Privacy policy
1. Who is responsible
Controller for the platform Eventplanner within the meaning of the GDPR:
Benedikt Ulrich
Hornschuchpromenade 29
90762 Fürth
Germany
Email: be@nedikt.be
Important: When you register for an event, the organizer of that event is the controller for your registration data. We process this data only on the organizer’s behalf and according to their instructions (Art. 28 GDPR). The organizer’s privacy notice is linked at the bottom of every event page (“Privacy” next to the organizer’s name). For questions about your registration, please contact the organizer first; we will forward requests we receive.
2. Visiting the website
When you open a page, our hosting provider automatically processes technical data: IP address, date and time, page requested, referrer, browser and operating system. This is necessary to deliver the website and to keep it secure (Art. 6(1)(f) GDPR – legitimate interest in a stable and secure service). Server logs are deleted by the hosting provider after a short period (usually within 30 days).
We do not use analytics, tracking or advertising cookies, and we do not embed third-party content (fonts are served from our own server; map links only open Google Maps when you click them).
3. Cookies
We only use cookies that are strictly necessary (§ 25(2) no. 2 TDDDG), so no consent banner is needed:
session– keeps organizers signed in to the admin area (7 days).admin_locale– remembers the language chosen in the admin area (1 year).
Attendees who only register for events receive no cookies.
4. Organizer accounts
When an organization signs up, we process the organization name, name and email address of the admins, a password hash, settings and the legal details entered by the organizer, to provide the service (Art. 6(1)(b) GDPR). Payment credentials for Stripe or PayPal are stored encrypted. Failed sign-in attempts are logged with email and IP address for 15 minutes to protect against password guessing (Art. 6(1)(f) GDPR). Account data is kept until the organization deletes its account in the settings.
5. Registration data (on behalf of organizers)
For registrations we store, on behalf of the organizer: name, email, phone number (if requested), answers to the organizer’s questions, chosen date, payment method and status, check-in time and whether you allowed or objected to invitations. Organizers can choose to anonymize this data automatically 6 or 12 months after the event; otherwise it is kept until the organizer deletes it. You can cancel your registration at any time via the link in your confirmation email, which deletes it.
6. Emails
We send transactional emails (registration confirmations, payment and location information, cancellations, account confirmation) and – only if the organizer is allowed to – invitations to events. Every invitation contains an unsubscribe link. Emails are sent via an email provider acting as our processor (see section 11).
7. Payments
If you pay online, you are forwarded to Stripe or PayPal. The payment is made directly to the organizer’s account; Stripe (Stripe Payments Europe Ltd., Ireland) or PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) process your payment data as independent controllers under their own privacy policies. We only receive the payment status. For bank transfer, InstaPay or payment on site, no payment data is processed by us.
8. Registration via WhatsApp
Some events let you register via WhatsApp. In that case, your answers are put into a message in your own WhatsApp app and nothing is stored on our platform. Sending the message is subject to WhatsApp’s privacy policy (WhatsApp Ireland Ltd.).
9. AI assistants (organizers only)
Organizers can connect ChatGPT or Claude to manage their events. Only event details and registration counts are exchanged – no personal data of attendees. The organizer’s use of these assistants is subject to the provider’s terms.
10. Reports of illegal content
If you report content via our reporting form, we process your details and the report to handle it (Art. 6(1)(c) GDPR in conjunction with Art. 16 DSA) and keep them for up to 12 months after the case is closed.
11. Processors and transfers to third countries
- Vercel Inc. – Hosting of the application, content delivery, storage of uploaded images and videos (Vercel Blob). Location: EU (Frankfurt) for storage; global edge network; USA (company seat). Safeguards: EU-U.S. Data Privacy Framework certification and EU Standard Contractual Clauses.
- Prisma Data, Inc. – Database hosting (Prisma Postgres, on AWS). Location: EU (Frankfurt, AWS eu-central-1). Safeguards: data stored in the EU; EU Standard Contractual Clauses for any access from the USA.
- Email provider (SMTP) – Sending of emails (confirmations, notifications, invitations). Location: to be specified. Safeguards: data processing agreement; EU location preferred.
12. Your rights
You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future. Contact: be@nedikt.be.
You also have the right to lodge a complaint with a supervisory authority, e.g. the authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de).
Providing data is neither legally nor contractually required, but without name and email address a registration is not possible.
We do not use automated decision-making or profiling.