Privacy Policy

 8 October 2026

The controller for the processing described in this policy is:

Franco Sparfeld — Berlin Salsacongress
Schöneberger Straße 18
10963 Berlin, Germany
Email: berlinsalsacongress@gmail.com
Phone: +49 172 3014173
Website: https://berlinsalsacongress.co

This policy covers our website, ticket and workshop administration, Family Circle loyalty programme, communications, Companion App, event photography and relevant digital services. Providers may also process data as independent controllers for their own services.

We process personal data only for specified purposes and on an appropriate legal basis:

• Article 6(1)(a) GDPR: consent, for example for optional marketing or tracking where required;
• Article 6(1)(b) GDPR: processing necessary to perform a contract with you or take steps at your request before entering into a contract;
• Article 6(1)(c) GDPR: legal obligations, including applicable accounting requirements;
• Article 6(1)(f) GDPR: legitimate interests, subject to balancing those interests against your rights and interests.

The relevant purposes and bases are described below. Accepting our Terms and Conditions is not a general consent to data processing, marketing, photography or AI use.

We obtain data directly from you, through bookings and registrations, from ticket purchasers booking on your behalf, and from attendance records maintained for the event. We may also receive information through the communication platforms you choose to use.

Providing information necessary for a booking is required to process that booking. Optional marketing subscriptions, optional app features and the chatbot are not required to purchase a ticket. Information about other required fields is provided at the relevant collection point.

Our website is operated using GoDaddy services. Visiting the website involves processing technical information such as IP address, browser and device information, requested pages, request times and error or security records, to deliver the website and maintain security.

The legal basis for necessary delivery and security processing is Article 6(1)(f) GDPR. Our legitimate interests are providing a functioning website, detecting misuse and protecting our systems. Any optional analytics or advertising processing is addressed separately below.

Our website uses a cookie banner. Cookies and similar technologies may store or access information on your device. Under section 25 TDDDG, consent is generally required unless an applicable exception covers the technology, such as storage strictly necessary to provide a service you expressly request.

Personal-data processing associated with these technologies additionally requires a GDPR legal basis. Optional analytics and advertising technologies are intended to operate on consent under Article 6(1)(a) GDPR and section 25(1) TDDDG.

You should be able to accept or reject optional categories and change your choice later through the website's consent settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

We use Eventbrite to sell and issue tickets, manage workshop registrations and support admission checks. Depending on the booking, we process names, email addresses, mobile number, gender, booking references, ticket categories, payment status, workshop selections, ticket changes and attendance information. Other checkout fields must be described in the final version.

We use this information to process bookings, communicate necessary event information, implement permitted ticket changes, verify admission and administer workshop places. For participants who contract with us, the basis is Article 6(1)(b) GDPR. Where another person purchases a ticket on your behalf, necessary participant administration may be based on Article 6(1)(f) GDPR; our interest is fulfilling that booking and admitting the intended participant. Mandatory recordkeeping is based on Article 6(1)(c) GDPR.

Payment providers process payment information through the selected checkout method. We do not need to receive full card details to confirm a booking.

Necessary booking messages are separate from marketing subscriptions. We do not treat a ticket purchase alone as consent to all marketing.

Family Circle recognises actual attendance and provides the discounts described in our Terms and Conditions. Buying an unused ticket does not count. A shifted ticket counts in the year of actual attendance and for the person who attended.

We maintain a record containing first and last name, email address, attendance years, number of qualifying years, Family Circle level and the relevant discount link. Attendance years and levels are assigned and checked manually by Franco Sparfeld. Only Franco Sparfeld has access to the loyalty table on our side; the storage provider processes data to operate its service.

The record is maintained using Google Sheets/Google Drive. Its purposes are identifying returning participants, assigning the correct level, providing discount information and resolving corrections. We obtain the underlying information from booking and event attendance records.

Proposed legal basis, subject to documented assessment: Article 6(1)(f) GDPR. Our legitimate interest is operating a loyalty programme that rewards returning attendees and verifying eligibility accurately. This must be balanced against participants' rights, reasonable expectations and the history of the original data collection. If you explicitly request a loyalty service, Article 6(1)(b) GDPR may apply to processing necessary for that request, depending on how the programme is structured.

Each attendance entry is retained for ten years after the relevant attendance. After that period it is deleted from the loyalty record and no longer counts toward the level. This applies to the individual attendance entry, rather than ten years after the last interaction. Separate accounting records follow their applicable legal retention rules.

You can ask us to check or correct your record or exercise your applicable deletion and objection rights by emailing us. Where processing is based on legitimate interests, an objection is assessed as described in section 18. Family Circle membership does not itself subscribe you to marketing newsletters.

