of Louco Event Media GmbH · for the Louco website, the Louco app and the Louco Check-in app
Last updated: 22 October 2026
This English version is a convenience translation. Only the German version is legally binding.
The controller responsible for data processing on www.louco.app, in the Louco app and in the Louco Check-in app is:
Louco Event Media GmbH, Berliner Straße 300b, 63065 Offenbach am Main, Germany
Represented by the managing directors Evin Acar and Erhan Tilki
Email: info@louco.app · Go to the contact form
Important: If you buy a ticket for an event, the respective organiser (“Creator”) is additionally the controller for the data it receives for its event (see section 10). For purchases from partners (e.g. Ticketmaster), the partner is the controller (section 13).
For all questions about data protection and for exercising your rights, you can reach us at info@louco.app or via our contact form. We have not appointed a data protection officer, as the legal requirements for doing so are not met.
We process personal data only to the extent that this is necessary to provide the platform and our services, you have given your consent, or the law permits it. The main categories are:
Purpose: For the website and apps to work, our servers process technically necessary data each time they are accessed: IP address, date and time, page/interface accessed, referrer URL, browser or app version, operating system, status code and amount of data transferred. We use this data to deliver the content, to ensure security and stability (e.g. defending against attacks) and to analyse errors.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure and functioning service); if you have an account, Art. 6 (1) (b) GDPR.
Hosting providers: Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg (data centre: Frankfurt am Main, region eu-central-1) and Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen (data centre in Falkenstein, Germany). We have concluded data processing agreements with both. For possible transfers to the USA by AWS, see section 24.
Retention period: Server and application log files are deleted after no more than 30 days, unless a security incident needs to be investigated further. Database backups are held at AWS in Frankfurt and are kept only for as long as is necessary for a restore; in the event of a restore, data deleted in the meantime is deleted again.
What: We store information on your device or read it from your device (cookies, local storage, device identifiers in the app). Under Section 25 German Telecommunications Digital Services Data Protection Act (TDDDG), this is only permitted if it is strictly necessary to provide the service you have requested (e.g. login status, language setting, ordering process, security, offline data of the Check-in app), or if you have given your consent.
Consent: For all services that are not strictly necessary, we obtain your consent via our consent tool (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can withdraw or change your consent at any time with effect for the future via “Cookie settings” in the footer or in the app under “Settings > Privacy”.
Categories: Our consent tool distinguishes between “Necessary” (always active: login, ordering process, security), “Personalisation”, “Statistics” and “Marketing” (relevant event advertising on other websites and on social media). All optional categories are switched off by default. The following are used: Statistics: Google Analytics for Firebase (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on our website, only with your consent. Google receives a pseudonymous identifier, device and browser information, pages accessed and interactions, as well as your truncated IP address; a transfer to the USA is possible (section 24). Retention period: 14 months. We do not use any analytics tool in our apps. External media: Google Maps (maps on event pages) and embedded TikTok videos only load after your consent or your click; Google or TikTok then receive your IP address and technical data. Marketing: currently no tools.
Consent tool: We use our own consent tool; no data is transmitted to a service provider. It stores your decision (consent ID, time, selection) for 12 months as proof. Legal basis: Art. 6 (1) (c) GDPR.
Personalisation: With your consent to “Personalisation”, we store your location or your city on your device in order to suggest events near you.
Proof and duration: We store your selection together with the time, version and selected categories – for logged-in users in the account (across devices), otherwise under a random identifier. We ask again after 12 months at the latest or if the services used change. We keep the proof for up to 3 years after the consent ends.
You can find a list of all cookies and services used, with their retention periods, in the consent tool under “Details”.
Purpose and data: You need an account to use many features. When registering, you choose your role (Private User or Creator) and verify your email address or phone number with a one-time code; you then set a password. You log in with your email address or phone number and either your password or a one-time code by email or SMS. During onboarding, we ask you as a Private User for: profile picture and username, as well as at least three interests (event categories). When registering, you confirm via a mandatory checkbox that you are at least 16 years old; we store this confirmation with a timestamp as proof. We do not ask for your date of birth. In the account settings, you enter your first and last name and optionally your gender, address and phone number. As a guest, you can initially use the app without an account. Your draft profile is saved automatically so that you can continue later.
