Privacy Policy

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to personally identify you. Detailed information on the subject of data protection can be found in our privacy policy below.

Data processing on this website is carried out by the website operator. You can find their contact details in the section "Information about the responsible party" in this privacy policy.

Some data is collected when you provide it to us, e.g. data you enter into a contact or reservation form. Other data is collected automatically when you visit the website by our IT systems, primarily technical data (e.g. internet browser, operating system or time of page access).

You always have the right to request information free of charge about the origin, recipient and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this at any time for the future. You also have the right to restrict processing and the right to lodge a complaint with the competent supervisory authority.

We host our website with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you visit our website, the Hetzner server automatically records access log data (IP address, date and time of access, URL accessed, referrer URL, data transferred, status code). This data is technically necessary for the secure operation of the website. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable and secure website).

The Hetzner privacy policy can be found at: hetzner.com/de/legal/privacy-policy

We have entered into a data processing agreement (DPA) with Hetzner. Hetzner processes personal data of our website visitors exclusively according to our instructions and in compliance with the GDPR. The DPA covers both website hosting and our email server (SMTP), which is used to send reservation confirmations, reminder emails and newsletters.

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. Please note that data transmission over the internet may have security vulnerabilities. Complete protection of data against access by third parties is not possible.

The responsible party for data processing on this website is:

Dilan Celik-Ayik Café KostBar Susannenstraße 36 20357 Hamburg Phone: +49 40 60443754 Email: info@kostbar-hamburg.de

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for data processing no longer applies. If you assert a legitimate request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing it (e.g. tax or commercial retention periods).

Where you have given consent to data processing, we process your personal data based on Art. 6(1)(a) GDPR. Where data is necessary to fulfil a contract, we process it based on Art. 6(1)(b) GDPR. To comply with a legal obligation, processing is based on Art. 6(1)(c) GDPR. Data processing may also occur on the basis of our legitimate interest under Art. 6(1)(f) GDPR. Where cookies or similar technologies are used, this is governed by § 25 TDDDG (German Telecommunications Digital Services Data Protection Act).

WHERE DATA PROCESSING IS BASED ON ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS ARISING FROM YOUR PARTICULAR SITUATION (ART. 21(1) GDPR). WHERE YOUR DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME (ART. 21(2) GDPR).

In the event of data protection violations, you have the right to lodge a complaint with the competent supervisory authority. For Hamburg, the responsible authority is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg.

This site uses SSL/TLS encryption for security reasons. You can recognise an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.

We hereby object to the use of contact data published as part of our legal notice obligation for the purpose of sending unsolicited advertising and informational materials. The operators of this website expressly reserve the right to take legal action in the event of unsolicited advertising information being sent.

The provider of the pages automatically collects and stores information in server log files that your browser automatically transmits: browser type and version, operating system used, referrer URL, hostname of the accessing computer, time of server request, IP address. This data is not merged with other data sources. Legal basis: Art. 6(1)(f) GDPR. Server log files are automatically deleted after 14 days as a rule.

Our website uses technically necessary session cookies required for the secure management of admin and staff sessions. These cookies are not used for tracking or advertising and are automatically deleted after 24 hours at the latest. Legal basis: Art. 6(1)(f) GDPR in conjunction with § 25(2) No. 2 TDDDG.

To protect our forms (reservation, contact) we use CSRF tokens (Cross-Site Request Forgery protection). These technically necessary tokens guard against unauthorised form submissions, are not used for tracking, and also fall under § 25(2) No. 2 TDDDG.

When you send us enquiries via the contact form, your details (name, email address, subject, message) are stored for the purpose of processing the request and in case of follow-up questions. We do not pass on this data without your consent. Legal basis: Art. 6(1)(b) GDPR (if contract initiation) or Art. 6(1)(f) GDPR (legitimate interest in processing enquiries).

Contact requests are deleted after final processing, at the latest after 6 months, unless statutory retention obligations prevent this.

