Privacy policy

1. Controller

Kleiner Bruder Kaffee GbR, Rohrbacher Straße 47, 69115 Heidelberg, Germany. Telephone +49 6221 438 2170, email hallo@kleiner-bruder-kaffee.de.

We are not required to appoint a data protection officer. Data protection enquiries reach Antje Sallmann at the address above.

2. Your rights

You have the right to information about the personal data we hold about you (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on our legitimate interests (Art. 21). Where processing is based on your consent, you may withdraw that consent at any time with effect for the future (Art. 7 (3)).

You also have the right to lodge a complaint with a supervisory authority. The competent authority for us is: Der Landesbeauftragte fur den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart.

3. Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you open a page, your browser transmits data that is recorded in server log files: your IP address, the date and time of the request, the page requested, the referring page, your browser and operating system version, and the amount of data transferred.

This processing is necessary to deliver the site and to keep it secure and stable. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is the technically error-free presentation and security of our website. Log data is not merged with other data sources and is deleted after 14 days at the latest.

Transfer to the USA takes place on the basis of the EU standard contractual clauses agreed with Vercel and the EU-US Data Privacy Framework. We have concluded a data processing agreement with Vercel in accordance with Art. 28 GDPR.

4. Cookies and local storage

We set no cookies for analytics, advertising or profiling, and no third party sets any either.

When you make a choice in the consent banner, we store one entry named kbk-consent in your browser's local storage so that we do not ask you again on the next visit. This entry contains only your decision and the date on which you made it. It never leaves your device and it is not readable by us. You can delete it at any time in your browser settings, or change your decision using the cookie settings link in the footer.

The legal basis for this storage is § 25 (2) no. 2 TDDDG, because it is strictly necessary to provide a function you have expressly requested.

5. Map (OpenStreetMap)

The map on the Find us section is not loaded automatically. Nothing is requested from any external server until you press the button that loads it.

If you do press it, the map is loaded from the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. In doing so your IP address, your browser and operating system details and the map section requested are transmitted to that foundation. We have no influence over what happens to that data. Their privacy policy is at https://wiki.osmfoundation.org/wiki/Privacy_Policy.

The legal basis is your consent under Art. 6 (1) (a) GDPR. You may withdraw it at any time using the cookie settings link in the footer, which unloads the map and removes the stored consent. The United Kingdom is covered by an adequacy decision of the European Commission.

6. Contact form and email

If you use the contact form we process the name, email address and message you enter, together with the optional telephone number, date and number of people. This is necessary in order to deal with your enquiry. The legal basis is Art. 6 (1) (b) GDPR where your enquiry concerns a booking or a contract, and otherwise Art. 6 (1) (f) GDPR on the basis of our legitimate interest in answering enquiries addressed to us.

Form submissions are delivered to our own email account and are not stored in a database on this website. We delete enquiries six months after the matter they concern has been dealt with, unless statutory retention periods under commercial or tax law require us to keep them for longer.

The same applies to messages you send us directly by email or leave on our answering machine.

7. Data relating to children (Art. 8 GDPR)

Most of our guests arrive with a child. Almost none of that has anything to do with this website, and we have built it that way on purpose.

We do not knowingly collect any personal data from or about children. Our contact form asks only for the details of the adult who fills it in, and it says so on the form. It has no field for a child's name, age, date of birth, height or photograph, and we ask you not to send us any of those in the free-text message either. If information of that kind reaches us anyway, we delete it as soon as we notice and within seven days at the latest, and we answer your enquiry without it.

Children are never invited to submit anything to us themselves. Nothing on this site requires an account, a login or a registration, and the Ruhezeit schedule and the events calendar work without anyone identifying themselves at all.

Bookings for a children's birthday are made by an adult, who is the contracting party. For those we store only that adult's name, contact details, the date and the number of people — never the birthday child's name or age, even when you offer it.

8. Photography in the café

The photographs on this website show rooms, tables, furniture and drinks. We do not photograph our guests for the website, and we do not photograph children for it at all.

If we ever want to take a picture in which an identifiable person appears, we ask that person first, in the room, on the day, and we accept no as an answer without discussion. Where a child would be identifiable we ask the accompanying adult, and we would rather take a different picture.

We operate no video surveillance of any kind on the premises.

9. Newsletter and social media

We do not operate a newsletter and there is no mailing list to join.

This website embeds no social media buttons, no fonts loaded from a third-party server at page view time, and no video players. The two typefaces used here are served from our own domain.

10. No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. The Ruhezeit levels shown on this site are set by hand by a member of staff; nothing about you is measured, inferred or stored in order to produce them.

11. Status of this policy

This policy is dated 1 September 2026. We will amend it if we change how the site works — for instance if we ever add an online booking system, which at the time of writing we have no intention of doing.