1. Controller
The controller responsible for data processing on this website is:
Innergarden UGBurdastraße 2377746 SchutterwaldManaging Director: Vardan GalstyanPhone: +49 177 2363225Email: kontakt@innergarden.community
artmosphere is an event series run by Innergarden UG. We are not required to appoint a data protection officer. For any privacy question, reach us at the email address above.
2. Hosting and server log files
This website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. On every request Vercel processes technically necessary data:
- IP address
- date and time of the request
- page requested and referrer
- browser, operating system and device type
We need this data to deliver the website, find errors and fend off attacks. The legal basis is our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR). Log files are kept only briefly and are not combined with other data. We have a data processing agreement with Vercel.
3. Registering for the event
When you register through the form, we process:
- your name and email address
- where you are travelling from, as you chose it from the suggestions: address, town, postcode, country and the matching coordinates
- the number of people and the parts of the evening you chose
- the form language and the time of registration
- a personal ticket code we generate for you
- at the door: whether you arrived and with how many people
We use this data to handle your registration, allocate places, send your confirmation, let you in on the evening and tell you about changes to the programme. The legal basis is arranging the participation you asked for (Art. 6(1)(b) GDPR).
We also use where you travel from to plan arrival and parking and for statistics on which towns our guests come from. These statistics show only towns and counts, never individuals. We publish them on this website as a map: dots for the towns guests came from, without numbers. For towns with fewer than three registrations, the dot is blurred by a few kilometres. No names, addresses or exact positions are published. The legal basis is our legitimate interest in planning the event (Art. 6(1)(f) GDPR).
We need the fields marked * for your registration. Without them we cannot reserve a place for you. If you register again with the same email address, we replace your earlier details.
Only the organising team can access registration data. At the door, the team sees your name, the number of people and the parts you chose. The data is stored in a database run by Neon Inc. (USA) on servers in Frankfurt am Main (AWS region eu-central-1).
4. Address search
So you do not have to type out where you are travelling from, the form suggests addresses. Our server passes the text you type to the Photon service of komoot GmbH, Potsdam. The request is made by our server, not your browser, so your IP address is not sent to komoot. The address data comes from OpenStreetMap (© OpenStreetMap contributors, ODbL). The legal basis is Art. 6(1)(b) GDPR.
5. Confirmation email
After you register, we send you an email with your name, the number of people, the parts you chose, your ticket link with a QR code and a calendar file. We send no other emails, such as a newsletter. We send it through Resend (Resend, Inc., USA), with whom we have a data processing agreement. The legal basis is Art. 6(1)(b) GDPR.
If your email program loads images, it fetches the logo from our server, the QR code from goQR.me (api.qrserver.com, Foundata GmbH, Karlsruhe) and the typeface from Google Fonts (Google Ireland Limited, Dublin). This sends your IP address to these providers, and for the QR code also your ticket link. If you do not want that, do not load the images in the email. Your ticket link works without the QR code.
6. Images and videos on this website
Photos on this website are delivered directly by Cloudinary Ltd. (Israel), which receives your IP address and technical details about your browser. The EU Commission has issued an adequacy decision for Israel. The legal basis is our legitimate interest in delivering images quickly (Art. 6(1)(f) GDPR).
On the artmosphere Vol 1 page, some portraits load directly from the websites of the artists and photographers concerned, and the preview images of the guest videos load from Vimeo (i.vimeocdn.com). These providers receive your IP address.
Videos from YouTube (Google Ireland Limited, Dublin) and Vimeo (Vimeo.com, Inc., New York, USA) load only when you click play. Until then no data is sent to these providers. Clicking play is an explicit request for the video, and the player is then necessary to show it to you (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). We embed YouTube through youtube-nocookie.com and Vimeo with Do Not Track enabled.
8. Links to other services
The directions link to Google Maps, and the footer links to Instagram and LinkedIn. These are plain links. Data reaches the provider only when you click one, and their privacy terms apply from then on.
9. Photos and video at the event
Photographers and videographers we commission take pictures and film at artmosphere. We publish the results on this website, on our social media channels and in coverage of the event. The legal basis is our legitimate interest in documenting and reporting on the event (Art. 6(1)(f) GDPR together with § 23 KUG).
If you would rather not be photographed, please tell the photographers on the night. If you appear in a published photo and would like it removed, write to artmosphere@innergarden.community and we will take it off this website straight away.
10. Recipients and transfers outside the EU
We do not pass your data on to third parties and do not sell it. It is processed only by the service providers named above, and only as far as each purpose requires.
Some of these providers are based in the USA (Vercel, Neon, Resend, Vimeo). We base transfers there on the adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Commission's standard contractual clauses (Art. 46(2)(c) GDPR).
11. How long we keep data
We delete registration data no later than 24 months after the event concerned. After that we keep only aggregated figures that identify no one, such as how many guests came from which town. Resend keeps confirmation emails only for the limited time the service needs for delivery and troubleshooting. No statutory retention period applies to a free registration.
12. Your rights
You have the right at any time to:
- access the data we hold about you (Art. 15 GDPR)
- have incorrect data corrected (Art. 16 GDPR)
- have your data erased (Art. 17 GDPR)
- restrict processing (Art. 18 GDPR)
- data portability (Art. 20 GDPR)
- withdraw consent you have given, with effect for the future (Art. 7(3) GDPR)
Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). This includes photos in which you appear.
An email to kontakt@innergarden.community is enough. To withdraw your registration, write to us from the address you registered with.
13. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-WürttembergLautenschlagerstraße 20, 70173 Stuttgarthttps://www.baden-wuerttemberg.datenschutz.de
14. Security and automated decisions
All connections to this website are encrypted with TLS. The internal area is password protected. We make no automated decisions and do no profiling.
15. Changes
When the website or the services we use change, we update this policy. The version published here is the one that applies.