1. Controller and Scope
This privacy policy applies to the website weventis.de, the web app and the Weventis apps for iOS and Android. It also applies when we provide Weventis for partners under a different brand or domain.
Controller within the meaning of the GDPR for Weventis: Weventis GmbH, Viktor-Frankl-Straße 22, 86916 Kaufering, Germany. Represented by: Andreas Emmert. Register court: Amtsgericht Augsburg, HRB 43387. Email: hello@weventis.de
The easiest way to send questions about data protection and requests regarding your rights is to hello@weventis.de or via customer service in the app.
We only process personal data where this is necessary for the respective purpose and there is a legal basis. The most important legal bases are: contract or user agreement (Art. 6(1)(b) GDPR), consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG), legal obligations (Art. 6(1)(c) GDPR) and legitimate interests (Art. 6(1)(f) GDPR).
Please note that the host of your event is responsible for the specific data processing in the event. In this case, Weventis only provides the infrastructure (see section 11).
2. Hosting, Server Log Files, Cookies and Local Storage
Hosting. The website, app, chat server, email sending, backups and databases run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. We also send our emails via Hetzner. Uploaded photos and files are stored by Contabo GmbH, Aschauer Straße 32a, 81549 Munich, Germany, in data centres in the EU. Both process data on our behalf (Art. 28 GDPR).
Server log files. With every request, the web server stores the IP address, date and time, requested address, referrer, browser identifier and status code. We need this to operate the service securely and stably and to fend off attacks (Art. 6(1)(f) GDPR). The log files are deleted after 14 days unless they are needed for longer to investigate a security incident.
Cookies and local storage. We do not use cookies or techniques for advertising, tracking or reach measurement. Apart from embedded third-party content, we only use entries that are strictly necessary for the service you request (section 25(2) no. 2 TDDDG); we do not ask for consent for these. For embedded third-party content, we obtain your consent (see section 9).
Internal analysis. We analyse how Weventis is used – including by guests – in order to operate, analyse and improve the platform (e.g. how often features are used). We only use our own tools on our servers, analyse data in anonymised form only and do not pass the results on to third parties (Art. 6(1)(f) GDPR).
| Name | Purpose | Storage period |
|---|---|---|
| Session cookie (PHPSESSID) | keeps you logged in while you use the service | until the browser is closed |
| weventis_api_token | secure login to the interface (HttpOnly, cannot be read by scripts) | 30 days or until you log out |
| weventis_remember | “Stay logged in”, only if you select it | 30 days or until you log out |
| fe_guest_fp | random device identifier so that guests can only vote once in lists (e.g. polls, “I’ll bring”); only set with the first vote | 1 year |
| wev_ref | remembers the referral link until you register | 30 days |
| reg_preview | remembers the early-access invitation | 30 days |
| gal_guest_name | remembers the name you entered in the guest gallery | 1 year |
| sidebar_state, gal_filter_*, gal_sort_* | display settings (sidebar, filters, sorting) | up to 1 year |
| Local storage (localStorage) | display settings, name last used on event websites, “Live arrival” status on this device, device key of the guest gallery, accepted short terms, name in the list module, view under Discover, draft when creating an event | until you delete it in your browser |
| Session storage (sessionStorage) | short-term states, e.g. the conversation with the digital assistant, event password, personal guest link and language selection | until the tab is closed |
3. User Account, Login and Social Login
Registration. For an account we need your first name, last name, email address and a password (stored only as a hash). You can voluntarily add a profile picture, a user name and further profile details. To confirm, we send a link to your email address. The legal basis is the user agreement (Art. 6(1)(b) GDPR).
Login and security. With every login we store the time, login method, success or failure and the IP address. After five failed attempts, we lock the account for 15 minutes. This allows us to detect and prevent misuse (Art. 6(1)(f) GDPR). We delete the login log after 90 days. Optionally, you can activate two-factor login with an authenticator app and log in via a link in an email.
Social login. You can log in with Google or Apple. After your approval, the provider then sends us your name, email address and an identifier for your account; you then do not need a password with us. The providers are Google Ireland Limited (Ireland) and Apple Distribution International Ltd. (Ireland); their own processing is governed by their privacy notices. The legal basis is Art. 6(1)(b) GDPR. We do not load any script from Google or Apple before you click the button.
