Privacy Policy

1. Controller

The person named above is the controller responsible for data processing.

2. General information on data processing

We process personal data only insofar as this is necessary for operating Noktürn, providing the platform functions, performing contracts, complying with legal obligations or safeguarding legitimate interests. Where consent is required, processing is based on Art. 6(1)(a) GDPR and — for access to information on the end device — § 25(1) TDDDG.

The specific legal bases and retention periods are stated below for each processing operation.

3. Hosting, delivery and database

The web platform is operated with Lovable. According to the available documentation, technical delivery takes place via Cloudflare Workers; database, login, file storage and backups are provided via Lovable Cloud / Supabase. In particular, IP addresses, page views, account, order, file and log data may be processed.

The legal basis is Art. 6(1)(b) GDPR insofar as processing is necessary to provide contractual platform functions, and Art. 6(1)(f) GDPR for secure, stable and efficient operation.

Lovable, Cloudflare and Supabase are contractually engaged in line with their data protection role. Where data is transferred to third countries, this only happens if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision or appropriate safeguards.

4. Server and security logs

When the platform is accessed and used, technically necessary log data is processed. This may include IP address, time, area accessed, login success or failure and security events. The processing serves IT security, abuse prevention and traceability. The legal basis is Art. 6(1)(f) GDPR.

According to the available documentation, login and security events are generally stored for 24 months and then deleted automatically, unless longer storage is required for legal defence or by legal obligations.

5. Cookies and local storage

The website uses technically required first-party cookies. The scan of 1 October 2026 found in particular __cf_bm and __dpl. LocalStorage is also used; the local setting nokturn:typography-size-v2 was found.

Strictly necessary access to the end device is based on § 25(2) TDDDG. Where access is not strictly necessary, it only takes place after consent under § 25(1) TDDDG; the subsequent processing of personal data is governed by Art. 6 GDPR.

6. Registration, login and user account

For registration and login we process in particular the email address, the password (only as a hash), registration time, login/logout times, login method, success or failure, IP address, session token and — where two-factor authentication is enabled — TOTP secret, backup codes and trusted devices.

The legal basis is Art. 6(1)(b) GDPR for using the account and Art. 6(1)(f) GDPR for IT security and abuse prevention. The session token is technically necessary within the meaning of § 25(2) TDDDG. The account remains until deleted by the data subject; security events are generally kept for 24 months.

7. Own submissions and moderation

For your own event or other submissions we process event data, venue and geo-coordinates, contact and identity details, verification status and internal moderation decisions with time, reason and acting identifier.

The legal basis is Art. 6(1)(b) GDPR for the listing relationship, Art. 6(1)(f) GDPR for verification, quality assurance and spam and fraud prevention, and Art. 6(1)(c) GDPR where statutory retention obligations apply. Data is processed until deletion/removal; past events are archived or deleted.

8. Ticket purchases, orders and receipts

For ticket purchases we process in particular the order number, event, ticket category, quantity, price, brokerage fee, currency, status, time, email and billing details, receipt language, ticket identifier with QR token and redemption status, and transaction and session identifiers of the payment provider. According to the available documentation, full card or bank details are not stored at Noktürn.

The legal basis is Art. 6(1)(b) GDPR for brokerage and delivery, Art. 6(1)(c) GDPR for statutory retention obligations and Art. 6(1)(f) GDPR for fraud prevention and protection against double sales. Order, invoice and payment records are generally kept for 10 years.

9. Payment processing with Stripe

Stripe Payments Europe Ltd., Ireland, is used for ticket payments and payouts. Payment data is generally processed by Stripe. Noktürn receives the transaction and status information needed for processing, allocation and proof.

Processing takes place to perform the contract under Art. 6(1)(b) GDPR and, where necessary, to comply with legal obligations under Art. 6(1)(c) GDPR. Stripe processes certain data as an independent controller.

10. Transactional emails and contact

Lovable Email is used for confirmation, receipt, login and other transactional emails. Recipient address, language, occasion, time and delivery and error status are processed. The legal basis is Art. 6(1)(b) GDPR and, for deliverability and security checks, Art. 6(1)(f) GDPR.

