Privacy Policy

1. Controller

Controller within the meaning of the EU General Data Protection Regulation (GDPR) and other data protection laws:

Jaroslaw Szymczak
c/o IP-Management #4273
Ludwig-Erhard-Str. 18
20459 Hamburg, Germany

Email: [email protected]

2. How this site works

• No cookies. This site sets no cookies of any kind — which is also why you won't find a cookie banner here.
• No analytics, no tracking. We use no visitor analytics, tracking pixels or fingerprinting.
• No third-party CDNs. Fonts, scripts and styles are self-hosted; your browser talks only to our server.
• No embedded third-party content. Ticket shops and social media are plain links — nothing loads from their servers until you click.

3. Hosting and server log files

When you visit this website, our hosting provider automatically processes the data your browser transmits in server log files: IP address, date and time of the request, requested URL, HTTP status, transferred data volume, referrer URL and user agent (browser/operating system).

This processing is based on Art. 6 (1) (f) GDPR — our legitimate interest in delivering the website securely and reliably, and in detecting and defending against attacks. Log files are not merged with other data sources and are automatically deleted after a short retention period.

4. Newsletter

If you subscribe to our newsletter, we process your email address and — if you choose to provide it — your first name, plus your language preference. We use this data exclusively to send you the newsletter (new dates, lineups, specials).

The legal basis is your consent, Art. 6 (1) (a) GDPR. We use double opt-in: your subscription only becomes active once you confirm it via the link in the confirmation email. You can withdraw your consent at any time via the unsubscribe link in every newsletter, or by emailing us — withdrawal does not affect the lawfulness of processing before the withdrawal.

The newsletter is sent via EmailOctopus, a service of Three Hearts Digital Ltd, United Kingdom, acting as our processor under a data processing agreement pursuant to Art. 28 GDPR. Data is transferred to the United Kingdom on the basis of the European Commission's adequacy decision for the UK (Art. 45 GDPR). Your data is stored until you unsubscribe.

5. Cloudflare Turnstile (newsletter anti-spam)

To protect the newsletter signup forms against automated abuse, we may use Cloudflare Turnstile, a privacy-friendly bot check provided by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, acting as our processor (Art. 28 GDPR). This section only applies while Turnstile is active on the forms. The Turnstile script is loaded from Cloudflare only when you start interacting with a newsletter form — never on page load. Cloudflare then processes technical data such as your IP address and interaction signals to distinguish humans from bots; Turnstile sets no cookies used for advertising or cross-site tracking. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in preventing spam and abuse of the signup form. Any transfer to the USA is based on the EU-US Data Privacy Framework, under which Cloudflare is certified.

6. Event data from undr.zone

Event information shown on this site (dates, lineups, venue details, flyers) is synced from our own event platform undr.zone to this server and delivered from here. No personal data of website visitors is involved in or transmitted through this process.

7. Contact by email or phone

If you contact us by email or phone, we process the data you provide (name, contact details, content of your message) to handle your request. Legal basis: Art. 6 (1) (b) GDPR where your request relates to a contract (e.g. tickets), otherwise Art. 6 (1) (f) GDPR — our legitimate interest in answering you. We delete this data once the request is fully handled and no statutory retention obligations apply.

8. External links

This site links to external platforms — ticket shops (Rausgegangen, Resident Advisor, Joyclub) and social media (Instagram, Telegram). We embed none of their content in your browser. When you follow such a link, the privacy policy of the respective provider applies.

Our homepage shows our latest Instagram posts. These are retrieved by our server from our automation provider Make (make.com, an EU-based service) and cached on our server — including the images, which we re-serve from our own domain. Your browser therefore loads them from us and never connects to Instagram or Meta, and no personal data about you is sent to Make or Instagram for this.

9. Age restriction

Our events are strictly 18+. This website is not directed at minors and we do not knowingly collect personal data from anyone under 18.

10. Your rights

Regarding your personal data, you have the right to:

• access (Art. 15 GDPR) — find out whether and which data we process about you,
• rectification (Art. 16 GDPR) — have inaccurate data corrected,
• erasure (Art. 17 GDPR) — have your data deleted,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) — receive your data in a machine-readable format,
• objection (Art. 21 GDPR) — object to processing based on legitimate interest,
• withdraw consent at any time (Art. 7 (3) GDPR) with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR) — for example the authority of your habitual residence or our registered office (Hamburg Commissioner for Data Protection and Freedom of Information).

To exercise any of these rights, just email us: [email protected]