Test My Batch logoTest My Batch

Privacy Policy for testmybatch.com

Version: September 2026

This English version is provided for convenience. In case of any discrepancy, the German version ("Datenschutzerklärung") prevails.

This Privacy Policy explains which personal data we process when you visit testmybatch.com, submit a request, use the customer dashboard or order services from Test My Batch, for which purposes and on which legal basis we do so, to whom data is disclosed, and which rights you have.

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Wonnda GmbH
Klosterstraße 65
10179 Berlin
Germany

Email: tmb@wonnda.com
Phone: +49 30 16634706

Represented by the managing directors Oliver Allmoslechner and Martin Ditzel.

Test My Batch is a product of Wonnda GmbH. We have not appointed a data protection officer, as the statutory requirements for doing so are not met. For all questions regarding data protection, please contact us at tmb@wonnda.com.

2. Overview

Test My Batch is offered exclusively to businesses. We therefore primarily process personal data of contact persons at our customers and prospects (for example name, business email address, phone number, role) and of website visitors (for example technical access data).

We process your data on the following legal bases:

  • Art. 6(1)(a) GDPR (consent), for example for web analytics cookies or direct contact by partner laboratories;
  • Art. 6(1)(b) GDPR (contract and pre-contractual measures), for example for preparing quotes, processing orders and the dashboard;
  • Art. 6(1)(c) GDPR (legal obligation), for example for retention obligations under commercial and tax law;
  • Art. 6(1)(f) GDPR (legitimate interest), for example for the secure operation of the website, the processing of data of contact persons at our business customers, our CRM and the enforcement of legal claims.

Where consent is required for accessing information on your device (for example cookies), the legal basis is Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(a) GDPR.

3. Provision of the Website, Hosting, Server Log Files

3.1 Hosting

The website is provided via the Lovable platform of Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. To deliver the website, Lovable uses infrastructure and network service providers that may operate data centres outside the European Economic Area, in particular in the USA. We have concluded a data processing agreement with Lovable. Transfers to third countries are safeguarded by the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR).

The legal basis is our legitimate interest in a secure, fast and reliable provision of the website (Art. 6(1)(f) GDPR).

3.2 Server Log Files

When you access the website, technical access data is processed automatically: IP address, date and time of access, page or file accessed, data volume transferred, browser type and version, operating system, referrer URL. This data is technically necessary to deliver the website and serves the security and stability of the system, for example to defend against attacks and to analyse errors. It is not merged with other data.

The legal basis is Art. 6(1)(f) GDPR. Log files are generally deleted within a few days and at the latest after 30 days, unless they are needed for longer to investigate a security incident.

4. Cookies and Consent Management

The website uses cookies and comparable technologies (for example local storage). Cookies are small text files stored on your device.

Strictly necessary cookies are required to operate the website, for example for logging in to the dashboard, language selection and storing your cookie settings. They are used without consent (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).

Non-essential cookies, in particular for web analytics (Section 5), are used only with your consent. When you first visit the website, we ask for your consent via a consent banner. You can change your selection at any time via the "Cookie settings" link in the website footer or withdraw your consent with effect for the future. We log your selection (time, categories chosen, banner version) in order to be able to demonstrate consent (Art. 7(1) GDPR). This log data is retained for three years after the last update of your settings.

The legal basis for non-essential cookies is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

5. Web Analytics and Tag Management

5.1 Google Tag Manager

We use Google Tag Manager from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Tag Manager is a tool we use to manage and embed website tags (for example for Google Analytics). Tag Manager itself does not set analytics cookies and does not collect personal data for its own purposes; however, your IP address is transmitted to Google when it loads. Tag Manager and the tags managed through it are loaded only after you have given consent via the consent banner.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

5.2 Google Analytics 4

With your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar technologies to analyse your use of the website, for example pages viewed, time spent, approximate location (based on the IP address, which is not stored), device and browser used, source of the visit and interactions such as submitting a request. Google Analytics 4 does not store full IP addresses. The information generated is generally transmitted to and processed on servers of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

We use the data to statistically evaluate the use of the website, improve our content and measure the success of our marketing activities. We have concluded a data processing agreement with Google. Google LLC is certified under the EU-US Data Privacy Framework; in addition, the EU Commission's Standard Contractual Clauses apply.

