Privacy Policy
What data we process when you use our website, leave luggage with us or create a customer account – and what rights you have.
This English translation is provided for information only. The German version is authoritative.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is: Atilla Ekizce, trading as "Bagstore" and "Bavarian Lockers", Bremer Str. 12, 49191 Belm, Germany. Drop-off point: Marsstraße 13, 80335 Munich (inside Café MackGorilla).
Contact: info.mackgorilla@gmail.com, phone +49 176 70140040. You can contact us at this address at any time with questions about data protection or to exercise your rights.
No data protection officer has been appointed, as there is no legal obligation to do so.
2. Summary
We only process personal data to the extent necessary to operate the website, book and store your luggage, handle payment, run your customer account and keep our drop-off point secure, or where you have given consent.
- No ad tracking: we do not use advertising or social media trackers and do not create usage profiles. For visitor numbers we only use cookieless audience measurement by Cloudflare (see below).
- No advertising cookies: in your browser we only store what is needed for the site to work (e.g. language, cart, sign-in).
- Fonts and code libraries are served from our own server; no data is sent to Google or other font providers.
- Payment is handled by Stripe; we never see your card details.
- We do not sell data.
3. Legal bases
We rely on the following legal bases under the GDPR:
- Art. 6(1)(b) GDPR – performance of a contract or pre-contractual steps (e.g. booking, storage, handover, customer account);
- Art. 6(1)(c) GDPR – legal obligations (e.g. commercial and tax record-keeping);
- Art. 6(1)(f) GDPR – legitimate interests (e.g. secure operation of the website, protecting stored luggage, preventing and investigating crime, preserving evidence);
- Art. 6(1)(a) GDPR – consent (e.g. news and offers by email);
- Section 25(2) no. 2 TDDDG – storing information in your browser where strictly necessary for a service you requested.
4. Hosting and visiting the website
Our website is delivered via the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (hosting, content delivery, protection against attacks). When you visit, Cloudflare processes technically necessary connection data: IP address, date and time, requested address, referrer, browser and device information.
This is done to deliver the website, keep it stable and secure and fend off attacks (Art. 6(1)(f) GDPR). Cloudflare acts as our processor. For transfers to the USA, Cloudflare relies on its certification under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
We do not analyse connection data ourselves. Where logs are created, they are deleted after 30 days at the latest unless needed to investigate a specific security incident.
5. Storage in your browser (local storage, cookies)
We do not use cookies for analytics or advertising. In your browser’s local storage we only keep information required for the features you use: your chosen language, the contents of your cart, an entered coupon code and – if you sign in to your customer account – your sign-in session.
The legal basis is Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(b) or (f) GDPR. You can delete these entries at any time in your browser settings.
On Stripe’s payment page, Stripe sets its own cookies, in particular for fraud prevention. See "Payment via Stripe".
6. Audience measurement with Cloudflare Web Analytics
To understand how often our pages are visited and how fast they load, we use Cloudflare Web Analytics (Cloudflare, Inc., see above). For this, the website loads a small Cloudflare script that transmits the page address, referring page, browser and device type, loading times and the approximate country when a page is viewed.
According to Cloudflare, Web Analytics does not set cookies, does not use local storage or fingerprinting and does not build profiles of individual visitors. We only see aggregated statistics such as page views per day.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is designing and technically optimising our website. You can object at any time (see "Your rights") or block the script with a content blocker in your browser. Cloudflare relies on the EU-U.S. Data Privacy Framework for transfers to the USA.
7. Luggage storage bookings and shop pre-orders
When you book online or pre-order in the shop, we process the details from the booking form: name, email address, phone number where provided, drop-off and pick-up time, number and type of bags, ordered items, price, redeemed coupons, payment status and the booking reference. Mandatory fields are marked; without them we cannot complete the booking.
The purpose is to perform the contract: reserving, receiving, storing and handing over your luggage, handling pre-orders, sending the confirmation with QR code and communicating about your booking (Art. 6(1)(b) GDPR).
We store booking and customer data in a database provided by Supabase Pte. Ltd. (Singapore) as our processor. The database servers are located in the EU (Ireland region). Any access from third countries is safeguarded by EU standard contractual clauses (Art. 46(2)(c) GDPR).
We keep booking data as long as needed to perform the contract and handle possible claims. Invoices and booking records are kept for up to ten years in line with commercial and tax law (Art. 6(1)(c) GDPR), with processing restricted during that time.
8. Payment via Stripe
Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. For payment you are redirected to a Stripe payment page, where Stripe processes your payment data (e.g. card or account details, name, email address, billing country) as well as device and connection data for fraud prevention.
