Skip to content
HeKa coffee
Send enquiry

Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

HeKa Kaffee Rösterei GmbH
Borsigstr. 20
64291 Darmstadt
Germany
Email: [email protected]
Phone: +49 6151 8701770

2. Overview

You can use this website without providing any personal data (§ 19(2) German Telecommunications Digital Services Data Protection Act (TDDDG)). We do not set cookies, do not use local storage or session storage, do not track you or analyse traffic and do not embed third-party content. Fonts are served from our own server. As we neither store nor read any information on your device, no consent under § 25 TDDDG is required and there is no cookie banner.

3. Hosting and delivery

The website is hosted by DigitalOcean, LLC, 105 Edgeview Drive, Ste. 425, Broomfield, CO 80021, USA. DigitalOcean processes data on our behalf as a processor (Art. 28 GDPR). Data centre region: Frankfurt am Main (FRA1).

For delivery, DigitalOcean uses Cloudflare, Inc. (USA) as a sub-processor, whose content delivery network (CDN) is an integral part of the platform and cannot be switched off.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure, fast and reliable provision of the website.

4. Server and edge logs

Each time the website is accessed, the following data is processed automatically:

The purpose is the technical operation and security of the website, in particular detecting and preventing attacks such as denial-of-service attacks and attempts at misuse, and analysing errors (cf. Recital 49 GDPR). The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is keeping the website available and protecting ourselves, our systems and our visitors against attacks.

The logs are stored by the host and its sub-processor and deleted as soon as they are no longer needed for this purpose. Logs that we access ourselves are kept for no longer than 7 days.

5. Contact form and email

If you write to us via the contact form or by email, we process your name, your email address, your message and your subject and, if provided, your company and phone number.

If your enquiry concerns an offer or a contract, the legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). For all other enquiries it is Art. 6(1)(f) GDPR; our legitimate interest is answering your message.

The form sends your details as an email to [email protected]. Our mailbox is operated by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, as a processor; processing takes place in the EU. Transmission is encrypted via TLS; there is no end-to-end encryption. Technically, the content of the form also passes through the DigitalOcean and Cloudflare infrastructure named in section 3.

We delete your enquiry once it has been dealt with. If it leads to a commercial transaction, we keep the correspondence as a business letter for 6 years (§ 257 German Commercial Code (HGB), Art. 6(1)(c) GDPR).

Name, email address and message are required. Without them we cannot process your enquiry. All other details are optional.

6. Spam protection

To protect the contact form against automated submissions, it contains a field that is invisible to humans (honeypot) and uses a hidden form field to check that a minimum time was taken to fill it in. No cookies, no browser storage and no captcha service are used for this. Submissions identified as spam are discarded without storing the IP address.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is preventing misuse and spam.

7. Recipients

8. Transfers to third countries

Data may be transferred to the USA via DigitalOcean and Cloudflare. The transfer is based on the EU-US Data Privacy Framework and the European Commission's adequacy decision (EU) 2023/1795 (Art. 45 GDPR). In the alternative, the European Commission's standard contractual clauses apply (Art. 46(2)(c) GDPR).

9. Storage period

Unless stated otherwise above, we store personal data only for as long as is necessary for the respective purpose or required by statutory retention periods.

10. Your rights

You have the right to

To exercise these rights, write to us at [email protected]. We will respond without undue delay and in any event within one month (Art. 12(3) GDPR).

11. Right to object under Art. 21 GDPR

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data based on Art. 6(1)(f) GDPR. Here this concerns the server and edge logs (4), spam protection (6) and contact enquiries that do not concern an offer (5).

Following an objection, we will no longer process your data unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

The objection is not subject to any formal requirements; ideally send it by email to [email protected].

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is that of the German federal state in which we have our registered office (§ 40 German Federal Data Protection Act (BDSG)):

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Wilhelmstraße 7, 65185 Wiesbaden
https://datenschutz.hessen.de

13. No automated decision-making

We do not make automated decisions within the meaning of Art. 22 GDPR and do not carry out profiling.

Last updated: October 2026