Privacy Policy

Version: 2 October 2026

1. Controller

FestCrew – proprietor Dominik Happ, Achalmstr. 17, 72664 Kohlberg, Germany, email: support@festcrew.app (hereinafter “we”).

2. Overview: what data we process

FestCrew is a platform through which event organizers organize helper rosters and participant lists for events. In doing so, we process data of organizers (with an account) and of helpers and participants (without an account, who sign up via an event link).

3. Hosting and server log files

Our servers are operated by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen) in data centers within the European Union; a data processing agreement pursuant to Art. 28 GDPR is in place with Hetzner. When the pages are accessed, the web server processes technically necessary data (IP address, time, page accessed, user agent) in log files to ensure operation and to defend against attacks (Art. 6(1)(f) GDPR). The log files are deleted after no more than 14 days.

To measure reach, we count visits to the public entry pages (home page, login, registration, “Create event”, template catalog) on the server side and anonymously. We store only the page accessed, the time, the country derived from the IP address as a two-letter code – the IP address itself is processed only transiently for this purpose and is not stored –, the domain of the referring page and whether the request came from an automated program. The country is determined using a locally stored database (DB-IP) without transferring data to third parties; no cookies are set and no individual persons are recognized (Art. 6(1)(f) GDPR). The count data are deleted after no more than 400 days.

4. Cookies

We use only technically necessary cookies: the session cookie for login, a cookie for the language setting and – for password-protected events – an access cookie with a lifetime of 12 hours that stores the successful password entry for the respective event. No tracking or marketing cookies and no third-party analytics services are used; consent is therefore not required (§ 25 Abs. 2 TDDDG).

Promotional materials (e.g. postcards) may carry campaign links. When such a link is opened we only record, server-side and anonymously, that and when the link was opened or that an event was created or a registration resulted from it – without cookies, without IP addresses or any other identification of individual visitors and without third-party services.

5. Organizer account

For the account, we process the email address, password (as a bcrypt hash only), language, country and time zone for the performance of the contract (Art. 6(1)(b) GDPR). If you set up a passkey for signing in (WebAuthn), we store its public key and an identifier of the passkey; biometric data (e.g. fingerprint) remains exclusively on your device and is never transmitted to us. When the account is deleted, the account data is deleted or – to the extent that statutory retention obligations exist (e.g. invoices) – anonymised.

Unconfirmed accounts: You can create an event without registering. For this we create an account with the email address you provide and store the event data you enter, language, country and time zone and – when you arrived via a campaign link – its identifier (pre-contractual measure, Art. 6(1)(b) GDPR). We send a confirmation link (valid for 24 hours) to that address and, while confirmation is pending, a single reminder with a new link (valid until the account is deleted); once confirmed, the account becomes a regular account. If the address already belongs to an account, you sign in with your password or with a code or sign-in link sent by email (valid for 15 minutes), and the event is assigned to that account. Accounts that are not confirmed are deleted together with their drafts after 14 days.

6. Helper and participant data (processed on behalf of the event organizer)

When helpers sign up for an event or participants register via a participant list, we process the data provided (name, email address, optionally telephone number and group affiliation, and for participants the answers to the details fields defined by the event organizer as well as the selected time slots) on behalf of the respective event organizer. Which details fields are requested is determined solely by the event organizer. The controller under data protection law for this data is the event organizer; we are a processor pursuant to Art. 28 GDPR. The associated data processing agreement (Auftragsverarbeitungsvereinbarung) is concluded electronically for each event upon publication and is available to the event organizer as a PDF. The data is used exclusively for organizing the event (shift schedule, participant sign-ups, confirmation and cancellation emails) and is deleted automatically once the period set by the event organizer after the end of the event has expired (default: 30 days, no more than 90 days); the same period applies to helper and participant data. Helpers and participants are informed of the deletion period when signing up and can cancel their sign-up themselves at any time via their personal management link.

The event data itself (title, date range, duty areas, shifts, lists – without helper data) is subject to fixed retention periods: unpaid or archived events without a payment reference are deleted automatically no later than 3 years after the end of the calendar year of the event. Paid events are retained as evidence of the underlying contractual relationship until the standard limitation period has expired (Sections 195, 199 of the German Civil Code, BGB); the event organizer can therefore delete them at the earliest 3 years after the end of the calendar year of the event. No later than 10 years after the end of the calendar year, paid events are also deleted automatically.