Weekly listings email by town and mood: Anyone who orders the weekly listings email provides an email address and chooses a town and one or more of the eleven equal moods; we also store the chosen language. The subscription only starts once the link in our confirmation email has been clicked (double opt-in). As proof of consent we store the time of sign-up and of confirmation, the wording and version number of the consent text, and the IP address at confirmation. The legal basis is your consent under Art. 6(1)(a) GDPR, which is also the express consent required by § 7(2) no. 2 of the German Unfair Competition Act (UWG). We keep the proof under Art. 6(1)(c) in conjunction with Art. 7(1) GDPR. The email contains only listed dates for the chosen town and moods; paid visibility in it is labelled “Werbung / advertising”. We use no tracking pixels, no open or click measurement and no personal analysis of reading behaviour. Emails are sent through Mailjet (Mailjet SAS, Paris, France; part of the Sinch group, Sweden), acting as our processor under Art. 28 GDPR on the basis of its data processing agreement (version 8, 29 Oct 2025). Open and click tracking are switched off for the whole account and for every single email. For delivery itself and to fight spam and abuse, Sinch states that it acts as an independent controller. Processing by sub-processors outside the EU, in particular in the US, is possible; it is safeguarded by EU Standard Contractual Clauses (Module 2) or the EU-US Data Privacy Framework. Every email contains an unsubscribe link; consent can be withdrawn at any time with effect for the future, also informally at info@noktuern.info. Unconfirmed sign-ups are deleted after 7 days. After unsubscribing we delete the address, town, mood and language within 30 days; the consent and unsubscribe evidence is kept for 3 years from the end of the year of unsubscribing (limitation period, § 195 German Civil Code), separately and solely to defend against claims. Nothing is passed to third parties.

A GMX mailbox of 1&1 Mail & Media GmbH is used for administrative correspondence. Communication data is stored for as long as necessary for handling, contract performance or statutory retention obligations.

11. Map and location functions

The following services are used for maps, place search and nearby functions. When a map is shown or a place is looked up, your browser or our server calls these services directly; your IP address, technical browser details and the requested map area or place name are transmitted. No account, name or email address is transmitted.

(1) Map tiles from OpenStreetMap (tile.openstreetmap.org): OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. An EU Commission adequacy decision exists for the UK (Art. 45 GDPR). Tiles are delivered via the content delivery network of Fastly, Inc. (USA), which is certified under the EU-US Data Privacy Framework (adequacy decision of 10 July 2023, Art. 45 GDPR).

(2) Dark-style world map (basemaps.cartocdn.com): CARTO (CartoDB Inc., USA, and CartoDB S.L., Spain). A transfer to the USA may take place; it is based on the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

(3) Place search (Nominatim, nominatim.openstreetmap.org): OpenStreetMap Foundation, United Kingdom (see above). Place lookups mostly run through our server, so your IP address does not reach Nominatim.

(4) Nearby search (Overpass): Overpass servers of FOSSGIS e. V. (overpass-api.de, Germany) and kumi.systems (Germany). No third-country transfer takes place.

The legal basis is Art. 6(1)(b) GDPR where you request the function, otherwise Art. 6(1)(f) GDPR (legitimate interest in a working map display). According to their own information, these services keep IP addresses only briefly in server logs. You may use the map functions or not; event lists work without a map.

12. Public event and place data

Public event data may be obtained for the Radar via the Ticketmaster Discovery API. Public place data from Wikidata/Wikimedia may be used for population figures or price classes. According to the available documentation, no additional personal user data is transmitted to these services.

Venue accessibility details: organisers can state features such as step-free entry, accessible toilet, seating, quiet room, hearing loop or sign language on request for their event. These describe the place, not people; only the entrant's account identifier and the time of change are processed (Art. 6(1)(f) GDPR). Visitors give no information about their own health or disability; no health data under Art. 9 GDPR is processed. Noktürn does not check these details on site. Retention: for as long as the event is listed.

