Privacy policy

1. Data protection at a glance

General information

The following notes provide a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally.

Data collection on this website

Data on this website is processed by the website operator. You can find their contact details in this website’s legal notice.

Some of your data is collected when you provide it to us (for example, when you contact us via the reservation form, email or WhatsApp). Other data is collected automatically by our IT systems when you visit the website — mainly technical data such as your browser, operating system or the time of the page view.

2. Data controller

The controller responsible for data processing on this website is:

Jan Medert (sole trader)
Coffee Brothers
Obermarkt 8
67547 Worms
Telephone / WhatsApp: +49 155 67021202
Email: mail@coffeebrothers.info

3. Hosting with Netlify

This website is hosted by Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). When you access the website, Netlify automatically collects information in server log files (IP address, date and time of the request, volume of data transferred, browser type, operating system and referrer URL). This is technically necessary to deliver the website.

The legal basis is Article 6(1)(f) GDPR (legitimate interest in delivering the website securely and without errors). A data processing agreement is in place with Netlify. For data transfers to the USA, we rely on the European Commission's adequacy decision (EU-US Data Privacy Framework).

Netlify privacy policy: netlify.com/privacy

4. Reservation, catering and workshop enquiries

When you request a table or catering through the form on “Reservations”, we process the details you provide (name, email, telephone number, date, time, number of guests, occasion and your message). Submissions go through Netlify Forms (see section 3). We then transfer the enquiry to our own administration system (Coffee Brothers OS), which runs on a server we operate ourselves, and respond by email, telephone or WhatsApp. The same applies to enquiries through the form on “Brothers Workshop” (name, company, email, telephone number, selected topics and your message).

The legal basis is Article 6(1)(b) GDPR (taking steps at your request before entering into a contract). We delete the details once the enquiry has been dealt with and no follow-up questions are expected, and no later than three months after the reservation date — unless statutory retention requirements (for example, for catering invoices) require longer storage.

5. Online ordering through gastronovi

“Order online” on the “Menu” and “Order” pages takes you to the ordering page of our till provider gastronovi (Gastronovi GmbH, Buschhöhe 2, 28357 Bremen). It opens in a new tab; no gastronovi content is embedded on our website itself, so no data is transferred before you click. On the ordering page, gastronovi processes your IP address and technical browser data, as well as the details you provide for your order (e.g. name, email, mobile number for the collection notification, order and payment details). Gastronovi handles payment through an integrated payment service provider.

Gastronovi processes this data as our data processor. The legal basis is Article 6(1)(b) GDPR (processing your order). We retain order and payment data for as long as tax and commercial law obligations require (generally eight to ten years). According to gastronovi, the mobile number used for collection notifications is deleted after the visit has ended. The gastronovi privacy policy linked on the ordering page also applies.

6. Job applications

If you apply through the “Jobs” page, your browser sends the form details (including your name, email, telephone number, desired role, availability, experience, your message and, where applicable, a link to your CV) directly to our management system at api.coffeebrothers.bar. The connection is encrypted and runs through the network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), which secures access to our server as a data processor; this transfer is also based on the EU-US Data Privacy Framework.

The legal basis is Article 6(1)(b) GDPR in conjunction with Section 26 BDSG (decision on entering into an employment relationship). In individual cases, we research publicly available professional information about applicants using an AI-assisted web search (OpenAI, L.L.C., USA). Only names and professional search terms are transmitted; information on origin, religion, health or other special categories is technically filtered out. A human always makes the decision on an application, never an automated system (Article 22 GDPR).

If no employment relationship is established, we delete your application data six months after the procedure ends (period under section 15(4) AGG), unless you have consented to longer storage.

7. Artist enquiries (“Take the stage”)

Enquiries through the form on ‘Stage’ (type of performance, name, email, telephone, links to your work, availability, message) also go directly to our administration system at api.coffeebrothers.bar (via Cloudflare, see section 6). The legal basis is Article 6(1)(b) GDPR. If no performance is arranged, we delete the enquiry after six months.

8. Contact via WhatsApp

Our website contains links to WhatsApp (provider: WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). WhatsApp opens only when you click one of these links; no data is transferred to WhatsApp beforehand. WhatsApp/Meta's privacy policies apply to processing within WhatsApp.

