Book Appointment

Privacy Policy

1. Data Controller

Barbier Berlin
Markgrafenstraße 88, 10969 Berlin
Email: info@barbier.berlin
Phone: 030 259 265 00

2. Collection and Storage of Personal Data

When using our website and booking system, we collect the following data:

  • Account data (name, email address, phone number) upon registration
  • Booking data (selected service, date, time)
  • Usage data (points balance, booking history, reviews)
  • Technical data (IP address, browser type) via server logs
  • Authentication data (hashed password, 2FA secret where applicable) when two-factor authentication is enabled

3. Purpose of Data Processing

  • Processing and managing appointment bookings
  • Managing your customer account and loyalty program
  • Appointment confirmations and reminders by email
  • Improving our services

4. Legal Basis

Your data is processed on the basis of Art. 6(1)(b) GDPR (performance of a contract) and Art. 6(1)(a) GDPR (consent).

5. Data Storage and Deletion

Your data is stored on servers in the European Union (Cloudflare, EU data centres). Personal data is deleted once the purpose of storage no longer applies, provided no statutory retention obligations exist.

Loyalty points expire after 6 months without an active booking.

6. Your Rights

You have the following rights regarding your personal data:

  • Right of access (Art. 15 GDPR)
  • Right to rectification (Art. 16 GDPR)
  • Right to erasure (Art. 17 GDPR)
  • Right to restriction of processing (Art. 18 GDPR)
  • Right to data portability (Art. 20 GDPR)
  • Right to object (Art. 21 GDPR)

To exercise your rights, please contact: info@barbier.berlin

7. Cookies and Local Storage

We use exclusively technically necessary cookies and locally stored values (no third-party tracking, no marketing cookies):

  • session (cookie, HTTP-only, Secure) — keeps you logged in. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). Lifetime: until logout or max. 30 days.
  • bb-theme (localStorage) — stores your light/dark mode preference. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a user-friendly presentation). No personal reference.
  • cookie-consent-accepted (localStorage) — remembers that you have acknowledged the cookie notice. No personal reference.

8. SSL Encryption

For security reasons, this website uses SSL/TLS encryption (HTTPS) with HTTP Strict Transport Security (HSTS). An encrypted connection is indicated by the padlock symbol in the address bar.

9. Hosting (Cloudflare)

Our website is provided via Cloudflare Pages (Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 München; parent company: Cloudflare Inc., USA). When the website is accessed, Cloudflare processes technical connection data (in particular IP address, date/time, volume of data transferred) in order to deliver the content and to defend against attacks.

The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and performant operation). A data processing agreement pursuant to Art. 28 GDPR has been concluded with Cloudflare. Any transfer to third countries is safeguarded by EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

10. Database (Cloudflare D1)

We store your account and booking data in a Cloudflare D1 database, hosted in EU data centres. Backups are created automatically by Cloudflare.

11. Email Delivery (Microsoft Exchange Online)

For transactional emails (booking confirmation, reminder, cancellation, password reset, email confirmation, welcome) we use Microsoft Exchange Online via the Microsoft Graph API. The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. The delivery data is processed in Microsoft's EU data centres.

The following are processed in this context: your email address, your name and the content of the respective email (appointment data, service, date/time, where applicable links for cancellation or password reset). Legal basis: Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in reliable customer communication).

A data processing agreement pursuant to Art. 28 GDPR (Microsoft Products and Services Data Protection Addendum, DPA) has been concluded with Microsoft. Any transfer to third countries (Microsoft Corporation, USA) is safeguarded by EU Standard Contractual Clauses and additional technical protective measures. Microsoft's privacy statement: privacy.microsoft.com

12. Push Notifications

Provided your browser or device supports it, you can optionally subscribe to push notifications (e.g. appointment reminders). These are activated exclusively after your express consent via your browser's notification function. In doing so, a technical push endpoint of your browser as well as the associated cryptographic keys are stored so that we can deliver notifications to you.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can deactivate the notifications at any time in the settings of your browser or device; the stored push data will then no longer be used.

13. External Services

We include the following external resources:

  • Fonts — The fonts used ("Inter", "Playfair Display", "Cairo") are delivered locally from our server (self-hosted). There is no connection to Google Fonts and no transfer of your IP address to third parties.
  • Google Maps (on the contact page) — Display of our location. The map is not loaded automatically, but only once you actively click "Load map" (two-click solution). Only then is a connection to Google established and your IP address transferred to Google. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; any transfer to the USA is safeguarded by EU Standard Contractual Clauses. The legal basis is your consent (Art. 6(1)(a) GDPR), which you grant by clicking and can withdraw at any time with effect for the future (e.g. by deleting the "maps-consent" entry in your browser's local storage).

14. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Friedrichstr. 219, 10969 Berlin.

Last updated: June 2026