Privacy Policy

1. Controller

The controller for operating this platform and the own purposes identified below is:

E-mail: [email protected]

We have not appointed a data protection officer, and are not required to do so under § 38 BDSG. Please use the e-mail address above for all data protection enquiries.

1a. Platform and organizer: responsibility by purpose

The platform operator identified above controls website operations, security measures, platform accounts, enquiries addressed to the platform and the general RAVR platform waiting list. Separately consented platform marketing is also an own purpose of the platform operator.

For events run by other organizers, the identified organizer decides on registration and orders, participant management and optional registration questions, admission, event communications, refunds and its own marketing. Its identity, privacy contact and complete privacy notice are displayed on the event page before data entry. Its notice specifies the legal bases, recipients and retention periods for those purposes. Seller status alone does not determine the privacy role.

Where RAVR technically carries out those event activities solely on the organizer’s instructions, it processes the data as a processor. The descriptions of those activities below explain technical processing; they do not make the platform operator the controller for all event data. Payment providers have separate notices for their own purposes. If actual decisions differ, the parties must separately establish and explain their roles, including any joint control arrangement.

When a buyer enters another participant’s details, that buyer is the source. The organizer must also inform those participants. Where an email address is supplied, RAVR sends the organizer notice after the order is stored; information does not replace a legal basis for collection. Without a reachable email address, the organizer must arrange another documented delivery method. Buyers are asked to pass on the notice before submitting details. Imports, manual collection, failed delivery and statutory exceptions require individual review: generally within one month, at the first communication or before the first disclosure, whichever happens first (Article 14 GDPR).

Address event data requests to the organizer’s privacy contact. The platform supports requests concerning those data within its applicable responsibilities; rights against the relevant controller remain unaffected.

2. First things first: no tracking

This website uses no third-party analytics, no advertising pixels, no social media plugins and no user-profiling services. In particular, we do not use Google Analytics, Google Tag Manager, the Meta pixel, Matomo, Plausible, PostHog or comparable tools.

Section 8 describes our own browser storage. The external security service Turnstile is addressed separately in section 6a; its security purpose alone does not establish an exemption under § 25 TDDDG.

Bot protection: We use Cloudflare Turnstile on the contact form, the homepage waitlist and the buyer dialog on event pages for paid orders using Stripe. The external script loads when one of these widgets is mounted with a configured sitekey. See section 6a for details.

3. Hosting and server log files

This website and its database are hosted with Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The application and database currently run together on one server in Falkenstein, Germany.

When you access the website, the web server automatically collects data transmitted by your browser and stores it in log files: IP address, date and time of the request, the resource requested, the HTTP status code, the volume of data transferred, the referring page and your browser and operating system identifier (user agent).

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the technically error-free operation of the site, its delivery, and defence against attacks. Container logs are managed through Coolify/Docker. The standard settings in use rotate up to three files of 10 MB per container, replacing the oldest file when the limit is reached. The time covered depends on log volume; this does not establish a fixed retention period in days. Additional infrastructure or proxy logs have their own settings, whose active configuration must be checked separately.

4. Processing activities in detail

The following overview describes technical event activities. For third-party events, responsibility and the specific legal bases for those purposes follow the organizer notice (section 1a).

5. Registration questions and special categories of data

Additional questions may be asked for individual events, for example the attendee's name or organisational details. Mandatory questions are marked as such; all other questions are optional.

Collecting special categories of personal data under Art. 9(1) GDPR through registration questions is prohibited. This includes health, disability, religion, ethnic origin and sexual orientation. This also applies to optional answers and information about other attendees. There is no separate explicit consent process for these data here; answering a question does not constitute such consent. Please do not enter these details. Organizers must review their questions and answer options before enabling collection. This does not provide automatic detection of sensitive content.

6. Pseudonymous page view statistics

To see how often an event page is viewed, we count page views in aggregate form. So that a single visit is not counted more than once, we derive a hash value from the IP address, the browser identifier and the event identifier. This hash is keyed with a secret that rotates daily, limiting matching through this hash to the same event and day. The raw IP address is not stored in these statistics records.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in being able to gauge demand for an event. Records are deleted automatically after 90 days. Raw records contain the hash, event, timestamp and, where applicable, referral attribution. They are pseudonymous because they permit temporary recognition; attribution using additional information cannot be ruled out. The daily secret remains cached for up to 25 hours. The balancing assessment and production access permissions must be documented before operational approval.

If an event page is opened via a referral link containing the ?affiliate= parameter, the view is attributed to that referral so commissions can be settled. The referral code is not stored on your device; it is read solely from the address you opened.