Verification codes by email or SMS: For SMS, we use Twilio Ireland Limited, 25–28 North Wall Quay, Dublin 1, Ireland (parent company Twilio Inc., USA). Twilio receives your phone number and the code. We send emails via the services named in section 17.
Login via Apple or Google: If you use “Sign in with Apple” or “Sign in with Google”, we receive from the respective provider your name, your email address (with Apple, possibly an anonymised forwarding address) and an identifier, but no password. The providers are Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland, and Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, respectively.
Login methods and security: You can connect and disconnect several login methods. For your security, we log changes to login methods (time, type of change).
Settings: We store your language setting (German/English), notification settings and whether the app may use your location.
Legal basis: Art. 6 (1) (b) GDPR (user agreement); for voluntary information, Art. 6 (1) (a) GDPR; security logs, Art. 6 (1) (f) GDPR.
Retention period: Until your account is deleted. After your deletion request, the account is deactivated immediately and your profile becomes invisible; your data is deleted or anonymised within 30 days, unless statutory retention obligations apply (section 25). You can delete your account at any time under “Settings > Delete account”.
Your profile: Your profile as a Private User is not visible to other Private Users. Creators only see your data in connection with your orders, check-ins and invitations to their events, as well as your username and profile picture if you follow them. Only you can see the list of Creators you follow.
Following: If you follow a Creator, we store this in order to notify you about new events by that Creator. The Creator only sees the total number of its followers, not who follows it.
Saved events: We store saved events in your account and remind you by push notification before the event. Creators only see the total number of times their event has been saved.
Sharing: If you share an event, we generate a link that you send yourself via your device's share menu. We store that sharing took place and via which type of channel (e.g. “Link copied”, “Share menu”), but not with whom. Creators only see the total number.
Creator profiles: Once their first event has been approved, Creator profiles and events are publicly visible on the platform and in search engines, including name, image, description, events and provider details.
Legal basis: Art. 6 (1) (b) GDPR; statistics for Creators, Art. 6 (1) (f) GDPR (aggregated only).
Location: To show you events near you, we use – if you allow it in the app and in your operating system – your device's location, otherwise the city you have selected. You can switch off location use at any time in the app under “Settings > Location access”. We do not track your location continuously and do not store movement profiles; the device location is only used for the respective search and is not stored on our servers. If you have not shared your location and have not selected a city, we determine your approximate city from your IP address in order to initially show you relevant events. For this purpose, we transmit your IP address to the service ipapi.co (Kloudend, Inc., USA); the result is cached for your network for up to 24 hours, and your IP address is not stored in our logs in the process. Legal basis: Art. 6 (1) (a) GDPR and Section 25 (1) TDDDG (device location), Art. 6 (1) (b) or (f) GDPR (selected city, IP location).
Maps: To display venues, we use Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) on the website and in the app, and Mapbox (Mapbox, Inc., 740 15th Street NW, Washington, DC 20005, USA) for the address search in the Creator area. Your IP address, the map section or the search term entered are transmitted to Google or Mapbox respectively. On our website, the map is only loaded after your consent or your click. Legal basis: Art. 6 (1) (a) GDPR or, for Creators' address search, Art. 6 (1) (b) GDPR.
Search: For search, we use Typesense, self-hosted on our servers. Search terms are processed to perform the search and are not stored. Legal basis: Art. 6 (1) (b) GDPR.
“For you”: If you are logged in, we show you events in the “For you” section that match the event categories you have selected and events you have saved (favourited). The selection is made according to a fixed set of rules (algorithm); there are no AI-based recommendations and no analysis of your other usage behaviour. Legal basis: Art. 6 (1) (b) GDPR (provision of the feature).
Website content: We manage the editorial content of our website with the content management system Sanity (Sanity AS, Oslo, Norway). Images are delivered via the Sanity CDN; your IP address is processed in the process. Legal basis: Art. 6 (1) (f) GDPR.