User and event data stored in Google Analytics is deleted after 14 months. Google Analytics cookies have a lifetime of up to two years.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw your consent at any time via the cookie settings. Further information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245.

6. Requests, Quotes and Communication

6.1 Request Form

Via the "Get a quote" form you can request an analysis of your product. We process the information you enter into the form: name of the contact person, company, business email address, phone number, link to the product page, photo of the product label, information about the product and your testing requirements, and the time of the request.

We process this data to review your request, ask follow-up questions, prepare and send a quote, and communicate with you about the request. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) where you are the contracting party yourself, and otherwise our legitimate interest in processing requests from our business customers (Art. 6(1)(f) GDPR).

The label photo may contain mandatory information such as the name and address of the responsible food business operator. Please do not upload photos in which other persons are recognisable.

6.2 Storage in Our Database (Supabase)

We store request data, order data, test reports and dashboard data in a database operated by us with Supabase Pte. Ltd., Singapore. The data is stored on servers in the European Union (Frankfurt am Main region, Germany). We have concluded a data processing agreement with Supabase. Where Supabase accesses data from outside the EEA for support or maintenance, this is safeguarded by the EU Commission's Standard Contractual Clauses.

The legal basis is Art. 6(1)(b) and (f) GDPR.

6.3 AI-Assisted Pre-Analysis of Your Request (OpenAI)

In order to process your request faster, we automatically evaluate the product page link you provide or the uploaded label photo. For this purpose, the content of the product page and/or the label photo is transmitted to the API of OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland, in order to extract product information (for example product type, ingredients, dosage form) and to suggest a suitable test scope. Your contact details (name, email address, phone number) are not transmitted to OpenAI.

OpenAI processes the data transmitted via the API exclusively on our behalf, does not use it to train its models and deletes it after 30 days at the latest. We have concluded a data processing agreement with OpenAI. Processing may take place on servers of OpenAI, L.L.C. in the USA; the transfer is safeguarded by the EU Commission's Standard Contractual Clauses.

The automatically generated suggestion is reviewed by our staff. The quote is prepared by a human. No automated decision-making within the meaning of Art. 22 GDPR takes place.

The legal basis is our legitimate interest in processing requests efficiently (Art. 6(1)(f) GDPR) and Art. 6(1)(b) GDPR.

6.4 CRM System (HubSpot)

To manage our customer and prospect relationships, we use the CRM system HubSpot from HubSpot Ireland Limited, 1 Sir John Rogerson's Quay, Dublin 2, Ireland (parent company: HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA). In HubSpot we store contact details of contact persons, company data, the communication history, requests, quotes and orders.

We have concluded a data processing agreement with HubSpot. HubSpot, Inc. is certified under the EU-US Data Privacy Framework; in addition, the EU Commission's Standard Contractual Clauses apply.

The legal basis is our legitimate interest in efficient customer management and sales organisation (Art. 6(1)(f) GDPR) and Art. 6(1)(b) GDPR.

6.5 Communication by Email and Phone

If you contact us by email (for example at tmb@wonnda.com) or by phone, we process your contact details and the content of the communication in order to handle your enquiry. For email traffic we use an external email service provider with whom a data processing agreement is in place.

The legal basis is Art. 6(1)(b) GDPR where the communication serves the initiation or performance of a contract, and otherwise Art. 6(1)(f) GDPR.

