Privacy Policy

1. Data Controller

The controller responsible for data processing on this website and the Artist4Friends platform is:

BotExplode UG (haftungsbeschränkt)
Kleinstückenweg 7i
15806 Zossen
Germany

Managing Director: Paul Rybka
Email: privacy@artist4friends.com

A data protection officer has not been appointed, as the legal requirements for a mandatory appointment (Art. 37 GDPR, Section 38 BDSG) are not met. For all data protection matters, you can reach us at the email address above.

2. Overview: Processing Principles

We process personal data only to the extent necessary to provide a functional platform and our content and services, following the principles of data minimization and purpose limitation (Art. 5 GDPR). We use no tracking or advertising cookies, no third-party analytics services, and no profiling. All data is processed in data centers within the European Union; the only exception is payment processing via Stripe (see Section 7).

3. Hosting and Server Log Files

Our platform is hosted on Microsoft Azure (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). The servers are located in a data center within the European Union. A data processing agreement pursuant to Art. 28 GDPR is in place with Microsoft (Microsoft Products and Services Data Protection Addendum).

3.1 Server Log Files

Each time you access our website, the following information is automatically recorded in server log files:

• IP address of the requesting device
• Date and time of access
• Name and URL of the retrieved file
• Referrer URL (previously visited page)
• Browser and operating system used
• HTTP status code and amount of data transferred

Purpose: Ensuring a smooth connection, system security and stability (in particular detecting and defending against attacks and abuse), and error analysis.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the platform).
Retention: Log files are deleted after 30 days at the latest, unless they are required to investigate a specific security incident.

3.2 Rate Limiting and Abuse Protection

To protect against automated attacks (e.g., brute-force attacks on login forms, spam sign-ups on public guest lists), we temporarily process IP addresses in memory to limit the number of requests per IP address. The legal basis is Art. 6(1)(f) GDPR.

4. Registration and User Account (Artist Accounts)

When you register as an artist / organizer, we collect and store:

• Email address (also your login name; confirmed via double opt-in)
• Artist name / display name
• Password (stored exclusively as a cryptographic hash, never in plain text)
• Language preference
• Optional: profile picture
• Time of registration and last login

If you subscribe to Pro, additionally: billing address and VAT-relevant information (see Section 7).

Purpose: Providing your user account, performing our contractual services, and communicating about your contract (e.g., confirmation and reminder emails).
Legal basis: Art. 6(1)(b) GDPR (contract performance).
Retention: Until you delete your account; statutory retention obligations (e.g., for invoice data) remain unaffected.

5. Guest Lists, Registrations, and Digital Tickets

5.1 GDPR Roles

Via Artist4Friends, artists and organizers (hereinafter "Artists") can create public registration pages for their events through which guests sign up for the guest list. Under data protection law, the roles are as follows:

• The respective Artist is the controller within the meaning of Art. 4(7) GDPR for the guest data collected via their guest list. The Artist decides on the purpose and scope of the collection.
• We (BotExplode UG) act as processor within the meaning of Art. 28 GDPR and process guest data exclusively on the basis of the data processing agreement that forms part of our Terms of Service, and according to the instructions of the respective Artist.
• For the Artist account data itself (Section 4) and technical access data (Section 3), we are an independent controller.

5.2 Data Collected at Guest Registration

When you sign up for an event as a guest, we process:

• Name (or the details requested by the Artist)
• Email address (for confirmation and ticket delivery, if applicable)
• Number of accompanying persons, if applicable
• Time of registration
• Registration status (e.g., registered, confirmed)

Purpose: Managing the event's guest list, delivering confirmations and digital tickets (incl. QR code), and admission control by the organizer.
Legal basis: Art. 6(1)(b) GDPR (processing your registration at your request) in conjunction with the responsibility of the respective Artist.
Retention: Guest data is deleted when the Artist deletes it, the event is deleted, or the Artist's account is deleted — at the latest 12 months after the event. Unconfirmed registrations are automatically cleaned up earlier.

5.3 Digital Tickets with QR Code

Digital tickets contain a QR code with a random identifier that does not allow third parties to identify you. When the organizer scans the ticket, only the registration status is checked.