With “Louco AI” (“Ask AI”), you can search for events in natural language. Without an account, 5 requests are possible; to count the number, we store an encrypted value (hash) generated from your IP address and your browser or device. Your input is transmitted, together with your previous question and the answer to it (so that follow-up questions are possible), the selected city, time zone, the current date and an indication of whether location sharing is enabled, to our AI service provider OpenAI Ireland Ltd., 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, Ireland, which generates an answer. Processing by OpenAI OpCo, LLC in the USA is possible; this takes place on the basis of the EU Standard Contractual Clauses. According to OpenAI, it does not use data transmitted via the interface to train its models. OpenAI does not store requests permanently; for abuse detection, OpenAI may retain them for up to 30 days. We store your last request and answer so that you can ask follow-up questions, until your account is deleted or, if you use the service without an account, together with the hash mentioned above. We do not transmit your name, your email address, your user ID or your precise location to OpenAI. Legal basis: Art. 6 (1) (b) GDPR. Please do not enter any sensitive data. AI answers may be inaccurate; the information on the event page is authoritative.
Purpose and data: If you acquire a ticket for a Creator event (paid or free of charge), we process: first and last name, email address, tickets and ticket types purchased, price, tax, ticket fee, discount or access codes used, payment status, order and transaction numbers, time and – voluntarily – phone number and billing address. We use this data to process the order, to issue you the ticket (QR code in the app and PDF by email) and – at your request via our contact form – an invoice in the name of the Creator, and to inform you about changes, cancellations and refunds.
Legal basis: Art. 6 (1) (b) GDPR (contract with the Creator, which we broker, and user agreement with us); voluntary information, Art. 6 (1) (a) GDPR; retention, Art. 6 (1) (c) GDPR.
Disclosure to the Creator: The Creator from whom you acquire the ticket is your contractual partner and receives the data necessary to hold the event: name, email address, order and ticket data, codes used, check-in status and any voluntary information you provided. The Creator is itself the controller for further processing and, under our terms, may only use the data for the event; it needs your consent for advertising. Legal basis: Art. 6 (1) (b) GDPR.
Payment processing by Stripe: Payment is processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”) directly for the Creator's Stripe account. Stripe receives your payment data (e.g. card details, PayPal or Klarna account), name, email address, amount, IP address and device information. Stripe is itself the controller for payment processing, fraud prevention and compliance with anti-money laundering obligations; the Creator also receives the payment data via its Stripe account. We do not receive complete card details. Depending on the payment method you choose in the Stripe checkout, the following are also involved: Apple Pay, Google Pay and, where applicable, other payment methods displayed in the checkout. Stripe's privacy notice.
Payment with PayPal: If PayPal is offered and you choose it, you will be redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. PayPal processes the payment directly for the Creator's PayPal account and receives for this purpose name, email address, amount, order reference and the data you enter at PayPal. PayPal is itself the controller for this; PayPal privacy notice. Legal basis: Art. 6 (1) (b) GDPR.
Wallet tickets: If you add a ticket to Apple Wallet or Google Wallet, the ticket file (event name, date, venue, ticket type, QR code, your name) is transmitted to Apple (Apple Distribution International Ltd., Ireland) or Google (Google Ireland Limited) and stored on your device or in your account with that provider. This only happens when you click. Legal basis: Art. 6 (1) (b) GDPR.
Payment disputes: In the case of chargebacks, Stripe informs the Creator and us; the Creator handles the case via Stripe.
Retention period: We keep order and invoice data for the statutory periods (accounting records 8 years, commercial and business letters 6 years, in each case from the end of the calendar year; Section 147 German Fiscal Code (AO), Section 257 German Commercial Code (HGB)). If the account is deleted, this data is separated from the account and stored only for these purposes with restricted access.
Check-in app: At the entrance, the door staff deployed by the Creator scan the QR code of your ticket with the Louco Check-in app. Depending on the Creator's settings, your name, your ticket type and your check-in status are displayed, and where applicable your profile picture. We store the check-in with its time so that a ticket can only be used once. So that admission also works without internet access, the event's ticket data and the guest list are loaded onto the door staff's device in advance.
Door staff: The Creator creates door staff in the Creator area (first and last name, email address) and determines for which events and for what period they have access, and whether they may see guests' personal data, manage guests or sell tickets on site. Login takes place with an automatically generated password or a login link. We log who carried out which check-in. Access to the event's data ends when the access period expires or access is revoked.
Guest list: Creators and their door staff can add people without a ticket to a guest list (first and last name, optionally email address, number of companions, ticket type, who invited the person, note for staff) and optionally send them an invitation by email. If you are on a guest list, the Creator entered your data; the Creator is the controller for this, and we store the data on its behalf.
