Privacy Policy

Last updated: 13 August 2026

This Privacy Policy explains how Evestival collects, uses, and protects your personal data when you visit evestival.com or use our Android app (together the "Service"). It is written in accordance with the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the German Federal Data Protection Act (BDSG).

1. Data Controller

The data controller responsible for this Service is:

Luis Prieto
Alte Ziegelei 19, 67346 Speyer, Germany
E-mail: [email protected]

Full legal notice: Impressum

2. Categories of data we collect

We collect only data that is necessary for the specific purpose stated. The categories are:

• Identity & contact data — name, e-mail address (account registration, contact form, newsletter).
• Authentication credentials — hashed password, JSON Web Token (JWT) stored in your browser's localStorage, e-mail verification tokens.
• Event / user content — event title, description, dates, venue, address, category, image, official website URL, YouTube URL, image credit. Submitted by registered users.
• Interaction data — which events you saved, which you marked as attending, ratings (1–5 stars), and public comments you post.
• Approximate location — GPS coordinates you voluntarily share when using the "Near Me" feature. These are transmitted in the encrypted request body only and are not stored.
• Communication data — messages submitted via the contact form (name, e-mail, subject, message text).
• Newsletter subscription — e-mail address only.
• Technical log data — partially anonymised IP address (last octet masked), request path, HTTP status code, timestamp. Recorded by our server for security and debugging.
• Analytics data (website) — page URL, full referrer URL, anonymised IP address (last two octets masked), browser type and version, operating system, device type, screen resolution, visit duration, and campaign parameters (UTM tags) where present. Collected by self-hosted Matomo, which is cookieless by default (no cross-site tracking); first-party analytics cookies are set only if you accept them, to recognise returning visits (see §4.9 and our Cookie Policy). Visitors with the browser Do Not Track (DNT) setting enabled are excluded entirely.
• Analytics data (Android app) — screen paths visited, feature interaction events (search, "Near me", category browsing), app session count, app install referrer (UTM campaign tags from the web install button you tapped, if any), and a pseudonymous user identifier for logged-in users. Collected by the Matomo Mobile SDK and sent to the same self-hosted Matomo instance in Germany. No advertising identifier (GAID/IDFA) is collected. You can opt out at any time in the app's Profile → Privacy settings (see §4.13).
• Advertising identifiers — if you accept cookies, Google AdSense may set advertising cookies and collect data as described in section 5.
• Push notification token — if you grant notification permission in the Android app, a Firebase Cloud Messaging (FCM) device token is stored to send event reminders. You can revoke permission at any time in your device settings.

3. Legal bases

We rely on the following legal bases under Article 6 GDPR:

4. How we use your data

4.1 Account & authentication

We store your name, e-mail, and a bcrypt-hashed password to create and maintain your account. We issue a JWT for browser-side authentication (stored in localStorage, never in a cookie). E-mail address verification tokens are single-use and expire after 7 days.

4.2 Event submissions

When you submit an event, we store the event data you provide. Your name and e-mail are associated with the submission for moderation purposes only. Approved events are published publicly. Rejected events are deleted within 14 days. The address you provide is geocoded (converted to latitude/longitude by OpenStreetMap Nominatim, an EU-based open-source service) to enable map display and "Near Me" search.

4.3 Saved events, attendance & ratings

We store which events you save, mark as attending, and rate in order to personalise your experience and provide aggregate statistics to other users (e.g., attendance count). Individual ratings are linked to your account but shown anonymously to others.

4.4 Comments

Comments you post are stored publicly under your display name. You may request deletion at any time via the contact form or account settings.

4.5 Location / "Near Me" search

If you use the "Near Me" feature, your browser requests your GPS coordinates and transmits them over HTTPS in the encrypted request body of a POST request. Coordinates are used only to calculate nearby events and are not stored in our database or access logs.

4.6 Contact form

Messages submitted via the contact form are stored in our database to allow us to reply. We retain them for 90 days after the matter is resolved, then delete them. Your e-mail address is used only to respond to your enquiry.

4.7 Newsletter

If you subscribe to our newsletter, we store your e-mail address and the date of subscription. You may unsubscribe at any time by clicking the link in any newsletter e-mail or by contacting us. Consent is documented and stored.

E-mail engagement measurement. Our newsletter and weekly-digest e-mails include open- and click-measurement via our own self-hosted Matomo instance (§4.9): a 1×1 tracking pixel records opens, and links are routed through a redirect that records clicks, so we can tell whether these e-mails are useful and improve them. Before any data reaches Matomo, your e-mail address is replaced by a pseudonymous identifier (a one-way hash) — your address itself is never sent to Matomo — no cookies are set, and the data stays on our own server in Germany. You can prevent open tracking by disabling image loading in your e-mail client, and stop all of it by unsubscribing. This applies only to e-mails you have opted into. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in improving communications you have opted into.