We use CleverReach, Mailchimp and Eventbrite Boost for newsletter communications. Subscriber data may include email address, name, subscription source, language, consent information and unsubscribe status, depending on the actual registration process.

Marketing based on consent uses Article 6(1)(a) GDPR. Lottery-related newsletter registration uses double opt-in. Eventbrite marketing registration uses a single opt-in process. A valid consent must still be specific, informed, voluntary and recorded; the absence of double opt-in does not remove those requirements.

Every marketing email must provide a way to unsubscribe. You can also contact us directly. Unsubscribing from marketing does not prevent necessary contractual event messages.

Our mailing tools can measure email opens and link clicks. Individual tracking must be described separately and use an appropriate consent mechanism where required; a newsletter subscription does not automatically authorise every form of tracking.

Subscriber data is used while a valid subscription continues, subject to periodic review. After withdrawal, limited suppression or consent-evidence data may be retained where necessary to honour the opt-out, demonstrate compliance or handle claims, on Article 6(1)(c) or (f) GDPR as applicable.

We use Google Analytics to understand website use and Meta Pixel to measure advertising effectiveness and related website interactions. These technologies may process device/browser information, online identifiers, page visits, events and approximate location; the exact fields depend on their configuration. Meta may associate events with a Meta account in accordance with its own role and policies.

The intended basis for optional analytics and advertising tracking is consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. The technical implementation must honour the visitor's choice. We do not upload participant contact lists to create Meta advertising audiences.

When you contact us, we process the information you provide to answer the request, administer your booking or review feedback. This may include your name, email address, message, booking reference and attachments.

The basis is Article 6(1)(b) GDPR for requests relating to your contract or pre-contractual steps, or Article 6(1)(f) GDPR for general correspondence. Our legitimate interest is responding to enquiries and improving event organisation. Correspondence may be processed through Gmail and Google storage services.

Please avoid including sensitive information unless needed. Safety reports may include health information or other specially protected data. Those reports require restricted access, an appropriate Article 9 GDPR condition where applicable and a separate retention assessment.

We use WhatsApp for groups and direct communication, and maintain social-media channels including Facebook and Instagram. The information you send and your account/profile details may be processed by us and the respective platform.

Joining a WhatsApp group is optional. Depending on the group or community structure, your phone number, profile information and contributions may be visible to other members. Please consider this before joining and avoid sharing other people's private information. Leaving a group does not necessarily delete information already received by others.

We use ManyChat for automated and AI-assisted social-media communication. The purpose is to respond to enquiries and provide event information. Depending on the messaging flow, ManyChat processes profile information, messages and interaction records. AI-assisted replies may also involve transmitting message content and relevant conversation context to an underlying AI provider. Messages can contain personal data even when the assistant has no access to booking systems.

Users must be clearly informed when they are interacting with an AI assistant, unless this is already obvious. Please do not send payment details, sensitive personal information or unnecessary booking information through the assistant. AI replies can contain errors; individual booking changes and refund requests should be addressed directly to the organiser. This does not exclude responsibilities imposed by applicable law.

Necessary individual booking communications use Article 6(1)(b) GDPR where applicable. General communication and moderation may use Article 6(1)(f) GDPR, based on our interest in responding and maintaining orderly community communication. Optional marketing requires the applicable consent or other specifically justified legal basis.

Our Zapier AI chatbot answers general questions using an event information database. It has no access to participant bookings or Family Circle records. Nevertheless, messages entered by users may contain personal data, and using the chatbot may involve processing technical information.

The purpose is to answer event enquiries. Please do not enter payment information, sensitive personal information or unnecessary booking details. For booking changes or individual account matters, contact us directly.

Zapier is also used for automations. Only data necessary for an identified workflow should be transferred.

The Companion App provides schedules, workshop information, favourites, reminders and workshop-rating features. In the event-release code dated 23 August 2026, favourites, reminders, cached programme data and an indication of workshops already rated are stored locally in the browser.

Workshop ratings are submitted to Supabase with the workshop identifier, star rating and a timestamp, with a fallback submission omitting the timestamp field. The submitted rating entry does not include a name or email address. This does not establish that all associated technical traffic or server logs are anonymous: the service receives the technical information necessary for the request.

Programme data is retrieved from published Google Sheets. Hosting and external links or embedded content may involve additional providers.

Local storage necessary for a feature explicitly requested by the user must be assessed under section 25(2) TDDDG; optional storage requires consent where the exception does not apply. The GDPR basis for rating processing and technical operation must be documented separately.

