Privacy policy

Kadir Alik, Schleiermacher Str. 23, 10961 Berlin, Germany
E-Mail: info@friendslist.de

A data protection officer is not legally required and has not been appointed.

friendslist.de sets no tracking or advertising cookies, loads no fonts or scripts from third-party servers and sells no data. There is no automated decision-making with legal or similarly significant effects (Art. 22 GDPR). Only to select Member Club emails do we evaluate simple interests – the music genres of events you saved or signed up for yourself (section 7). We measure which pages are viewed how often and how fast they load – with Vercel Web Analytics and Speed Insights, without cookies and without storing anything on your device; for this the scripts read only the necessary details in the browser (section 12). We show no cookie banner because we set no cookies for advertising or analytics (sections 11 and 12).

When you visit, our host processes technically necessary data: IP address, date and time, page requested, amount of data transferred, referrer and browser/OS identifier. The legal basis is Art. 6 (1) (f) GDPR – our legitimate interest in secure and stable operation. These logs are not combined with other data. We do not store them separately; at the host they are deleted automatically after our plan's retention period – currently after one day.

If you join a Friendslist – our name for an event's guest list – we process: first name, last name, email address, optionally a phone number, and the number of people you bring. If you sign up yourself, we are responsible for the form, storage, confirmation email, QR code and deletion; once the list is passed to the promoter or club named in the form, they become responsible for their own use of it (entry, export, own copies). Promoters can also add guests themselves, for example after a request by message; in that case the details come from them, the promoter is responsible (legal basis: their legitimate interest in admitting announced guests, Art. 6 (1) (f) GDPR), and we process the details only on their behalf – storage, confirmation email with QR code, entry including via the door link, display in the added person's own account, deletion – and not for our own purposes. Anyone added this way is told so in the first email – with the name and contact of the person who added them, purpose, recipients, retention period, rights and a link to remove themselves immediately (Art. 14 GDPR).

Purpose: We pass these details to the promoter or club so they can find you on the list at the door – as a list in the promoter area or as an export (CSV, Excel, PDF). Without that transfer a Friendslist cannot work.

QR code and entry: The confirmation email contains a personal QR code. When the door team scans it we store the time of the scan and who scanned it; the code is then used up. This lets promoters see how many of the registered guests actually came.

Door link for the door team: Promoters can give their cashier or door staff a door link. Whoever opens it sees, for this one event, first and last name, the number of plus ones and, where given, the promoter and a note by the organizer – no email address, no phone number – and can check guests in, nothing else. The door staff act on behalf of the organizer. So that entry also works without internet, the device's browser stores this list. The copy is deleted once the link has expired (12 hours after the end of the event) or been switched off and the page is opened again afterwards, and at any time via “Delete data from this device”. We do not store the link; it is computed from a secret key when needed. The door page does not measure any usage.

Emails about your entry: After signing up you get a confirmation with the event image, all details of the night and your QR code. If the event moves to another time or venue, or is cancelled, we email you again. The images are embedded in the email and are not loaded from our server – so we don't learn whether or when you open an email.

Legal basis: Art. 6 (1) (b) GDPR: the sign-up is the service you ask for, and passing your details to the promoter is a necessary part of it – without it your name is not on the list at the door. The form names who receives the data. We do not ask for separate consent, because consent without which the service would not exist would not be freely given (Art. 7 (4) GDPR).

Deletion: All sign-ups are deleted automatically no later than 30 days after the event. You can also remove yourself at any time via the link in the confirmation email.

If a Friendslist is full you can join the waiting list. For this we process first name, last name, email address and the number of people you bring. After joining you get a confirmation, a second email if a place frees up, and a notice if the event is cancelled – nothing else happens with it. Legal basis: Art. 6 (1) (b) GDPR. You can remove yourself at any time via the link in any of these emails; no later than 30 days after the event we delete the waiting list automatically.

For the newsletter we process your email address and chosen language. We use double opt-in: after signing up you receive an email with a confirmation link; only then are you on the list. As proof of consent (Art. 7 (1) GDPR) we store the time of sign-up and confirmation plus a hash of the IP address salted with a secret key (pseudonymised: it cannot be traced back to the IP without the key) – we do not store the IP itself.

