1. Name and Address of the Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) and other national data protection laws is listed in the Imprint.

2. General Principles of Data Processing

We collect, process, and use personal data only in compliance with relevant data protection regulations. This means user data is processed only if a legal permission or consent exists. We take organizational, contractual, and technical security measures in accordance with the state of the art to ensure that the regulations of data protection laws are observed and to protect the data managed by us against accidental or intentional manipulation, loss, destruction, or against access by unauthorized persons.

3. Collection and Processing of Personal Data

Below we inform you about individual processing operations, their scope, and purpose.

a) When visiting the website (Server Log Files)

Purpose: Ensuring the security and stability of the platform, connection establishment, administrative purposes.

Processed Data: IP address, date and time of access, name of retrieved file, transferred data amount, referrer URL, browser type and version, operating system.

Legal Basis: Our legitimate interest (Art. 6 para. 1 lit. f GDPR).

b) When registering an account

Purpose: Creation and management of your user account, fulfillment of the user contract, provision of personalized functions.

Processed Data: Name, email address, password (encrypted). For organizers additionally: Organizer name, legal entity, industry, contact details, address, legal information (VAT ID, Commercial Register) and verification documents.

Legal Basis: Fulfillment of a contract (Art. 6 para. 1 lit. b GDPR).

c) When using interactive functions (User-Generated Content)

Purpose: Publication and display of content created by you (events, reviews, comments, profile information) according to the purpose of the platform.

Processed Data: All content you actively enter on the platform, including texts, images, reviews, and metadata such as timestamps. This data is linked to your profile.

Legal Basis: Fulfillment of a contract (Art. 6 para. 1 lit. b GDPR).

d) When contacting (Support Form)

Purpose: Processing your request and communicating with you.

Processed Data: Name, email address, subject, message, and possibly event ID.

Legal Basis: Implementation of pre-contractual measures or fulfillment of a contract (Art. 6 para. 1 lit. b GDPR).

e) Voluntary demographic information and preferences

Purpose: Improvement of personalized event recommendations; provision of anonymized, aggregated statistics for organizers.

Processed Data: Birth year, gender, marital status, preferred categories, and cities.

Your individual demographic data is never publicly displayed or passed on to third parties. It is used exclusively in aggregated and anonymized form for statistics.

Legal Basis: Your voluntary consent (Art. 6 para. 1 lit. a GDPR), which you can revoke at any time by deleting the information in your profile.

4. Data Transfer to Third Parties and Providers

A transfer of your personal data to third parties for purposes other than those listed below does not take place.

a) Payment Service Providers

If you use paid services, your payment data (e.g. credit card number) will be passed on to the payment service provider commissioned by us (e.g. Stripe) for processing payments. Legal basis is Art. 6 para. 1 lit. b GDPR.

b) AI Services (Google AI Platform / Vertex AI)

For optional features such as event flyer analysis or event description generation, we use AI services from Google. For this purpose, the data you provide (images, event key data) is transferred to Google servers. We do not transmit any directly personal master data (name, email). The legal basis is our legitimate interest in providing innovative features (Art. 6 para. 1 lit. f GDPR).

c) Hosting and Technical Providers

Our platform is hosted by an external provider (e.g. Vercel, Firebase). Data collected within the scope of using this website is stored on their servers. We have concluded a data processing agreement (DPA) ensuring that your data is processed in accordance with GDPR.

d) Legal Obligations

We only pass on your data to state institutions and authorities if this is necessary within the framework of a legal obligation or for prosecution of criminal offenses.

e) Social Media Integration (Meta / Instagram)

If you use the "Post to Instagram" function (Premium feature), the event data you select (image, description text) will be transferred to Meta Platforms Ireland Ltd. via the official Meta Graph API in order to publish the post on your behalf. Authentication tokens (OAuth) are also processed during this operation. The legal basis is the performance of the contract (Art. 6 para. 1 lit. b GDPR) for the provision of the booked function.

5. Cookies and Tracking Technologies

Our platform uses cookies. Detailed information and management options can be found in our separate **Cookie Policy**.

6. Your Rights as a Data Subject

You have comprehensive rights regarding your data stored with us:

You have the right to **access** (Art. 15 GDPR), **rectification** (Art. 16 GDPR), **earasure** ("right to be forgotten", Art. 17 GDPR), **restriction of processing** (Art. 18 GDPR), **objection** to processing (Art. 21 GDPR), and the right to **data portability** (Art. 20 GDPR) at any time. Furthermore, you have the right to revoke given **consent** at any time (Art. 7 para. 3 GDPR) and to lodge a complaint with a **supervisory authority** (Art. 77 GDPR).

7. Duration of Data Storage

We store your personal data only as long as necessary to achieve the purposes mentioned here or as provided for by the various storage periods required by law. After the respective purpose ceases or these periods expire, the corresponding data is routinely blocked or deleted in accordance with legal regulations. Data in backups is deleted after backup rotation cycles expire.

8. Protection of Minors

Our offer is generally directed at persons of legal age. Use by persons under 16 years is not permitted without the consent of legal guardians. We do not knowingly collect data from minors. If we become aware of this, we will delete the corresponding data immediately.