We only receive the information needed to complete the transaction, such as payment confirmation, amount, payment method and a transaction ID – never full card or account details.
The legal bases are Art. 6(1)(b) GDPR (payment processing), Art. 6(1)(c) GDPR (legal obligations such as anti-money-laundering rules) and Art. 6(1)(f) GDPR (fraud prevention). Stripe may transfer data to the USA, relying on the EU-U.S. Data Privacy Framework or EU standard contractual clauses. More: stripe.com/privacy.
9. Emails about your booking
We send confirmations, luggage tickets with QR code and sign-in emails via the email service Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) as our processor. This involves your email address, your name and the content of the message.
The legal basis is Art. 6(1)(b) GDPR. The transfer to the USA is safeguarded by EU standard contractual clauses (Art. 46(2)(c) GDPR).
10. Customer account
You may create a free customer account. You sign in without a password using a link or code we email to you. In the account we process your email address, your name, optionally a phone number and your preferred language, your bookings and luggage tickets, and any coupons and promotions assigned to you.
The legal basis is Art. 6(1)(b) GDPR. The data is stored in the Supabase database in the EU mentioned above. You can have your account deleted at any time; a simple email is enough. Data we must retain by law is restricted rather than deleted.
11. News, offers and coupons by email
If you expressly consent in your customer account, we will email you news, promotions and coupons from Bavarian Lockers and Café MackGorilla. We store your consent and when it was given (Art. 6(1)(a), Art. 7(1) GDPR).
You can withdraw your consent at any time with effect for the future – in your customer account or by emailing us. This does not affect the lawfulness of processing before withdrawal.
12. Receiving, tagging and photographing luggage
When we receive your luggage, we tag it and photograph its external condition. The photos are stored with your booking reference in a private, access-protected storage in the EU; only our staff have access.
The photos are used to identify your luggage, document its condition and resolve possible disputes (Art. 6(1)(b) and (f) GDPR). They are deleted no later than 30 days after pick-up unless needed longer to resolve a reported damage or loss.
On handover we may ask to see your luggage ticket or an official photo ID. We do not store ID data; we only inspect it.
13. CCTV at the drop-off point
The drop-off point and storage area at Marsstraße 13 are monitored by CCTV. Signs on site point this out. Images are recorded, but no sound.
CCTV serves to protect stored luggage and our property, to prevent theft and damage and to investigate and preserve evidence in case of an incident. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in these purposes.
Recordings are automatically overwritten after 72 hours. Only where an incident needs to be investigated do we keep the relevant recordings until it is resolved, and we may pass them to law enforcement authorities or insurers.
14. Contact by email or phone
If you contact us by email or phone, we process your details to answer your request (Art. 6(1)(b) GDPR for booking-related requests, otherwise Art. 6(1)(f) GDPR). We delete the request once it has been dealt with and no retention obligations apply.
15. Map on the homepage (OpenStreetMap)
To show our location, we embed a map whose tiles are loaded from the servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Your IP address is transmitted to the OpenStreetMap Foundation in the process.
We use the map so that you can find us easily (Art. 6(1)(f) GDPR). The European Commission has issued an adequacy decision for the United Kingdom. More: osmfoundation.org/wiki/Privacy_Policy.
16. Google reviews and links to other services
On the homepage we show excerpts from publicly posted Google reviews with abbreviated names. We do not load any content from Google for this; the excerpts are part of our page (Art. 6(1)(f) GDPR). If you do not want your review to appear here, just send us a short message.
Links to Google Maps, Instagram or YouTube are plain links. Only when you click one are you taken to that provider, who then processes data under its own responsibility.
17. Recipients and transfers to third countries
Your data is only accessible to our staff and the service providers named in this policy, to the extent required for their tasks. We have concluded data processing agreements under Art. 28 GDPR with our processors. Beyond that we only disclose data where required by law (e.g. to authorities) or to establish, exercise or defend legal claims.
Transfers outside the EU only take place on the basis of an adequacy decision (e.g. EU-U.S. Data Privacy Framework, United Kingdom) or appropriate safeguards such as EU standard contractual clauses.
18. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR).
Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
A simple message to info.mackgorilla@gmail.com is enough. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the Bavarian Data Protection Authority (BayLDA), Promenade 18, 91522 Ansbach, Germany, or the authority where you live.
19. No automated decision-making
We do not make decisions based solely on automated processing, including profiling (Art. 22 GDPR).
20. Security and changes
Our website is encrypted with TLS throughout. Access to booking data and luggage photos is restricted to authorised staff and technically secured.
We update this privacy policy when our services or the law change. The version published here applies.