Legal

Privacy Notice

Last updated: 25 October 2026 · GDPR (EU) 2016/679

This Privacy Notice explains how CHERRY (“we”, “us”) processes personal data when you visit our website or enquire about cleaning services. It is provided under Articles 13 and 14 of the GDPR. This notice is informational; it is not legal advice.

1. Controller

The data controller is CHERRY. Contact for privacy matters: [email protected]. Full company details appear in our Legal Notice.

2. What we process

• Browsing the brochure site: technical request data needed to deliver pages securely (typically IP address, browser/user-agent, requested URL, timestamps). We do not run advertising trackers or non-essential analytics on this site.
• Contact / enquiry: identity and contact data (name, email, optional phone), service type, optional preferred date, and free-text notes — only if you submit an enquiry through a channel that actually transmits those fields (secure enquiry API when linked, or email). The public form on this host does not store enquiry content on the static brochure server.
• Cookie and similar preference data. See our Cookie Notice.
• Language preference (de / en) stored locally on your device when you use the language control — not used for profiling or advertising.

We do not sell enquiry data. Marketing messages require a separate opt-in.

3. Purposes and legal bases

• Responding to enquiries and performing bookings: contract or steps prior to a contract (Art. 6(1)(b)).
• Operating, securing and improving the website: legitimate interests (Art. 6(1)(f)).
• Non-essential analytics or marketing cookies: consent (Art. 6(1)(a)); you may withdraw at any time.
• Legal obligations: Art. 6(1)(c) where applicable (e.g. tax or accounting records).

4. Retention

We keep personal data only as long as needed for the purposes above, then delete or anonymise it. Typically enquiry data for up to 24 months if no booking follows, and booking/invoice data for the period required by local law.

5. Recipients and transfers

Static website host (current). The public brochure at cherry.ninutech.com is delivered by a static hosting provider (Vercel). When you load pages, that host processes technical request data as above to serve the site. Vercel is a US company; request handling may involve processing outside the EEA. We do not place enquiry form contents, booking files, or a customer database on this static host. We have not enabled Vercel Analytics, Speed Insights, or similar product analytics.

Source repository. Website source code is kept in a code repository (GitHub). Enquiry personal data is not stored in that repository. GitHub is not used as a recipient of Contact form submissions.

Enquiry / booking data. Until a separate enquiry service under our control (with an Art. 28 arrangement where required) is linked, online form intake on this host does not transmit enquiry fields to a store. You may contact us by email instead; email providers then process the message under their terms.

Art. 28 contracts. Where a third party processes personal data on our behalf as a processor, we use a written contract (GDPR Art. 28) when that arrangement applies. Vercel’s published Data Processing Addendum is offered for its Pro and Enterprise plans; while this brochure remains on a limited plan, we describe the host honestly above and keep enquiry content off that host. If we upgrade or change host, we will update this section and name the contractual basis (including Standard Contractual Clauses and/or the EU–U.S. Data Privacy Framework where used).

We do not appoint payment processors via this website in the current phase.

6. Your rights

You may request access, rectification, erasure, restriction, portability, and object to processing based on legitimate interests (Arts. 15-21 GDPR). Where processing is based on consent, you may withdraw consent without affecting prior lawful processing.

You may lodge a complaint with a supervisory authority (Art. 77 GDPR). If you live in Berlin or our main establishment is in Berlin, the competent authority is typically the Berliner Beauftragte für Datenschutz und Informationsfreiheit. You may also contact the authority of your EU/EEA residence. Update this paragraph if CHERRY’s establishment is in another German Land.

7. Security measures

Under GDPR Art. 32 we apply measures proportionate to risk for this brochure phase, including: HTTPS in production; Content-Security-Policy and related browser security headers; self-hosted page scripts (no animation CDN); Contact form fail-closed validation in the browser; and keeping enquiry content off the static host. When a separate enquiry API is operated, additional controls apply (field allowlisting; CSRF; Origin / intent checks; honeypot; rate limiting; hashed IP for abuse control not profiling; AES-256-GCM at rest; retention and purge). No payment card data is collected via the website enquiry form. Report suspected vulnerabilities to [email protected] (see also security.txt).

8. Language preference

The site interface is English by default. You may optionally switch to German via the header language control. That choice is stored on your device (cherry_lang_v1) with an allowlisted value only. It is not used to build an advertising profile. See the Cookie Notice.

9. Children

Our services are directed to adults. We do not knowingly collect data from children.

10. Service disruptions

If online enquiry or booking channels are disrupted, we will publish a short notice on Transparency when practical (similar to public-service outage notices), and you may reach us by email listed in the Legal Notice.