Referrals. If you register via a referral link, we store who referred you in order to credit a bonus (Art. 6(1)(b) GDPR). The referral programme is switched off by default; as long as it is off, we do not store who referred you.
Records of your consents. When you agree to the terms and conditions, a price change, the Etiquette or the short terms for the gallery, we store the time, the wording and your IP address as proof. This allows us to show what you agreed to (Art. 6(1)(f) GDPR). The storage period is stated in section 10.
4. Events, Guests, Event Website and Photos
Planning events. When you create an event, we store what you enter: name, date, locations, schedule, groups, menu, accommodation, texts and images. Co-organisers you invite can also see and edit this information (Art. 6(1)(b) GDPR).
Guest data. Hosts enter their guests, e.g. name, email address, companions, group and menu choice, and invite them by email or link. Guests reply via their personal link or the event website. Without an account, guests can change their reply or decline; only the host can delete the entry itself, and guests can request deletion via their personal link. Our invitation emails contain a link to this privacy policy and to the imprint. We send invitations and reminders on behalf of the host. We conclude a data processing agreement with hosts. Guests can also write a free-text message to the host. Please do not enter any sensitive information there, e.g. about health or religion.
Event website. The website of an event can be accessed by anyone who knows its link as soon as the host publishes it; optionally with a password. The host decides what it contains. If an event is set to “Public”, logged-in users nearby and friends of the host see the title, date, city, venue, map position, category, cover image, number of acceptances and the link to the event website under Discover. Even then, the guest list and chat remain visible to guests only. The gallery only appears on the event website if the host expressly releases it. Event websites and guest pages are blocked for search engines. The links contain a random identifier and no referrer is sent when they are opened. We immediately remove your personal guest link from the address bar.
Gallery, posts and stories. Photos, videos, posts, stories, likes and comments can only be seen by the participants of the respective event – this includes guests without an account to whom the host gives the gallery link. Stories are visible for a maximum of 24 hours and are then deleted. We review reported content and hide it in the event of violations. Please only upload photos to which you hold the rights and to which the persons depicted have agreed. Photos may contain location information (GPS data) if your device stores it. We store the originals unchanged, which means they may still contain location information. Only the reduced-size views and the playable video copies are free of metadata. There is no facial recognition. As a guest, you can delete your own photos yourself at any time, with an account or from the same device you used to upload them. Reported photos cannot always be deleted.
Who’s coming. If the host allows it, guests with an account who have accepted can see who else is coming and can add each other as friends. You can hide yourself from these lists in your privacy settings.
5. Community, Friends and Chats
Friends. You can send friend requests to other users, accept requests and block people. You can find friends via your personal friend link or QR code, via the search (name, user name or exact email address) and via suggestions from shared events.
Privacy settings. Under My account → Privacy you decide who may send you requests, whether you are visible in guest lists and can be found via the search and whether friends can see which public events you are going to. You can hide suggestions individually or switch them off completely.
Chats. You can write to friends and take part in group chats of your events. Messages are transmitted in encrypted form and stored in encrypted form on our servers, but are not end-to-end encrypted; they are delivered in real time via our own server. Chats remain stored until they are deleted or the account is permanently deleted. We also store when you were last active in order to display unread items and notifications correctly (Art. 6(1)(b) GDPR).
6. Location, Maps and Discover
Discover. To show you events near you, you set a location – via the search or, if you allow it, via your device’s location. We only store an approximate location (rounded to approx. 1 km), the radius and the time of your consent (Art. 6(1)(a) GDPR). We do not store your exact location. We automatically delete the location after 12 months without use. Discover is only available to logged-in users. Under My account → Location & Discover you can delete the location at any time and thereby withdraw your consent.
Where am I. When you use the “Where am I” feature, we process your current location in order to show it to you in the app and to enable you to use location-based features. Your location is only processed when you use the feature and have allowed access to your location in your device settings. The legal basis is Art. 6(1)(b) GDPR, insofar as the location processing is necessary to provide the feature you have called up.
Travelling together and live location. To organise travelling together to an event, you can arrange to meet other users and share your current location with them. If you activate location sharing, we continuously process your location data while sharing is active and show your current location to the users you have selected. This allows those involved to see, for example, where you are on the way to the agreed meeting point or event.
