Privacy policy

Please note: this English version is a convenience translation. Only the German version is legally binding – read the German version.

Last updated: October 2026

Controller

The controller responsible for processing personal data on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Herrengut Barbershop UG (haftungsbeschränkt) & Co. KG
Dorotheenstraße 139
22299 Hamburg
Germany
Phone: +49 40 639 11 300
Email: support@herrengutbarbershop.de

You will find further details about our company in our imprint. If you have any questions about data protection, we will be happy to answer them at the email address above.

The essentials

You can generally use our website without giving us any personal data. Personal data means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR) – for example your name, address, email address, phone number or IP address.

We process personal data in accordance with the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG). Depending on the purpose, we rely on the following legal bases:

• Art. 6(1)(a) GDPR – your consent, for example for Google Analytics;
• Art. 6(1)(b) GDPR – a contract or pre-contractual steps, for example when you book an appointment or order a voucher;
• Art. 6(1)(c) GDPR – legal obligations, for example retention obligations under commercial and tax law;
• Art. 6(1)(f) GDPR – legitimate interests, for example the secure and stable operation of our website.

Storing information on your device and accessing it is additionally governed by § 25 TDDDG: both are only permitted with your consent (§ 25(1) TDDDG), unless they are strictly necessary to provide a service you have explicitly requested (§ 25(2) no. 2 TDDDG).

We only store personal data for as long as is necessary for the respective purpose or required by statutory retention obligations. You are under no statutory or contractual obligation to provide your data; however, without the information marked as required we cannot process an order or a withdrawal submitted through our forms. We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Hosting and server log files

Our website is hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. IONOS processes the data on our behalf on the basis of a data processing agreement under Art. 28 GDPR.

Every time you visit our website, the browser on your device automatically sends information to our server. This information is stored in so-called server log files:

• IP address – stored in the log files in shortened (anonymised) form only,
• date and time of access,
• name and URL of the file accessed,
• the website from which you accessed our site (referrer URL),
• browser and browser version, operating system and device type.

We process this data to ensure a smooth connection and convenient use of the website, to evaluate system security and stability, and for other administrative purposes. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest follows from these purposes. We never use the data to draw conclusions about you personally. The log files are deleted automatically after eight weeks at the latest.

Cookies, local storage and consent

Our website itself does not set any cookies. Cookies and similar technologies such as local storage are small sets of data that your browser stores on your device. They do not harm your device and do not contain viruses or other malware.

Your choice in the cookie notice

On your first visit, we ask whether you would like to allow statistics (Google Analytics) and marketing (Google Ads conversion measurement). As long as you do not agree, these services are not loaded. We store your choice – which categories you allowed and when – in your browser’s local storage (entry “hg-consent-v1”), so that we don’t have to ask you again on every page. This information stays on your device, is not transmitted to us and remains stored until you change your choice or clear your browser data. The legal basis is § 25(2) no. 2 TDDDG, because storing it is strictly necessary to respect your decision, and Art. 6(1)(f) GDPR.

Changing or withdrawing your consent

Using “Cookie settings” at the very bottom of every page, you can change your choice at any time and withdraw any consent you have given with effect for the future (Art. 7(3) GDPR). This does not affect the lawfulness of processing carried out before the withdrawal. If you withdraw consent, the page reloads so that the services concerned no longer run. You can also delete cookies that have already been stored in your browser settings.

You can also set your browser so that no cookies are stored, or so that you are always notified before a new cookie is created. Disabling cookies completely may, however, mean that you cannot use all functions of our website.

Google Tag Manager, Analytics and Ads

We only use the following services if you have given your consent in the cookie notice. The provider in each case is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time via “Cookie settings”.

Google Tag Manager

We use Google Tag Manager to manage the measurement code of Google Analytics and Google Ads and to add it to our website. We only load it once you have agreed to at least one of the categories statistics or marketing. Tag Manager itself does not create user profiles, but your IP address is transmitted to Google when it loads.