Real event photos and videos may show identifiable participants, artists or team members. We use recordings for event documentation and promotion, subject to the applicable legal basis, image rights and the information provided at the recording location.

Consent under Article 6(1)(a) GDPR is used where required. Where a legitimate-interest basis under Article 6(1)(f) GDPR is appropriate, the interest is documenting and communicating the event; the rights, expectations and interests of people depicted must be assessed for the particular use. Ticket purchase is not blanket consent. Minors and close-up promotional portraits require particular care.

We use Adobe and creative services including Runway and Kling. AI-generated promotional stories feature fictional personas. Artist photographs have been used as input to develop personas that are not recognisable as those artists in the final images. The original input photos are nevertheless personal data where the artists are identifiable; output changes do not remove the need for a lawful upload and appropriate information to those artists.

Contact us if you have a question or request concerning a recording. Where processing is based on consent, you may withdraw it for future processing. Where processing is based on legitimate interests, you may object as described in section 18. Requests are assessed under applicable law, including the rights of other people and any justified retention needs.

We use ChatGPT Pro mainly for general drafting and planning tasks. We do not upload participant lists to AI tools. Some AI-assisted work is for internal use; internal use does not by itself mean that data remains within our organisation.

If personal correspondence, photos or other identifiable information is submitted to an AI provider, that transmission needs its own assessed purpose, legal basis, data-minimisation measures and suitable provider arrangements. General drafting using no personal data about others is distinct from such processing.

AI tools do not assign Family Circle levels or make decisions about individual bookings in the confirmed workflow.

Lottery entry data is used to administer entries, draws, winner contact and prizes. Newsletter subscription is a separate processing purpose, even where the registration journey includes both. The actual consent wording and any requirement to subscribe must be transparent.

PollUnit is used for voting; Sling is used for volunteer organisation. Where used, voucher services, payment services or upload services must also be covered with their actual data flows.

Personal data may be received by the providers identified in the relevant sections, payment providers, authorised service partners, advisers or authorities where disclosure is necessary and lawful. Service providers may act as processors, independent controllers or joint controllers depending on the processing. Their role must be assessed rather than assumed from the brand name.

For processing on our behalf, appropriate agreements under Article 28 GDPR are required. Providers or their subprocessors may process data outside the European Economic Area.

Transfers require an applicable Chapter V GDPR mechanism. An adequacy decision may apply only if its conditions are met, including verifying certification where relevant. Otherwise, appropriate safeguards such as standard contractual clauses and any necessary supplementary measures must be assessed.

We retain personal data only as long as necessary for the stated purpose, subject to mandatory retention and justified needs to establish, exercise or defend legal claims. Different categories require different periods; accounting requirements do not justify keeping every marketing, chatbot or loyalty record for the same duration.

The confirmed Family Circle rule is ten years for each attendance entry. Other retention periods must be completed in the relevant sections before publication. Records retained for legal obligations should be restricted from unrelated uses.

Appropriate access controls, account protection and deletion processes are necessary. Backups and exports must be included in those processes, with a documented deletion schedule. No internet-based service can guarantee absolute security.

Subject to the conditions of the GDPR, you have the right to:

• obtain access to your personal data and a copy;
• have inaccurate data corrected and incomplete data completed;
• request deletion;
• request restriction of processing;
• receive data portability where applicable;
• withdraw consent at any time, without affecting processing lawfully carried out before withdrawal;
• object to processing based on Article 6(1)(e) or (f) GDPR on grounds relating to your particular situation.

Direct marketing objection: You may object at any time to processing for direct marketing, including related profiling. We will stop using your data for those purposes.

For other legitimate-interest processing, we will stop processing after an objection unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is needed for legal claims.

Send requests to berlinsalsacongress@gmail.com. We may request proportionate information to verify identity where necessary. We respond within the time limits set by the GDPR, normally one month; any permitted extension will be explained.

You may lodge a complaint with a supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. For the controller's Berlin address, the Berlin Commissioner for Data Protection and Freedom of Information is a relevant authority: https://www.datenschutz-berlin.de.

Family Circle attendance and levels are assigned manually. The chatbot cannot approve booking changes, refunds or loyalty levels. In the confirmed workflows, we do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect you within Article 22 GDPR.

Analytics and advertising technologies may nevertheless analyse behaviour or involve profiling. This is addressed in the relevant sections and consent settings; the absence of Article 22 decisions does not mean that no automated processing occurs.

We may update this policy to reflect actual changes in our services or legal requirements. Where new purposes require additional information or consent, an update alone does not replace those requirements. The published policy should show its actual effective date.