7. Customer Account and Dashboard

After placing an order, you receive access to a customer dashboard in which you can view the status of your order and retrieve test reports. Login is passwordless via a login link ("magic link") that we send to your email address. For this we use the authentication service of Supabase (Section 6.2). When you log in, we process your email address, the time of login, the IP address and technical session data. Strictly necessary cookies maintain your session.

The legal basis is Art. 6(1)(b) GDPR. Security logging is based on Art. 6(1)(f) GDPR.

8. Contract Processing and Payment

8.1 Order Data

To perform the order, we process company data, contact details of contact persons, quote and order data, invoicing data, product data, information about the samples, the order status, communication regarding the order and the test reports. The legal basis is Art. 6(1)(b) GDPR and, for contact persons who are not themselves the contracting party, Art. 6(1)(f) GDPR. We retain invoicing data due to obligations under commercial and tax law (Art. 6(1)(c) GDPR).

8.2 Payment Processing (Stripe)

We process payments via the payment service provider Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). Via Stripe, bank transfer, SEPA direct debit, credit card and PayPal are available to you. You enter your payment data (for example card number, IBAN, account holder name) directly with Stripe; we ourselves do not receive full payment data, only information about the payment status, payment method, the last digits of the payment instrument and the transaction reference.

Stripe processes your data for payment processing and fraud prevention partly under its own responsibility. Stripe may transfer data to Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework, and the Standard Contractual Clauses apply in addition. Further information: https://stripe.com/privacy.

If you pay with PayPal, your data is additionally processed by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. Further information: https://www.paypal.com/legalhub/privacy-full.

The legal basis is Art. 6(1)(b) GDPR.

9. Disclosure to Partner Laboratories

The analyses are not performed by us but by partner laboratories. Our partner laboratories are testing laboratories accredited under ISO/IEC 17025 and/or operating under GMP and established in the European Union. No transfer to third countries takes place in this context.

9.1 Disclosure for Performance of the Order

To perform the analysis, we transmit to the partner laboratory the samples, the product data required for the analysis (for example product name, ingredients, batch number, test scope) and the customer's company name. As a rule, we do not transmit contact details of your contact persons in this context. The partner laboratory processes this data under its own responsibility within the scope of its accreditation and its statutory documentation obligations.

The legal basis is Art. 6(1)(b) GDPR and, for contact persons, Art. 6(1)(f) GDPR.

9.2 Disclosure of Contact Details in Urgent Cases

In urgent cases where direct coordination between you and the partner laboratory is necessary to perform the order (for example short-notice queries about a sample that otherwise cannot be analysed), we may transmit the name, business email address and phone number of your contact person to the partner laboratory or establish direct contact. The partner laboratory may use this data exclusively for handling the specific order.

The legal basis is Art. 6(1)(b) GDPR and, for contact persons, Art. 6(1)(f) GDPR.

9.3 Direct Contact by Partner Laboratories with Your Consent

If you give us your separate consent, we may pass on your contact details (name, company, business email address, phone number) to the partner laboratory that performed your analysis so that it can contact you directly, for example for follow-up questions, follow-up analyses or its own offers. The partner laboratory is itself responsible under data protection law for this contact. On request, we will tell you to which partner laboratory your contact details were disclosed.

Consent is voluntary and not a condition for placing an order. You can withdraw it at any time with effect for the future, for example by email to tmb@wonnda.com. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

The legal basis is your consent (Art. 6(1)(a) GDPR).

10. Information About Our Own Similar Services

If you have ordered services from us, we use the email address provided in that context to occasionally inform you about our own similar Test My Batch services (Section 7(3) of the German Act Against Unfair Competition, UWG). You can object to this use at any time without incurring any costs other than transmission costs at basic rates, for example via the unsubscribe link in every email or by email to tmb@wonnda.com. The legal basis is our legitimate interest in direct marketing to existing customers (Art. 6(1)(f) GDPR).