Lost & found notices: organisers and venues can publish found items as a notice with item description, venue and event date. Names, contact details, ID or card numbers, contents of wallets or phones, and photos are not allowed; every notice is checked by a person before publication. Only the posting account's identifier and the time are processed (Art. 6(1)(f) GDPR; legitimate interest in returning lost property and preventing abuse). Seekers contact the venue directly; Noktürn relays no messages, keeps no found items and checks no proof of ownership. A notice expires automatically 30 days after publication, or earlier when marked returned; the review log is kept 90 days. Duties under §§ 965 ff. German Civil Code remain with the venue.

Year review "Where the scene went" and press & radio pack: the year review shows only per-town totals from published listings (dates, venues, split across the eleven moods); no visitor, account, ticket or location data is used and no profiles are created. A venue may object to being named at any time (info@noktuern.info). The press pack contains only details about Noktürn and its owner; Noktürn keeps no press mailing list and sends nothing. Anyone asking for no further contact is noted with the address alone on a block list (Art. 6(1)(f) GDPR) for as long as the request stands.

Community boards and Scene Curators: (1) Gig-Pooling (/pooling) and the Independent Gig Exchange (/gig-exchange) are free notice boards. We process the posting account's identifier, the post details (event or town, mood, rough departure area or date window, optional notes) and messages that Noktürn's message box relays to the person who posted. Contact details are never shown publicly; phone numbers and email addresses are not allowed in posts. Noktürn arranges no rides and no bookings, takes no money and is never a party to any agreement. Legal basis: Art. 6(1)(b) GDPR (providing the board) and (f) (preventing abuse). Posts end automatically (Gig-Pooling when the event ends, Gig Exchange after 6 months at the latest); messages are deleted 30 days after sending or one week after the post ends. (2) Scene Curators are invited personally by the owner; publicly shown are the curator name or pseudonym, town, short text, badge and picks (Art. 6(1)(b) and (a) GDPR). Curators receive no money; picks cannot be bought.

13. AI-assisted text and translation functions

The Lovable AI Gateway, which can forward requests to connected AI models, may be used for certain text and translation functions. According to the documentation, page texts or item descriptions — but not customer accounts — are to be used for this.

According to the information available, no customer accounts are transmitted to the AI models for these functions. Personal data is only processed or transmitted where permissible and necessary for the respective function.

14. Time-limited review and adviser access

Time-limited access may be set up for data protection advisers, lawyers, tax advisers or other reviewers. Email address, role, grant and expiry date, confirmations, revocation and logs of the areas accessed with time and IP address are processed.

The legal basis is Art. 6(1)(b) GDPR for the advisory/review relationship, Art. 6(1)(f) GDPR for traceability and protection of confidential information, and Art. 6(1)(c) GDPR where legal obligations are concerned. Access logs are generally stored for 24 months.

15. Reports, complaints and security notices

For reports and complaints we process contact details, report category, facts, attachments, handling notes and decision. The legal basis is Art. 6(1)(c) and (f) GDPR. The data is stored for as long as necessary for documentation and legal defence.

16. Business partner outreach

Where publicly published business contact details of venues or businesses are used for individual partner outreach, we process source, time, proof of origin, address type, draft, sending/objection status and block-list entries. According to the documentation, nothing is sent fully automatically, only after personal release.

The legal basis may be Art. 6(1)(f) GDPR, provided the legal requirements — in particular of the UWG (German Unfair Competition Act) — are met. Objections are respected; block-list entries may be stored to avoid renewed contact.

17. Your rights

Subject to the legal requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR). Consent given can be withdrawn at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority. For North Rhine-Westphalia, the competent authority is in particular the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

18. SSL/TLS encryption and security

The website uses HTTPS/TLS. Security headers such as HSTS, X-Content-Type-Options and clickjacking protection are also used. Despite appropriate technical and organisational measures, absolute security of data transmission over the internet cannot be guaranteed.

19. Changes to this privacy policy

We update this privacy policy when functions, service providers or the legal situation change. Functions that are not yet public or not yet in operation are reviewed for data protection before activation, and this privacy policy is supplemented in advance where necessary.