Legal basis: Art. 6 (1) (a) GDPR (consent). You can withdraw it at any time via the unsubscribe link in every email – we then remove your address from the list; we keep no suppression list. Sent emails and delivery logs remain with the mail service (section 13) for 30 days. Unconfirmed sign-ups are deleted after 7 days.

There are two kinds of accounts. Promoter accounts for submitting events: we store name, email address, promoter name, optionally phone number and Instagram handle, and your password solely as a cryptographic hash (bcrypt) – we never see it in plain text. Friendslist member accounts for guests: we store name, email address and the password hash.

After registering we email you a confirmation code; the account only becomes usable with it. Used or expired codes are deleted daily. Accounts that were never confirmed are deleted after 7 days.

As a member you can save events and join the Member Club of clubs or promoters. We then store which events and clubs these are; saved events are deleted 30 days after the respective event. In “My area” we also show all Friendslist entries that exist under your email address – including ones from before you created the account or ones added by promoters.

Emails from your Member Clubs: When you join a Member Club, the button says that you'll get emails whenever a new event is published there – clicking it orders them (consent, Art. 6 (1) (a) GDPR and § 7 (2) no. 2 UWG). We record when and with which wording that happened (Art. 7 (1) GDPR) and which events you have already been told about, so no email comes twice. So you only get relevant ones, we look at the music genres of events you saved or signed up for yourself (from two events on; entries made by promoters don't count). That is profiling within the meaning of Art. 4 no. 4 GDPR, but no decision with legal effect; the basis is our legitimate interest in not sending irrelevant emails (Art. 6 (1) (f) GDPR), and you can object at any time (section 16). You can unsubscribe at any time with one click via the link in every email or in your area under “Notifications” – no login, no reason needed.

Legal basis: Art. 6 (1) (b) GDPR – the account and its functions are the contract you enter into with us. Admin accounts are additionally protected by a second factor (one-time code from an authenticator app); we store the secret required for it encrypted and use it solely to verify the code at login, recovery codes only as hashes.

Deletion: You can delete your account yourself at any time in the account settings; this removes your saved events, Member Clubs, password and codes; Friendslist entries run until their 30-day limit and can be removed individually via the link in the email. Events you submitted remain in the calendar without any link to a person. On request we also delete the account if you email us.

The app is a second way into the same content and the same account as the website: parties, Friendslist sign-up, your QR codes, following clubs and, for organizers, the door scanner. It talks exclusively to our servers (friendslist.de) over the same infrastructure (sections 3, 10 and 13). The app contains no third-party advertising or analytics components and creates no advertising identifier; we measure nothing in the app.

Login: When you log in to the app, the server issues a session token which the app stores in your device's keychain (iOS Keychain) – encrypted and readable only by the app. It is valid for 60 days and extended on use; the app deletes it when you log out, and it becomes invalid server-side when you change your password or log out in the browser. This storage is technically necessary for the service (§ 25 (2) no. 2 TDDDG). Beyond that the app only keeps a short-lived cache of the last loaded party lists so it is not empty without a connection.

Push notifications: Notifications exist only with an account and only if you allow them in the iOS system dialog. Your device then creates a delivery address (push token) which we store with your account together with platform, language and your settings (new parties from followed clubs, reminder on the evening of the party). To send, we pass the token, the notification's title and text and its target in the app to Expo's push service (650 Industries, Inc., see section 13), which forwards it to Apple's APNs – no email address, no name. We keep delivery receipts for a few hours to remove devices where the app was deleted. The legal basis is your consent (Art. 6 (1) (a) GDPR); you can withdraw it at any time in the app under “More” or in iOS Settings – we then delete or deactivate the token. Logging out or deleting the account removes it as well.

Camera: Only the door scanner for organizers uses the camera, and only if you allow it. The camera image is searched for a QR code on the device; it is neither stored nor transmitted. Only the content of the code (the check-in identifier of the sign-up) is transmitted so our server can mark the guest as checked in (section 4).

Apple: You get the app from Apple's App Store. Which data Apple processes in that context and when operating iOS (for instance crash reports, if you allowed that in iOS Settings) is determined by Apple as an independent controller; Apple's privacy policy provides details.

