Privacy Policy

1. Controller

Sarah Hartel | sarahby, Borromäerinnenstraße 89, 51688 Wipperfürth, Germany. Email sarah@sarah-by.com, Phone +33 7 44 75 59 38.

Protecting your personal data matters to us. This policy explains what data we process when you visit sarah-by.com, why, and which rights you have under the EU General Data Protection Regulation (GDPR).

2. Hosting, website platform and CRM

This website is built and hosted on Onepage (Onepage GmbH, Germany). When you visit the site, technically necessary data (IP address, date and time of access, pages accessed, browser type, operating system, referrer URL) is processed in server logs to deliver the site securely. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functional website). Inquiries submitted through our forms are stored in the CRM provided by Onepage under a data processing agreement (Art. 28 GDPR).

3. Request form

If you send an inquiry through the request form, we process the data you provide: name, email address, the occasion you select, an optional date, and your message. We use this data exclusively to respond to your inquiry, prepare a culinary concept and, where applicable, prepare and perform a contract. Legal basis: Art. 6(1)(b) GDPR.

If you share dietary requirements or allergies of guests in the course of an inquiry, we process this information solely to plan and deliver the event safely, and only as far as necessary. Where such information relates to health, we process it on the basis of your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.

Inquiry data that does not lead to a contract is deleted no later than 12 months after our last exchange. Data that is part of a contractual or billing record is retained for the statutory commercial and tax retention periods (up to 10 years) and then deleted.

4. Newsletter

If you sign up for occasional updates, we process your name and email address on the basis of your consent (Art. 6(1)(a) GDPR), confirmed via double opt-in. You can unsubscribe at any time via the link in each email or by writing to sarah@sarah-by.com. The newsletter is sent via the Onepage platform.

5. Cookies and consent

This website uses cookies and similar technologies. Technically necessary cookies are used on the basis of Art. 6(1)(f) GDPR and § 25(2) TDDDG. All marketing and analytics technologies described in section 6 are used only after your consent via the cookie banner (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw or adjust your consent at any time via the cookie settings link in the footer.

6. Marketing and measurement (consent-based)

a) Google Tag Manager (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) manages the tags below; it does not collect personal data itself.

b) Google Ads conversion tracking and remarketing (Google Ireland Ltd.) measures whether visitors reached the site via our ads and whether an inquiry was sent, and may show follow-up ads within the Google network. Processed data: cookie and click identifiers, IP address, page interactions. Data may be transferred to the USA on the basis of the EU-US Data Privacy Framework and/or Standard Contractual Clauses. Opt-out: adssettings.google.com.

c) Meta Pixel and Conversion API (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland) measures interactions after Meta ad contact and enables remarketing audiences. Processed data: device and browser information, IP address, page views, form events. Transfer to the USA under the EU-US Data Privacy Framework and/or Standard Contractual Clauses. Opt-out via your Meta ad preferences.

7. Social media links

This site links to our profiles on Instagram and Facebook. We do not transfer any data through these links; the providers' own privacy policies apply once you visit their platforms.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interest (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future.

To exercise your rights, email sarah@sarah-by.com. You also have the right to lodge a complaint with a supervisory authority; the authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), www.ldi.nrw.de.

9. Updates

This privacy policy is current as of July 2026. We will update it when our tools or legal requirements change.