purpose of processing

The optional cookies described below are not required for the operation of the website. These are, for example, marketing, performance and analytics cookies that help us understand how visitors use the website. In particular, they provide us with information on usage behavior and thus support us both in optimizing the user experience and in measuring the success of our marketing activities.

When you first visit our website, you will be informed in detail about the use of such technologies and have the option to decline the use of services that are not strictly necessary for the use of the website. You can access the cookie settings at any time via the footer of the website in order to adjust your preferences with effect for the future.

Google Analytics

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, to statistically evaluate the use of our website. Google Analytics is loaded directly on our website and only after you have given your consent. We have configured Google Analytics as follows: Google signals and ads personalization are disabled, no granular location and device data is collected, data is not shared with Google for its own purposes, and data relating to individual users is deleted after two months. Data may be transferred to Google LLC in the USA (see section "Data Transfers to Third Countries").

Legal basis for processing

Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG.

11. Automated Decision-Making

We do not use automated decision-making pursuant to Art. 22 GDPR in the processing operations described above.

12. Artificial Intelligence ("AI")

We may use artificial intelligence in the processing of personal data described in this privacy policy. This may be done in particular for the following purposes:

• process support, optimization and automation,
• reviewing, evaluating and summarizing application documents,
• supporting IT security, for example by identifying security-relevant anomalies,
• supporting the creation, revision, analysis and review of content as well as accessing, preparing and using company knowledge,
• data analysis, evaluation and recognition of patterns, trends and relationships as well as forecasting and decision support.

The use of artificial intelligence complies with the legal requirements of the GDPR and Regulation (EU) 2024/1689, the Artificial Intelligence Act ("AI Act"), and serves exclusively supporting, preparatory or monitoring purposes. No automated decision-making or profiling with legal effects or similarly significant effects within the meaning of Art. 22 GDPR takes place. All decisions on inviting, hiring or rejecting applicants are made by qualified employees. At no time is personal data used to train AI models.

13. Recipients of Your Data

Personal data collected by us is generally only transferred if you have given your explicit consent pursuant to Art. 6(1)(a) GDPR, if the disclosure is necessary pursuant to Art. 6(1)(f) GDPR to protect legitimate interests or to establish, exercise or defend legal claims and there is no reason to assume that your interests worthy of protection prevail, if we are legally obliged to do so (Art. 6(1)(c) GDPR), or if the disclosure is legally permissible and necessary for the performance of a contract or to take steps prior to entering into a contract (Art. 6(1)(b) GDPR). Where we transfer data to processors, this is done on the basis of the data processing agreement concluded pursuant to Art. 28 GDPR.

The recipients to whom we transfer personal data and the respective purpose are listed below:

Microsoft Ireland Operations Limited
One Microsoft Place, South County Business Park
D18 P521 Dublin
Ireland
Provision of the technical infrastructure and hosting of our website (Microsoft Azure).

Google Ireland Limited
Gordon House, Barrow Street
Dublin 4
Ireland
Statistical analysis of website usage (Google Analytics), only with your consent.

salesforce.com Germany GmbH
Erika-Mann-Str. 31-37 (Kontorhaus)
80636 Munich
Germany
Management of customer and prospect relationships (CRM).

Personio SE & Co. KG
Seidlstraße 3
80335 Munich
Germany
Receipt and management of applications and conduct of the application process.

LinkedIn Ireland Unlimited Company
Wilton Plaza, Wilton Place
Dublin 2
Ireland
Operation of our company presence on the social network LinkedIn.

In addition, where necessary, we may transfer your data to other recipients such as recruitment agencies, recruiting service providers, job portals and career networks, authorities, public offices and similar recipients. This concerns, for example, tax authorities, public prosecutors’ offices and courts as well as auditors.