Your contact details and the Creator: Under “Settings > Privacy & visibility”, you decide whether Creators may see and download your email address and phone number in attendee lists and guest lists (“Share contact details with Creators”). Without your permission, these details are hidden from the Creator. The Creator always receives your name and ticket data, because as the organiser it is your contractual partner; for mandatory event notices (e.g. cancellation, rescheduling, refund), we use your contact details regardless of this setting.
Legal basis: Art. 6 (1) (b) GDPR (ticket contract), guest list Art. 6 (1) (f) GDPR (the Creator's legitimate interest in orderly admission control).
Retention period: We store check-in data and guest lists for as long as the Creator needs them to run its events, at most until the Creator account is deleted.
In the case of refunds by the Creator or cancellation of an event, we process the order data, refund amount and reason, and trigger the refund via Stripe to your original payment method. You will receive a confirmation by email. Legal basis: Art. 6 (1) (b) and (c) GDPR. Retention period as in section 10.
We also display events from partner ticket providers (currently Ticketmaster, Reservix and myticket.de; others may be added), whose data (title, date, venue, images, prices) we import automatically via interfaces; no user data is transmitted in the process. If you choose a partner's option when purchasing, we redirect you to that partner's site. The partner receives the usual technical data (IP address, browser). For Ticketmaster and myticket.de, the link first passes through the affiliate network Impact (Impact Tech, Inc., USA), which uses a partner identifier in the link to record that you came via Louco so that a commission can be attributed; Impact acts on behalf of the respective partner. We do not transmit your user ID, your email address or any other account data to partners or to Impact, and our website does not pass on the referring page (referrer) when the link is opened. On louco.app and in the app, we do not use any tracking pixels or scripts from partners or affiliate networks. The partner alone is the controller for everything that happens on the partner's site. We do not see tickets that you buy from the partner. Legal basis: Art. 6 (1) (f) GDPR (redirection at your request and settlement of commissions); cookies set by the partner or Impact on their own site are subject to their privacy policy.
Data: For Creators, we additionally process: full name, email, phone, name of the Creator or company, company name, legal form, business and billing address, VAT ID number, commercial register number and tax number, Creator type, information on business volume from onboarding (categories, ticket volume, frequency), event content, tax settings, discount codes, statistics, subscription, credits, invoices, Stripe account status and disputes.
Verification of trader status: Before approving the first event, we check whether the Creator runs a business or is self-employed, and may request evidence for this (e.g. business registration, extract from the commercial register, VAT ID number). We store the result of the check (date, type of evidence, person carrying out the check); we delete copies of the evidence after the check has been completed, at the latest after 30 days. Legal basis: Art. 6 (1) (b) and (c) GDPR (contract; Art. 30 Digital Services Act).
Purposes: Provision of the Creator area; review of the Creator and the first event, as well as of date changes (quality, fraud prevention); duplicate detection; billing of subscriptions, credits and ticket fees; invoicing; sales and customer support based on the onboarding information (legal basis for this: Art. 6 (1) (f) GDPR); compliance with legal obligations (tax law, Digital Services Act).
Stripe: To sell paid tickets, Creators set up a Stripe Standard account. Stripe itself collects identity, company and bank data in the process (as a separate controller). We receive the account status, transaction data and dispute data from Stripe. Subscriptions and credit packages are billed via Stripe.
Legal basis: Art. 6 (1) (b) GDPR (contract), Art. 6 (1) (c) GDPR (tax and platform obligations), Art. 6 (1) (f) GDPR (verification, fraud prevention, sales).
Retention period: Account data until the Creator account is deleted; invoice and accounting data 8 or 10 years respectively; review and rejection data relating to events is kept for up to 3 years after account deletion to prevent abuse.
If you are invited: Creators can invite you to an event – via your Louco username, your email address or an uploaded list. In this case, we received your email address from the Creator (Art. 14 GDPR). On the Creator's behalf, we send an invitation email with a personal link; Louco users also receive a push and in-app notification. We store your email address or your username, an optional personal message and the status (open, accepted, declined). If the event is full, you can be placed on a waitlist; we notify you by email when a place becomes available.
Searching for Louco users: When inviting, Creators can search by display name or @username; only the profile picture, display name and username are shown, never the email address or phone number. You can only be invited if you allow invitations in your settings (“Allow event invitations”); you can change this setting at any time.
