PRIVACY POLICY

This privacy policy informs you about the processing of personal data on our website artist4friends.com and in our web application (artist4friends-prod.azurewebsites.net).

1. DATA CONTROLLER

2. OVERVIEW OF DATA PROCESSING

We only process personal data to the extent necessary to provide a functional website and our content and services.

Types of data processed:

• Master data (e.g., names, email addresses)
• Usage data (e.g., pages visited, access time)
• Meta/communication data (e.g., IP addresses, device information)
• Contract data (e.g., selected plan, payment information)

Categories of data subjects:

• Website visitors
• Registered users (artists, e.g. DJs)
• Guests who sign up on Friendslists
• Organizers (club, booker or promoter) who get a guest list

3. LEGAL BASIS

We process personal data in accordance with the following legal bases:

• Consent (Art. 6(1)(a) GDPR) – You have given us your consent for a specific processing purpose (e.g., statistics cookies, newsletter).
• Contract Performance (Art. 6(1)(b) GDPR) – Processing is necessary for the performance of a contract or pre-contractual measures (e.g., account creation, Friendslist management).
• Legal Obligation (Art. 6(1)(c) GDPR) – Processing is necessary for compliance with a legal obligation (e.g., retention periods for invoices).
• Legitimate Interests (Art. 6(1)(f) GDPR) – Processing is necessary to protect our legitimate interests (e.g., security, website operation).

4. HOSTING

Our website is hosted by Linevast (Linevast Ltd., UK). The host processes access data (IP address, date/time of access, amount of data transferred, referrer URL, browser type) in server log files on our behalf.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and efficient operation).

The web application (artist4friends-prod.azurewebsites.net) runs on Microsoft Azure (Microsoft Ireland Operations Ltd., Ireland) in a data center in the EU.

A data processing agreement (DPA) pursuant to Art. 28 GDPR has been concluded with the host.

5. FONTS (LOCALLY HOSTED)

This website uses locally hosted fonts (Bebas Neue, Space Mono). No connections to external servers (such as Google Fonts) are established. Your IP address is not transmitted to third parties.

6. COOKIES AND LOCAL STORAGE

We use cookies and your browser's localStorage to enable certain features and improve the website.

6.1 Technically Necessary Storage

This storage is essential for the operation of the website:

• a4f_consent (localStorage) – Stores your cookie settings. Contains: version, timestamp, selected categories. Not deleted when closing the browser.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest), Section 25(2) No. 2 TDDDG (German Telecommunications Digital Services Data Protection Act - technically necessary).

6.2 Optional Cookies (only with consent)

The following cookies are only set if you expressly consent:

Statistics Cookies:

• Google Analytics 4 – We use Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to analyze website usage. Google Analytics uses cookies to collect anonymous usage data (pages visited, session duration, device type). IP addresses are anonymized. Data is only collected after your consent. You can withdraw your consent at any time via the cookie settings.

Provider: Google Ireland Limited. Privacy Policy: https://policies.google.com/privacy

Marketing Cookies:

• Currently, no marketing cookies are used.

Legal basis: Art. 6(1)(a) GDPR (consent), Section 25(1) TDDDG.

6.3 Withdrawing Consent

You can change your cookie settings at any time by clicking on the cookie icon at the bottom left of the page. There you can withdraw or adjust your consent.

7. DATA PROCESSED IN DETAIL

7.1 Website Visit

When you visit our website, the following data is stored in server log files:

• IP address (anonymized after 7 days)
• Date and time of the request
• Page/file accessed
• Amount of data transferred
• Browser type and version
• Operating system
• Referrer (previously visited page)

This data is used for security and error analysis. It is not combined with other data.

Storage period: 7 days, then anonymized.

Legal basis: Art. 6(1)(f) GDPR.

7.2 Artist Account (Web Application)

When you register as an artist in our web application (artist4friends-prod.azurewebsites.net), we process:

• Email address (also your login; confirmed via link)
• Artist name or display name
• Password (stored only as a cryptographic hash, never in plain text)
• Interface language and the language of your emails
• Selected plan (Free, Basic or Premium) and billing period
• Optional: profile picture; on the Premium plan also profile bio, logo, colors and your own text for guest emails

Login log: For every login we store the time, a shortened device description and a truncated IP address – to protect your account and for support. We delete the individual login entries after 90 days.

Legal basis: Art. 6(1)(b) GDPR (contract performance); for the login log Art. 6(1)(f) GDPR (protecting the account).

Storage period: Until you delete your account. Statutory retention obligations (e.g., for invoices) remain unaffected.

7.3 Story Photo

If you upload your own photo for an event's story image, we store it so you can reopen the story later. Only you can see the photo; it is not published on the event page and not passed on to third parties. You can remove it at any time. If you duplicate an event, we copy the photo to the new event. If the event or your account is deleted, we delete the photo within 24 hours at the latest.

Legal basis: Art. 6(1)(b) GDPR.