4.8 Server security logs

Our web server (Caddy) and API log request metadata — anonymised IP (last octet replaced with .0), request path, HTTP method and status code, timestamp. GPS coordinates are not logged. Logs are deleted automatically after 14 days. Legal basis: Art. 6(1)(f) — legitimate interest in detecting and defending against attacks.

4.9 Analytics (Matomo — cookieless by default; cookies only with consent)

We use a self-hosted instance of Matomo running on our own server in Germany (Contabo GmbH). All analytics data is processed solely on our own server and is never shared with third parties. The following data is recorded per page view:

• Page URL visited and full referrer URL
• IP address with the last two octets masked (e.g. 192.168.x.x) — the original IP is never stored
• Browser type and major version, operating system, device type (desktop / tablet / phone)
• Screen resolution and approximate visit duration
• On-site interactions (e.g. which search and filter features are used)
• Campaign parameters (UTM tags) if present in the URL you followed

Cookieless by default. Unless you accept cookies, Matomo writes no cookies and no persistent identifier to your device and your IP is anonymised before storage. In this mode the processing does not require consent under Art. 5(3) ePrivacy Directive; legal basis: Art. 6(1)(f) GDPR — legitimate interest in understanding how the Service is used. Because no identifier is stored, returning visits cannot be linked, so each visit is counted as new.

If you accept cookies, Matomo sets first-party cookies (_pk_id, _pk_ses, _pk_ref, and a mtm_cookie_consent consent record) so that we can recognise returning visitors and measure retention. These cookies hold only a random identifier — never your name or email — and are detailed in our Cookie Policy. Legal basis for these cookies: your consent under Art. 5(3) ePrivacy Directive and Art. 6(1)(a) GDPR, which you may withdraw at any time by clearing your consent (the analytics cookies are then deleted and Matomo reverts to cookieless mode).

Opt-out: Visitors who have enabled the Do Not Track (DNT) browser setting are excluded from all Matomo tracking automatically — in both modes. To enable DNT, see your browser's privacy settings. Raw visit data is retained for 180 days; aggregated statistics are kept indefinitely.

4.10 Advertising (Google AdSense)

With your consent (cookie banner), we display ads via Google AdSense. Google may set advertising cookies and collect data about your browsing behaviour to show personalised ads. See Google's Privacy Policy and Ad Settings. If you decline cookies, no AdSense script is loaded. Legal basis: Art. 6(1)(a) — consent.

4.11 Push notifications (Android app)

If you grant notification permission in the Android app, we store a Firebase Cloud Messaging (FCM) device token linked to your account. We use this token solely to send event reminders and alerts you have opted into. You can revoke permission in your device settings at any time; we will delete the token within 7 days.

4.12 Fonts (Bunny Fonts CDN)

We load web fonts from Bunny Fonts (fonts.bunny.net), a GDPR-compliant EU-based CDN operated by Bunny.net in the Netherlands. Bunny Fonts does not log IP addresses for font requests. No data is shared with Google for font delivery.

4.13 In-app analytics (Matomo Mobile SDK — opt-out available)

The Android app includes the Matomo Mobile SDK, which sends usage data to the same self-hosted Matomo instance on our server in Germany that powers the website analytics (§4.9). No data leaves our own infrastructure for analytics purposes.

The following data is recorded:

• Screen paths visited within the app (e.g. /event/123)
• Feature interaction events: keyword searches, "Near me" activations, category browsing
• App session start (foreground resume events)
• First app open, including the install referrer — the UTM campaign tag of the web install button you tapped, if any (provided by the Google Play Install Referrer API)
• Anonymised IP address (last two octets masked before storage)
• A pseudonymous numeric user ID for logged-in accounts, used only to stitch together a single user's journey across web and app within our own Matomo instance

The following data is not collected: advertising identifiers (GAID), precise GPS location (location is used only for the "Near Me" search as described in §4.5 and is not sent to Matomo), contacts, photos, or payment data.

Opt-out: You can disable all in-app analytics at any time via Profile → Privacy → Share anonymous usage data. Toggling this off stops all further event transmission immediately. Legal basis: Art. 6(1)(f) GDPR — legitimate interest in understanding how app features are used, balanced against your right to opt out at any time. Raw visit data is retained for 180 days; aggregated statistics are kept indefinitely (same as §4.9).