6a. Bot protection on public forms (Cloudflare Turnstile)

We use Cloudflare Turnstile to protect the contact form, the homepage waitlist and the buyer dialog for paid Stripe orders against spam and automated abuse. The provider is Cloudflare Germany GmbH, c/o Design Offices München Atlas, Rosenheimer Straße 143C, 81671 Munich, Germany.

When the relevant widget is mounted with a configured sitekey, the browser loads a script from challenges.cloudflare.com; in checkout this happens in the open buyer dialog with Stripe selected. Cloudflare processes your IP address, information about your browser and device, and interaction data from the check, and issues a single-use token which we verify with Cloudflare when the form is submitted. Our backend sends the token and your IP address to the Siteverify endpoint and checks the expected action (contact, platform_waitlist or checkout). The checkout requirement is configurable.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in preventing spam and automated abuse. We do not use the service for analytics or advertising. This legal basis for processing personal data does not replace the separate assessment under § 25 TDDDG of storage on or access to your device. Actual access and storage, their duration and the conditions of any exemption under § 25(2) TDDDG still require verification against the deployed configuration; this notice does not claim that an exemption from consent has been established.

Cloudflare may process data globally, including in the US. Section 10 explains its processor-role transfer safeguards. Under the Turnstile Privacy Addendum, Cloudflare acts as a processor to protect our website and as a separate controller when improving its own bot detection using these signals. For Cloudflare's own retention periods please see the Cloudflare privacy policy.

If the security check cannot load for you — because of a script blocker, for example — you can always reach us directly by e-mail at [email protected].

6b. Cloudflare DNS, proxy and CDN

We use Cloudflare Free for DNS, reverse proxy, delivery and protection of the website. Requests to Cloudflare-protected addresses first pass through its global network. Cloudflare processes IP addresses, timestamps, requested URLs, HTTP headers and technical connection and security data; forwarded requests may also include their contents. Public content may be cached in the CDN.

Our legal basis is Article 6(1)(f) GDPR. Our legitimate interests are reliable delivery, availability and protection against attacks. Cloudflare's data processing agreement applies to processing on our behalf. Its privacy policy describes its own processing. International transfers and retention are addressed in sections 10 and 11.

7. Information about future events

Event waitlist email requires confirmation within 48 hours. We record the consent wording, version, purpose, organizer identity and time. Unconfirmed entries are deleted after 48 hours; confirmed entries expire when the next published event from this organizer starts or after 365 days, whichever comes first, or earlier when you unsubscribe. Every organizer mailing must include your unsubscribe link. Organizers must refresh exported lists before every mailing, remove withdrawn entries and delete copies after use.

During checkout or when joining a waitlist you may optionally consent to being informed about this and future events from the organizer. This consent is not necessary to buy a ticket.

We do not currently send automated promotional e-mails. The organizer may contact waitlist members about this and their next event. You may withdraw your consent at any time, without giving reasons and with effect for the future, by e-mail to [email protected]. The lawfulness of processing carried out before withdrawal remains unaffected.

8. Information stored on your device

We store only information on your device that is strictly necessary for the service you have requested. Such storage requires no consent under § 25(2) no. 2 TTDSG.

9. Recipients of your data

We pass on your data only where this is necessary to perform the contract or where we are legally obliged to do so. Where a provider acts as a processor, an agreement under Article 28 GDPR is required before use. This notice does not certify that those agreements have been concluded.

Stripe processes some payment data to meet its own legal obligations — for example fraud, anti-money-laundering and sanctions screening — and acts as a controller in its own right in that respect. Stripe's own privacy policy applies to that processing.

We also transmit data to our tax advisers and the tax authorities where necessary for accounting and to meet tax obligations, and to public authorities and courts where we are legally obliged to do so.

10. Transfers to third countries

Our application and database server is in Falkenstein, Germany. Mailjet identifies Frankfurt, Germany, and Saint-Ghislain, Belgium, as customer-data storage locations. This does not establish exclusive EU processing for every provider activity, including global group, support and security operations.

Stripe also processes payment data outside the EEA, including in the US. Its Data Transfers Addendum gives priority to the EU-US Data Privacy Framework for covered transfers to Stripe, LLC; where that mechanism does not apply, the incorporated EU Standard Contractual Clauses are provided. The Stripe DPA forms part of its standard service terms.

Cloudflare uses a global network including US locations. For restricted EEA transfers in its processor role, the Cloudflare DPA provides EU Standard Contractual Clauses and supplementary safeguards. Cloudflare's own purposes, including improving Turnstile, are described in its separate privacy notices.