Responsibility: The Creator is responsible for the decision to invite you. We process your data to send and manage the invitation.
Unsubscribing: Via the link in every invitation, you can declare that you no longer wish to receive invitations via Louco. We then store your email address on a blocklist.
Legal basis: Art. 6 (1) (f) GDPR (interest of the Creator in the invitation; we safeguard your interest through the option to unsubscribe and a short retention period); if accepted, Art. 6 (1) (b) GDPR.
Retention period: We store invitations that have not been accepted and waitlist entries for as long as the Creator needs them for its event, at most until the Creator account is deleted; uploaded lists are not stored for other purposes after sending.
Mandatory notifications: We send messages that are necessary for your account or your tickets (e.g. purchase confirmation, refund, cancellation, change of date or venue, security notices; for Creators, e.g. approvals, rejections, payment and Stripe notices) regardless of your settings. Legal basis: Art. 6 (1) (b) GDPR.
Other notifications: e.g. new events from Creators you follow, reminders of saved or booked events, presale reminders, invitations, event suggestions, and for Creators new sales and reports. We only send promotional notifications (e.g. event suggestions, offers, “Last Call”) if you have activated them under “Communication settings” (Art. 6 (1) (a) GDPR). You can switch these on and off under “Settings > Notifications” per channel (push, email) and per type. Legal basis: Art. 6 (1) (b) GDPR (follow and save features), and for push notifications additionally your permission in the operating system (Section 25 TDDDG).
Push notifications: For this purpose, we process a device identifier (push token) and transmit it to Google Firebase Cloud Messaging (Google Ireland Limited) or the Apple Push Notification Service (Apple).
In-app notifications are displayed in your account and are deleted together with it.
We send all emails from the website and app (e.g. login codes, order confirmations and tickets, changes and cancellations, reminders, refunds, invitations and waitlist, welcome emails, emails to Creators about sales, subscriptions and invoices) via Microsoft 365 / Microsoft Graph (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) with the sender address noreply@louco.app. Via Brevo (Sendinblue SAS, Paris, France), we only send the welcome email for the Creator waitlist and the acknowledgement of receipt for support requests. We send replies to support requests via Freshdesk (section 20), and emails from our mailboxes (e.g. info@louco.app) via IONOS SE, Elgendorfer Str. 57, 56410 Montabaur. The service providers process your email address and the content of the message on our behalf. Where applicable, you will receive payment receipts from Stripe directly from Stripe on behalf of the Creator.
Newsletter: We do not currently send a newsletter to Private Users. If we introduce one, sign-up will only take place with your consent using the double opt-in procedure; we will then provide the details here.
Creator waitlist: If you put yourself on our waitlist as a Creator, we store your details (name, email address, where applicable information about your events) in Brevo (Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France), send you a welcome email and inform you as soon as you can create a Creator account. Legal basis: Art. 6 (1) (b) GDPR (your request). Retention period: until you register as a Creator or unsubscribe, at most 12 months.
Business contacts: We manage Creators as business contacts and inform them about Louco's services (Art. 6 (1) (f) GDPR). You can object to this at any time, e.g. via the unsubscribe link in the email or at info@louco.app.
Support requests: Anyone who contacts us via the support form is stored as a contact in Brevo in order to send the acknowledgement of receipt; whether you wish to receive advertising is only stored if you actively indicate it. We only send advertising with your consent.
If you report content to us via the report function or our contact form, we store your report (content concerned, category, comment, time) and your account or – for reports without an account – the contact details you provided, in order to review the report, prevent abuse and inform you of the outcome. We do not disclose your identity to the Creator unless this is strictly necessary for the review or required by law. Legal basis: Art. 6 (1) (c) GDPR (Digital Services Act) and (f) GDPR. Retention period: 3 years after completion.
If you contact us by email, contact form or support, we process your details (name, email address, request, where applicable order number and account ID) in order to handle your request, including in the ticketing system Freshdesk (Freshworks Inc., 2950 S. Delaware Street, San Mateo, CA 94403, USA). Support chat in the app: In our apps, we use the chat service Freshchat (also Freshworks). If you are logged in, your name, your email address and your Louco user ID are transmitted to Freshchat so that we can assign your request to your account; we store chat histories for 24 months. The chat service is loaded when the app starts. Legal basis: Art. 6 (1) (b) or (f) GDPR.