Where the data transfers described constitute processing on behalf within the meaning of Art. 28 GDPR, we ensure that such processing takes place exclusively on the basis of data processing agreements that meet the legal requirements of the GDPR. These oblige the respective processor in particular to process personal data only in accordance with our instructions, to ensure a level of data protection appropriate to the risk and to comply with data protection obligations, in particular with regard to supporting the fulfillment of data subject rights.

Where certain data transfers take place within the framework of joint controllership pursuant to Art. 26 GDPR, this is done on the basis of a joint controllership agreement. This agreement clearly defines the respective roles and responsibilities with regard to compliance with data protection requirements, for example which controller is responsible for which obligations in connection with the exercise of data subject rights or the fulfillment of information obligations. We will provide you with the essential content of such agreements upon request.

14. Data Transfers to Third Countries

Some of the recipients of your personal data named in the previous section are located in so-called third countries in which the level of data protection is not comparable to that in the EU. Third countries are all countries outside the European Economic Area. The European Economic Area comprises all countries of the European Union as well as the countries of the so-called European Free Trade Association, namely Norway, Iceland and Liechtenstein.

Data transfers to such countries may take place, for example, if we use service providers located in a third country. Transfers of personal data to third countries take place on the basis of an adequacy decision of the European Commission. Where there is no adequacy decision of the European Commission for the respective third country, the transfer takes place on the basis of appropriate safeguards within the meaning of Art. 46(2) GDPR. Copies of these safeguards can be requested from the controller.

In addition, some recipients of your personal data based in the USA may be certified under the EU-U.S. Data Privacy Framework ("DPF"). For such recipients, there is a limited adequacy decision for certain categories of data. To the extent of the data recipient’s valid DPF certification, the personal data is transferred on the basis of this adequacy decision.

15. Storage Period

We only process personal data for as long as is necessary for the respective purpose of processing. As soon as the purpose no longer applies and no statutory retention obligation or other reason stated below prevents erasure, the data is deleted or anonymized.

The specific storage period is determined by the following criteria. If several criteria apply, the longest period is decisive. After it expires, the data is routinely deleted.

• Purpose limitation: As long as we need the data to achieve the respective purpose of processing, for example to provide our services, to communicate with you or to perform a contract, we store it for the duration of this purpose.
• Consent: We store data that we process on the basis of your consent (Art. 6(1)(a) GDPR) until you withdraw your consent, but no longer than until the purpose of processing no longer applies.
• Contractual relationship: We generally store data that we process within the framework of a contractual relationship (Art. 6(1)(b) GDPR) until the contract has been fully processed, unless a statutory retention obligation or a legitimate interest requires longer storage.
• Statutory retention obligations: Much data is subject to statutory retention obligations (Art. 6(1)(c) GDPR in conjunction with the respective statutory provisions) that prevent earlier erasure. Particularly relevant are retention periods under commercial law pursuant to the German Commercial Code (Handelsgesetzbuch, "HGB") and under tax law pursuant to the German Fiscal Code (Abgabenordnung, "AO"). Depending on the type of document, they generally amount to six to ten years from the end of the respective financial year. During these periods, the processing of the data is restricted and the data is kept exclusively to fulfill the statutory documentation obligation.
• Legitimate interests: Storage beyond the aforementioned periods may take place insofar as we have a legitimate interest (Art. 6(1)(f) GDPR) in retention and this outweighs the interests of the data subject worthy of protection. Such an interest may arise in particular from the establishment, exercise or defense of legal claims for the duration of the applicable civil-law limitation periods under the German Civil Code (Bürgerliches Gesetzbuch, "BGB"), where the regular limitation period is three years (Section 195 BGB) and up to 30 years in certain cases (Section 197 BGB), as well as from preventing renewed contact after an objection or withdrawal, for example by keeping a blocklist (e.g. for recipients who have unsubscribed from advertising). In these cases, we restrict processing and delete the data as soon as the legitimate interest no longer applies.
• Applications: We generally delete application documents and personal data of applicants no later than six months after the end of the application process, unless your application leads to employment and no legitimate interests prevent erasure. Retention for this period serves in particular the establishment, exercise or defense of claims under the German General Equal Treatment Act (Allgemeines Gleichbehandlungsgesetz, "AGG"). If your application leads to employment, we transfer the data required for the employment relationship to our HR management system and continue to process it in accordance with the privacy notice for employees. If you have consented to being included in our talent pool, we store your data on the basis of your consent until you withdraw it. If you do not withdraw your consent, we delete your data after 2 years of inactivity.

