Twink DeathPrivacy

This Privacy Policy applies to the website twink-death.de and informs you about the processing of personal data in accordance with the GDPR, the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

This website is delivered via Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare operates a global network of data centres; the site is served from the data centre closest to your location. When you visit the site, Cloudflare, acting as our processor, automatically processes your IP address, browser and device information, the requested address, the time of access and the referrer URL in order to deliver the page and defend against attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and fast operation of the website.

Data may be transferred to the USA in the process. Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023; the standard contractual clauses of the data processing agreement apply in addition.

The texts of our legal pages are loaded server-side from a content management system hosted by Hetzner Online GmbH in Germany.

This website uses technically necessary cookies required for its operation (§ 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR). This includes the cookie of our consent management, which stores your choice.

In addition, we use Google Analytics 4 for audience measurement. The cookies required for this are set only after your explicit consent (§ 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR); without consent, the Google script is not even loaded. You can withdraw your consent at any time with effect for the future via the "Cookie settings" button in the page footer.

We use Google Analytics 4, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Its purpose is audience measurement: we analyse which pages are viewed in order to improve our offering. This involves processing, among other things, a truncated IP address, device and browser information, approximate location and interactions on the website.

The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. Without consent, no script is loaded and no analytics cookie is set; our Google Consent Mode v2 settings default to denied. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework (adequacy decision of 10 July 2023). Analytics data is deleted after 14 months.

You can withdraw your consent at any time via "Cookie settings" in the page footer.

We sell tickets via the on:Tickets platform at tickets.twink-death.de, operated by on:NetworkAgency UG (haftungsbeschränkt), Holstenhofweg 54, 22043 Hamburg, as our processor on servers of Hetzner Online GmbH in Germany. When you purchase a ticket, we process your first and last name, email address, order and payment data and the ticket number. The legal basis is Art. 6(1)(b) GDPR.

When you enter an address in the ticket checkout, on:Tickets may suggest matching addresses. The characters you type are sent to on:Tickets and matched there against its own instance of the open-source software Photon (data source OpenStreetMap) running on servers of on:NetworkAgency in Germany. Your IP address is not passed to the Photon instance, no data is sent to Google or other external map services, and no cookies are set. Search queries are not stored; only the address you confirm is stored. The legal basis is Art. 6(1)(b) GDPR.

The list of dates on this website is loaded server-side; no connection is made from your device to on:Tickets. Only when you open the ticket selection does your browser connect to tickets.twink-death.de and to js.stripe.com.

Further recipients are: Stripe Payments Europe, Ltd., Dublin, for payment processing (Art. 6(1)(b) and Art. 6(1)(f) GDPR for fraud prevention; possible transfer to Stripe, Inc., USA, based on the EU-U.S. Data Privacy Framework); Haufe-Lexware GmbH & Co. KG, Freiburg, for invoicing and accounting (Art. 6(1)(c) GDPR); Microsoft Ireland Operations Limited, Dublin, for sending ticket and reminder emails; Apple Distribution International Ltd., Cork, if you use a wallet ticket; and Functional Software, Inc. (Sentry), USA, for error analysis in the ticketing system.

Our events are explicitly aimed at gay, bi and queer men as well as male-read people; admission is not tied to sexual orientation. However, anyone who buys a personalised ticket in their own name is thereby linked to an event advertised in this way. That link allows conclusions to be drawn about sexual orientation, even where they do not apply in an individual case. Because the mere possibility of such an attribution is sufficient, we treat this data as a special category of personal data within the meaning of Art. 9(1) GDPR.

This concerns the name on the ticket, the email address, the link between ticket and person, and the time of admission.

We process this data solely in order to run the event: ticket delivery, admission control, ticket returns and the admission concept. There is no analysis of attendance behaviour, no profiling and no disclosure to advertising networks.

We use this data solely to issue your ticket in your name and, where necessary, to check your ID against the name on the ticket at the entrance (ID check). We do not pass it on to third parties or process it for any other purpose. The legal basis is Art. 6(1)(b) GDPR.

At the entrance we check tickets by scanning a QR code. This verifies whether the ticket is valid and has not already been used; the time of the scan is stored. There is no facial recognition, no video recording and no behavioural analysis.

Scanning takes place exclusively on devices that we provide and manage ourselves; private devices of staff or helpers are not used for this. So that admission control also works without a network connection, the guest list is cached on the device in encrypted form. The key for this exists only while the application is open and is not stored on the device; a lost device therefore does not disclose the list.

Access to the guest list is limited to people who need it for their task. After the event we delete the admission data within the periods stated below.

For guests, a strict ban on photography, video and audio recording applies at our events. Phone cameras are sealed at the entrance.

We do not photograph in the crowd either. Recordings are made exclusively in specifically designated areas, such as a photo wall where one has been set up, and of the DJ set without the audience in frame. No photographs are taken anywhere else, in particular not in darkrooms, play areas or toilets.

Anyone photographed at a designated photo spot decides so themselves by stepping into it. The legal basis is your consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR. You may withdraw it at any time with effect for the future at [email protected]; we will then remove the image from our own channels. Copies already shared by third parties cannot be recalled.

If you expressly wish, we will inform you by email about upcoming Twink Death dates. You give this consent separately during the ordering process or in person; without it, you will only receive the emails required to process your order.

The legal basis is your consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR. We treat your address as a special category of personal data because it links you to an event explicitly aimed at gay, bi and queer men. We send information about our own Twink Death events only, never third-party advertising.

You can unsubscribe at any time via the unsubscribe link at the end of every email or by writing to [email protected]. No costs arise other than transmission costs at base rates. After you unsubscribe, we add your address to a suppression list so that you receive no further notifications.

Under the GDPR you have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)). Please contact [email protected] to exercise them.

You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Straße 22, 7th floor, 20459 Hamburg, Germany.

Where we process data on the basis of legitimate interests, you may object to that processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). Send your objection informally to [email protected]. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests.

Invoices and accounting records including name, order and payment data: eight years from the end of the calendar year in which the record was created (§ 147(3) AO, § 257(4) HGB).

Business correspondence relating to orders: six years from the end of the year in which it was created (§ 257(1) nos. 2 and 3 HGB, § 147(3) AO).

Admission data, meaning the link between ticket and person and the time of the scan: 90 days after the event. This period covers returns and payment queries. We delete it afterwards; records required for accounting purposes are retained for the period stated above.

Records of email delivery (recipient, subject, delivery status): twelve months. They form part of our audit records and document whether a ticket or reminder email was delivered.

Security records of logins and changes within the ticketing system: 18 months. Records relating to orders, payments and invoices are kept for ten years, as they serve both accounting traceability and the accountability obligation under Art. 5(2) GDPR.

Access logs of the web server running the ticket shop: 14 days. For the delivery of this website via Cloudflare we do not keep log files of our own.

Audience measurement with Google Analytics 4: 14 months. Evidence of consent given: three years after withdrawal or the end of processing, in order to be able to demonstrate it (Art. 7(1) GDPR). Email enquiries unrelated to an order: after completion, at most six months.

Where a statutory retention period applies, we restrict the data concerned for all other purposes and delete it once the period has expired.