Last updated: November 2026 This English version is a translation provided for convenience. In case of doubt, the German version of this privacy policy applies. 1. Controllers For this website, the beta sign-up, the contact form and partner and pitch deck enquiries: Albuena GbR (a German civil-law partnership), partners Anica Buchta and Marlene Zak, Stallschreiberstraße 50, 10969 Berlin, Germany. E-mail: hello@albuena.com For nutrition counselling (sections 9 to 11): Anica Buchta, freelance nutrition counsellor, Stallschreiberstraße 50, 10969 Berlin, Germany. E-mail: hello@albuena.com In this policy, “we” refers to the respective controller. 2. Summary We only process personal data to the extent necessary to operate this website, for the beta sign-up, enquiries and nutrition counselling, or where you have given your consent. This policy applies to albuena.com. The Albuena app has its own privacy policy. 3. Hosting and server log files This website is built and hosted with the website builder Onepage. The provider is Onepage GmbH, Hanauer Landstraße 172, 60314 Frankfurt am Main, Germany. When you visit the website, technical data is processed automatically: IP address, date and time, page visited, referrer URL, browser and operating system. This is necessary to deliver the website securely and reliably. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is secure and error-free operation. A data processing agreement pursuant to Art. 28 GDPR has been concluded with Onepage. 4. Domain and e-mail The domain and e-mail mailbox are hosted by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. If you send us an e-mail, your message and your contact details are stored on IONOS servers. A data processing agreement has also been concluded with IONOS. 5. Beta sign-up for the Albuena app If you sign up for the beta, we process your e-mail address and your device type (iPhone or Android). You can voluntarily provide your first name and how you heard about Albuena. We use this data to invite you to the beta, to keep you informed about the beta, to send you a short feedback questionnaire and to give you the promised year of Premium after launch. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future, for example by e-mail to hello@albuena.com. The data is stored in Onepage's customer relationship management system (CRM); we also receive a notification by e-mail. We delete the data as soon as you withdraw your consent, but no later than six months after the launch of the app. To take part in the beta, you use Apple's TestFlight or Google Play. Apple's or Google's privacy policies apply to this.

6. Contact form and e-mail If you write to us via the contact form or by e-mail, we process your details (for example name, e-mail address, message) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to counselling or another contract, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering enquiries. We delete the data once the enquiry has been dealt with, unless statutory retention obligations prevent this. 7. Partner enquiries You can send us an enquiry about working together via the form on the “For partners” page. We process the details you provide there (for example name, e-mail address, organisation and message) in order to answer your enquiry and discuss a possible collaboration. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract), otherwise Art. 6(1)(f) GDPR. Our legitimate interest is handling business enquiries. The data is stored in Onepage's CRM; we also receive a notification by e-mail. If no collaboration results, we delete the data no later than twelve months after the last contact, unless statutory retention obligations prevent this. 8. Pitch deck requests You can request our pitch deck via the form on the “For investors” page. We process the details you provide there (for example name, e-mail address and organisation) in order to send you the pitch deck and to talk to you about an investment or funding. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a contract), otherwise Art. 6(1)(f) GDPR. Our legitimate interest is handling business enquiries. The data is stored in Onepage's CRM; we also receive a notification by e-mail. We delete the data no later than twelve months after the last contact, unless statutory retention obligations prevent this. 9. Nutrition counselling For nutrition counselling, Anica Buchta processes your contact details and the information you give for the consultation. This may include health data, for example about pregnancy, breastfeeding, intolerances or eating habits. The legal basis is Art. 6(1)(b) GDPR (carrying out the counselling). Health data is only processed with your explicit consent pursuant to Art. 9(2)(a) GDPR, which you can withdraw at any time. Invoicing data is kept for as long as tax law requires (usually ten years). Counselling documents are deleted two years after the last consultation unless you request deletion earlier. 10. Online counselling via Zoom Online consultations take place via Zoom. The provider is Zoom Communications, Inc., USA. Video, audio, your display name and technical connection data are processed. Conversations are not recorded. The legal basis is Art. 6(1)(b) GDPR. Data may be transferred to the USA. Zoom is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). A data processing agreement has been concluded with Zoom. 11. Payment via PayPal If you pay for counselling or digital content via PayPal, the data required for this (for example name, e-mail address and invoice amount) is transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. The legal basis is Art. 6(1)(b) GDPR (processing the payment). PayPal is itself responsible for processing the payment; PayPal's privacy policy applies. You can also pay by bank transfer instead. 12. Cookie banner and Google Analytics We use Onepage's cookie banner to obtain and store your consent to statistics cookies. Without your consent, we do not load any statistics services. You can change your choice at any time via the “Cookie settings” icon at the bottom right of the page. Storing your choice is technically necessary (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG) and serves as proof of your consent (Art. 6(1)(c) GDPR). With your consent, we use Google Analytics 4 via Google Tag Manager to understand how the website is used, for example which pages are visited and how visitors find their way here. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Among other things, device and browser data, approximate location, pages visited, time spent and the referring page are processed. Google Analytics sets cookies for this purpose. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future via “Cookie settings”. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). A data processing agreement has been concluded with Google. The retention period is set to 2 months; advertising features and Google Signals are deactivated.

13. Link to Instagram This website links to our Instagram profile. This is a simple link. Data is only transmitted when you click on it; Meta Platforms Ireland Limited's privacy policy then applies. For confidential health information, please use e-mail or the consultation instead. 14. Encryption This website uses SSL/TLS encryption. You can recognise it by “https://” in the address bar. 15. Your rights You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time (Art. 7(3)). Simply write to us at hello@albuena.com. Right to object: If we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can also lodge a complaint with a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59–61, 10555 Berlin, Germany. 16. Obligation to provide data and automated decision-making For the beta sign-up, we need your e-mail address and your device type. For counselling, the information without which counselling is not possible is required. We do not make any automated decisions and do not carry out profiling.