You decide yourself whether and with whom you share your location. Location sharing can be ended at any time. Once it has ended, your current location is no longer transmitted to the selected users. The legal basis is Art. 6(1)(b) GDPR, insofar as the processing is necessary for organising travelling together as requested by you and for the location sharing you have activated.
Attending public events. If you click “Going” or “Interested” for a public event, we store this. Friends only see your attendance if you allow it in your privacy settings – they never see your location.
Live arrival. If the host has switched on the feature, you can share your location on the way with the host and co-organisers on the day of the event. This only happens if you actively start it (Art. 6(1)(a) GDPR) and only in the time window from 12 hours before to 12 hours after the start. As soon as you arrive or stop sharing, transmission stops. We delete positions without updates after 3 hours and all arrival data no later than 2 hours after the end of the time window.
Address search. We search for addresses and places using the Photon service of komoot GmbH, Friedrich-Wilhelm-Boelcke-Straße 2, 14473 Potsdam, Germany. Usually the request runs via our server so that komoot only receives the search term; for the accommodation search, your browser sends the request directly and transmits your IP address (Art. 6(1)(f) GDPR).
Maps. Your browser loads map tiles from the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Your IP address is transmitted in the process. There is an adequacy decision of the EU Commission for the United Kingdom (Art. 45 GDPR). The legal basis is our interest in a functioning map display (Art. 6(1)(f) GDPR).
External events. Under Discover, we also show public dates from publicly accessible sources (organisers, cities, ticket providers) that we retrieve automatically or research with the help of AI. For this we only store the title, date, location and the link to the source, no personal data. Details and tickets are available from the respective source, whose privacy notices apply there. One of the sources we use is Ticketmaster (USA); we only transmit the search area (location and radius) to it, no other user data is transmitted. We load images of external events via our server so that your browser does not connect to the provider.
7. Notifications, Emails, Payments and Customer Service
Push notifications. In the app, we send you push notifications if you wish (e.g. new acceptances, messages, reminders). For this we store a device identifier (push token) and pass the token and message text to the Expo service of 650 Industries, Inc., USA, which delivers them via Apple or Google. We do not transmit the content of chat messages. The legal basis is your consent in your device’s system prompt (Art. 6(1)(a) GDPR); you can switch off push at any time in your device settings or under notification settings. The transfer to the USA is based on the EU-US Data Privacy Framework where the provider is certified, otherwise on the EU standard contractual clauses (Art. 45, 46 GDPR).
Emails. We send emails that are part of the service: confirmations, login links, invitations and reminders for events and notices about your account (Art. 6(1)(b) GDPR). You choose which notices you receive under notification settings. We do not send advertising newsletters.
Payments. You pay for paid packages via Mollie B.V., Keizersgracht 126, 1015 CW Amsterdam, Netherlands. You only enter your payment details (card and account details) with Mollie. We store the Mollie customer ID, the payment and subscription ID, amount, status, term and the record of your consent with time, IP address and wording. Mollie also processes the data under its own responsibility, e.g. for fraud prevention and due to anti-money laundering obligations. The legal basis is Art. 6(1)(b) and (c) GDPR.
Invoices. We keep invoices and accounting records for eight years in accordance with section 147 AO, section 257 HGB and section 14b UStG, and books of account and annual financial statements for ten years (Art. 6(1)(c) GDPR). We create invoices as PDFs with name and email address. They remain unchanged for eight years. When your account is deleted, we anonymise the account and delete the customer record at Mollie.
Customer service and feedback. If you write to us via customer service, by email or via a feedback function, we process your message, your contact details and the link to your account in order to help you (Art. 6(1)(b) or (f) GDPR). We delete enquiries three years after completion unless there is a retention obligation. On request, you will receive a copy of all data stored about your account. Our support only accesses the content of your events if you release this for a specific event; the release is limited in time, chats are excluded and every access is logged. The following paragraph applies to reported content.
