Privacy policy

This English translation is for information only. Only the German version is legally binding: Datenschutzerklärung (Deutsch).

Protecting your data is important to us. Here you can find out which data we collect when you visit our website or reserve online, what we use it for and what rights you have.

1. Controller

Ali Alghanem
CITY KIOSK (Einzelunternehmen)
Sulzbachtalstr. 49
66280 Sulzbach
Phone: 0157 70272393
Email: Ag.12804@hotmail.com

2. Summary

• Our website sets no cookies and uses no analytics or advertising services (no tracking).
• We load no content from third-party servers – no third-party fonts, scripts, maps or videos. Map services only open if you click the corresponding link.
• If you reserve online, we use your name and contact details only for this reservation (and as a non-reversible check value against reservations that are repeatedly not collected) and make them unrecognisable 90 days after completion.
• Files that you send us in the kiosk via QR code for printing are deleted after printing, at the latest after 24 hours.
• Messages sent via our “Praise & criticism” form are read only by the owner; name and contact details are optional. They are kept in a separate mailbox (not in our general data backups); we delete them after 90 days, open complaints later in justified cases.
• Our server is located in Germany. Emails go through our mailbox at Microsoft (Outlook.com/Hotmail).

3. Hosting

The website, the online shop and our till system run on our own server from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data centre in Germany. Hetzner processes the data only on our behalf; we have a data processing agreement with Hetzner pursuant to Art. 28 GDPR (DSGVO).

4. Visiting the website and server logs

When you open any page, your browser transmits data to our server for technical reasons: your IP address, date and time, the address requested, the amount of data transferred, information about your browser and operating system (user agent) and, where applicable, the previously visited page (referrer). We need this data to display the page to you and to protect our server against misuse and attacks. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR (DSGVO)).

For the website and the online shop, our server does not create access logs. It stores messages about technical errors without the IP address and without information about your browser; they are automatically overwritten based on size (at most 5 × 10 MB per service).

The connection to our website and to the online shop is encrypted (HTTPS).

5. Online reservation (“Reserve & collect in the kiosk”)

In the online shop at shop.citykiosk-sulzbach.de you can reserve items and collect them in the kiosk. You only pay when you collect; there is no online payment.

Which data?

• your name and your phone number and/or email address (one of the two is required so that we can reach you if we have questions),
• a message to us, if you write one,
• the reserved items, prices, time and pickup number,
• to protect against misuse (e.g. large numbers of automatically generated reservations), a check value (hash) of your IP address instead of the address itself,
• check values (hashes) of your phone number and email address – see “Reservations not collected”.

For what purpose and on what legal basis?

We use the data to accept your reservation, to put the goods aside, to contact you if necessary and to match the reservation when you collect it (Art. 6(1)(b) GDPR (DSGVO) – steps prior to entering into a contract and performance of the contract). The check value of the IP address serves to protect against misuse (Art. 6(1)(f) GDPR (DSGVO)). A reservation is not possible without a name and contact details.

Reservations not collected

We put reserved goods aside for you – other customers cannot buy them during this time. Anyone who repeatedly (as a rule twice) does not collect reservations may therefore temporarily no longer be able to reserve online. So that we can recognise this, we additionally store your phone number and email address as a check value (hash): a string of characters from which the number and address cannot be calculated back, but with which we can recognise a new reservation with the same details. These check values are kept when we make your other data unrecognisable after 90 days. The legal basis is our legitimate interest in not having goods blocked by reservations that are never collected (Art. 6(1)(f) GDPR (DSGVO)). We will lift a block at your request in the kiosk; you can then reserve online again.

Email notification

If you provide an email address, we will send you a message as soon as your reservation is ready for collection. We can also have ourselves notified of new reservations by email; this message contains your name and your contact details. We send emails via our email mailbox at Outlook.com (formerly Hotmail). The provider is Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland. Microsoft may also process data in the USA; for the USA, the adequacy decision of the EU Commission on the EU-US Data Privacy Framework applies, under which Microsoft is certified (Art. 45 GDPR (DSGVO)).

Storage in the browser

The online shop does not set any cookies for analytics or advertising purposes. So that your shopping basket and your pickup number are not lost, the shop can store them in your browser’s storage; this information does not leave your device and is technically necessary for the function you have requested (§ 25(2) no. 2 TDDDG – German Telecommunications Digital Services Data Protection Act). You can delete it at any time via your browser settings.

How long?

A reservation that is not collected expires after the period shown when you reserve. 90 days after completion of a reservation (collected, cancelled or expired), name, phone number, email address, message and the check value of the IP address are automatically overwritten. What remains is information without names and contact details (items, amounts, pickup number), which we need for our accounting, as well as the check values of the phone number and email address for the block in case of reservations not collected (see above).

Who receives the data?