4.14 Accommodation search (Stay22 — loads only on click)

On event pages we offer a "Where to stay" feature that shows an interactive map of nearby hotels and rentals, provided by Stay22 Inc. (Canada). It aggregates accommodation listings from booking platforms (e.g. Booking.com, Expedia) around the event's location. If you book through it, we may earn an affiliate commission — at no extra cost to you. This is clearly labelled as an advertising/affiliate link next to the feature.

Nothing is loaded or sent to Stay22 unless you actively open the feature. The map is not loaded when the page opens. Only when you click "Find hotels near this event" is the Stay22 map embedded — at which point your browser connects to Stay22, sending your IP address, browser and device information, and the event's location and dates (so it can show relevant accommodation). Stay22 may then set its own third-party cookies to operate the map and attribute any resulting booking. Before you click, no request is made and no data is transmitted to Stay22.

Legal basis: your consent, given by the deliberate, informed action of opening the feature (Art. 6(1)(a) GDPR; Art. 5(3) ePrivacy Directive) — the affiliate disclosure is shown before you click. Stay22 acts as an independent controller for the data it receives once the map is opened; its handling of that data is governed by Stay22's Privacy Policy. If you do not open the feature, none of the above applies.

5. Third-party processors & recipients

We do not sell, rent, or share your personal data with any other party for marketing purposes.

6. International data transfers

Most data is processed within the EU/EEA (Germany, Netherlands, Ireland). Data transferred to the United States (Google AdSense, Firebase) is protected by Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR and the respective Data Processing Agreements with Google LLC / Google Ireland Limited. Data transmitted to Stay22 Inc. in Canada — only if you open the "where to stay" feature (§4.14) — is covered by the European Commission's adequacy decision for Canada (Art. 45 GDPR), which recognises Canadian commercial data-protection law (PIPEDA) as providing an adequate level of protection. Copies of these safeguards are available on request.

7. Retention periods

8. Your rights

As a data subject under GDPR, you have the following rights. To exercise any of them, please contact us at [email protected]. We will respond within one month (Art. 12(3) GDPR).

• Right of access (Art. 15) — obtain a copy of the personal data we hold about you.
• Right to rectification (Art. 16) — correct inaccurate or incomplete data.
• Right to erasure / "right to be forgotten" (Art. 17) — request deletion of your data where no overriding legitimate ground exists. You can delete your account from your profile settings.
• Right to restriction of processing (Art. 18) — ask us to restrict processing while a dispute is resolved.
• Right to data portability (Art. 20) — receive your data in a structured, machine-readable format.
• Right to object (Art. 21) — object to processing based on legitimate interest. We will stop unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent (Art. 7(3)) — withdraw consent for newsletter or advertising cookies at any time without affecting prior lawful processing.
• Right to lodge a complaint (Art. 77) — complain to the supervisory authority in your EU member state, or in Germany to:
  LfDI Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz — www.datenschutz.rlp.de

9. Children under 16

Our Service is intended for users who are at least 16 years of age. We do not knowingly collect personal data from anyone under 16. The minimum age of 16 applies to account creation in accordance with Art. 8(1) GDPR as implemented in German law (§ 7 TTDSG). Registration requires users to actively confirm they are at least 16.

If you believe a user under 16 has created an account, please contact us immediately at [email protected]. We will delete such accounts and all associated data without delay.

10. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, or unauthorised disclosure. Measures include:

• All data transmitted via HTTPS/TLS 1.2+ (enforced by Cloudflare and Caddy).
• Passwords stored as bcrypt hashes (never in plain text).
• JWT authentication — no session cookies, reducing CSRF risk.
• Server located in Germany (Contabo GmbH) with disk-level and network-level access controls.
• GPS coordinates transmitted only in encrypted POST request bodies, never in URLs or logs.
• Rate limiting and bot-detection on all authentication and submission endpoints.

No method of internet transmission is 100% secure. In the event of a data breach affecting your rights and freedoms, we will notify the competent supervisory authority within 72 hours (Art. 33 GDPR) and affected users without undue delay (Art. 34 GDPR).

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be announced on the website and, for registered users, by e-mail at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this page periodically.

12. Contact & complaints

For any questions or to exercise your data rights, please contact:

Luis Prieto
Alte Ziegelei 19, 67346 Speyer, Germany
E-mail: [email protected]

If you are not satisfied with our response, you have the right to lodge a complaint with the supervisory authority:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz (LfDI RLP)
Hintere Bleiche 34, 55116 Mainz
www.datenschutz.rlp.de