Skip to content
DEEN
DEEN
Menu

Toasted

Privacy policy

This is a translation for information; the German version is authoritative.

1. Controller

Jost Niemann, trading as “Toasted”, Rudolf-Diesel-Straße 5, 26135 Oldenburg, Germany Email: info@toasted-official.com, phone: +49 (0) 151 72209149

This policy applies to toasted-official.com, toasted-clothing.com and the customer account at konto.toasted-official.com. We are not required to appoint a data protection officer, as fewer than 20 people at our company are regularly involved in processing personal data (Section 38 BDSG).

2. Principles

We process as little personal data as possible. Our websites use no analytics or tracking tools, no advertising cookies and no social media plugins. Fonts and all content are loaded from our own servers; no data is transferred to third parties such as Google when you visit a page.

3. Hosting and server logs

Our websites, the customer account and our internal merchandise management system run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in Germany or the EU. We have concluded a data processing agreement with Hetzner (Art. 28 GDPR).

We do not keep access logs of page views in our shops. To keep the servers secure and stable, they process technically necessary data such as IP address, time and requested address (Art. 6(1)(f) GDPR):

  • Abuse protection: In the customer account and at checkout we count requests per IP address to slow down attacks and automated mass requests. These counters are deleted after one day at the latest.
  • Error logs: Server error messages are stored only up to a limited size and are continuously overwritten automatically.

4. Storage in your browser

We store the following in your browser’s local storage (no tracking cookies):

  • your confirmation of the age check (toasted-official.com only),
  • the contents of your cart (item numbers and quantities),
  • whether you have hidden the mascot.

When you are logged in to your customer account, we set a technically necessary session cookie so that you stay logged in.

This information is strictly necessary for the functions you request (Section 25(2) no. 2 TDDDG). You can delete it at any time in your browser settings.

5. Customer account and orders

For orders and your customer account we process your name, delivery and billing address, email address, phone number if provided, order data and – for retailers – company data. You log in with a passkey or a one-time link sent by email; we do not store passwords. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and legal obligations (Art. 6(1)(c) GDPR).

We retain order and invoice data in accordance with commercial and tax law retention periods (Section 147 AO, Section 257 HGB; up to 10 years). You can have your account deleted at any time; data subject to retention is then blocked and deleted when the period expires.

We send emails about orders and your account (e.g. order confirmation, invoice, shipping notice, login link) ourselves via our mail server at Hetzner (see no. 3).

6. Withdrawal via the online function

If you use “Withdraw from contract”, we process your name, email address, order number, the items concerned, a reason if you choose to give one, and the date and time of receipt. We send you an acknowledgement of receipt by email and process the withdrawal. The legal basis is our legal obligation (Art. 6(1)(c) GDPR in conjunction with Section 356a BGB) and the handling of the contract (Art. 6(1)(b) GDPR). We keep this information with the order records (see no. 5).

7. Payment

Payment takes place on the payment providers’ pages; card details never reach our servers.

  • Stripe (credit card, Apple Pay): Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. For Apple Pay, Apple is additionally involved under its own terms.
  • PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.

We transmit the data required for payment (amount, order number, email address and name if applicable). The payment providers process this data as independent controllers, among other things for fraud prevention and to meet legal obligations (e.g. anti-money-laundering checks), and may transfer data to countries outside the EU; their privacy notices apply. Legal basis for the transfer: Art. 6(1)(b) GDPR.

Purchase on account (retailers only): Retailers we approve individually can order on account. You transfer the invoice amount to our account within the payment term; we record the receipt of payment for your order. No credit check with a credit agency takes place and no other service providers are involved. Legal basis: Art. 6(1)(b) GDPR.

8. Shipping

For delivery we pass your name and delivery address to the carrier: in Germany Hermes Germany GmbH, Essener Straße 89, 22419 Hamburg; to other EU countries DHL (Deutsche Post AG, Charles-de-Gaulle-Straße 20, 53113 Bonn). We do not pass on your email address or phone number. Legal basis: Art. 6(1)(b) GDPR.

9. Contact by email or phone

If you contact us, we process your details to handle your enquiry (Art. 6(1)(b) or (f) GDPR). Our mailboxes are currently hosted by SiteGround Spain S.L. (Madrid, Spain) as a processor; incoming emails are checked there for spam and malware. We delete enquiries once they have been dealt with and no retention obligation applies.

