Privacy policy

1. Controller

[Firmenname bzw. Vor- und Nachname des Inhabers], [Straße und Hausnummer], [PLZ] [Ort]
Email: [E-Mail-Adresse] · Phone: [Telefonnummer]

No data protection officer has been appointed. [Check whether one is required]

2. Overview

We only process personal data as far as it is needed to run this website, the online booking and your customer account, or if you have given your consent. Legal bases are in particular Art. 6 (1) (b) GDPR (contract), (c) (legal obligations), (f) (legitimate interests) and (a) (consent), and § 25 TDDDG for access to your device.

3. Hosting and server logs

The website and booking system are hosted by: [Hosting-Anbieter, z. B. Microsoft Ireland Operations Ltd. (Azure, Region Westeuropa) oder VPS-Anbieter], under a data processing agreement (Art. 28 GDPR).

When you visit the website, the server processes technically necessary data (IP address, time, page requested, browser identifier) to deliver the site and keep it stable and secure (e.g. limiting too many requests from one IP address) – Art. 6 (1) (f) GDPR. Our application logs contain no names, email addresses or phone numbers. Log data is deleted after 14 days.

4. Online booking

For a booking we process the chosen services, barber and time, your name, email address, phone number, an optional note for the barber, your language and the status of the booking and deposit, in order to provide the appointment (Art. 6 (1) (b) GDPR). Your barber sees what is needed for the appointment.

Cancelled, declined and expired requests are anonymised after 6 months (name, email, phone and note are removed). Completed appointments are kept: [Aufbewahrung abgeschlossener Termine, z. B. 3 Jahre – mit Steuerberatung abstimmen].

5. Customer account and loyalty programme

If you create an account, we store your name, email address, phone number, language, a hashed password, your bookings and your loyalty progress (Art. 6 (1) (b) GDPR). We send a link to confirm your email address. Unconfirmed accounts are deleted after 30 days.

For signing in we set a technically necessary, encrypted session cookie (httpOnly) and keep a note in your browser's local storage that a session exists (§ 25 (2) no. 2 TDDDG). In your profile you can export your data as a file and delete your account at any time; future appointments are then cancelled under the cancellation terms.

6. Emails

We send the emails needed for bookings and your account (request received, acceptance with payment link, confirmation with calendar file, reminder, cancellation, account confirmation, password reset) – Art. 6 (1) (b) GDPR. Sent via: [E-Mail-Versanddienst, z. B. Azure Communication Services / SMTP-Anbieter] (processor). Outgoing emails are stored until they have been sent and afterwards only kept as a delivery log without content.

7. Deposit

[Zahlungsdienstleister – derzeit keiner: Anzahlungen laufen im Demo-Modus]. In demo mode no payment data is requested or processed; only the amount and status of the (simulated) payment are stored.

8. Abuse protection (bot check)

To protect the booking, registration and password-reset forms against automated requests we use – if enabled – Cloudflare Turnstile (Cloudflare, Inc. (Turnstile), 101 Townsend St., San Francisco, CA 94107, USA). Technical browser data and your IP address are sent to Cloudflare to tell humans from bots; no advertising cookies are set. Legal basis: our legitimate interest in secure operation (Art. 6 (1) (f) GDPR, § 25 (2) no. 2 TDDDG). Cloudflare is certified under the EU-US Data Privacy Framework. [Legal review]

9. Cookies and consent

Without your consent we only use technically necessary storage: language (cookie NEXT_LOCALE, one year), colour scheme (local storage), sign-in (see section 5) and your cookie choice itself. For statistics and marketing we ask for your consent on your first visit (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). No analytics or advertising scripts load before that.

We store your choice with the time and the version of the settings in your browser for 12 months. You can change or withdraw it at any time via “Cookie settings” in the website footer; withdrawal applies from that moment.

10. Statistics (only with consent)

With your consent to “Statistics” we measure how the website is used (e.g. pages viewed, booking steps) to improve it. Service used: [Statistics service, e.g. Google Analytics 4 (Google Ireland Ltd.) with IP truncation – or “none”]. No names, email addresses or phone numbers are sent.

11. Marketing and campaign measurement (only with consent)

With your consent to “Marketing” we can tell which ad or campaign brought you to us: campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and click IDs from Google (gclid) or Meta (fbclid) are stored in your browser for 30 days on your first visit and sent to us with a booking. This shows us which ad led to which bookings. Optional services: [e.g. Google Ads conversion tracking, Meta Pixel (Meta Platforms Ireland Ltd.) – or “none”]. Without consent none of this is stored or sent.

12. Recipients and third countries

Recipients are the processors named above (hosting, email) and – only with consent or when enabled – the statistics, marketing and bot-protection services named. Where data is transferred to the USA, this is based on the EU-US Data Privacy Framework or standard contractual clauses.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7 (3)). You also have the right to lodge a complaint with a data protection supervisory authority, e.g.: [Zuständige Datenschutz-Aufsichtsbehörde, z. B. Berliner Beauftragte für Datenschutz und Informationsfreiheit].

14. Obligation to provide data

We need your name, email address and phone number to arrange an appointment. Without them online booking is not possible, but you can always call us.