Legal · Privacy Policy
Privacy Policy
Protecting your personal data is a top priority for BarberClub Mido. Below, we explain transparently how your data is collected, processed, and safeguarded when using our website and booking our barbering services.
- Last Updated
- October 2026
- Legal Framework
- EU GDPR / German BDSG
- Data Controller
- BarberClub Mido · Gronau
Data Controller
The controller responsible for data processing on this website and for salon services is:
- Business
- BarberClub Mido
- Address
- Gronauer Straße 24, 48599 Gronau (Westfalen), Germany
- Phone
- +49 2565 9379515
- Industry
- Hair Salon & Barbering Services
To be confirmed by owner: Full legal name of the owner/managing representative, dedicated official privacy email address, and chamber of crafts registration (Handwerkskammer Münster / commercial register, if applicable).
Legal Bases for Processing
We process personal data strictly in compliance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). Depending on the transaction, processing is grounded on:
- Art. 6(1)(b) GDPR (Contract Performance & Pre-contractual Steps): Managing, confirming, rescheduling, and fulfilling barber appointments, as well as providing customer accounts.
- Art. 6(1)(a) GDPR (Consent): Where you provide explicit opt-in consent (e.g., for optional news and promotional updates). Consent can be revoked at any time with future effect.
- Art. 6(1)(f) GDPR (Legitimate Interests): Ensuring website operational stability, IT defense, fraud prevention, and efficient salon schedule administration.
- Art. 6(1)(c) GDPR (Legal Obligations): Meeting statutory tax and commercial record retention mandates under German law (§ 147 AO, § 257 HGB).
Customer Accounts & Authentication
Visitors can create a customer account to review upcoming visits, view past booking history, and manage personal profile details.
Account Registration & Profile Fields
During registration, we collect your email address, a password, full name, and optionally your phone number. Passwords are never stored in plain text; they are securely hashed using modern cryptographic algorithms on the backend.
Email Verification & Password Recovery
To confirm email validity and protect against fraudulent registrations, we issue a six-digit verification code via email. Email verification does not automatically log you in.
Similarly, password resets require a time-limited six-digit email reset code.
Session Tokens & Storage Architecture
Upon signing in, short-lived access tokens exist solely in volatile browser memory (never stored in localStorage).
Session renewal uses an HttpOnly, Secure, SameSite refresh cookie issued by the backend at /api/v1/auth, inaccessible to client-side scripts.
Appointment Bookings (Guest & Member)
Appointments can be booked online either through an authenticated customer account or as a guest without creating an account.
Information Collected for Appointments
To schedule and execute your salon visit, we record:
- Full name
- Email address (for booking receipt and notifications)
- Phone number (for urgent schedule coordination)
- Selected department/audience (e.g., Men or Children)
- Chosen grooming service and variant
- Preferred barber (or open assignment based on availability)
- Selected date and time slot
Guest Bookings & Signed Management Tokens
For guest bookings, our system creates a signed management token sent via your booking confirmation link. This allows guests to check status, reschedule, or cancel within allowed notice windows without creating an account.
Raw management tokens are not stored in plain text in the database.
Notice Windows for Changes and Cancellations
Cancellations and rescheduling are governed by salon-configured minimum notice periods (minimumCancellationNoticeMinutes / minimumRescheduleNoticeMinutes).
Google Calendar Integration
To optimize daily chair schedules in Gronau, prevent double-bookings, and coordinate barber availability, our backend synchronizes appointments with the salon's Google Calendar.
Technical Architecture & Background Workers
Synchronization operates via the Google Calendar API through asynchronous background workers on the backend.
Once a booking is committed to the database, an event is created in the salon's configured Google Calendar ID under the Europe/Berlin timezone.
Event Lifecycle in Google Calendar
Rescheduling: When an appointment is rescheduled, the same calendar event is updated asynchronously with the new time and barber.
Cancellation: Cancelling an appointment deletes the corresponding event from the pinned salon calendar.
Completion / No-Show: When a visit is finished or marked no-show, the calendar event description is updated to COMPLETED or NO_SHOW.
Fault Resilience & Confidentiality
Temporary Google API outages do not cause booking failures; background jobs retry up to five times. When disabled in salon settings, no calls are made to Google.
The public website and customer responses never disclose internal Google Calendar identifiers or diagnostic details.
Email Notifications & Communications
Notifications are transmitted via secure SMTP mail protocols.
Transactional Messages
We send emails essential to the execution of your visit or account security (booking receipts, status updates, cancellation confirmations, verification codes, and password resets) pursuant to Art. 6(1)(b) GDPR.
Promotional News & Offers
Marketing emails are delivered only if you affirmatively opted in (Art. 6(1)(a) GDPR). You can withdraw this consent at any time via your customer profile.
Data Retention & Erasure
Personal data is retained only for the duration required to satisfy the respective processing purpose or statutory retention obligations.
- Booking and transaction records: Retained in accordance with German commercial and fiscal codes (§ 147 AO, § 257 HGB), generally for 6 to 10 years.
- Security codes: Expire automatically after their brief validity window.
- Customer accounts: Maintained until deletion is requested.
Your Rights under GDPR
Under the EU General Data Protection Regulation, you hold the following rights regarding your personal information:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR)
- Right to object (Art. 21 GDPR)
- Right to withdraw consent (Art. 7(3) GDPR)
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The responsible authority in North Rhine-Westphalia is Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW), Kavalleriestr. 2–4, 40213 Düsseldorf (www.ldi.nrw.de).
Privacy Questions & Contact
For any inquiries regarding this Privacy Policy or your data protection rights, please reach out to us:
- Entity
- BarberClub Mido
- Postal Address
- Gronauer Straße 24, 48599 Gronau (Westfalen), Germany
- Phone
- +49 2565 9379515
To be confirmed by owner: Dedicated email contact for privacy matters (e.g. privacy@barberclub-mido.de or contact@...).
Book your visit or get in touch
Have questions about your appointments?
We are here for you – in person at our Gronau salon or by phone.