Google Analytics 4

If you consent to the statistics category, we use Google Analytics 4 to understand how our website is used and to keep improving it. Pseudonymous usage profiles are created and cookies (e.g. “_ga”) are used. The data collected includes in particular:

• pages viewed, date and time, and the previously visited page (referrer URL),
• browser, operating system, device type and screen resolution,
• your approximate location (e.g. country and city), which Google derives from your IP address,
• interactions on our website, including events we define such as submitting a booking request or a voucher order including the order value – without names or contact details.

According to Google, IP addresses are not logged or stored in Google Analytics 4. Google processes the data for Google Analytics on our behalf (Art. 28 GDPR). Event data is deleted automatically after the retention period set in our Analytics account, after 14 months at the latest. You can also prevent Google Analytics from collecting data by installing a browser add-on from Google.

Google Ads conversion measurement

If you consent to the marketing category, we measure how successful our ads on Google are. For this purpose, Google stores cookies (e.g. “_gcl_au”) on your device. If you came to our website via a Google ad, Google and we can recognise that a certain action then took place – such as a booking request or a voucher order (conversion). We learn the total number of users who clicked on an ad and reached a page with conversion measurement; we do not receive any information that identifies users personally. If you are signed in to a Google account, Google may link the data to your account under its own terms and use it for personalised advertising. Google is partly responsible for this processing itself. Learn more: How Google uses information from sites that use its services.

Google Consent Mode

We use Google Consent Mode, which tells Google whether you have agreed to the statistics and marketing categories. All categories are set to “denied” by default; Google services may only use cookies or similar technologies on your device for the categories you have agreed to. Without any consent, we don’t load the Google services at all.

Transfers to the USA

Google may also transfer data to Google LLC in the USA. The European Commission has adopted an adequacy decision for the USA (EU-US Data Privacy Framework, Art. 45 GDPR), under which Google LLC is certified (dataprivacyframework.gov). For more information, please see Google’s privacy policy.

Online booking (Studiobookr)

You can book appointments online via Studiobookr, the booking calendar of the Studiolution salon system that we use to manage our appointments. The provider is Head-on Solutions GmbH, Bärenschanzstraße 2, 90429 Nürnberg, Germany.

We only load the booking calendar once you choose a shop – on our Prices & Booking page or via a booking link for a specific shop. Until then, no connection to Studiobookr is established. As soon as the calendar loads, your browser connects to Studiobookr’s servers (studiobookr.com); technical data such as your IP address, information about your browser and device, and the address of our website are transmitted in the process.

When you book an appointment, Studiobookr processes the information you enter in the booking calendar – in particular your name, email address and phone number, the chosen shop, the service, date and time, and any other information you provide voluntarily. We use this data to manage and confirm your appointment and to reach you if anything changes. The legal basis is Art. 6(1)(b) GDPR. Head-on Solutions GmbH processes the booking data on our behalf (Art. 28 GDPR). If you use features of the studiobookr.com platform that go beyond booking with us – such as your own customer account or reviews on Studiobookr – Head-on Solutions GmbH is itself responsible for them, and its own privacy policy applies.

If Studiobookr stores information on your device that is technically required for the booking, this is based on § 25(2) no. 2 TDDDG. We keep your appointment data for as long as is necessary to manage appointments and maintain our customer relationship; statutory retention obligations remain unaffected.

If you have agreed to the statistics or marketing category, we record the submission of a booking request as an event (see Google services). With this event we only transmit which shop the request was for – not your name, contact details or appointment details.

Prefer not to use the online calendar? Simply book by phone – St. Pauli +49 40 639 11 300, St. Georg +49 40 248 59 419 – or by email at termine@herrengutbarbershop.de.