Mailjet's Sinch processing terms and privacy policy describe further recipients and processing. The linked agreements provide the respective transfer terms; further information or a copy of the safeguards applicable to our processing is available through our privacy contact.

11. Retention periods

We currently do not operate our own database or file backups.

We retain personal data only for as long as necessary for the purposes stated or as long as statutory retention obligations apply. In detail:

• Invoices and accounting records: 8 years from the end of the calendar year in which the invoice was issued (§ 147(3) AO, § 14b UStG). We do not delete this data even on request; instead we restrict processing to the retention purpose.
• Order and attendee data: 3 years after the event ends. We then pseudonymise buyer identity and delete tickets including codes/QR data, admission history, registration answers, access credentials and order state logs. The separate contractual confirmation is retained as business correspondence for 6 years from the end of the year of contract conclusion (§ 257 HGB, § 147 AO), then deleted once the event operational period has also ended. Accounting orders and payment references are deleted after 8 years from the end of the year of the latest relevant event (event end, payment, invoice, refund or closed payment dispute), once all associated accounting documents have expired. Unresolved reconciliation, disputes and documented statutory or court retention holds are preserved; holds have a recorded reason and review date.
• Checkouts that were never completed: 90 days. Where no contract was formed there is no reason to keep your contact details at all. Expired, failed or cancelled attempts without payment or accounting records are deleted completely; minimal duplicate guards follow their separate retention period.
• Answers to registration questions: with the order data, so 3 years after the event ends. The content of the answer is then deleted together with its relationships.
• Admission data: scanner device identifiers and door staff notes 90 days after the event ends; the admission timestamp and ticket relation are deleted with the tickets after 3 years, subject to the unresolved cases and documented holds described above.
• Delivery log for organizer emails: 365 days.
• Page view statistics: 90 days, deleted automatically.
• Secondary operational copies: checkout responses 1 day; integration deliveries 30 days; completed payment-provider payloads 30 days from receipt. Access credentials are removed from these copies. Pending financial recovery retains only necessary replay fields. Erasure clears linked copies; completed duplicate guards expire after 8 years from year end of creation or completed processing; order-linked guards are deleted with the final order deletion. Unresolved replay/reconciliation work and documented retention holds must first be resolved.
• Erasure evidence: the HMAC lookup, pseudonym and accountability record are deleted 3 years after erasure. Evidence linked to a held order is preserved for the documented hold period.
• Server and container logs: size-based rotation using the criteria in section 3; this does not establish a fixed period in days.
• Mailjet Free: Its plan documentation specifies 90 days for statistics and campaigns. Templates and stored contacts remain for the account lifetime. These provider periods are separate from RAVR's own delivery logs.
• Cloudflare: The provider documents 31 days of historical retention for the Security Events and Security Analytics datasets on Free. This is not a blanket deletion period for all Cloudflare data; other processing follows the purposes and retention criteria in its privacy notices.
• Early-access waitlist: up to 365 days after sign-up, or until you withdraw consent.
• Enquiries sent through the contact form: until the enquiry has been dealt with conclusively; after that we delete it unless a retention obligation applies — business correspondence can be subject to commercial and tax retention periods.
• Consent to information about future events: until withdrawal; evidence of the consent beyond that for as long as necessary to defend against claims.

12. Your rights

You have the following rights in relation to your personal data:

• Access to the data we process (Art. 15 GDPR),
• Rectification of inaccurate data (Art. 16 GDPR),
• Erasure (Art. 17 GDPR), unless a statutory retention obligation prevents it,
• Restriction of processing (Art. 18 GDPR),
• Data portability in a structured, commonly used and machine-readable format (Art. 20 GDPR),
• Objection to processing based on Art. 6(1)(f) GDPR (Art. 21 GDPR),
• Withdrawal of consent at any time with effect for the future (Art. 7(3) GDPR).

An e-mail to [email protected] is enough to exercise these rights. We respond without undue delay and at the latest within one month of receipt (Art. 12(3) GDPR). To avoid disclosing your data to unauthorised persons, we may ask questions to verify your identity.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The competent authority is the one for your place of residence, your place of work, or the place of the alleged infringement. The authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf.

13. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place. We do not evaluate you automatically and take no decisions about you based solely on automated processing.

14. Whether you must provide data

Providing your name, e-mail address and billing address is necessary in order to conclude and perform a ticket purchase; without it we cannot perform the contract or issue a ticket. All further information is voluntary and marked as such.

15. Changes to this policy

We update this privacy policy when the processing described here or the legal position changes. The version published on this page applies; the date of the most recent change is shown above.