Privacy Policy
Last updated: June 2026
Privacy at a glance
We take the protection of your personal data seriously and process it solely in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG). This policy explains what data we collect when you visit this website and when you place an order, for what purpose and on what legal basis, and what rights you have.
Controller
The controller responsible for data processing on this website within the meaning of Art. 4(7) GDPR is:
Humpback Whale Specialty Coffee
Thi Thanh Huong Quach
Türkenstraße 84a, Amalienpassage, 80799 München, Germany
[email protected]
Hosting
This website is hosted by an external service provider that processes the data arising from operation on our behalf and on servers within the European Union. The legal basis is our legitimate interest in the secure and reliable provision of the site (Art. 6(1)(f) GDPR). A data-processing agreement pursuant to Art. 28 GDPR is in place with the provider.
Server log files
When the website is accessed, the hosting provider automatically collects information that your browser transmits (server log files): browser type and version, operating system, referrer URL, host name of the accessing device, time of the server request, and the IP address. This data is used for technical provision, stability and security (Art. 6(1)(f) GDPR) and is not merged with other data sources.
SSL/TLS encryption
For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in your browser's address bar.
Shopping cart (local storage)
The items in your cart are stored solely in your browser's local storage (key “hbw-cart”) so they persist between visits. This data never leaves your device and is not stored on our servers; it is technically necessary to operate the shop. You can delete the entry at any time via your browser settings.
Consent preference
Your choice on the consent banner is stored locally in your browser (local storage, key “hbw-consent”) so we do not have to ask you on every visit. This value is likewise not transmitted to us.
Order processing
When you place an order, we process the data required for it — in particular your name, delivery and billing address, email address and order contents — to form and perform the purchase contract (Art. 6(1)(b) GDPR). We pass this data to the payment service provider you select and to the logistics company commissioned with shipping, to the extent necessary for fulfilment. No further disclosure takes place.
Payment processing via Stripe
Payments are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin, Ireland; payment processing may involve Stripe, Inc., USA). Depending on the payment method you choose (credit/debit card, Apple Pay, Google Pay or SEPA direct debit), Stripe transmits the data required to process the payment and prevent fraud. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). For any transfer to the USA, Stripe relies on the EU Commission's Standard Contractual Clauses and the EU-US Data Privacy Framework. Details: https://stripe.com/privacy
Google Maps
On our location page we embed a map from Google Maps (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The map loads only after you have consented; in doing so your IP address may be transmitted to Google and possibly transferred to the USA (relying on the Standard Contractual Clauses and the EU-US Data Privacy Framework). The legal basis is your consent (Art. 6(1)(a) GDPR). Details: https://policies.google.com/privacy
We link to our Instagram profile in the footer. This is a plain hyperlink, not an embedded component — so no data is transmitted to Instagram unless you click the link. Only when you visit Instagram does the provider (Meta Platforms Ireland Ltd., Dublin, Ireland) process your data under its own privacy policy.
Contacting us by email
If you contact us by email, we process your details in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual or contractual enquiries) or our legitimate interest in responding (Art. 6(1)(f) GDPR).
Retention period
We process personal data only for as long as is necessary for the respective purpose. Beyond that, we retain data from order processing where statutory retention obligations exist — in particular commercial and tax retention periods of six and ten years respectively (§ 257 HGB, § 147 AO). Once the periods expire, the data is deleted.
Your rights
You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing (Art. 21). You may withdraw any consent given at any time with effect for the future. To exercise your rights, an informal message to the contact details above is sufficient.
Right to lodge a complaint with a supervisory authority
Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.
Changes to this privacy policy
We will amend this privacy policy whenever changes in the law or in our services require it. The current version published on this page applies.