Voucher orders and payment

You can order vouchers using the order form on our gift vouchers page. We process the information you enter in the form – in particular your name, email address and delivery address, the vouchers you want and the payment method you choose. We use this data to process and fulfil your order, send the vouchers, issue an invoice, correspond with you, handle payment and assert or defend any claims. The legal basis is Art. 6(1)(b) GDPR.

The form data is transmitted in encrypted form to our web server at IONOS and forwarded from there to us by email. We automatically send a confirmation to the email address you provide. For delivery, we pass your name and delivery address on to the shipping company we use.

We keep order and invoice data for as long as retention obligations under commercial and tax law apply (§ 257 HGB, § 147 AO) – six to ten years, depending on the type of document. The legal basis for this is Art. 6(1)(c) GDPR. After that, we delete the data.

Payment by bank transfer or PayPal

You pay in advance by bank transfer or via PayPal. For a bank transfer, we and the account-holding bank process the payment data, such as name, IBAN, amount and payment reference. If you choose PayPal, we forward you to PayPal after you submit the order. For this, we transmit the order number, the vouchers ordered and the amount to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg (“PayPal”). You make the payment itself directly with PayPal, which is responsible for it. PayPal then confirms the payment to us. Until then, we store your order on our web server at IONOS; orders that are not completed are deleted there after three days. If forwarding is exceptionally not possible, we instead send you a payment request by email via PayPal and transmit your email address, the amount and the order number for this – and, where applicable, your name. Whether PayPal carries out its own checks, such as a credit check for certain payment methods, is governed by PayPal’s privacy statement. The legal basis is Art. 6(1)(b) GDPR.

Online withdrawal

You can use our withdrawal form to withdraw from a contract concluded online. We process your name, email address and order number and, if you wish, the order date, the date you received the goods and the items you want to withdraw. We use this information to process your withdrawal, unwind the contract and send you, without delay, a confirmation of receipt by email stating the content of your withdrawal and the date and time it was received. The legal bases are Art. 6(1)(c) GDPR in conjunction with § 356a of the German Civil Code (BGB) and Art. 6(1)(b) GDPR.

This information is also transmitted in encrypted form to our web server at IONOS and forwarded to us by email. We keep it together with the order documents (see voucher orders). You can of course also declare your withdrawal by email or letter – details are in our cancellation policy.

Contact by email or phone

If you contact us by email or phone – for example at support@herrengutbarbershop.de, termine@herrengutbarbershop.de or directly at one of our shops – we process your information (such as your name, contact details and your request) in order to answer your enquiry. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to an appointment or contract, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the data once your enquiry has been dealt with, unless statutory retention obligations apply – for business letters, for example, six years.

Job applications

If you apply to us – for example by email to team@herrengutbarbershop.de for a position on our jobs page – we process your application documents in order to decide whether to enter into an employment relationship. The legal basis is Art. 6(1)(b) GDPR. If you are not hired, we delete your documents no later than six months after the application process has ended, unless you have agreed to longer storage.

YouTube videos

Some posts in our journal show videos from YouTube. At first you only see a preview image that is stored on our own server – no connection to YouTube exists at that point. Only when you click the play button on the preview image is the video loaded in privacy-enhanced mode from youtube-nocookie.com. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Your IP address, the address of our website and technical information about your browser, among other things, are then transmitted to YouTube. Even in privacy-enhanced mode, YouTube may store cookies or similar technologies (e.g. local storage) on your device once the video has started. If you are signed in to YouTube or Google, YouTube may associate the playback with your account. The legal basis is the consent you give by clicking (Art. 6(1)(a) GDPR, § 25(1) TDDDG). For any transfer to the USA, the information given above applies. Learn more in Google’s privacy policy.

Reviews on our website

On our website we show the overall Google rating of our shops and selected Google reviews with the reviewer’s first name and, where given, the initial of their surname, the star rating, month and text. We take this information from our Google Business Profiles and store it as text on our own server – no connection to Google is made when it is displayed. The legal basis is our legitimate interest in showing our shops’ Google reviews on our website (Art. 6(1)(f) GDPR). If you don’t want your review to appear on our site, email us at support@herrengutbarbershop.de and we will remove it from our website.