10. Retailer enquiry

For the retailer enquiry we process company and contact details and information about your business (type of business, address, VAT ID, message). The purpose is to check whether we will supply you as a retailer (Art. 6(1)(b) GDPR).

VAT ID check: If you enter a VAT ID, we check it automatically. We query German numbers in the European Commission’s database (VIES); only the number is transmitted and only “valid” or “invalid” is returned. We confirm numbers from other EU countries with the German Federal Central Tax Office (BZSt); the number, company name, town, postcode and street are transmitted, and the reply states whether the number and details match. Legal basis: Art. 6(1)(b) GDPR and, for deliveries to other EU countries, additionally Art. 6(1)(c) GDPR (evidence for tax-exempt supplies). We store the result with the date.

Sales agent code: If a Toasted sales agent has visited you, you can enter their code. We then assign you to this sales agent. They look after you, see your contact and order data as far as necessary for this, and receive commission on your orders. Legal basis: Art. 6(1)(b) and (f) GDPR (customer care and settlement with the sales agent).

Approval: We approve you automatically if your details are clearly confirmed: for retailers from other EU countries, if the BZSt confirms the VAT ID as valid and the company name and town match; for retailers from Germany, if the VAT ID is valid and you have entered the code of a Toasted sales agent. In all other cases a person decides. An enquiry is never rejected automatically, and you can request at any time that a person reviews your enquiry.

Retailer information by email: As a retailer who has bought from us, we inform you by email about new and similar Toasted products (Section 7(3) UWG; Art. 6(1)(f) GDPR – our interest in direct marketing to existing customers). We point this out to you already in the retailer enquiry. You can object at any time without incurring costs other than transmission costs at basic rates – by clicking the link in each of these emails or by emailing info@toasted-official.com. After an objection we send you no further such emails and only store that and when you objected.

Data from enquiries that do not lead to a business relationship is deleted six months after the review is completed; for an ongoing business relationship, after it ends and retention periods have expired.

11. Newsletter

With your consent (Art. 6(1)(a) GDPR) we send you our newsletter with drops, news and offers. We use the double opt-in procedure: you are only subscribed after clicking the confirmation link in our email. We store your email address, the shop through which you subscribed, the times of subscription, confirmation and, if applicable, unsubscription, and the version of the consent text in order to be able to prove your consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). We also store the language (German or English) in which you want to receive the newsletter; you can change it in your customer account. You can unsubscribe at any time via the link in every email, with one click via your email program’s unsubscribe function, or in your customer account.

We send the newsletter ourselves via our mailbox newsletter@toasted-official.com at Hetzner (see no. 3); we do not use an external newsletter service. Subscription data is also transferred to our internal merchandise management system on a separate server at Hetzner for administration.

Measuring success without tracking: Our emails contain no tracking pixels and no redirected links; we do not record whether or when you open an email or click a link. To judge whether a newsletter is worthwhile, we internally compare the recipient list of a mailing with our orders and determine how many orders with what revenue were received from recipients in the 14 days after sending. We use the result only as a total per mailing, not in relation to individuals. The legal basis is our legitimate interest in evaluating our advertising (Art. 6(1)(f) GDPR); you can object at any time (Art. 21 GDPR) – an email to info@toasted-official.com is sufficient.

12. Loyalty programme (roast level)

With your customer account you take part in the loyalty programme (terms of participation in Section 11 of our terms and conditions). We calculate your roast level and the resulting discount from paid orders of the last 12 months (Art. 6(1)(b) GDPR). One-time bonus points are awarded for a confirmed newsletter subscription and for following our Instagram accounts; we only store that and when you received the bonus. We do not check whether you actually follow us, and we receive no data about this from Instagram.

On our pages we link to our Instagram accounts (@toasted.official, @toasted.clothing). These are simple links; no Instagram content is embedded, and no data is transferred to Meta when you visit our pages. Only when you click a link are you taken to Instagram (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland), where its privacy notices apply.

14. Recipients

Apart from the service providers mentioned, data is only received by those who need it to perform the contract or because of legal obligations – such as our tax adviser, authorities within the scope of legal obligations or, for retailers, the responsible sales agent.

15. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw consent at any time with effect for the future. An email to info@toasted-official.com is sufficient.

You can also lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

16. Version

Version of this privacy policy: 24 October 2026. If our service providers change (for example with the planned move of our mailboxes), we will update it beforehand.