The specific deletion periods for individual processing activities are set out in our internal deletion and retention concept.

16. Data Subject Rights

You can exercise the rights listed below. Your requests to exercise data protection rights and our responses to them are retained for documentation purposes for a period of three years after the end of the year in which we responded to your request and, in individual cases, beyond that for the establishment, exercise or defense of legal claims. The legal basis for this is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting ourselves against claims or fines under Art. 82 and 83 GDPR and in fulfilling our accountability obligation under Art. 5 GDPR.

16.1 Right of Access, Art. 15 GDPR

You have the right to request information from us about your stored personal data. This information covers whether Planet A Foods GmbH processes/stores personal data about you and, among other things, which data is involved and for what purposes this data is processed. Upon request, Planet A Foods GmbH will provide you with a copy of the data.

16.2 Right to Rectification, Art. 16 GDPR

You also have the right to request the correction of incorrectly stored data or the completion of incomplete data.

16.3 Right to Erasure, Art. 17 GDPR

You also have the right to request the erasure of your personal data, provided that the legal requirements for this are met. We are obliged to erase data, among other things, if your personal data is no longer necessary for the purposes for which it was collected or otherwise processed, if you have withdrawn consent you previously gave, or if the data has been processed unlawfully.

16.4 Right to Restriction of Processing, Art. 18 GDPR

Subject to the legal requirements, you have the right to restriction of the processing of your personal data.

16.5 Right to Data Portability, Art. 20 GDPR

You have the right to have the data that you have provided to us on the basis of your consent or an existing contractual relationship with you handed over to you in a machine-readable format or, at your choice, transferred to a third party.

16.6 Right to Object, Art. 21 GDPR

Right to object on grounds relating to your particular situation

Where we process your data for the performance of a task carried out in the public interest or in the exercise of official authority (Art. 6(1)(e) GDPR), or where the processing is based on the legitimate interests of Planet A Foods GmbH (Art. 6(1)(f) GDPR), you have the right to object at any time to the processing of your personal data on grounds relating to your particular situation.

This also applies to profiling based on this provision within the meaning of Art. 4(4) GDPR. We will then stop the processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests in the processing being stopped.

Right to object to the processing of data for direct marketing purposes

In individual cases, we process your personal data for direct marketing purposes. You have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing. This also applies to profiling to the extent that it is related to such direct marketing. If you object to processing for direct marketing purposes, we will no longer process your personal data for these purposes.

The objection can be made informally and should be addressed to:

Planet A Foods GmbH
Fraunhoferstr. 11a
82152 Planegg
Germany

or to the following email address: sales@forplaneta.com

16.7 Right to Withdraw Your Consent, Art. 7(3) GDPR

Where we process your data on the basis of your consent, you have the right to withdraw your consent at any time. The withdrawal does not affect the lawfulness of the processing carried out on the basis of the consent until the withdrawal. You will be informed of how to withdraw your consent when you give it.

16.8 Contact Information for Exercising Data Subject Rights

To exercise your data subject rights, you can contact us at the following email address: sales@forplaneta.com

16.9 Right to Lodge a Complaint, Art. 77 GDPR

If you are a data subject within the scope of the GDPR, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). You can exercise this right with a supervisory authority in the member state of your habitual residence, your place of work or the place of the alleged infringement.

General note

We reserve the right to change and adapt this privacy policy with effect for the future, for example if our processing activities or the legal requirements change.

Last updated: 20 October 2026