Our server may fetch the current overall Google rating at most once a day via the Google Places API. Your browser does not connect to Google for this, and no data about you is sent to Google.

The “Review on Google”, “Read on Google” and “Write a review” links on our pages (for example under reviews) are plain links. Google only opens when you click them, and Google’s privacy policy applies there.

Maps, fonts and links

Maps

The maps on our shop pages are static images stored on our own server. They are based on map data from OpenStreetMap (© OpenStreetMap contributors, licence). No data is transmitted to map services when they are displayed.

Fonts

Our fonts are also stored on our own server. No connection is made to Google Fonts or any other font service.

Links to other providers

Links to Google Maps and Apple Maps (directions), to our Google reviews, to Studiobookr and to Instagram, Facebook and YouTube (for example to our profiles or videos) are plain links. Only when you click such a link do you leave our website; the respective provider then processes your data in accordance with its own privacy policy. We do not use social media plugins or the Meta/Facebook pixel.

Disclosure of data

We only transfer your personal data to third parties in the cases described in this privacy policy. Beyond that, we only pass on your data if

• you have given your express consent under Art. 6(1)(a) GDPR,
• disclosure under Art. 6(1)(f) GDPR is necessary to establish, exercise or defend legal claims and there is no reason to assume that you have an overriding legitimate interest in your data not being disclosed,
• there is a legal obligation to disclose the data under Art. 6(1)(c) GDPR, or
• this is necessary under Art. 6(1)(b) GDPR to perform contracts with you.

Service providers acting on our behalf – such as our hosting provider – process your data only in accordance with our instructions. The data transferred is always limited to the minimum required.

Data security

Our website and all forms are transmitted exclusively via an encrypted SSL/TLS connection. You can recognise it by “https://” and the padlock symbol in your browser’s address bar. In addition, we use appropriate technical and organisational measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction and unauthorised access by third parties. We continuously improve our security measures in line with technological developments.

Data transmitted over the internet, for example by email, may nevertheless be subject to security gaps; complete protection is not possible. You can therefore always give us personal data by phone instead.

Your rights

You have the right

• under Art. 15 GDPR to request information about your personal data processed by us. In particular, you can request information about the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the source of your data if it was not collected from you, and the existence of automated decision-making including profiling;
• under Art. 16 GDPR to request without delay the rectification of inaccurate or the completion of your personal data stored by us;
• under Art. 17 GDPR to request the erasure of your personal data stored by us, unless processing is necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims;
• under Art. 18 GDPR to request the restriction of processing of your personal data if you contest the accuracy of the data, if the processing is unlawful but you oppose its erasure, if we no longer need the data but you need it for the establishment, exercise or defence of legal claims, or if you have objected to processing under Art. 21 GDPR;
• under Art. 20 GDPR to receive the personal data you have provided to us in a structured, commonly used and machine-readable format or to request its transmission to another controller;
• under Art. 7(3) GDPR to withdraw your consent at any time with effect towards us. As a result, we may no longer continue the data processing based on this consent in the future;
• under Art. 77 GDPR to lodge a complaint with a supervisory authority (see right to lodge a complaint).

To exercise any of these rights, simply email us at support@herrengutbarbershop.de.

Right to object

Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR (Art. 77 GDPR). As a rule, you can contact the supervisory authority of your usual place of residence, your place of work or our registered office. The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (Hamburg Commissioner for Data Protection and Freedom of Information)
Ludwig-Erhard-Str. 22
20459 Hamburg, Germany
datenschutz-hamburg.de

Updates to this policy

This privacy policy is currently valid and was last updated in October 2026. As our website and services evolve, or as a result of changes in legal or regulatory requirements, it may become necessary to amend it. You can view and print the current version on this page at any time.