7.4 Event and Guest Data

When an artist creates an event with a Friendslist, we process:

• Event name, date, venue and number of spots
• Email address of the organizer (club, booker or promoter) who gets the guest list

From guests who sign up on a Friendslist (they don't need an account for this):

• Required: name and email address (for the emails about the sign-up and the Friendslist pass)
• Optional: phone number – only for the artist, in case something changes at short notice
• The language the guest signed up in
• Time of the sign-up and status on the list; for a prize draw also when the link in the email was clicked, and the result of the draw

Friendslist pass: After signing up, the guest gets a personal link to their Friendslist pass. It only shows the event and the status.

Who gets what?

• The artist sees name, email address and – if provided – the phone number. On the Basic or Premium plan, the artist can export these details as a CSV file.
• The organizer only gets the names for the guest list – no email addresses, no phone numbers. For a prize draw, the organizer only gets the names of the winners.

Legal basis: Art. 6(1)(b) GDPR (contract performance with the artist); for guests Art. 6(1)(b) GDPR (the spot on the list the guest requests). The respective artist is the controller for guest data; we process it on their behalf (Art. 28 GDPR).

Storage period: Until the guest removes themselves (“Release your spot” or “Remove this entry” in every guest email) or the artist deletes the entry, the event or their account. Prize draw entries without a click on the email link are deleted automatically, no later than 25 hours after the draw.

7.5 First Come, First Served and Prize Draw

• First come, first served: After submitting, the guest is on the list right away. There is no confirmation link for the spot.
• Prize draw: The guest gets an email with a link. One click – and they're in the draw. The system draws the winners at random.

Only the organizer confirms the guest list, with one click in their email.

7.6 Artist Newsletter Opt-in

In all plans, artists can enable an optional newsletter checkbox for their guests; it is never pre-ticked. On the Premium plan, the artist can make entry to an event conditional on the newsletter sign-up (“Entry only with newsletter sign-up”); this is clearly indicated before signing up. Whether this coupling of entry and consent is permissible (Art. 7(4) GDPR) is currently under legal review.

With “First come, first served”, consent applies from submitting the form; with a prize draw, from the click on the link in the email. We do not send a separate confirmation link for the newsletter. The artist sends the newsletter themselves with their own tool and is responsible for it. As proof, the following is stored:

• Guest's email address
• Whether and when consent was given
• The wording of the consent as shown and the language
• Whether entry depended on the newsletter sign-up
• Event at which consent was given

Legal basis: Art. 6(1)(a) GDPR (guest's consent). Guests can withdraw at any time via the unsubscribe link in every newsletter email from the artist; their spot is not affected.

7.7 Contact

If you contact us by email, we store your inquiry for processing.

Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest).

Storage period: Until the inquiry is resolved, maximum 2 years.

8. DATA DISCLOSURE TO THIRD PARTIES

Your data will only be disclosed to third parties:

• if you have expressly consented (Art. 6(1)(a) GDPR)
• if it is necessary for contract performance (e.g., payment service providers)
• if we are legally obligated to do so
• if it is necessary to protect legitimate interests and your interests do not outweigh ours

Data Processors:

• Linevast Ltd. (UK) – hosting of the website
• Microsoft Ireland Operations Ltd. (Ireland) – hosting of the web application (Microsoft Azure, EU)
• Email delivery provider (SMTP, servers in the EU) – sending the web application's emails

Payments for Basic and Premium are processed via Stripe (Stripe Payments Europe, Ltd., Ireland).

Appropriate data processing agreements pursuant to Art. 28 GDPR have been concluded with all processors.

9. DATA TRANSFER TO THIRD COUNTRIES

Google Analytics: If you consent to statistics cookies, data may be transferred to Google servers in the USA. Google is certified under the EU-US Data Privacy Framework, ensuring an adequate level of data protection. IP addresses are anonymized before transfer.

Note on UK: The United Kingdom is considered a safe third country based on the EU Commission's adequacy decision.

Stripe: Stripe may transfer payment data to Stripe, Inc. in the USA. Stripe is certified under the EU-US Data Privacy Framework.

All other data (fonts, hosting) remains within the EU/EEA or UK.

10. YOUR RIGHTS

Under the GDPR, you have the following rights:

• Right of Access (Art. 15 GDPR) – You can request information about your processed data.
• Right to Rectification (Art. 16 GDPR) – You can request correction of inaccurate data.
• Right to Erasure (Art. 17 GDPR) – You can request deletion of your data ("right to be forgotten").
• Right to Restriction (Art. 18 GDPR) – You can request restriction of processing.
• Right to Data Portability (Art. 20 GDPR) – You can receive your data in a machine-readable format.
• Right to Object (Art. 21 GDPR) – You can object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3) GDPR) – You can withdraw given consent at any time.

To exercise your rights, please contact: datenschutz@artist4friends.com

11. RIGHT TO LODGE A COMPLAINT

You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data.

Competent supervisory authority for Brandenburg (Germany):

12. SECURITY

We employ technical and organizational security measures to protect your data against manipulation, loss, destruction, and unauthorized access. These include:

• SSL/TLS encryption of all data transfers (HTTPS)
• Encrypted storage of passwords
• Regular security updates
• Access restrictions based on the principle of least privilege

13. CHANGES TO THIS PRIVACY POLICY

We reserve the right to adapt this privacy policy to changed legal requirements or changes to our services. The current version can always be found on this page.