7. Email delivery

For sending system emails (confirmations, magic links, invoice notifications), we use the service Brevo (Brevo SAS, 106 Boulevard Haussmann, 75008 Paris, France) as a processor within the EU. The recipient address, subject and content of the respective email are transmitted.

8. Payments and invoices

For paid publications, we process the invoicing data (organization, address, VAT ID where applicable) for the performance of the contract and on the basis of statutory obligations (Art. 6(1)(b) and (c) GDPR). Invoices and payment records are stored in unalterable form in accordance with the retention periods under commercial and tax law (Section 147 of the German Fiscal Code (AO), Section 257 of the German Commercial Code (HGB)) for 10 years from the end of the calendar year in which the invoice was issued and are deleted automatically once this period has expired. A VAT ID provided is verified via the European Commission's VAT Information Exchange System (VIES).

The payment itself is processed via the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). During the payment process you are redirected to Stripe's pages; your email address, the name or organization and the address from your invoicing data as well as the amount, the purpose of the payment and a reference to the event concerned are transmitted there. From this information Stripe creates a permanent customer record, which we reuse for further payments. You enter your payment details (e.g. card details) directly with Stripe; for their processing, Stripe is in part an independent controller. This may involve a transfer of data to the parent company Stripe, Inc. in the USA; Stripe is certified under the EU-U.S. Data Privacy Framework, and standard contractual clauses are in place in addition. The legal basis is Art. 6(1)(b) GDPR.

If your billing country is outside Germany, Stripe (seller: Link Commerce) acts as the seller of the paid publication (merchant of record) and is an independent controller for processing the purchase, including tax calculation and invoicing; in that case you receive the invoice from Stripe. We store a copy of this invoice (containing the name or organization and the address) as evidence of the purchase and make it available for download in your account; the retention periods stated above apply to this copy (Art. 6(1)(b), (c) and (f) GDPR).

9. Support requests

For support requests, we process the information contained in the request in order to handle it (Art. 6(1)(b) or (f) GDPR); requests are deleted automatically 90 days after they have been resolved.

10. Direct marketing to clubs and organizations

To make FestCrew known to clubs, day-care centers, schools and similar organizations, we research publicly available information about such organizations (e.g. on their websites, in club directories or in the register of associations) and store it in an internal prospect database. The data processed comprises: the organization's name, address and category, information about its events, the place where the information was found (source) and – where publicly stated – the name and contact details of a contact person (e.g. board member or head).

We use this data exclusively to inform the organizations about FestCrew by postal mail (letter or postcard) and for the internal evaluation of the success of these mailings; for this purpose we keep internal notes and an internal assessment of whether an organization may be a suitable prospect – both relating to the organization, not to individual persons. We do not send marketing emails and do not make marketing calls; researched email addresses and telephone numbers serve solely to identify the organization unambiguously. The data is not passed on to third parties.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in direct marketing of our service to organizations for which it may be relevant (cf. recital 47 GDPR). As we do not collect the data from the data subjects themselves, we hereby provide the information required by Art. 14 GDPR; at the latest with the first mailing we refer to this privacy policy.

We erase personal data – in particular the name and contact details of the contact person as well as personal email addresses and telephone numbers – as soon as it is established that contacting the organization is not (or no longer) envisaged, and in any event no later than 3 years after the last contact or – if no contact has been made – after the data was collected. Information relating solely to the organization itself (e.g. name, category, public address, website, information about its events and the processing status) may be retained beyond that period in order to avoid duplicate records in future research and to avoid contacting organizations again that have objected or for which contact is not envisaged. You may object at any time, without giving reasons, to the processing of your data for direct marketing purposes (Art. 21(2) GDPR) – e.g. by email to support@festcrew.app. After an objection we will no longer contact the data subject; for this purpose we merely keep a suppression record containing the data required to honor the objection.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise these rights, please contact support@festcrew.app. If your request concerns helper or participant data of an event, we may forward it to the event organizer responsible or assist them in responding.

You also have the right to lodge a complaint with a data protection supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).

12. No automated decision-making

No automated decision-making, including profiling, takes place.