Flyers promoters upload for an event are stored in the Vercel Blob file store (Vercel Inc., see section 13). The files are kept on servers in the USA and are publicly retrievable via an unguessable address – necessary so browsers can display them. When a flyer is replaced or the event deleted, we delete the file too; it may linger in the host's caches and backups for up to 30 days, but is no longer publicly retrievable. Whoever uploads a flyer is responsible for any people shown on it having agreed to it.

If you book a highlight as a promoter we store the booking on the event (package, time, price) and issue an invoice to your account details. Legal basis: Art. 6 (1) (b) GDPR. Because of the statutory retention duty for tax purposes (§ 147 (3) German Fiscal Code, § 14b VAT Act) we keep invoices and accounting records for eight years from the end of the calendar year of the invoice – even if the account is deleted before. Longer only where a pending tax or legal proceeding requires it. Payment does not take place via the website; there is no payment provider.

Anyone creating a marketplace profile (venue, DJ, photo, video, visuals, tech, MC, graphics, promotion) decides what it contains: name or artist name, categories, description, tags, city, price details, links to website and social channels, reference photos and video links; venues additionally type, capacity, district, optionally address and the link to their entry in the club directory. The profile is visible to all signed-in accounts on friendslist.de, not to search engines and not to visitors without an account. Legal basis is Art. 6 (1) (b) GDPR (providing the profile at your request); the photos are stored like flyers with Vercel Blob (sections 8 and 13). We take a quick look before publishing; rejected profiles are visible only to you and us. You can pause, change or delete the profile at any time – on deletion we remove the photos too.

Requests to a profile and replies to them run as messages via friendslist.de. We store subject, text, sender, recipient and time so both sides can read the history; the participants' email addresses are not passed to the other side. We notify the recipient of every new message by email via our email provider (section 13), including the beginning of the message. Legal basis is Art. 6 (1) (b) GDPR. We do not routinely analyse messages and do not use them for advertising. We can only look at them when there is a specific reason – a notice under Art. 16 DSA, suspected abuse, a support request from either side or an official order; every such access is logged internally. Histories stay readable for both sides until one of the two accounts is deleted – then they are deleted with it.

To defend accounts against attacks we log sign-in attempts and security-relevant actions in the admin area. We only store a salted hash of the IP address, never the address itself. These entries are deleted after 90 days. Legal basis: Art. 6 (1) (f) GDPR.

We only set cookies if you log in: a technically necessary session cookie (fl_session; httpOnly, SameSite=Lax, 14 days) that keeps you signed in and, for admin accounts during sign-in, a second one for at most five minutes (fl_mfa) that only allows entering the one-time code. No consent is required for this under § 25 (2) no. 2 TDDDG. Visitors without a login receive no cookie.

Browser storage: only the door page for door staff (section 4) stores anything on the device – the guest list of that event and check-ins not yet sent, in the browser's local storage, plus the page itself and its scripts in an offline store (service worker). This is strictly necessary for the explicitly requested offline entry (§ 25 (2) no. 2 TDDDG). All other pages store nothing in the browser.

So that promoters can see how their event is doing, we count page views and clicks on the ticket link per event and day, plus a rough source category (e.g. 'search engine' or 'Instagram'). Only totals are stored. We set no cookie and create no identifier on your device. So that a script cannot inflate the numbers, a view counts only once per internet connection, event and day; for this we keep a counter for 24 hours against a secret-salted hash of the IP address (as in section 10), never the address itself. Individuals cannot be identified or recognised from the totals. The legal basis for the counter is Art. 6 (1) (f) GDPR; no consent is required.

In addition we use Vercel Web Analytics (Vercel Inc., see section 13) to see which pages are viewed how often. The service sets no cookies and, according to Vercel, stores no IP address; it records the page viewed, the referring page, country or region, device type, browser and operating system. To distinguish visits within a day, Vercel derives a hash from IP address and browser identifier that is re-salted daily and cannot be traced back to you. In the same way, Vercel Speed Insights measures page load times during real visits (Core Web Vitals), also without cookies. We strip all parameters from addresses before sending except campaign tags (src, utm_…) – tokens from email links, email addresses and search terms are not sent – and the admin area is not counted. Legal basis is Art. 6 (1) (f) GDPR – our legitimate interest in knowing the site's reach. Nothing is stored on your device for this; the scripts read only the details needed for measurement in the browser (page address, referring page, load times, type of network connection) and transmit them. We consider this audience measurement part of running a public calendar; whether consent is required for it under § 25 TDDDG is not conclusively settled in law. On storage periods: the daily hash is worthless after 24 hours because it is re-salted – beyond that no view can be tied to a device. The resulting report is aggregated and not related to individuals; it is viewable for our plan's reporting window, currently 12 months. Vercel explicitly states that data may be kept beyond that so a larger plan could later show older figures.

