Privacy policy

1. Controller within the meaning of the GDPR

Kurzhaar Kiosk — proprietor Emre Yıldırım Kaiser-Wilhelm-Straße 288 47166 Duisburg-Hamborn Telephone: +49 203 4491570 Email: hallo@kurzhaar-kiosk.de

No data protection officer has been appointed, because the statutory thresholds for doing so are not met (Art. 37 GDPR, § 38 BDSG).

2. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. A data processing agreement under Art. 28 GDPR is in place. Transfers to the United States are based on the European Commission’s standard contractual clauses and on the provider’s certification under the EU-US Data Privacy Framework.

When the site is accessed, access data is automatically written to server log files: a truncated IP address, the date and time of the request, the page requested, the volume of data transferred, the status code, the referring page and the browser and operating system identifiers.

The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the technically faultless operation of the site and in defending against attacks. Log files are deleted after 30 days at the latest.

3. Cookies and local storage

This website sets no advertising or analytics cookies. Only the following two entries are stored, and they are held in your browser’s local storage rather than on our servers:

• “kk-consent-v1” — your decision in the cookie notice. Without it we would have to ask you again on every page view. Retained until you clear your browser storage.
• “kk-stempelkarte-v1” — your digital loyalty card: a randomly generated card code, the number of stamps and their dates. This entry never leaves your device. It is not transmitted to us, to Vercel or to any third party, and we have no technical means of reading it.

4. The digital loyalty card in detail

No registration is required for the card. No name, no email address and no device identifier is collected. The card code is generated entirely inside your browser.

If you want a stamp in the shop, you read the code out at the counter. It is written by hand, with the date, into a book beside the till, so that the tenth free haircut can be verified. The legal basis for that record in the shop is Art. 6 (1) (b) GDPR (operating the loyalty scheme at your request). Entries are destroyed twelve months after the last entry.

If you clear your browser storage the card on your device is lost. In that case the count can be restored from the book using your code.

5. Contact form

If you send us a question using the form on this website, we process the data you provide (name, email address, chosen topic and message text) solely in order to answer your enquiry.

The legal basis is your consent under Art. 6 (1) (a) GDPR, given by ticking the box and revocable at any time with effect for the future, and Art. 6 (1) (b) GDPR insofar as your enquiry is directed at concluding a contract.

Messages are deleted once the matter has been dealt with, and at the latest six months after receipt, unless statutory retention obligations apply. Data is not passed to third parties. The form is expressly not a booking; it creates no entitlement to be served at any particular time.

6. Google Maps

On the “Find us” section we offer a Google Maps map. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map is not loaded until you have expressly agreed — either in the cookie notice or via the button directly beside the map area. Before that, no connection to Google is established at all. Once you agree, your IP address and details about your device are transmitted to Google, and a transfer to the United States cannot be ruled out.

The legal basis is your consent under Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. You may withdraw that consent at any time via “Cookie settings” in the footer. Details of Google’s processing can be found in its own privacy policy.

7. Reviews

The reviews shown on this website are an editorially maintained static copy of our public Google Business profile. No Google widget is embedded. Viewing the reviews section therefore transmits no data to Google.

8. Fonts

The typefaces “Staatliches” and “Barlow” are downloaded when the website is built and are served from our own server. No connection to Google Fonts servers is made when the page is opened, and no IP address is transmitted there.

9. Your rights as a data subject

You have the following rights in relation to us:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7 (3) GDPR)

10. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. The authority responsible for us is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

11. Automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. The typical waiting time shown on the home page is an average taken from till data and is calculated with no reference to you whatsoever.