Last updated: 2026-08-11 · Deutsche Fassung
This policy explains how Nullzeiger GmbH processes personal data when you use Lunchmenu.ch.
We process personal data under the revised Swiss Federal Act on Data Protection (revFADP). Where the EU General Data Protection Regulation (GDPR) applies, we comply with it as well.
Nullzeiger GmbH, Köchlistrasse 28, 8004 Zürich, Schweiz (commercial register no. CH-020.4.091.508-0) is the controller for personal data collected through this website.
For privacy questions and to exercise your rights: privacy@lunchmenu.ch
We process only what the service needs, or what you choose to give us.
| Data | Purpose | Legal basis |
|---|---|---|
| Account: email address, name, password (stored only as a hash), preferred language | Running your account and signing you in | Performance of a contract |
| Google or GitHub sign-in: your identifier at that provider, email address, name | Signing in without a separate password | Performance of a contract |
| Favourites, ratings and review text | Showing your saved restaurants and public reviews | Performance of a contract |
| Polls: the name you type yourself when voting, creating a poll or suggesting a restaurant, your vote, and a shortened value derived from your IP address combined with a secret, which cannot be reversed (when voting, creating a poll and suggesting a restaurant) | Running the poll and preventing repeat voting and mass-created polls | Contract and legitimate interest in preventing abuse |
| Poll result by email (optional): the email address you enter when sharing a poll | Sending one single email with the result when the poll ends | Performance of a contract |
| Newsletter: email address, send time, timezone, preferences | Sending the menu newsletter you asked for | Consent |
| Marketing consent: when and where you agreed | Proving that, and when, you asked for news and offers by email | Consent; for existing customers, legitimate interest with a right to object at any time (see section 6) |
| Emails you send us: sender address, subject, content and technical headers | Handling your request and keeping track of the correspondence | Performance of a contract or legitimate interest in answering you |
| Usage events: restaurant page views, share clicks, favourite actions | Understanding which content is used; statistics for restaurants | Legitimate interest in operating and improving the service |
| Security log: timestamps of sign-ins and administrative changes | Traceability and abuse detection | Legitimate interest in security |
| Location (only if you allow or enter it) | Showing restaurants near you | Consent |
If you allow location access or type an address, the coordinates are sent to our server to search for nearby restaurants.
We do not store your location. It is used to answer that one search and then discarded.
Address search and map tiles are requested by your browser directly from external services (see section 5). Those services see your IP address.
We use few cookies. The strictly necessary ones do not require consent; analytics cookies are set only after you agree.
| Cookie | Purpose | Lifetime |
|---|---|---|
| lm_session | Keeps you signed in. Strictly necessary. | 7 days |
| lm_oauth_state | Protects Google/GitHub sign-in against tampering. Strictly necessary. | a few minutes |
| lm_poll_voter | Recognises your vote in a poll so you can change it instead of voting twice. Strictly necessary. | 180 days |
| _ga, _ga_* | Google Analytics. Set only if you accept in the banner. | up to 24 months |
We do not sell personal data. We use the following providers to run the service:
We send you news and offers about Lunchmenu.ch by email when you provide your email address in the course of using our service and do not object: you can untick the corresponding box right where you enter your address, and every email contains an unsubscribe link (Art. 3 para. 1 lit. o Swiss UCA). We record when and where you made that choice.
Under Swiss law (art. 3 para. 1 let. o UCA) we may inform existing customers about our own, similar services. You can object to that at any time as well.
Every marketing email contains an unsubscribe option. You can opt out or withdraw a given consent at any time, including with an informal message to privacy@lunchmenu.ch; after that you will receive no further marketing email. Sign-in codes and other emails needed to run the service are unaffected.
Emails you send to our addresses (for example privacy@lunchmenu.ch) are received through Cloudflare Email Routing and stored with sender address, subject and content so that we can handle your request and keep track of the correspondence.
Some of these providers are based outside Switzerland, including in the United States. Personal data may therefore be transferred to countries whose data protection level differs from Switzerland's.
Where that happens we rely on the European Commission's Standard Contractual Clauses in the form recognised by the Swiss FDPIC, or on a recognised adequacy decision.
You have the right to access the personal data we hold about you, to have it corrected or deleted, and to receive it in a common format. You may object to processing and withdraw consent at any time.
Write to privacy@lunchmenu.ch. We may ask you to prove your identity so that we do not disclose data to the wrong person.
You can withdraw analytics consent at any time by clearing this site's stored choice in your browser; we will then ask again.
You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC). If you live in the EU or EEA, you may complain to your local supervisory authority.
Traffic is encrypted with HTTPS. Passwords are stored only as salted hashes (PBKDF2), never in plain text. Database access is limited to operating the service.
Restaurant details and lunch menus come from the restaurants themselves, from a restaurant's own publicly accessible website, or from manual entry by us. Every menu records where it came from.
If you represent a restaurant and want its listing changed or removed, contact us at the address above.
We may update this policy when the service or the legal situation changes. The version published here is the one that applies.