When making a table reservation via our website, the data you enter (name, email, phone, date, time, number of guests, seating option, message and optionally occasion, allergy/intolerance details and notes to our team) is stored for the purpose of processing and confirming the reservation. We use this data for reservation processing and, where legally permitted, for the review email described below. Legal basis for reservation processing: Art. 6(1)(b) GDPR.

You will receive a confirmation email and, where applicable, a reminder email 24 hours before your appointment. Reservation data will be deleted within 30 days of the reservation date, unless statutory retention obligations apply. Excluded from this are data required to fulfil statutory tax retention obligations (§ 147 AO, up to 10 years).

The fields "occasion", "allergies & intolerances" and "notes" are voluntary. If you provide information about intolerances or allergies there, we process it solely to prepare for your visit and delete it together with the reservation (at the latest 30 days after the date). By entering such information you consent to its processing (Art. 9(2)(a) GDPR).

On the day after your reservation date we send you a one-time thank-you email to the address provided with your reservation, thanking you for your visit and asking for a Google review. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in guest feedback). The email is sent only if the requirements of Section 7(3) UWG are met and no objection has been made. After an objection, we store your email address only in blocked, non-reversible form (a cryptographic verification value) to reliably prevent further review emails. We keep this block entry for as long as we send review emails. If we stop sending them, we delete it. The legal basis for this is Art. 6(1)(c) GDPR in conjunction with Art. 21(3) GDPR. You can object to these emails at any time; a short message to info@kostbar-hamburg.de is sufficient, and every such email contains a note to this effect.

When you contact us by email or phone, your request including all resulting personal data is stored and processed for the purpose of handling it. Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR. Enquiries are deleted after final processing, at the latest after 6 months, unless statutory retention obligations prevent this.

To subscribe to our newsletter, we need your email address. We use the double opt-in procedure: after signing up, you will receive a confirmation email in which you must confirm your registration. Only after your confirmation will your email address be added to our newsletter list. Legal basis: Art. 6(1)(a) GDPR.

You can unsubscribe from the newsletter at any time using the "Unsubscribe" link in the newsletter or by contacting us. After unsubscribing, your data will be deleted immediately (Art. 17 GDPR). The consent given up to the time of revocation remains unaffected by the cancellation.

The newsletter is sent via our own server (Hetzner, Germany). Your email address will not be passed on to third parties.

To document your consent we record during the sign-up process: the time of the sign-up request, IP address and time of the confirmation click (double opt-in). This data is deleted together with your email address immediately upon unsubscription.

Responsible for web analytics: Dilan Celik-Ayik, Café KostBar, Susannenstraße 36, 20357 Hamburg, Email: info@kostbar-hamburg.de.

Matomo is operated exclusively on our own server in Germany (analytics.kostbar-hamburg.de, Hetzner Online GmbH). All analytics data remains on this server. No data is shared with third parties and no transfer to third countries outside the EU takes place.

Data is collected solely for statistical analysis of website usage in order to improve our website and identify technical errors. No profiling, cross-site tracking or use for advertising purposes takes place.

We use Matomo without cookies. No tracking cookies or similar technologies are stored on your device. § 25 TDDDG (consent requirement for device access) therefore does not apply.

The following data is collected on each page visit:

• Anonymised IP address (last 2 bytes masked, e.g. 192.168.xxx.xxx)
• Page visited and time of access
• Time spent on the page
• Referrer page (without query parameters — no PII in URLs)
• Browser and operating system used
• Screen resolution and language setting

The legal basis is Art. 6(1)(f) GDPR (legitimate interest). Our legitimate interest lies in the anonymised analysis of user behaviour to optimise our website and identify technical errors. As no cookies are set and no personal data is transferred, our interests outweigh the interests of the data subjects.

Note: The German Federal Commissioner for Data Protection (BfDI) is discussing whether cookieless analytics based on anonymised technical characteristics also require consent. We monitor this legal development and will adjust our practice if a binding decision requires it.

Raw data (visit logs) is automatically deleted after 180 days. Aggregated, anonymous reports (total page views, visitor counts) are retained indefinitely without personal reference.

