Privacy policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

No data protection officer has been appointed; the business does not reach the thresholds of § 38 of the German Federal Data Protection Act. Data protection enquiries are answered personally by the owner at the address above.

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA, whose European infrastructure runs in Frankfurt am Main. When you open the site, the host processes technically necessary connection data in server log files:

• truncated IP address of the requesting device
• date and time of access
• the address requested and the volume of data transferred
• referrer address, where transmitted
• browser type, browser version and operating system

The legal basis is Article 6 (1) (f) GDPR. Our legitimate interest is the secure, stable and attack-resistant operation of the website. Log files are deleted after 30 days at the latest. A data processing agreement under Article 28 GDPR is in place with Vercel; transfers to the United States are covered by the European Commission’s standard contractual clauses and by certification under the EU-US Data Privacy Framework.

We set no cookies for analytics or advertising. Only your browser’s local storage is used, for two purposes:

• your choice in the consent banner, so that we do not have to ask again on every visit;
• your digital stamp card, if you use it.

Neither entry leaves your device, and neither is read or transmitted by us. The legal basis for storing the consent decision is § 25 (2) no. 2 TDDDG in conjunction with Article 6 (1) (f) GDPR. You can delete both entries at any time by clearing this site’s data in your browser.

In the “Find us” section we offer a map from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The map is not loaded automatically. You first see our own, locally stored street plan; a connection to Google is only established once you explicitly click “Load the map from Google”.

Doing so transmits your IP address, information about your browser and any Google cookies set in your browser to Google; a transfer to the United States cannot be ruled out. The sole legal basis is your consent under Article 6 (1) (a) GDPR and § 25 (1) TDDDG.

You may withdraw your consent at any time with effect for the future by clicking “Cookie settings” in the site footer. The lawfulness of processing carried out before withdrawal is unaffected. For details on Google’s processing see policies.google.com/privacy.

If you write to us using the form on the home page, we process the details you enter: name, email address, telephone number where given, the nature of the enquiry, the volume in litres, the collection time and your message.

Processing serves to deal with your enquiry. The legal basis is Article 6 (1) (b) GDPR where the enquiry is directed at concluding or performing a contract, and otherwise Article 6 (1) (f) GDPR, on the basis of our legitimate interest in answering enquiries.

The data is delivered by email to our mailbox at mailbox.org AG, Rungestraße 20, 10179 Berlin, and stored there. Enquiries that do not lead to a contract are deleted no later than six months after the last correspondence. Orders are subject to the commercial and tax retention periods of six and ten years respectively.

The data is not passed to any third party. There is no automated decision-making and no profiling.

The typefaces Public Sans and Karla are not fetched from Google servers. They are bundled when the site is built and served from our own server, so opening the page creates no connection to Google. The same applies to every photograph and to the street plan.

When you buy on the spot we process personal data only if you pay by card. Payments are handled by SumUp Payments Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, Ireland; we ourselves see neither your full card number nor your name. There is no video surveillance at the hatch. The paper stamp card carries no personal details.

In respect of personal data concerning you, you have the following rights against us:

• right of access under Article 15 GDPR
• right to rectification under Article 16 GDPR
• right to erasure under Article 17 GDPR
• right to restriction of processing under Article 18 GDPR
• right to data portability under Article 20 GDPR
• right to object to processing under Article 21 GDPR
• right to withdraw consent under Article 7 (3) GDPR

An informal email to moin@kaffeeklappe-winterhude.de is enough. You also have the right to lodge a complaint with a supervisory authority. The competent authority is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Straße 22, 20459 Hamburg.

We update this policy when the legal position or the technology used on this website changes. The version published here is the one that applies. This version dates from 1 September 2026.