We process messages to our WhatsApp number through Meta's WhatsApp Business Platform in our administration system. An AI assistant initially answers simple enquiries (e.g. opening hours or reservation requests); for this, your message text — or the audio file for transcription in the case of voice messages — is sent to OpenAI, L.L.C. (USA). A member of our team can take over at any time on request. The legal basis is Article 6(1)(b) GDPR or our legitimate interest in providing a prompt response (Article 6(1)(f) GDPR); transfers to the USA rely on the EU-US Data Privacy Framework.

WhatsApp privacy policy: whatsapp.com/legal/privacy-policy-eea

9. Google Maps (only after you click)

On the “Visit” page, you can display a Google Maps map (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map only loads when you click “Load map”. From that moment, your IP address and technical browser data are transmitted to Google, possibly also to the USA, and Google may use cookies or similar technologies.

The legal basis is your consent, which you give by clicking (Article 6(1)(a) GDPR, Section 25(1) TDDDG). Consent applies only to the current page view; the map will be hidden again on your next visit. No connection to Google is made without a click. The “Open Maps” and “Directions” links simply take you to Google's website.

Google privacy policy: policies.google.com/privacy

10. Links to Instagram and Facebook

We link to our Instagram and Facebook profiles (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). These are simple links, not embedded content: data is transferred only when you click the link and visit Meta's website.

11. Cookies and local storage

Our own pages set no cookies and use no analytics, tracking or marketing services. Fonts and all other content load from our own webspace. Only when you click to load the Google Maps map (section 9) or visit the gastronovi ordering page (section 5) may those providers set their own cookies.

12. SSL / TLS encryption

For security reasons, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the browser address bar beginning with “https://”.

13. Obligation to provide data

You are not obliged to provide us with personal data. However, without the details marked as required, we cannot process a reservation, application or enquiry.

14. Your rights

You have the right at any time to obtain information free of charge about your stored personal data, its origin and recipients, and the purpose of processing (Article 15 GDPR). You also have rights to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may withdraw consent at any time with effect for the future (Article 7(3) GDPR).

Right to object (Article 21 GDPR): Where we process data on the basis of our legitimate interests (Article 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests.

For all of this, an informal message to the contact details above is sufficient. You also have the right to complain to the competent supervisory authority. The authority responsible for us is:

The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
datenschutz.rlp.de

15. Ticket purchases for events

On the “Tickets” page you can buy admission tickets for events at Coffee Brothers. We process the details from the order form (name, email address, optional phone number, selected event, ticket tier, quantity and language) as well as the order number, payment status, the issued ticket codes and the time of admission. Your browser sends the details directly to our management system at api.coffeebrothers.bar; the connection is encrypted and routed through the network of Cloudflare, Inc. (see section 6). The legal basis is Art. 6(1)(b) GDPR (performance of the purchase contract).

Payment is handled by PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. We redirect you to PayPal's pages with the order number and amount; which data PayPal collects there is governed by PayPal's privacy statement. From PayPal we receive confirmation of the payment, a transaction reference and the name and email address of the paying PayPal account. The legal basis is Art. 6(1)(b) GDPR.

We send your tickets by email. For delivery we use Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France) as a processor within the EU; the email address, name and the content of the ticket email are transmitted. You can also access your tickets via a personal link that is sent only to you; we store only a check value (hash) of it.

To fend off automated abuse we limit the number of requests per IP address; the IP address is held in a cache only briefly (a few minutes) for this purpose (Art. 6(1)(f) GDPR). During the purchase your browser keeps the order number and email address in session storage (sessionStorage, key “cb_ticket_order”) so that the thank-you page can display your tickets; the entry is deleted when the browser tab is closed (Section 25(2) no. 2 TDDDG).

We retain order and invoice data for ten years under Section 147 of the German Fiscal Code and Section 257 of the German Commercial Code; ticket codes and admission records form part of these order records. At the entrance our staff see only the ticket code, ticket tier, first name and validity.

16. Local convenience features

Saved recipes and articles are stored, at your choice, only in your browser’s local storage. You can delete them via your browser’s website data. The local coffee assistant “Coffee Bro” searches the content of this website. Questions are not sent to an AI service; the AI assistant on WhatsApp is separate from it (see section 8). The Google map only loads after you click.