Only we do. Technically involved are our hosting provider (section 3) and, if we send emails about your reservation, our email provider Microsoft (see “Email notification” – with possible processing in the USA). Apart from that, we do not pass your data on to anyone else.

6. Printing files via QR code (in the kiosk)

In the kiosk you can send us PDF files and photos from your phone via a QR code so that we can print them for you. The page for this is on our till server (section 3); it sets no cookies and loads nothing from third-party servers.

Which data?

• the files you send, with their file names (we store photos in reduced size and without location and camera data), the number of copies you want and – if you write one – your note to us,
• an order number, date and time, number of pages and price,
• to protect against misuse (too many orders from one device), your IP address (for IPv6 only the first part) – only in the server’s working memory, for at most 24 hours, not in a file or database.

For what purpose and on what legal basis?

We use the files only to print them as you request and to charge for the printing (Art. 6(1)(b) GDPR (DSGVO)). Before we print, our staff look at the files at the till. The IP address serves to protect against misuse (Art. 6(1)(f) GDPR (DSGVO)).

How long?

We delete the files as soon as the order has been printed, charged or rejected – orders not collected are deleted automatically after 24 hours – together with the file names and your note. Files, file names and note never go into our data backups. What remains is the order number, time, number of pages and file type and – if you pay – the till receipt, which we must keep for our accounting. On your phone, the page remembers your last order number in the browser’s storage only as long as the tab is open (technically necessary for the status display, § 25(2) no. 2 TDDDG).

Who receives the data?

Only we do. Technically involved is our hosting provider (section 3). We do not pass your files on to anyone else.

7. Praise & criticism via our form

Using the “Praise & criticism” form on our website, you can send us praise, criticism, complaints or suggestions – anonymously if you wish. Your message is transmitted encrypted (HTTPS) to our till server (section 3) and is not published.

Which data?

• the type of your message (e.g. praise or criticism), your text and the language of the page,
• optionally your name and an email address or phone number, if you would like a reply,
• date and time of receipt,
• to protect against misuse (too many messages from one device), your IP address (for IPv6 only the first part) – only in the server’s working memory, for at most 24 hours, not in a file or database and never together with your message.

For what purpose and on what legal basis?

We read your message to improve our service and – if you provide contact details – to reply to you if necessary. The legal basis is our legitimate interest in receiving and handling feedback from our customers (Art. 6(1)(f) GDPR (DSGVO)); providing your name and contact details is optional. Please do not write any sensitive information (e.g. about your health) in the message.

Who receives the data?

Only the owner can read the messages in the protected area of our till system; by default, employees have no access to them. Technically involved is our hosting provider (section 3). We do not pass your message on to anyone else.

How long?

We store messages in a separate, protected mailbox, kept apart from the other data of our till system. We automatically delete the text, name and contact details after 90 days, or earlier on request; the content is overwritten. If a criticism or complaint has not yet been resolved (e.g. because we are waiting for your reply), we keep it longer in individual cases with a documented reason, but only as long as necessary – at most 90 days at a time, at most 12 months after receipt in total, and at most 36 months for a legal clarification (e.g. warranty) (Art. 6(1)(f) GDPR). To protect against data loss we back up the mailbox daily in encrypted form; these backups are deleted automatically after 14 days and are used only for restoring after a technical failure – messages that were already deleted are deleted again immediately. The messages are not included in the general data backups of our till system.

8. Contact by phone or email

If you call us or write to us, we use your information only to deal with your request (Art. 6(1)(b) or (f) GDPR (DSGVO)) and delete it as soon as it is no longer needed for this purpose and no statutory retention obligations apply. Our email mailbox is hosted at Outlook.com by Microsoft (provider and possible processing in the USA: see section 5, “Email notification”).

9. Links to map and parcel services

Under “Contact & directions” we link to OpenStreetMap and Google Maps. Only when you click one of these links does your browser connect to the respective provider (OpenStreetMap Foundation, United Kingdom; Google Ireland Limited, Ireland, with possible transfer to the USA). The provider’s privacy notices then apply.

On our “Parcel service” page we also link to the websites of Hermes and UPS (tracking, power of attorney). Here too, your browser only connects to the provider when you click a link; the provider’s privacy notice then applies.

On our “Money transfer” page we link to the websites of Ria, Western Union and MoneyGram. Here too, your browser only connects to the provider when you click a link; the provider’s privacy notice then applies.

10. Your rights

You have the right of access to the data we store about you (Art. 15 GDPR (DSGVO)), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on our legitimate interest on grounds relating to your particular situation (Art. 21). You can cancel a reservation at any time. To do so, simply contact us (section 1).

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR (DSGVO)), for example the one responsible for us: Unabhängiges Datenschutzzentrum Saarland, Fritz-Dobisch-Straße 12, 66111 Saarbrücken.

No automated decision-making or profiling takes place.

As of: October 2026