Privacy policy

Draft. To be completed and legally reviewed before publishing.

1. Controller

Sebastian Schneegaß, HKC – Horse Killing Coffee (in formation), email: hallo@hkc.coffee, address: [to be completed]

2. What we process when you visit

When you open the site, our hosting provider processes technically necessary data (IP address, time, requested file, browser) to deliver the site and protect it from abuse. Legal basis: Art. 6(1)(f) GDPR. Hosting: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (Cloudflare Workers). Transfers to the US are based on the EU-US Data Privacy Framework, which Cloudflare has joined.

Fonts are served from our own server. No data is sent to Google Fonts.

3. Waitlist

When you sign up, we store your email address, your country, the page language and the time of your consent. We only use this data to tell you when HKC launches. Legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with an informal email or via the unsubscribe link in every email. We delete the data after you withdraw, and at the latest six months after HKC launches if you have not ordered by then.

Newsletter and confirmation: we are not sending any emails yet. At launch you will receive an email with a confirmation link (double opt-in). Only after you click it are you on the mailing list. Sending and list management will then be handled by Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany) as our processor, servers in the EU. For this we store your email address, language, country and the time of confirmation. Without confirmation we delete your address.

4. Analytics

Analytics with PostHog (servers in the EU) only run if you agree in the cookie notice (Art. 6(1)(a) GDPR, § 25(1) TDDDG). Without your consent nothing is loaded. We store your choice in your browser’s local storage, and you can change it any time via “Cookie settings” in the footer.

5. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, and the right to lodge a complaint with a data protection supervisory authority.

The German version of this policy is legally binding.