Reports. If you report content or a profile or if a report is received about your content, we process the report, the reported content and the necessary context, e.g. parts of a chat history, and review them. We review chats, profiles and the host’s own content ourselves, not the host. Selected staff members are given access to the reported chat messages for this purpose. This only applies to reports, not to general use. We inform the person concerned of measures and the reporter of receipt and the outcome. The legal basis is our interest in protecting users and operating the platform as well as our legal obligations (Art. 6(1)(f) and (c) GDPR). Authorities only receive data if we are legally obliged to provide it.
8. Digital Assistant and AI Features
Digital assistant. The assistant answers questions about using the service with the knowledge from our help pages. It is only available after logging in. For this purpose, we send your question and the latest messages of the chat to Anthropic, a provider of AI language models (Anthropic, PBC, San Francisco, USA, or the Anthropic company named in our contract). Beforehand, we remove email addresses and long numbers; we do not transmit your name, account or event data. Anthropic processes the data on our behalf and does not use it to train its models. The transfer to the USA is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
We only store the cleaned question, the language, whether the question could be answered and which help articles were used – without reference to your account and without IP address – for 90 days in order to improve the help pages; after that they are deleted automatically. Free text you enter may still contain personal data despite the cleaning. To prevent misuse, we count requests per account and day using an encrypted value that expires at the end of the day. The legal basis is our interest in quick, simple help (Art. 6(1)(f) GDPR); use is voluntary and customer service is always directly available to you. Please do not enter any personal data in the chat. AI answers may contain errors. In the chat window, we point out that you are chatting with an AI.
Further AI features. We also use Anthropic to prepare blog articles and to research public events on the internet. For this we only transmit the search area, period and categories. If the research searches where many users have their Discover location, only the name of a city is sent to Anthropic, derived from stored Discover locations (grid of about 50 km, only from 10 users per cell), never the location of an individual person. This grid is switched off by default for AI research and switched on for queries to Ticketmaster. In each case, only the location and radius are transmitted. A person checks blog articles before publication; events found appear after our approval or automatically if the link to the source can be reached.
We do not make automated decisions within the meaning of Art. 22 GDPR.
9. Embedded Third-Party Content
We load some content from servers of other providers. For technical reasons, the provider receives your IP address and browser data. The legal basis is our interest in an attractive and complete presentation (Art. 6(1)(f) GDPR) and, for videos and music, your consent (Art. 6(1)(a) GDPR, section 25(1) TDDDG). YouTube, Vimeo and Spotify only load after you have clicked “Load content”. Before that, no data is transmitted to the provider. Above the button there is a notice with a link to this policy. Your consent only applies to the respective page view; you withdraw it by reloading the page.
| Content | Provider | When |
|---|---|---|
| Videos (YouTube in enhanced privacy mode) | Google Ireland Limited, Ireland | after you click “Load content” |
| Videos (Vimeo) | Vimeo.com, Inc., New York, USA | after you click “Load content” |
| Music (Spotify) | Spotify AB, Stockholm, Sweden | after you click “Load content” |
We retrieve the weather for your next event day from Open-Meteo on the server side; only the coordinates of the event location, rounded to one kilometre, are transmitted, no data about you.
10. Recipients, Third Countries and Storage Period
Recipients. Within Weventis, other users only see what you share or what the host of an event releases. In addition, the service providers named in this policy receive data: Hetzner (hosting, databases, chat, email, backups), Contabo (photo storage, test and development servers), Mollie (payments), Anthropic (assistant, AI research, blog), Expo (push), komoot (address search), OpenStreetMap Foundation (maps), Open-Meteo (weather), Ticketmaster (event source, search area only), Unsplash (blog images, without user data), Vimeo, YouTube (Google) and Spotify (embedded content after your click) and, for social login, Google or Apple. Authorities only receive data if we are legally obliged to provide it.
Third countries. Some providers are based in the USA: Anthropic (assistant, event research, blog), Expo (push), Vimeo (videos), Ticketmaster (search area only) and Unsplash (blog images, without user data). Google, Apple and YouTube process data via their companies in Ireland. We only transfer data to the USA on the basis of an adequacy decision (EU-US Data Privacy Framework, where the provider is certified) or the EU standard contractual clauses (Art. 45, 46 GDPR). There is an adequacy decision for the United Kingdom.