We work with the following service providers, each under a data processing agreement pursuant to Art. 28 GDPR:

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA – website hosting, file storage for flyers (Vercel Blob) and audience and load-time measurement (Vercel Web Analytics and Speed Insights, section 12). The website is served from the Frankfurt region; the file store is located in the Washington, D.C. region (USA). For the USA there is an EU Commission adequacy decision (Implementing Decision (EU) 2023/1795, “EU-U.S. Data Privacy Framework”) under which Vercel is certified (Art. 45 GDPR); EU standard contractual clauses additionally apply in case the decision lapses.

Neon (a service of Databricks, Inc., USA) – database. The database cluster is located in the EU (Frankfurt region). EU standard contractual clauses apply to transfers to the USA.

Resend Inc. – sending all emails from the site (confirmations with QR code, changes and cancellations, waiting list, newsletter confirmation, Member Club emails, marketplace messages, account emails). Email address and message content are processed; Resend keeps sent emails for 30 days. Resend is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); EU standard contractual clauses additionally apply.

650 Industries, Inc. (Expo), USA – push service for the app (section 7a): receives our notifications and forwards them to Apple (APNs) or Google (FCM). The device's push token, the notification's title and text and its target in the app are processed. EU standard contractual clauses apply to transfers to the USA. Apple Inc. provides the APNs delivery service; Apple is certified under the EU-U.S. Data Privacy Framework.

STRATO GmbH, Berlin – our mailbox (info@friendslist.de). Messages from the contact and reporting forms, replies to our emails and our answers are stored there; servers in Germany.

Cloudflare, Inc. – manages only the domain's DNS records (mapping friendslist.de to our host). The website itself does not run through Cloudflare; Cloudflare sees no page content or form data.

Beyond that we pass Friendslist data to the respective promoter or club – that is the purpose of the sign-up and is described in section 4.

The standard contractual clauses we rely on with Vercel, Neon, Resend and Expo are part of the respective data processing agreements. The text of the clauses is published in EU Commission Implementing Decision (EU) 2021/914 and freely available there. We will provide a copy of the agreements concluded with these providers on request to info@friendslist.de – trade secrets and prices in them will be redacted.

Via the contact form and the reporting form under Art. 16 DSA we collect your name, email address, your message and – for a notice – the address of the content complained about. We need these details to reply to you; for a notice, Art. 16 (2) DSA expressly requires them.

The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in answering enquiries) and, for notices, additionally Art. 6 (1) (c) GDPR (legal obligation under Art. 16 DSA). We do not store the entries in a database: they are sent solely as an email to us and as a confirmation of receipt to you (mail service Resend, section 13). We delete the emails once the matter is settled – for notices at the latest after three years, so that we can still show how we decided if a complaint follows.

If a notice leads us to remove content, we inform the person who uploaded it of the reasons (Art. 17 DSA). We do not pass on your name or address in doing so, unless the notice itself visibly concerns you – for example a photo of you.

To prevent abuse of the forms we limit the number of submissions per internet connection per hour. For this we store no IP address in plain text, only a short-lived counter against a hash (section 12 applies accordingly).

Ticket buttons lead to external providers such as Eventbrite or Resident Advisor, map links to Google or Apple Maps. Table requests open WhatsApp or your email app with a prepared message to the promoter – we do not store the request and do not learn whether you send it. Only when you click there do you leave our site and the respective provider's privacy policy applies. We do not embed these services and transmit no data to them ourselves.

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future.

Right to object: You may object to processing we base on our legitimate interest (Art. 6 (1) (f) GDPR – such as server logs, security logs, counters and audience measurement, the selection of Member Club emails by genre) on grounds relating to your particular situation. You may object to the use of your data for direct marketing, including selection by genre, at any time without giving reasons – it then stops immediately. An informal email is enough.

Just write to info@friendslist.de. You can also lodge a complaint with a supervisory authority – ours is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.

Version: September 2026. This policy describes the current state of processing. We update it when we add features.