For video appointments (e.g. onboarding of Creators), we use Zoom (Zoom Communications, Inc., San Jose, USA). Legal basis: Art. 6 (1) (b) GDPR, otherwise (f) GDPR. Retention period: 24 months after completion, unless retention obligations apply. You can use the public Help Center (questions and answers) without providing any personal data.
Error analysis: To detect and fix crashes and errors, we use Sentry (Functional Software, Inc., San Francisco, USA; data stored in the EU region, Germany). In the event of an error, technical information (device type, operating system, app version, time, error message, pseudonymous user ID) is transmitted. Legal basis: Art. 6 (1) (f) GDPR. Retention period: 30 days.
Monitoring: We monitor our systems with self-hosted Grafana on the basis of technical metrics.
Abuse and fraud prevention: To protect against abuse (e.g. fake accounts, ticket fraud, bot attacks, mass invitations), we analyse technical data (IP address, device identifier, login attempts, usage patterns) and rate-limit requests. Legal basis: Art. 6 (1) (f) GDPR.
We maintain profiles on Instagram and Facebook (Meta Platforms Ireland Limited, Dublin), TikTok (TikTok Technology Limited, Dublin), YouTube (Google Ireland Limited) and LinkedIn (LinkedIn Ireland Unlimited Company, Dublin). If you visit these profiles, the platform operators process your data in accordance with their own privacy notices. We are joint controllers with Meta for the statistics about our pages (Insights) (Art. 26 GDPR); the agreement with Meta is available online. Legal basis: Art. 6 (1) (f) GDPR (public relations). On our website, we only link to these profiles via simple links.
If you apply to us, we process your application documents in order to carry out the application process (Art. 6 (1) (b) GDPR, Section 26 German Federal Data Protection Act (BDSG)). After the process has been completed, we delete the documents after 6 months at the latest, unless you have consented to longer storage.
Processors: We use service providers that process data on our behalf and in accordance with our instructions (Art. 28 GDPR): hosting and infrastructure (AWS, Hetzner), email and SMS delivery (Microsoft, IONOS, Twilio, Brevo), push notifications (Google Firebase), maps (Google, Mapbox), location detection (ipapi.co), search (Typesense), error analysis (Sentry), customer support (Freshdesk, Freshchat), statistics with consent (Google Analytics for Firebase), AI (OpenAI) and internal collaboration (e.g. Microsoft 365, Slack, Jira, GitHub, Zoom). We have concluded data processing agreements with all of them.
Independent controllers: We also transmit data to: Creators (ticket purchase, admission, invitations), Stripe and other payment providers, Apple and Google (login, app stores), partner ticket providers (on redirection), tax advisers and authorities, to the extent that we are legally obliged to do so.
Third countries: Some service providers are based in the USA or may transfer data there. For the USA, there is an adequacy decision of the EU Commission (EU-U.S. Data Privacy Framework, Art. 45 GDPR) for companies certified under this framework. Where a provider is not certified, we transfer data on the basis of the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR). Adequacy decisions also exist for Norway (EEA) and the United Kingdom. You can obtain a copy of the safeguards on request.
We store personal data only for as long as is necessary for the respective purpose or as statutory retention obligations apply. In summary:
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17) – you can delete your account yourself at any time –, restriction of processing (Art. 18), data portability (Art. 20), withdrawal of consent given, with effect for the future (Art. 7 (3)), and objection (Art. 21, see below). To exercise these rights, an email to info@louco.app or a message via our contact form is sufficient. We will respond within one month.
Right to lodge a complaint: You can lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The supervisory authority responsible for us is: The Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), Gustav-Stresemann-Ring 1, 65189 Wiesbaden (HBDI website).
Where we process your data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then no longer process the data, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.
You can object to processing for direct marketing purposes at any time without giving reasons; we will then no longer process your data for these purposes.
The provision of your data is neither required by law nor by contract. However, without the data marked as mandatory, we cannot provide you with an account or process a ticket purchase. There is no solely automated decision-making with legal or similarly significant effects (Art. 22 GDPR). The automatic duplicate detection for events and Stripe's fraud check may result in an event not being created or a payment being declined; in this case, you can contact us and we will review the case personally.
We will amend this Privacy Policy if our processing operations or the legal situation change. The version published here at the relevant time applies. We will inform registered users of material changes by email or in the app.