Privacy Policy

1. Controller

This English version is a translation for your convenience. Only the German version is legally binding.

The controller for the processing of personal data on bleane.events is:

bleane GmbH Wandersmannstr. 64 65205 Wiesbaden Germany

For questions about data protection, reach us at hello@bleane.com.

2. Overview

This Privacy Policy explains which personal data we process when you visit bleane.events, apply for membership, sign in and buy tickets.

We don’t use any third-party analytics or advertising trackers and don’t make automated decisions that have legal effects on you. People decide on applications.

3. Visiting the website

When you open the website, we process technically necessary connection data: IP address, time and target of the request, browser and device information and, where applicable, the previously visited page. This serves to deliver the website, analyze errors and protect against misuse.

To prevent misuse of the application and sign-in forms, we count attempts per IP address and email address. For this, we only store an irreversible hash and delete it after 24 hours at the latest.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in operating the website securely and reliably.

4. Application

When you apply, we process your first and last name, your email address, your Instagram handle, how you heard about us, and your reason for applying. To decide on the application, we also look at your public Instagram profile. If you apply through a member’s invite link, we store who invited you; the member sees your name and whether you were admitted, but not whether we rejected you.

The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary to decide on your membership.

5. Membership and signing in

For your membership, we process your name, your email address and information about your active sessions. To sign in, we send you a single-use link by email.

The legal basis is Art. 6(1)(b) GDPR.

We also store how you use the website as a member, such as when you are active and which events you look at. This helps us develop the community and our events. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in improving what we offer. We delete this data when your membership ends.

6. Tickets and payments

When you buy a ticket, we store which event you hold a ticket for and list you on the guest list with your name and email address at the time of purchase. When we scan the QR code of your bleane card at the door, we record there when you checked in. Payments are processed by Stripe Payments Europe, Ltd., Ireland. Stripe processes your payment data, such as card details, and may also use it under its own responsibility to prevent fraud. We only receive the information we need to match the payment.

The legal basis is Art. 6(1)(b) GDPR. We keep invoices and payment records for up to ten years due to commercial and tax law obligations (Art. 6(1)(c) GDPR).

7. Emails

We send you emails that are necessary for the membership, such as sign-in links, the confirmation of your membership, ticket confirmations and cancellations. The legal basis is Art. 6(1)(b) GDPR. We use the service Resend to send them.

8. Cookies

We only use technically necessary cookies for your sign-in session and to protect against misuse. The legal basis is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(b) or (f) GDPR. No consent is required for this.

9. Service providers and recipients

To run the website, we use the following service providers, with whom we have concluded data processing agreements under Art. 28 GDPR:

• Vercel Inc., USA: website hosting
• Neon Inc., USA: database
• Resend, USA: sending emails
• Stripe Payments Europe, Ltd., Ireland: payment processing

10. Transfers to third countries

Some of our service providers are based in the USA or rely on global infrastructure. Transfers to third countries take place on the basis of an adequacy decision of the EU Commission, such as the EU-U.S. Data Privacy Framework, or on the basis of EU Standard Contractual Clauses.

11. Retention

We only store personal data for as long as necessary for the respective purpose. We delete applications we don’t accept after six months at the latest. We delete member data when your membership ends (you can end it yourself under “Profile”) or when you ask us to. Your past ticket purchases are an exception: name, email address and event remain stored on the guest lists of past events so that we can trace events and payments (Art. 6(1)(c) and (f) GDPR). Statutory retention obligations remain unaffected.

12. Your rights

Subject to the statutory requirements, you have the following rights:

• Access to the data stored about you (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation (Art. 21 GDPR)

13. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Postfach 31 63, 65021 Wiesbaden, Germany, datenschutz.hessen.de.

14. Changes

We update this Privacy Policy when the website or the law changes. The version published here applies.