6. Email Delivery

To send transactional emails (registration confirmations, sign-up and ticket confirmations, reminders, contract and billing information, replies to support requests), we use an email service provider (SMTP provider) with servers located in the EU, with whom a data processing agreement pursuant to Art. 28 GDPR is in place. The data transferred includes email address, name, and the respective message content.

We do not send marketing newsletters. You will only receive emails that are necessary for the performance of the contract or your registration. The legal basis is Art. 6(1)(b) GDPR.

7. Payment Processing (Stripe)

For processing payments for the Pro subscription, we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland).

The data required for payment processing is transferred to Stripe, in particular:

• Name and email address
• Billing address
• Payment details (e.g., credit card data, SEPA mandate) — these are entered directly with Stripe and never reach our servers
• Subscription and revenue information

Legal basis: Art. 6(1)(b) GDPR (contract performance). Stripe may also transfer data to its parent company Stripe, Inc. in the USA. Stripe is certified under the EU-U.S. Data Privacy Framework; in addition, standard contractual clauses (Art. 46(2)(c) GDPR) are in place. For more information, see Stripe's privacy policy: https://stripe.com/privacy.

Invoice and accounting data is retained for 10 years due to commercial and tax law obligations (Section 147 AO, Section 257 HGB). The legal basis in this respect is Art. 6(1)(c) GDPR.

8. Cookies

We use strictly necessary cookies only. A consent banner is therefore not required (Section 25(2) No. 2 of the German TDDDG). In detail:

Legal basis: Art. 6(1)(f) GDPR and Art. 6(1)(b) GDPR respectively. No tracking, analytics, or advertising cookies are used, and no data is transferred to advertising networks.

9. Retention and Deletion

Personal data is stored only as long as necessary for the respective processing purpose or as required by statutory retention obligations:

• Account data: until you delete your account
• Event and guest data: until deleted by the Artist, at the latest 12 months after the event; unconfirmed guest registrations are removed automatically earlier
• Invoice and accounting data: 10 years (Section 147 AO, Section 257 HGB)
• Server log files: 30 days
• Support requests: until finally resolved, then deleted after 12 months at the latest

After the respective period expires, the data is deleted or anonymized, unless a statutory obligation requires further retention.

10. Data Security

We implement technical and organizational measures (Art. 32 GDPR) to protect your data against manipulation, loss, destruction, and unauthorized access, in particular:

• TLS encryption of all data transfers (HTTPS, HSTS)
• Passwords stored exclusively as salted hashes using state-of-the-art algorithms
• Content Security Policy and further security headers against injection of foreign content
• Protection of all forms against cross-site request forgery
• Rate limiting against brute-force and spam attacks
• Account lockout after repeated failed login attempts
• Access to production data restricted to authorized persons on a need-to-know basis
• Regular security updates and backups

11. Your Rights as a Data Subject

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): information about the data we process, including a free copy
• Rectification (Art. 16 GDPR): correction of inaccurate or completion of incomplete data
• Erasure (Art. 17 GDPR): deletion of your data ("right to be forgotten"), unless retention obligations apply
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR): receiving your data in a structured, commonly used, machine-readable format
• Objection (Art. 21 GDPR): objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation
• Withdrawal of consent (Art. 7(3) GDPR) with effect for the future

To exercise these rights, simply send an informal email to privacy@artist4friends.com. If your request concerns guest data of a specific event, we may forward it to the responsible Artist or support them in responding.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg
Stahnsdorfer Damm 77
14532 Kleinmachnow, Germany
www.lda.brandenburg.de

You may also contact the supervisory authority of your habitual residence.

13. No Automated Decision-Making

Automated decision-making, including profiling within the meaning of Art. 22 GDPR, does not take place.

14. Minors

Our service is not directed at children under the age of 16. We do not knowingly collect personal data from children under 16 without parental consent.

15. Changes to This Privacy Policy

We update this privacy policy when the legal situation, our service, or the service providers we use change. The current version can always be found on this page; the date of the last update is shown above. In the event of significant changes affecting your user relationship, we will inform registered users by email.