← Home Samuel Nagler

Booking terms & privacy

As of October 2026. This page explains what data is processed when you visit samuelnagler.com and when you book an appointment online. In short: I collect as little as possible. For the online booking I only need a few details. Your full name and postal address are not required; you only have to give one way to contact you, so I can reach you with questions about your appointment or payment.

Privacy policy

1. Controller

Samuel Nagler, Eresburgstr. 24-29, 12103 Berlin, Germany, e-mail: samuelnaglerprivat@gmail.com (see also the legal notice).

2. Hosting and server data

The site is operated by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). When you open a page, Cloudflare processes technically necessary data such as IP address, time, requested page and browser details to deliver the site and protect it against attacks. Legal basis: Art. 6(1)(f) GDPR (secure and stable operation). This may involve a transfer to the USA. According to its own statements Cloudflare is certified under the EU-US Data Privacy Framework and offers standard contractual clauses as a processor. Fonts and images are hosted on this domain. There are no tracking, analytics or advertising services, and no cookies for such purposes.

3. Online booking

When you book you choose a category, day, time and payment method. The following is stored:

When the booking page is opened, a hash of the random device ID (see section 5) is also stored so that I can see how many different devices have visited the page (a plain count, no content). It is deleted after 14 days without another visit. Legal basis: Art. 6(1)(f) GDPR (planning and operating the service).

To protect against automated bookings I use Cloudflare Turnstile when you reserve. Cloudflare checks in the background whether a human is using the page (this processes, among other things, your IP address and browser details). Cloudflare may evaluate technical signals (e.g. IP address, user agent, TLS characteristics) and may set a security cookie; no advertising or tracking cookies are set. Legal basis: Art. 6(1)(f) GDPR (abuse protection).

The contact detail (e-mail, phone number or Instagram name) is mandatory for a booking because otherwise I cannot reach you about problems with payment or appointment; without it no booking is possible. No name or address is required. Your payment is matched through the payment reference (date, time, booking number, contact detail).

Legal bases: Art. 6(1)(b) GDPR (arranging and carrying out the appointment) and (f) (legitimate interests: protection against spam, abusive reservations and attacks).

Retention: Data in the online booking system is generally deleted 14 days after the appointment has ended, or after cancellation or expiry of a reservation, unless further storage is required. Technical counters (abuse protection) are deleted after 2 days at the latest. Payment, invoice and accounting records are kept regardless, to the extent required by law (usually up to eight years). Where data is needed to establish or defend legal claims, it may be kept until that purpose ceases. The database provider technically keeps short-lived restore points and security logs, which are deleted under its own periods.

4. Payment

You pay the deposit yourself by bank transfer or PayPal. I receive the details your bank or PayPal transmits (e.g. the payer's name and the reference) and match them manually with your booking. There is no automatic payment processing on this site. Your bank and PayPal process payment data as independent controllers under their own privacy terms (for PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A.); they are not part of this site's booking system. How long I keep payment records is governed by statutory duties (see above).

5. Storage on your device

The booking page stores in your browser (local storage) a random ID, the private link to your reservation, your language choice and a flag showing whether you have already seen the appointment notice. This serves the booking service you request (§ 25(2) no. 2 TDDDG). In addition the server sets a cookie (sn_dev) with a random ID that contains no information about you. It is valid for 62 days and renewed at every visit to the booking page, so that the limit of two appointments and one unconfirmed reservation still works if local storage was wiped. If you do not visit for more than 62 days, it expires. You can delete all of this at any time in your browser settings; the limit may then be circumvented and I will no longer recognise your reservations automatically. Only I use a login cookie, for the admin area.

6. Contact

If you write to me (e-mail, the site's contact form, Instagram), I process your details to answer your request (Art. 6(1)(b) or (f) GDPR) and delete them when no longer needed. The contact form opens your e-mail program; the site stores nothing of it. On Instagram, Meta's privacy terms also apply.

7. Recipients

I only pass data on to providers needed to run the site (Cloudflare as host, database and security provider) and where I am legally required to. The booking database is set up at Cloudflare with a preferred location of Western Europe; it is not strictly restricted to the EU, and Cloudflare may process data at other locations as well (third-country transfer, see section 2). Payment providers (bank, PayPal) only receive data through your own payment (see section 4).

8. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection to processing based on legitimate interests (Art. 15 to 21 GDPR). E-mail me; a booking number helps me match your request but is not a precondition. You also have the right to lodge a complaint with a data protection supervisory authority. For my place of business this is in particular the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany. More information at www.datenschutz-berlin.de.

9. Changes

I will update this policy when the site or the law changes. The version published here applies.