Privacy Policy

1. Who is responsible?

The controller for data processing on this website and the Artist4Friends platform is:

We have not appointed a data protection officer because the legal requirements for this are not met (Art. 37 GDPR, Section 38 BDSG). For any privacy question, email us at the address above.

Guest data follows its own split of roles: the respective artist is the controller and we work on their behalf. See Section 7.1.

2. Principles

We only process personal data as far as needed to run the platform and provide our services, following data minimization and purpose limitation (Art. 5 GDPR).

• No tracking or advertising cookies
• No third-party analytics and no profiling
• Processing in data centers in the EU – the only exception is payment via Stripe (Section 14)

3. Hosting, server logs and abuse protection Draft – legal review pending

The platform runs on Microsoft Azure (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) in a data center in the EU.

A data processing agreement under Art. 28 GDPR is in place with Microsoft (Microsoft Products and Services Data Protection Addendum).

3.1 Server logs

Each time you open one of our pages, the server automatically records:

• IP address of the requesting device
• Date and time
• Name and address of the requested file
• Referrer (the page you came from)
• Browser and operating system
• HTTP status code and amount of data transferred

Purpose

Stable and secure operation, defense against attacks and abuse, error analysis.

Legal basis

Art. 6(1)(f) GDPR (legitimate interest in secure operation).

Retention

30 days at most, unless we need an entry to investigate a specific security incident.

3.2 Abuse protection

To stop automated attacks (e.g. password guessing at login) and fake sign-ups on Friendslists, we count requests per IP address.

• For this, the IP address is only kept in the server’s memory, not in a database.
• For Friendslist sign-ups we count per IP address and event. The counter expires after 10 minutes at most.
• We also check whether a form was sent unnaturally fast. This uses a timestamp, not data about you.

Legal basis: Art. 6(1)(f) GDPR (protecting the platform, artists and guests).

4. Your artist account Draft – legal review pending

When you sign up as an artist, we store:

• Email address (also your login; confirmed via link)
• Artist name or display name
• Password – only as a cryptographic hash, never in plain text
• Interface language and the language of your emails
• Time of registration
• Optional: profile picture

Depending on your plan and use, also:

• Profile bio – guests see it on your event pages (Premium)
• Logo, colors and your own subject line and text for guest emails (Premium)
• Your events with date, venue, settings and the organizer who gets the list
• Default settings for the newsletter opt-in and export templates
• Plan, billing period and subscription status; when you confirmed the export notice
• With a subscription (Basic or Premium): billing address and VAT details (Section 14)

Purpose

Providing your account, delivering our services, communicating with you about your contract.

Legal basis

Art. 6(1)(b) GDPR (contract).

Retention

Until you delete your account. Statutory retention duties (e.g. for invoices) still apply.

5. Login log Draft – legal review pending

Each time you log in, we store the time, a short device description (e.g. “iPhone · Safari”) and a shortened IP address (IPv4 without the last block, IPv6 only the first 48 bits).

We also store the date of your last login and the number of logins on your account.

Purpose

Protecting your account and support (e.g. if you ask whether someone else logged in).

Legal basis

Art. 6(1)(f) GDPR.

Retention

We delete the individual login entries after 90 days. Last login date and count stay until you delete your account.

6. Story photo Draft – legal review pending

If you upload your own photo for an event’s story image, we store it on our servers so you can reopen the story later.

• Only you can see the photo. It is not published on the event page and not shared with third parties.
• You can delete it any time via “Remove photo”.
• If the event or your account is deleted, we delete the photo within 24 hours.
• If you duplicate an event, we copy the photo to the new event.

The finished story image is created in your browser. What you share is up to you. Legal basis: Art. 6(1)(b) GDPR.

7. Guests: signing up for a Friendslist Draft – legal review pending

Artists create events on Artist4Friends. On the event page you can sign up for the Friendslist as a guest. You don’t need an account for this.

7.1 Who is responsible for what?

• The artist is the controller (Art. 4(7) GDPR) for their guests’ data and decides how it is used.
• We are the processor (Art. 28 GDPR). We only process guest data on the artist’s instructions, based on the data processing terms in our Terms.
• We are the controller ourselves for artist account data, server logs and abuse protection.

