Privacy policy

The controller responsible for data processing on this website is:

We have not appointed a data protection officer, as we are not legally required to. If you have questions about data protection, please contact us directly.

• We only process your data to manage your appointments and to provide this website securely.
• We do not use advertising or analytics cookies and we do not track you.
• We do not sell your data or share it for advertising.
• Your booking data is stored in data centres in Frankfurt am Main, Germany.

This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The application runs in a data centre in Frankfurt am Main; requests may first be routed to a nearby server of Vercel's global network.

Each visit involves the processing of technically necessary data:

• IP address,
• date and time of access,
• requested address (URL) and amount of data transferred,
• browser, operating system and, if applicable, the previously visited page (referrer).

The purpose is to deliver the website and to ensure its stability and security. The legal basis is our legitimate interest in a secure and working service (Art. 6(1)(f) GDPR). The logs are kept only briefly and are then deleted automatically.

We have a data processing agreement with Vercel (Art. 28 GDPR). Vercel is certified under the EU-US Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR); the EU Standard Contractual Clauses apply in addition.

When you book an appointment online, we process:

• name and phone number (required),
• email address (optional),
• the chosen service, barber, date, time and price,
• your chosen language and the time at which you acknowledged this privacy policy.

We use this data to plan and carry out your appointment and to contact you about changes or cancellations. If you provide an email address, we send you a confirmation, a reminder about 24 hours before the appointment and messages about changes. The legal basis is the performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR).

An online booking is not possible without a name and phone number. You can always book by phone or in person instead.

Our team may add notes about you (e.g. haircut preferences) and see your appointment history, including missed appointments. To limit no-shows, each person can have at most 2 upcoming online bookings. After repeated missed appointments, online booking may be blocked for you; booking by phone remains possible. This decision is always made by a person, not by an automated system (no automated decision within the meaning of Art. 22 GDPR). The legal basis is our legitimate interest in reliable appointment planning (Art. 6(1)(f) GDPR).

Storage period: your client data and appointment history are deleted once no appointment has taken place for 24 months, or earlier if you ask us to. Statutory retention obligations (e.g. for accounting records under § 147 of the German Fiscal Code and § 257 of the German Commercial Code) remain unaffected.

After booking you receive a personal link that lets you view, reschedule or cancel your appointment. The link contains a random key; we only store a non-reversible check value (hash) of it. Please do not share the link, because anyone who has it can manage the appointment.

To send booking confirmations, reminders and change notices we use the email service Resend (Plus Five Five, Inc., USA). Your email address, your name and the appointment details are transmitted. The legal basis is Art. 6(1)(b) GDPR. We have a data processing agreement with the provider; the transfer to the USA is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Booking, client and staff data is stored in a database provided by Neon, Inc. (USA, a Databricks company). The servers are located in Frankfurt am Main (EU). We have a data processing agreement with the provider. Where access from the USA, for example for maintenance or support, cannot be ruled out, it is safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

To prevent automated mass bookings and attacks, we count requests per IP address and per phone number over short periods. These counters are deleted after 24 hours at the latest. The legal basis is our legitimate interest in the security of the booking system (Art. 6(1)(f) GDPR).

We do not use cookies for advertising, analytics or tracking. We only use technically necessary techniques:

• a cookie that stores the language you chose,
• the progress of your booking in your browser's session storage (sessionStorage), which is deleted when you close the tab,
• for staff, a sign-in cookie for the duration of the session.

Storing and reading this information does not require consent, because it is strictly necessary for the service you have explicitly requested (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). Further processing is based on Art. 6(1)(b) or (f) GDPR.

The fonts on this website are loaded from our own server. No connection to Google's servers is made.

The directions link opens Google Maps or Apple Maps. Data is only transmitted to that provider once you tap it; their privacy policy then applies.

For our staff we process, to organise appointments and rotas: name, email address, phone number, photo (optional), working hours and absences, sign-in sessions (including IP address and browser) and a log of changes made. The legal basis is the employment relationship (Art. 6(1)(b) GDPR) and our legitimate interest in being able to trace changes (Art. 6(1)(f) GDPR).

If staff members turn on push notifications, we store a push address for their device. Notifications are delivered through the push service of the browser or device maker (e.g. Google, Apple, Mozilla). The basis is consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which can be withdrawn at any time in the settings.

Only our staff, where they need the data for their tasks, the service providers named above and the provider of our booking software, which operates and maintains the system on our behalf, have access to your data, each as a processor. We only pass data to other third parties if we are legally required to.

You have the right to:

• access the data we hold about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• withdraw any consent you have given, with effect for the future (Art. 7(3) GDPR).

For any request, an informal message to or a call to +49 30 1234567 is enough.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is: .

We update this privacy policy when our service or the law changes. The version published here applies.