This is a translation for convenience. The German version is legally binding. Datenschutz (German version)
We take the protection of personal data seriously. This policy describes which data is processed when you visit beansandbrews.de.
Controller
Boje & Boje UG (haftungsbeschränkt), Elbchaussee 585, 22587 Hamburg
Email: info@beansandbrews.de
Server log files
When pages are accessed, the server automatically collects data transmitted by the browser: IP address, date and time, page accessed, browser type and operating system, and amount of data transferred. This processing serves the technical operation of the site and the defence against attacks. The legal basis is Art. 6(1)(f) GDPR.
Cookies and cache
The website uses technically necessary cookies, for example for login, security and page caching. Marketing or tracking cookies are not set without consent.
So that the selected language (German or English) is kept as you click through the site, the website stores a technically necessary cookie called ‘pll_language’. It contains only the language code (for example ‘de’ or ‘en’) and expires after one year.
Audience measurement
To understand which content is read, we use the analytics software Burst Statistics. It is self-hosted on our own web server; the data collected is not passed on to third parties. We use the cookieless, data-minimising mode: no cookies are set. To be able to count visits, the server creates a non-reversible hash from the IP address, the browser identifier and a random value that is newly generated every day. Because the random value changes every day, visits on different days cannot be linked to one another; no permanent browser fingerprint is created. The IP address itself is not stored.
The data recorded is the pages accessed, the referrer (the page from which you came to us), device type, browser and operating system, time spent on the page and scroll depth, and the country. The country is determined from the IP address using a GeoLite2 database stored locally on our server; the IP address is not transmitted to any other party for this purpose. The legal basis is our legitimate interest in data-minimising audience measurement (Art. 6(1)(f) GDPR).
Accounts, listings and comments
For registration, login and the management of listings, we store the information entered by users for as long as the account exists. Listings contain the contact details provided voluntarily.
Newsletter
With ‘Beans & Brews Weekly’, we send a newsletter once a week containing editorial articles from the magazine. It may also contain selected offers from the Beans & Brews marketplace and advertising from relevant companies, labelled as advertising.
What data: email address (required), first name (optional) and the interests selected (coffee, tea, cocoa, offers). As proof of consent, we store the time, form and page of the sign-up, the wording and version of the consent text, and a non-reversible hash of the IP address, not the IP address itself.
Double opt-in: After signing up, you will receive an email with a confirmation link. We only send the newsletter after you have confirmed. If the sign-up is not confirmed, you will not receive any newsletters.
Legal basis: your consent under Art. 6(1)(a) GDPR and § 7(2) No. 2 UWG (German Act against Unfair Competition). Storing the proof of consent is based on our legitimate interest in being able to demonstrate consent (Art. 6(1)(f) GDPR).
Withdrawal and unsubscribing: You can withdraw your consent at any time with effect for the future, via the unsubscribe link in every issue or by email to info@beansandbrews.de.
Storage period: We store the data until you unsubscribe from the newsletter. After that, the email address remains stored with the note ‘unsubscribed’, so that it receives no further newsletters and we can demonstrate the earlier consent. On request, we will delete the address completely.
No open or click tracking: We do not analyse whether or when individual recipients open the newsletter or which links they click. Links to the magazine contain only general campaign tags (utm parameters) that are not assigned to any individual.
Service providers: We manage subscriber data with our own software (B&B CRM) on our own web server; no external newsletter provider receives the data. For sending, we use the email service Resend (2261 Market Street #5039, San Francisco, CA 94114, USA) as a processor. In the process, the email address and the content of the message are transferred to the USA. Resend is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR).
Event calendar
Submitting an event: Organisers can suggest events using the form in the event calendar. In doing so, we process the event details and the name and email address of the person submitting, in order to review the submission and to get in touch if we have questions. The name and email address are not published. The legal basis is your consent (Art. 6(1)(a) GDPR). To protect against misuse, we store a non-reversible hash of the IP address for no more than one hour. We delete the contact details as soon as they are no longer needed for processing, or immediately on request.
Calendar subscription and ‘Save to calendar’: If you add events to your calendar as a subscription or a file, your calendar program (for example Google Calendar, Apple Calendar or Outlook) retrieves the event file from our server. In doing so, we process only the data technically required for the retrieval, as described under server log files. For Google Calendar, Google’s privacy policy applies to any further processing.
Map view: The world map in the event calendar is loaded as soon as you open the ‘Map’ view. Your browser then loads the Leaflet map module (with the Leaflet.markercluster extension) from unpkg.com (Cloudflare, Inc., USA) and map tiles from OpenStreetMap (OpenStreetMap Foundation, United Kingdom). In the process, your IP address is transmitted to these providers. The legal basis is our legitimate interest in clearly presenting the event locations (Art. 6(1)(f) GDPR). As long as you do not open the map view, these services are not loaded.
Maps in the city guides: The map showing the cafés in a city guide is loaded as soon as you scroll to it. Your browser then also loads the Leaflet map module from unpkg.com (Cloudflare, Inc., USA) and map tiles from OpenStreetMap (OpenStreetMap Foundation, United Kingdom); in the process, your IP address is transmitted to these providers. The same information applies as for the map view in the event calendar. The ‘Open in Google Maps’ buttons are simple links: Google only receives data when you click on them.
External services
When embedded content (such as maps or videos) is accessed, the respective provider may receive the IP address. We embed such content sparingly.
Rights of data subjects
Data subjects have the right of access, rectification, erasure, restriction of processing, data portability and objection. Complaints can be lodged with a data protection supervisory authority.