7.2 What we process

• Required: name and email address
• Optional: phone number – only for the artist, in case of last-minute changes
• The language you signed up in
• Time of sign-up and your status on the list (e.g. “On the list”, “In the draw”, “Won”)
• For a prize draw: when you clicked the link in the email and the result of the draw
• If you ticked the newsletter box: wording, time and whether it was a condition of entry (Section 9)

7.3 Who gets what?

• The artist sees your name, email address and – if given – your phone number. On Basic or Premium they can export your details as a CSV file.
• The organizer (club, booker or promoter) only gets the names for the guest list – no email addresses, no phone numbers.
• For a prize draw, the organizer only gets the winners’ names. Guests who didn’t win are not passed on.

7.4 Friendslist pass

After signing up you get a personal link to your Friendslist pass. It contains a random ID and only shows the event and your status.

Anyone with the link can open the pass, so please don’t share it.

7.5 Guest emails and language

We send you the emails about your sign-up – e.g. “Your spot is secured”, the link for the draw or the result of the draw. They arrive in the language you signed up in.

7.6 Removing yourself

• Every guest email contains the links “Release your spot” and “Remove this entry” (in case someone signed up with your address).
• As long as the list is not yet with the organizer, or before the draw, we delete your entry right away.
• If the organizer already has the list, please contact the artist or us.

Purpose

Managing your spot on the Friendslist, sending you the related emails, handing the guest list to the organizer.

Legal basis

Art. 6(1)(b) GDPR – contract or pre-contractual steps for the spot on the list that you request.

Retention

Decided by the artist. We delete guest data as soon as you remove yourself or the artist deletes the entry, the event or their account.

Deleted automatically

Prize draw entries without a click on the email link are deleted automatically, no later than 25 hours after the draw.

8. First come, first served and prize draw Draft – legal review pending

For each event, the artist chooses how spots are given out:

• First come, first served: once you hit send, you’re on the list right away. There is no confirmation link for your spot. You get an email saying “Your spot is secured”.
• Prize draw: after you hit send, you get an email with a link. One click and you’re in the draw. The link works until the draw.

At the draw, the system picks the winners at random. You get the result by email.

Only the organizer confirms the list – not you. They get the guest list by email and confirm it with one click (Section 10).

9. Newsletter opt-in Draft – legal review pending

An artist can ask in the form whether you’d like their newsletter. The wording is fixed: emails about the artist’s events, new music and promotions.

9.1 Optional – with one exception

The checkbox is optional. You get your spot just the same without it.

Exception: for some events on the Premium plan, signing up for the newsletter is a condition of entry. The form says so clearly before you sign up (“Entry only with newsletter sign-up”).

9.2 When your consent applies

• First come, first served: your consent applies from the moment you send the form. There is no extra confirmation link.
• Prize draw: your consent applies when you click the link in the email – the same click puts you in the draw.

As proof, we store the wording you saw and the time of your consent.

9.3 The artist is responsible

The artist sends the newsletter themselves, using their own newsletter tool, and is solely responsible for it. We don’t send newsletters for them.

In the export, the artist only gets guests who consented as newsletter contacts. We advise them to have these contacts confirmed via double opt-in in their newsletter tool. You will then get an email with a confirmation link from there.

9.4 Unsubscribing

You can withdraw your consent at any time – via the unsubscribe link in every newsletter email from the artist or by contacting the artist directly. Your spot or entry is not affected.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 7(2) No. 2 UWG).

10. Organizer and status emails Draft – legal review pending

For each event, the artist enters an email address of the club, booker or promoter. We only use this address for the emails about this event.

• The organizer gets: the guest list (names only), a link to confirm it and, if not yet confirmed, a reminder.
• The artist gets: an email when the list is with the organizer, and one when the organizer has confirmed it.

We store when the list was sent and when it was confirmed. We process the organizer’s address – like guest data – on behalf of the artist (Section 7.1).

11. Link preview Draft – legal review pending

Public event pages contain preview data for messengers and social networks: title, date, place and the artist’s profile picture.

When you share an event link, the service (e.g. WhatsApp or Instagram) fetches this data from our server. That service’s privacy policy then applies to the preview.

As an artist you can change or remove your profile picture at any time. Legal basis: Art. 6(1)(b) GDPR.

