1. Controller
The controller responsible for processing personal data on this website is:
[First and last name, or company name]
[Street and house number]
[Postcode and town]
Email: [Email address]
2. Summary
- We process personal data only as far as needed to run this website, to handle your inquiries, orders and member account, or where you have given consent.
- We use no analytics, tracking or advertising tools.
- The website loads no content from third parties: fonts are served from our own server, and videos and social networks are only linked. The provider's own privacy policy applies only once you follow such a link.
- We do not sell data.
3. Hosting and server logs
The website runs on our own server infrastructure; no external hosting provider is involved. Connections are encrypted with TLS.
With every request our servers process: IP address, date and time, the requested address, status code and amount of data transferred, the previous page (referrer) and browser and device type (user agent). This is necessary to deliver the website and to keep it secure and stable, for example to detect attacks. The legal basis is Art. 6(1)(f) GDPR.
Access logs containing IP addresses are deleted automatically after 14 days. Application logs contain no IP addresses and are deleted after eight weeks at the latest.
To prevent abuse, such as automated login attempts, we count form submissions per IP address in a temporary cache. These counters expire after one hour at the latest (Art. 6(1)(f) GDPR).
4. Cookies and local storage
We only use cookies that are strictly necessary for the website to work (Section 25(2) no. 2 TDDDG; Art. 6(1)(b) and (f) GDPR). No consent is required for them.
- eb_csrf: protects forms against misuse by other websites; kept for one year.
- eb_session: set when you log in, open a share link or receive a message after submitting a form. It contains only a random identifier; the session data stays on our server. Kept for two weeks; logging out ends the session.
- eb_lang: remembers the language you chose; deleted when you close the browser.
- eb_msg: shows a confirmation or error message after you submit a form and is deleted afterwards.
On the members' mix page your browser stores the chosen view (grid or list) in local storage (exabeat_mixes_view). This value never leaves your device.
5. Booking inquiries
When you send an inquiry through the booking form, we process your name, email address and phone number, the event details (date, type, location, postcode, size, budget, music wishes, playlist link) and your message. We use them to answer your inquiry and to prepare an offer or contract (Art. 6(1)(b) GDPR) and delete them once they are no longer needed for this. If a booking is made, we keep the business records for as long as commercial and tax law requires (Art. 6(1)(c) GDPR).
6. Membership and member account
Membership request: we process your name, email address, message, the language used and the IP address the request came from. The IP address helps us detect abuse (Art. 6(1)(f) GDPR); we need the other details to decide on the request (Art. 6(1)(b) GDPR). If we approve it, we create an account and email you a link to set your password.
Registration via an invitation or share link: if you register through an invitation QR code or a share link, we process your name, email address, phone number and password. The password is stored only as a cryptographic hash, never in plain text.
Share links: when you open a share link we sent you, your session (cookie eb_session) remembers the link so that you can use the shared content for a limited time without logging in. We only count how often a link was opened, not by whom. If you register through the link, we note which account was created.
Member account: we use your account data to provide the members' area, to log you in and, on request, to send you a password reset link (Art. 6(1)(b) GDPR). The data is kept while the account exists. We delete the account at your request.
7. Notifications (newsletter)
When you sign up for notifications, we store your email address and/or phone number, the time of your consent and whether you confirmed the sign-up. For an email address we first send a confirmation email (double opt-in). We inform you about new events and releases. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time, for example via the unsubscribe link in every email or by emailing us. After you unsubscribe we keep a note of it so that you receive no further messages; on request we delete the entry completely.
8. Tickets
For a ticket order we process your name, email address, optionally your phone number, the tickets ordered, the payment method and the order status. You receive your tickets by email as a PDF with a QR code. At the entrance our staff scan the QR code, and we store the time and result of the check. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR). We keep order and payment records for as long as commercial and tax law requires (Art. 6(1)(c) GDPR).
With the payment method "Offline" we review your order and arrange payment with you directly.
9. Sending emails
Emails from this website (tickets, confirmations, membership, password reset) are sent via [Name and address of the email provider], which processes the data on our behalf (Art. 28 GDPR).
10. Recipients
Only the people who need your data for the purposes above have access to it. Beyond that we pass data only to the service providers named above, who act on our behalf, or to authorities where the law requires it.
11. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Just write to the email address above.
Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation.
You can also lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).
12. Required details and automated decisions
Providing your data is voluntary. Without the fields marked as required, however, we cannot handle an inquiry, order or registration. We do not use automated decision-making or profiling.
13. Changes
We update this privacy policy when the website or the law changes. The version published here applies.