Privacy policy

Papa & Bande, Inhaber Tobias Ehlers, Göttinger Chaussee 78, 30453 Hannover-Ricklingen, Germany. Telephone +49 511 2109840, email moin@papa-und-bande.de. We do not have a statutory data protection officer as we are below the threshold of § 38 BDSG.

This website is hosted by Vercel Inc. on servers in the European Union. When you open a page the server writes a log entry containing your shortened IP address, the time, the page requested, the referrer and your browser type. Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest in operating a secure website. These logs are deleted after 14 days. A data processing agreement pursuant to Art. 28 GDPR is in place.

The certificate generator on the home page runs entirely in your browser. The first name, the date and the name of the barber you type in are held in the memory of the page while it is open and used only to draw the page you print. They are not transmitted to our server, not stored in a cookie or in local storage, not written to any log and not passed to anyone else. Closing or reloading the tab erases them. Because nothing reaches us, there is no processing of personal data by us at this step, and therefore no retention period and nothing to erase on our side. We deliberately ask for a first name only — no surname, no date of birth, no photograph.

Most of the people we cut hair for are children, and children's data deserves more care, not less. Three rules we hold ourselves to:

1. The booking form is addressed to the parent or guardian and asks only for the grown-up's name, telephone number and, optionally, email address. We never ask for a child's name, age, date of birth, height, photograph or any health information in a form.

2. A child is never invited to submit their own details. If a child fills the form in, we treat the entry as invalid and delete it.

3. What you tell us in the chair — that a child dislikes the clipper noise, for example — is kept as a short note in our appointment book and deleted when the note is no longer useful, at the latest after twelve months.

If you have nonetheless entered something about a child in the free-text field, write or call us and we will delete it immediately.

When you request an appointment we process the name, telephone number and, if given, the email address of the person booking, the service, the requested day and time, and any free text you add. Purpose: arranging, confirming and carrying out the appointment. Legal basis: Art. 6 (1) (b) GDPR (steps prior to a contract) and, for the confirmation call, Art. 6 (1) (f) GDPR. The data reaches us by email and is entered in our appointment book. We delete booking data six months after the appointment unless commercial or tax retention periods under §§ 147 AO, 257 HGB require otherwise.

We set no tracking, analytics or advertising cookies. We store two things in your browser's local storage, and only after you have chosen: your answer to the cookie banner, and whether you have asked for the map to be loaded. Both are technical settings on your device, are never sent to us and can be removed by clearing your browser data. Legal basis: § 25 (2) TDDDG for strictly necessary storage and Art. 6 (1) (a) GDPR for your consent to the map.

The map is not loaded until you click to load it. Only then does your browser contact OpenStreetMap Foundation (St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom) and transmit your IP address. Legal basis: Art. 6 (1) (a) GDPR, your consent, which you may withdraw at any time by reloading the page.

The typefaces Bangers and Nunito Sans are served from our own domain. Your browser makes no request to Google Fonts or any other third party when you view this site.

The WhatsApp button is an ordinary link. Nothing is loaded from WhatsApp until you tap it. If you write to us there, the content and your telephone number are processed by WhatsApp Ireland Ltd under their own terms; we use the number only to answer you and delete the conversation after six months. Legal basis: Art. 6 (1) (b) and (f) GDPR.

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Where processing rests on consent, you may withdraw it at any time with effect for the future. A message to moin@papa-und-bande.de is enough; we do not require a particular form.

You may complain to a supervisory authority, for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, poststelle@lfd.niedersachsen.de.

We do not use profiling or automated decision-making within the meaning of Art. 22 GDPR.