Storage period.
| Data | How long |
|---|---|
| Account, profile, own events, chats | until you delete them or your account |
| Guest data of an event | until the host deletes it or the event, for free events no later than 12 months after the event day |
| Free events | archived 6 months after the event day (no longer public), deleted 6 months later (12 months after the event day), in each case no earlier than 30 days after our announcement; unless reactivated beforehand |
| Stories | a maximum of 24 hours |
| Location for Discover | until you delete it, no later than 12 months after last use |
| Live arrival | no later than 2 hours after the end of the time window |
| Questions to the assistant | 90 days |
| Login log | 90 days |
| Inactive free accounts | 24 months after last use; deletion announced 30 days before this period ends |
| Backups | 14 days |
| Records of consents (terms and conditions, price changes, Etiquette, gallery short terms) | until your account or the event is deleted; records relating to orders together with the invoices for 8 years |
| Server log files | 14 days |
| Customer service enquiries | 3 years after completion |
| Invoices, accounting records | 8 years (books of account 10 years) |
Deleting your account. When you delete your account, we cancel running subscriptions and deactivate the account – with a running subscription at the end of the term, or immediately if you wish: you are logged out everywhere, your events go offline and your posts and messages are hidden from others. You can restore your account within 30 days by logging in again. After that, we permanently delete your personal data and your events including guests, photos and chats. Copies in backups are overwritten after 14 days at the latest. Photos that you uploaded as a guest to the gallery of another person’s event remain with the respective host, without being attributed to you and without your name. Your comments, posts and stories in other people’s events are deleted. Entries in guest lists of other people’s events remain with the host. The invoices that must be retained by law are also kept with their original details (see Invoices), as are anonymous key figures without reference to you (e.g. duration of use, number of events and guests, month of registration), which we use to analyse and improve the service (Art. 6(1)(f) GDPR; anonymous data is not subject to the GDPR).
Inactive free accounts. After 24 months of continuous inactivity, we delete your user account and the associated personal data unless statutory retention obligations or other reasons prevent deletion. We inform you 30 days before the planned deletion. If you use your account again within these 30 days, it will not be deleted for inactivity.
11. Data Processing in a Specific Event
The host alone decides which event they offer, whom they invite, which information they request from participants and what they use this information for. If the host processes personal data of participants to organise and run their event (e.g. participant list, contact details, payment processing, communication before and after the event, photo and video recordings), the host is the controller for this within the meaning of Art. 4(7) GDPR. To this extent, we process this data exclusively as a technical service provider on behalf of and on the instructions of the host (Art. 28 GDPR) and not for our own purposes.
Obligations of the host. The host is obliged to inform participants independently and in good time about the processing of their data (Art. 13 and 14 GDPR). This includes in particular:
- name and contact details of the host as controller,
- purposes and legal bases of the processing,
- recipients of the data and storage period,
- information on the rights of data subjects and the right to lodge a complaint with a supervisory authority.
The host provides this information in the event description or in their own privacy information that can be accessed before registration. This privacy policy does not replace this information insofar as the host processes data beyond the technical features of the platform or for their own purposes.
The host is also solely responsible for the lawfulness of their data processing, for handling data subject requests concerning the data they process and for complying with legal requirements, e.g. for photo and video recordings or passing data on to third parties.
Support from the platform. Within the scope of the technical possibilities, we support hosts in fulfilling their obligations, in particular with requests for access, rectification and erasure and with the security of processing. We forward enquiries from participants relating to data processing by a host to the respective host or refer them to the host.
When you register for an event, you transmit your data to the respective host. You can find their privacy information in the event description. If you have questions about the processing of your data by the host, please contact the host directly. The other sections of this privacy policy apply to data processing by us as platform operator.
12. Your Rights, Complaints and Changes
Your rights. You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR), for example by deleting your location, ending live arrival or switching off push. You can do much of this directly in the app; otherwise a message to hello@weventis.de is sufficient.
Right to object. If we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless there are compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.
Complaints. You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany (postal address: Postfach 1349, 91504 Ansbach), www.lda.bayern.de.
Obligation to provide data. For an account we need your name, email address and a password or social login; all other information is voluntary. Without the mandatory information, we cannot set up an account.
Changes. We adapt this policy when features or the legal situation change. The version published here applies.