Privacy Policy

The controller for the processing of personal data on heldby.me within the meaning of the General Data Protection Regulation (GDPR) is Christian Feuerbacher und Peter Juras GbR, Mainzer Str. 18, 80804 München, Germany, email: info@heldby.me ("heldby.me", "we").

We have not appointed a data protection officer, as we are not required to. For questions about data protection, you can reach us at the email address above or through our contact form.

heldby.me is a platform on which hosts offer events and participants book them. We are responsible for operating the platform, the hosts' accounts and the booking and payment infrastructure.

A participant's contracting party for the event is the respective host. The host receives the data needed to hold their event (section 6) and is themselves responsible for its further use. Emails that a host writes to their participants through heldby.me are sent by us on the host's behalf; the host is responsible for their content.

Payments are processed through the host's account with the payment service provider Stripe. Stripe processes the payment data as an independent controller (section 9).

When you open heldby.me, our servers process technically necessary data: your IP address, the date and time of access, the address requested, the amount of data transferred, your browser and operating system, and the page you came from. We need this data to deliver the website, keep it secure and fix faults.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a secure and working service. Server logs are deleted after 30 days.

We do not use any analytics, tracking or advertising tools and do not embed social media plugins. Fonts are loaded from our own servers.

The website, the database and our email delivery run at Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, in data centres in Frankfurt am Main. To deliver pages quickly we use the content delivery network Amazon CloudFront, whose servers may also be located outside the EU.

We have a data processing agreement with AWS under Art. 28 GDPR. Where data is transferred to Amazon Web Services, Inc. in the USA, this is based on the EU-US Data Privacy Framework, under which the company is certified, and additionally on the European Commission's standard contractual clauses.

We only use cookies and entries in your browser's storage that are strictly necessary for the features you use (§ 25(2) no. 2 TDDDG). No consent is required for this, which is why we do not show a cookie banner.

Signing in as a host: a session cookie for as long as you are signed in. Signing in as a participant: the cookie "student_session" for 24 hours after you sign in with an email code. Language: the cookie "heldbyme_locale" remembers the language you chose. Mission Control: a cookie for the internal operations view, for the operators only.

Stored in your browser: after a booking, your browser remembers which events you booked ("heldbyme_bookings"), your name and email address to prefill your next booking ("heldbyme_student") and which hosts you follow. This data does not leave your device and can be deleted at any time in your browser settings.

For a booking we process your name, your email address, the event booked, the price, any discount code redeemed, the payment method chosen, the payment status, the language you booked in and your choices about the right of withdrawal. We confirm the booking by email and show it on your booking page.

The host receives your name, your email address, the booking and payment status and the amount paid. They can record your attendance and send you event-related messages. They have no access to your bookings with other hosts.

The legal basis is Art. 6(1)(b) GDPR (performance of the user agreement with us and of the event contract with the host). We keep booking and payment data for as long as commercial and tax retention obligations require, usually up to eight years (Art. 6(1)(c) GDPR).

If you share an event through your personal link, or book through a link in an email from the host, we store which link the booking came from. From this the host can see which participants brought someone along and which emails led to bookings. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is that the host can understand how participants find them.

Around a booked event you receive emails that the booking requires: the confirmation, changes, cancellations and refunds and, if the host set them up, a preparation email before and a follow-up email after the event. The follow-up email contains only information about that event.

The legal basis is Art. 6(1)(b) GDPR. We send the emails through Amazon Web Services (section 4).

You can follow a host, when booking or on their page. With your consent, the host sends you invitations to new events and, where applicable, discounts by email through heldby.me. Only people who have consented receive such invitations.

Consent you give on a page is confirmed through a link we send you by email (double opt-in). As proof we store the wording you agreed to, the time, the language, your IP address and browser identifier.

The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG); we store the proof under Art. 6(1)(c) and (f) GDPR. You can withdraw your consent at any time with effect for the future, through the unsubscribe link in every invitation or by sending us a message. After withdrawal you receive no further invitations; you will still receive information about a booking.

Paid bookings are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland, through the host's Stripe account. On the payment page your browser loads program code from Stripe; you enter your card, bank or wallet details directly with Stripe, and we do not see them. Stripe also collects device and usage data to prevent fraud.

We only receive from Stripe what the booking requires: whether and how much was paid, the payment method, fees and refunds. The legal basis is Art. 6(1)(b) and (c) GDPR. Stripe is itself responsible for the payment data; Stripe may transfer data to Stripe, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. You can find details in Stripe's privacy policy at stripe.com/privacy.

To receive payments, hosts conclude their own contract with Stripe. In doing so, Stripe checks among other things the host's identity and bank details.

For a host account we process your name, email address, password (only as a secure hash), the address of your page, time zone, language, your status as a trader or private individual, as a trader your name and address, your profile (photo, text, design), your events and emails and the connection to your Stripe account. We store which version of the terms you accepted and when (with IP address and browser identifier as proof), terminations and withdrawals, and fee agreements.

The legal basis is Art. 6(1)(b) GDPR, and for records Art. 6(1)(c) and (f) GDPR. After the contract ends we delete the data unless we need it for retention obligations, open bookings, refunds or legal claims.

We store your profile photo with UploadThing (Ping Labs, Inc., USA) as a processor; the transfer to the USA is based on the European Commission's standard contractual clauses. The name, photo, text and events on your page are public.

If a host chose a place from Google Maps for their event, the event page shows a map section that your browser loads from Google. Google receives your IP address and technical details about your browser. If a host searches for a place when creating an event, the search terms go to Google.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest is showing the place of an event clearly. Google may transfer data to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

With the buttons below your booking you can add it to your calendar or save your ticket in Google Wallet. Only when you choose Google Wallet do we send the ticket details (event, time, place, host and your name) to Google. The legal basis is Art. 6(1)(b) GDPR.

If you write to a host through their contact form, we pass your name, your email address and your message on to them. If you write to us or report content, we process the same details to handle your request.

Emails to our addresses at heldby.me are received by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as a processor and forwarded to our mailboxes. The transfer to the USA is based on the EU-US Data Privacy Framework, under which the company is certified, and additionally on the European Commission's standard contractual clauses.

To protect against abuse we count requests and payment attempts per sender. For this we store only an irreversible hash of the IP address and delete it once it is no longer needed.

The legal basis is Art. 6(1)(b) and (f) GDPR; the legitimate interest is answering requests and protecting the platform from abuse.

Your data is received only by the parties named in this policy: the host of your booking, Stripe and our processors Amazon Web Services, Cloudflare, UploadThing and Google. Beyond that, we only pass data on where we are legally obliged to.

We do not make decisions based solely on automated processing and do not create profiles. Reports about content are reviewed by people.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: where we process data on the basis of Art. 6(1)(f) GDPR, you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal message to info@heldby.me is enough for any of this. You also have the right to lodge a complaint with a data protection supervisory authority, for example the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany.

If the way heldby.me processes data changes, we update this policy. The version published here applies.