Website and client privacy notice

1 Controller

Maison du Chat GmbH, Nidderauer Straße 10, 60388 Frankfurt am Main, Germany, is responsible for the processing described here. Privacy contact: notifications@maisonduchat.de.

This notice covers our website, enquiries, client accounts and care services. Separate notices cover applicants and employees.

2 Accounts and care requests

We use contact and household details, language, availability, pet profiles, feeding and medication instructions, access information, dates, quotes, bookings and billing records to handle enquiries and provide agreed care. Accounts also involve login, security and terms-acceptance records. Forms identify required information; without it, we may be unable to complete the relevant process. Additional information is optional.

Information comes from you, authorised household members, nominated contacts and our sitters, who document visit times, tasks and relevant observations.

Article 6(1)(b) GDPR covers pre-contractual steps and contract performance. Other relevant enquiries, account security and necessary evidence preservation rely on Article 6(1)(f): our legitimate interests in customer service, secure operations and establishing or defending claims. Statutory accounting and retention duties rely on Article 6(1)(c).

For online payments, we use Stripe Payments Europe Limited (Ireland). Stripe processes contact, billing, payment, transaction and technical security data. MDC relies on Article 6(1)(b) GDPR for payments, Article 6(1)(c) for statutory records and Article 6(1)(f) for fraud prevention. Stripe also acts independently for purposes including payment security and its own legal duties. Details: Stripe privacy and data processing agreement.

3 Access and photographs

Assigned sitters receive necessary care and access information. Camera disclosures, including audio functions, inform and protect staff; they do not give MDC access to recordings. Article 6(1)(b) and (f) GDPR apply.

Care photos are shared through the client portal (Article 6(1)(b) GDPR); necessary incident evidence relies on Article 6(1)(f). Public content uses only screened, non-identifying pet images and genuinely anonymised report excerpts. Selection and anonymisation serve our legitimate interest in presenting our services. People, households, absences and security details must not be identifiable.

4 Communications

We handle enquiries and care through the portal, email, telephone or WhatsApp Business (WhatsApp Ireland Limited). Business email, automated emails and OneDrive documents use Microsoft 365 through GoDaddy. These services process recipient, content and technical transmission data. Email open and link-click tracking is off. Until 6 October 2026, automated emails were sent through Postmark (AC PM LLC, USA); Postmark may still hold records of those emails until they are deleted.

Using WhatsApp also involves its processing of account, communication and connection data. Telephone, email and the portal remain alternatives. We do not routinely record calls or generate automatic transcripts; necessary outcomes are briefly noted. The legal bases follow the relevant purpose in section 2. We do not use these communications for newsletters or advertising campaigns.

5 Website and browser technologies

Replit, Inc. (USA) provides hosting and the database. Website requests involve IP addresses, requested resources and technical connection data. Article 6(1)(f) GDPR applies: our interest in a functioning, secure website. Technical logs are kept only as necessary for operations, security or a particular incident.

The necessary maison-du-chat-session cookie supports login and lasts up to twelve hours. Google’s infrastructure cookie GAESA supports technical routing in Replit hosting and lasts about 30 days. These necessary cookies rely on section 25(2) TDDDG; subsequent processing relies on Article 6(1)(b) or (f) GDPR. We do not use advertising or audience-measurement tools.

6 Addresses and travel times

For address suggestions, our server sends entered searches, language and a technical session identifier to Google Places. Manual entry is available. At operations’ request, Google Routes calculates travel times using origin and destination addresses or place identifiers, transport mode and, where relevant, timing. We do not continuously track GPS locations. Article 6(1)(f) GDPR applies: our legitimate interests in accurate addresses and practical assignment planning. Google Ireland Limited processes these data as an independent controller under the Google Maps Platform terms. Further information: Google privacy policy.

7 Recipients and international transfers

Relevant administrators and assigned sitters receive information needed for their duties. Other recipients include the IT, communications and payment providers described above and, where necessary, veterinary practices, nominated helpers, external tax and accounting advisers, insurers, legal advisers and authorities. The purposes and legal bases described above apply.

Providers may process data outside the EEA, particularly in the USA and, for Stripe, India. Transfers rely on applicable EU adequacy decisions where these cover the recipient and processing; otherwise, EU standard contractual clauses and necessary supplementary safeguards apply. Replit processes data under its data processing agreement, as does Postmark for records of earlier automated emails. Details and copies of relevant safeguards are available from notifications@maisonduchat.de.

8 Retention

Closed enquiries without a booking are deleted twelve months after the last meaningful exchange, provided no discussion or booking continues. Routine email, portal and WhatsApp messages are likewise deleted twelve months after the last meaningful exchange once the matter is closed; separately necessary evidence follows the periods below.

We review reusable profiles after 24 months without a completed booking or substantive client contact. If no current or future activity remains, we ask once whether the account is still needed. Without a reply within 30 days, we close it and delete reusable client and pet profiles. Confirmed continuing need is recorded and reviewed again.

Access information remains only while needed and authorised for planned or recurring care. Obsolete, replaced, unnecessary or unauthorised codes are removed, including historical copies.

Necessary written care reports normally remain through 31 December of the third calendar year after the visit; access after account closure is restricted to evidence purposes. Routine photos are deleted twelve months after the visit or earlier account closure. Necessary incident evidence and genuinely anonymised public copies are treated separately.

Legally required invoices and accounting vouchers generally remain eight years, specified books and accounts ten years, and required business correspondence six years, normally from the relevant year‑end. Particular disputes or legal duties may extend retention of the necessary records. Once the reason ends, they are deleted or anonymised.

9 Nominated contacts

Clients may provide a trusted, emergency or veterinary contact’s name, phone number and, where supplied, email, relationship and authority. We use these for necessary consultation and care coordination. Article 6(1)(f) GDPR supports our and the client’s legitimate interests in reliable care and reachable contacts.

Nominated people receive direct information about the source and use of their details. Details remain only while the nomination is needed; necessary care evidence follows section 8. Please contact notifications@maisonduchat.de to correct details or tell us you do not wish to act as a contact.

10 Your rights

Subject to legal conditions, you have rights of access and a copy, correction, erasure, restriction and portability. You may withdraw consent for the future without affecting earlier lawful processing. Send requests to notifications@maisonduchat.de.

You may complain to a supervisory authority, particularly where you live or work or an alleged infringement occurred. In Hesse: the Hessian Commissioner for Data Protection and Freedom of Information, Complaint to the Hessian authority.

We do not make solely automated decisions with legal or similarly significant effects.

11 Right to object

You may object to processing under Article 6(1)(f) GDPR on grounds relating to your particular situation. We stop unless demonstrated compelling legitimate grounds override your interests and rights, or processing is needed to establish, exercise or defend legal claims. Contact: notifications@maisonduchat.de.