You may object to anonymised data collection by Matomo at any time (Art. 21 GDPR). Use the opt-out widget below to do so — your choice is stored in a cookie in your browser:

Since Matomo does not store personal data (IP fully anonymised), rights of access, rectification and erasure under Art. 15–17 GDPR are not practically applicable. For questions please contact: info@kostbar-hamburg.de.

On our contact page we offer an interactive map based on OpenStreetMap, operated by the OpenStreetMap Foundation (OSMF), St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom.

The map is only loaded when you actively click "Load map". Only then is a connection to OSMF servers established, which receives your IP address. Legal basis: Art. 6(1)(f) GDPR (legitimate interest: location information for guests). The UK has an EU adequacy decision (June 2021). OSMF privacy policy: https://osmfoundation.org/wiki/Privacy_Policy

This site uses locally hosted fonts (Cormorant Garamond, DM Sans) for consistent display. The font files are stored on our own server. No connection to external font services (e.g. Google Fonts, Adobe Fonts) takes place.

This website uses Google Ads to measure the success of our ads. If you reached us via a Google ad and consented to the marketing category in our cookie banner, we store the click identifier provided by Google ("gclid") in your browser for up to 30 days. If you complete a reservation within that period, we link the identifier to the reservation to measure whether our ads lead to reservations. Once we run Google ads, we transmit to Google solely this click identifier and the time of the reservation — no names, email addresses, phone numbers or reservation details. We delete the click identifier no later than 30 days; if you withdraw your consent earlier via the cookie settings, we delete it immediately.

Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG (consent). The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; as part of Google's processing, data may be transferred to Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. This USA transfer is based on the EU Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) — Google LLC is DPF-certified; where required, EU Standard Contractual Clauses apply additionally. Google processes the transmitted click identifier as an independent controller.

Conversion tracking is only activated when you have explicitly consented to marketing cookies in the cookie banner. You can withdraw your consent at any time via the cookie banner. Google privacy policy: https://policies.google.com/privacy

Only if you consent to marketing cookies in the cookie banner do we load the Meta Pixel operated by Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland. It records page views (the "PageView" event; on individual campaign landing pages, where applicable, also "ViewContent") to measure the reach and effectiveness of our ads on Facebook and Instagram, and sets the "_fbp" cookie (lifetime: 3 months). Data may be transferred to Meta Platforms, Inc. in the USA. Legal basis: Art. 6(1)(a) GDPR, § 25(1) TDDDG (consent). The transfer to the USA is based on the EU-US Data Privacy Framework (Art. 45 GDPR) — Meta Platforms, Inc. is DPF-certified. Without your consent the Meta Pixel is not loaded; you can withdraw your consent at any time via the cookie banner. Meta privacy policy: https://www.facebook.com/privacy/policy

Google Consent Mode v2 is active on all pages of this website. Without your explicit consent, all Google parameters are set to "denied" (ad_storage, ad_user_data, ad_personalization, analytics_storage). No cookies are set and no data is transmitted to Google. An update to "granted" only occurs after active consent in the cookie banner.

You have the following rights with regard to your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)

Zur Ausübung Ihrer Rechte wenden Sie sich bitte an: info@kostbar-hamburg.de.

To exercise your rights, please contact: info@kostbar-hamburg.de.

Soweit wir Ihre personenbezogenen Daten auf Grundlage unseres berechtigten Interesses (Art. 6 Abs. 1 lit. f DSGVO) verarbeiten — etwa Server-Logdaten, Sicherheitsmaßnahmen, Standortinformationen — haben Sie das Recht, jederzeit aus Gründen, die sich aus Ihrer besonderen Situation ergeben, Widerspruch gegen diese Verarbeitung einzulegen. Wir verarbeiten Ihre Daten dann nicht mehr, es sei denn, wir können zwingende schutzwürdige Gründe für die Verarbeitung nachweisen, die Ihre Interessen, Rechte und Freiheiten überwiegen (Art. 21 Abs. 1 DSGVO).

Widerspruch: info@kostbar-hamburg.de — Betreff: „Widerspruch Datenverarbeitung"

Last updated: June 2026