12. Calendar and directions Draft – legal review pending

• Add to calendar: we create the calendar file (.ics) ourselves on our server. It is saved on your device; no other service is involved.
• Directions: the button opens Google Maps with the venue’s address. Only when you click is data sent to Google, e.g. your IP address and the address searched for.

Google Maps is operated by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. Google’s privacy policy applies. We don’t embed maps in our pages.

13. Email delivery Draft – legal review pending

We use an email service provider (SMTP) with servers in the EU. A data processing agreement under Art. 28 GDPR is in place.

We transfer the email address, name and content of each email. We send:

• Emails about your account (e.g. confirmation, password reset, payments)
• Guest emails (Section 7.5)
• Emails to organizers and status emails (Section 10)
• Replies to support requests

We don’t send marketing newsletters ourselves. The legal basis for these emails is Art. 6(1)(b) GDPR.

Guest emails may contain the artist’s logo, colors and own text (Premium). The logo loads from our server when the email is opened – without tracking parameters. Your IP address briefly ends up in the server log (Section 3.1).

14. Payments via Stripe

We process payments for Basic and Premium via Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland).

We transfer what Stripe needs for the payment:

• Name and email address
• Billing address
• Payment details (e.g. card, SEPA mandate) – you enter them directly with Stripe; they never reach our servers
• Subscription and revenue information

Legal basis: Art. 6(1)(b) GDPR. Stripe may transfer data to Stripe, Inc. in the USA. Stripe is certified under the EU-U.S. Data Privacy Framework.

Standard contractual clauses also apply (Art. 46(2)(c) GDPR). More: stripe.com/privacy.

We keep invoice and accounting data for 10 years due to commercial and tax law (Section 147 AO, Section 257 HGB; Art. 6(1)(c) GDPR).

15. Customer service, billing and free months Draft – legal review pending

For customer service and billing we process contract and usage data of your account:

• Plan, billing period and payment status
• Number and dates of your events and the number of guests – not their names
• Date of your last login and number of logins (Section 5)
• Redeemed promo codes and free months given to you

When we give you free months, we log the date, plan, number of months, a short note and who gave them. We let you know by email.

Only staff with admin rights have access. Legal basis: Art. 6(1)(b) GDPR (contract) and (f) GDPR (good customer service). Retention: until you delete your account.

16. Cookies and local storage Draft – legal review pending

We only use strictly necessary cookies, so no consent banner is needed (Section 25(2) No. 2 of the German TDDDG).

Legal basis: Art. 6(1)(b) or (f) GDPR. There are no tracking, analytics or advertising cookies and no data goes to advertising networks.

17. Retention at a glance Draft – legal review pending

After that, we delete or anonymize the data unless the law requires longer retention.

18. Data security

We protect your data against manipulation, loss and unauthorized access with technical and organizational measures (Art. 32 GDPR), in particular:

• Encrypted transfer (HTTPS, HSTS)
• Passwords only as salted hashes using state-of-the-art algorithms
• Content Security Policy and further security headers
• Protection of all forms against cross-site request forgery
• Request limits against password guessing and spam
• Account lockout after repeated wrong passwords
• Access to production data only for authorized staff, only as far as needed
• Regular security updates and backups

19. Your rights

• Access to your data, including a free copy (Art. 15 GDPR)
• Rectification of wrong or incomplete data (Art. 16 GDPR)
• Erasure, unless a retention duty applies (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a common, machine-readable format (Art. 20 GDPR)
• Objection to processing under Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR)

A simple email to privacy@artist4friends.com is enough. If it concerns guest data of an event, we forward your request to the responsible artist and help them respond.

20. Complaints to a supervisory authority

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

You can also contact the supervisory authority where you live.

21. No automated decisions Draft – legal review pending

There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

The draw in a prize draw is pure chance. It doesn’t assess any personal characteristics and is therefore not a decision within the meaning of Art. 22 GDPR.

22. Minors

Our service is not aimed at children under 16. We do not knowingly collect data from children under 16 without parental consent.

23. Changes to this privacy policy

We update this policy when the law, the platform or our service providers change. The current version is always on this page, with the date at the top.

If there are significant changes for your account, we’ll let you know by email.

↑ Back to top