Privacy policy

Kadir Alik, Schleiermacher Str. 23, 10961 Berlin, Germany
E-Mail: kadir.alik@gmx.de

A data protection officer is not legally required and has not been appointed.

friendslist.de sets no tracking or advertising cookies, embeds no analytics services, loads no fonts or scripts from third-party servers and sells no data. There is no profiling and no automated decision-making. That's also why there is no cookie banner here: there is simply nothing to consent to.

When you visit, our host processes technically necessary data: IP address, date and time, page requested, amount of data transferred, referrer and browser/OS identifier. The legal basis is Art. 6 (1) (f) GDPR – our legitimate interest in secure and stable operation. These logs are not combined with other data and are deleted automatically after a short time.

If you join a Friendslist – our name for an event's guest list – we process: first name, last name, email address, optionally a phone number, and the number of people you bring.

Purpose: We pass these details to the promoter or club so they can find you on the list at the door. Without that transfer a Friendslist cannot work.

Legal basis: Art. 6 (1) (b) GDPR (steps taken at your request prior to entering into a contract). In addition, the form asks for your explicit consent to the transfer.

Deletion: All sign-ups are deleted automatically no later than 30 days after the event. You can also remove yourself at any time via the link in the confirmation email.

For the newsletter we process your email address and chosen language. We use double opt-in: after signing up you receive an email with a confirmation link; only then are you on the list. As proof of consent (Art. 7 (1) GDPR) we store the time of sign-up and confirmation plus a non-reversible hash of the IP address – we do not store the IP itself.

Legal basis: Art. 6 (1) (a) GDPR (consent). You can withdraw it at any time via the unsubscribe link in every email – we then delete your address completely. Unconfirmed sign-ups are deleted after 7 days.

If you create a promoter account we store name, email address, promoter name and your password solely as a cryptographic hash (bcrypt) – we never see it in plain text. Legal basis: Art. 6 (1) (b) GDPR. We delete your account on request; just write to us.

To defend accounts against attacks we log sign-in attempts and security-relevant actions in the admin area. We only store a salted hash of the IP address, never the address itself. These entries are deleted after 90 days. Legal basis: Art. 6 (1) (f) GDPR.

We set exactly one cookie, and only if you log in as a promoter or admin: a technically necessary session cookie (httpOnly, SameSite=Lax, 14 days) that keeps you signed in. No consent is required for this under § 25 (2) no. 2 TDDDG. Visitors without a login receive no cookie.

So that promoters can see how their event is doing, we count page views and clicks on the ticket link per event and day, plus a rough source category (e.g. 'search engine' or 'Instagram'). Only totals are stored. We set no cookie, store no IP address and create no identifier – individuals can neither be identified nor recognised from this. No personal data is created, so no consent is required.

We work with the following service providers, each under a data processing agreement pursuant to Art. 28 GDPR:

Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA – website hosting. Delivery runs from the Frankfurt region (fra1). EU standard contractual clauses apply to transfers to the USA; Vercel is additionally certified under the EU-U.S. Data Privacy Framework.

Neon Inc. – database. The database cluster is located in the EU (Frankfurt region). EU standard contractual clauses apply to transfers to the USA.

Resend Inc. – sending confirmation and newsletter emails. Email address and message content are processed. EU standard contractual clauses apply to transfers to the USA.

Beyond that we pass Friendslist data to the respective promoter or club – that is the purpose of the sign-up and is described in section 4.

Ticket buttons lead to external providers such as Eventbrite or Resident Advisor, map links to Google Maps. Only when you click there do you leave our site and the respective provider's privacy policy applies. We do not embed these services and transmit no data to them ourselves.

You have the right to information (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future.

Just write to kadir.alik@gmx.de. You can also lodge a complaint with a supervisory authority – ours is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.

This policy describes the current state of processing. We update it when we add features.