11. Other Recipients

In addition to the service providers named in this Privacy Policy, we disclose personal data only where necessary to: tax advisers and auditors (Art. 6(1)(c) and (f) GDPR); legal advisers, courts and debt collection service providers to enforce or defend claims (Art. 6(1)(f) GDPR); authorities where we are legally obliged to do so (Art. 6(1)(c) GDPR); and, in the context of a corporate transaction, to the acquirer (Art. 6(1)(f) GDPR).

12. Data Transfers to Third Countries

Some of the service providers we use are established or operate servers outside the European Economic Area, in particular in the USA (Google, HubSpot, Stripe, OpenAI, Lovable infrastructure, Supabase support). Where data is transferred there, this takes place only on the basis of an adequacy decision of the EU Commission (Art. 45 GDPR), in particular the EU-US Data Privacy Framework for certified companies, or on the basis of the EU Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR) including supplementary measures. We will provide you with a copy of the respective safeguards on request.

13. Retention Periods

We store personal data only for as long as necessary for the purposes stated or as required by statutory retention obligations. In detail:

  • Requests that do not lead to an order: 12 months after the last contact.
  • Order and contract data, quotes, order confirmations, invoices and business correspondence: up to ten years after the end of the calendar year in which the order was completed (Section 147 of the German Fiscal Code, Section 257 of the German Commercial Code).
  • Test reports in the dashboard: three years from provision; they are then deleted from the dashboard. We recommend archiving test reports yourself.
  • Customer account: until deletion of the account at your request or after three years of inactivity, unless retention obligations prevent this.
  • Consents and their withdrawal: three years after withdrawal or expiry of the consent, as evidence.
  • Cookie settings: up to twelve months, after which we ask again.
  • Data in Google Analytics: 14 months.
  • Data at OpenAI: up to 30 days.
  • Server log files: generally a few days, at most 30 days.

After expiry of the respective period, the data is deleted or anonymised, unless longer storage is necessary to establish, exercise or defend legal claims.

14. Your Rights

You have the following rights vis-à-vis us with regard to personal data concerning you:

  • right of access (Art. 15 GDPR),
  • right to rectification (Art. 16 GDPR),
  • right to erasure (Art. 17 GDPR),
  • right to restriction of processing (Art. 18 GDPR),
  • right to data portability (Art. 20 GDPR),
  • right to withdraw consent with effect for the future (Art. 7(3) GDPR),
  • right to object (Art. 21 GDPR, see Section 15).

To exercise your rights, an email to tmb@wonnda.com is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, Germany, email: mailbox@datenschutz-berlin.de. You may also contact the supervisory authority of your habitual residence or place of work.

15. Right to Object

Where we process your personal data on the basis of Art. 6(1)(f) GDPR (legitimate interest), you have the right to object to the processing at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

Where we process your data for direct marketing purposes (Section 10), you may object at any time without giving reasons. We will then no longer process your data for this purpose.

You can object informally, for example by email to tmb@wonnda.com.

16. Obligation to Provide Data

You are neither legally nor contractually obliged to provide your data. However, without the data marked as mandatory in the request form (in particular name, company, email address and product information), we cannot prepare a quote or perform an order.

17. Automated Decision-Making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The AI-assisted pre-analysis (Section 6.3) only generates a suggestion that is reviewed by our staff.

18. Data Security

The website and the dashboard are delivered via a TLS-encrypted connection (https). We use technical and organisational measures to protect your data against loss, manipulation and unauthorised access, and continuously adapt these measures to the state of the art.

19. Changes to This Privacy Policy

We amend this Privacy Policy when our data processing or the legal situation changes. The current version published on this page applies. The date of the last update is shown at the beginning of this policy.

[Include only if fonts are loaded from Google servers; omit if fonts are self-hosted:]

20. Google Fonts

For a consistent display, the website uses fonts from Google ("Google Fonts"), which are loaded from servers of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, when the page is accessed. Your IP address is transmitted to Google in the process. This takes place only with your consent via the consent banner (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, a standard font of your system is used. Further information: https://policies.google.com/privacy.