1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Tobias Kloy
c/o Block Services
Stuttgarter Str. 106
70736 Fellbach
Germany
Telephone: 06836 7789 851
Email: studio@neunzignullnull.de
No data protection officer has been appointed because there is no legal requirement to do so.
2. General information on data processing
We process personal data only as necessary to operate this website and its features. All data is processed on our own server in Germany. No data is transferred to countries outside the European Union. Your data is not passed on or sold for advertising purposes.
This website uses TLS encryption (HTTPS), so third parties cannot read the data you send us in transit.
3. Hosting and server logs
When you visit the website, our server automatically processes technically necessary data: anonymised IP address, date and time of access, page accessed, referrer URL, and browser and operating system information (user agent). IP addresses are stored only in anonymised form, so they cannot be linked back to you.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interests are providing the website, maintaining its stability and security, preventing attacks and diagnosing errors.
This also applies to our festival widget, which operators of other websites can embed on their pages: when it is displayed, your browser loads the script, festival data and, if enabled, images directly from our server. The widget sets no cookies and contains no tracking; only the technically necessary data listed above is processed.
4. Cookies
This website uses only technically necessary cookies: a session cookie and a cookie that protects forms against cross-site request forgery. These contain no tracking information, are not used for advertising and expire automatically after no more than two hours.
The legal basis is Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), concerning strictly necessary storage, together with Article 6(1)(f) GDPR. We use no optional or tracking cookies, so a cookie banner is not required.
5. Web analytics (self-hosted Matomo)
We use Matomo to measure website reach. Matomo runs exclusively on our own server; no data is transferred to third parties. It is configured without analytics cookies, IP addresses are anonymised, and we respect your browser’s Do Not Track setting: if enabled, no data is collected.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is analysing usage statistics to improve the site. Anonymisation excludes identification as far as possible.
6. Maps (OpenStreetMap through our own server)
Our maps use tiles based on OpenStreetMap, served solely through our own server (tile proxy). Your browser does not connect to third-party servers for these tiles, and no personal data is transmitted to them. The legal basis for the associated technical processing is Article 6(1)(f) GDPR (providing the map feature).
7. Weather data
Festival pages show a seven-day forecast. Our server retrieves the data once a day using the event venue’s coordinates, not your location or your browser. No personal data, especially your IP address, is transmitted. The weather provider is identified next to the forecast.
8. Festival submissions
When you submit a festival, we collect your email address solely to acknowledge receipt, inform you of publication or rejection, and ask follow-up questions if necessary. Your address is not published and is automatically deleted no later than 90 days after the review is complete. The legal basis is Article 6(1)(b) GDPR (handling your request).
You may also optionally provide the organiser’s official contact address. This is a business contact detail for the festival. After editorial review, it is linked as a contact button on the festival page for visitors’ enquiries. The legal basis is Article 6(1)(f) GDPR (providing complete event information). Organisers may request its removal at any time using the details in our legal notice.
9. Change and line-up suggestions
When you use “Suggest a change” on a festival or artist detail page, we collect your name, email address and suggestion text solely to review the suggestion and tell you whether it was accepted or rejected. Your name and email address are not published and are automatically deleted no later than 90 days after the decision. The suggestion text is subsequently retained without a link to you. The legal basis is Article 6(1)(b) GDPR (handling your request).
10. Questions for organisers
When you submit a question about a festival, we collect your email address, optionally your first name, and the question text. We review each question and then forward it to the organiser’s contact address without your name or email address. After a further editorial review, we publish the question and answer on the festival page. Only the question text and answer are published, never your name or address. We email you with the answer, or to tell you that we have not published your question.
The legal basis for handling the question and notifying you of the answer is Article 6(1)(b) GDPR. Publishing the question and answer is based on Article 6(1)(f) GDPR (providing useful event information to all visitors). Your first name and email address are automatically deleted no later than 90 days after publication or rejection; the question and answer remain without personal attribution.
Organisers may stop receiving visitor questions at any time using the unsubscribe link in our email. In that case, we keep the contact address on a suppression list solely to prevent further questions being sent to it (Article 6(1)(c) and (f) GDPR, implementing the objection). We keep it there for as long as the objection remains in effect and remove the block on request.
11. My area: update subscriptions and saved festivals
In “My area”, you can create passwordless access using your first name and email address, save festivals and manage your update subscriptions. Sign-in uses a time-limited link sent by email; no password is stored. The legal basis for this area is Article 6(1)(b) GDPR. You can delete your account at any time: “Delete account” permanently removes your data, saved festivals, subscriptions, ratings and uploaded photos. You can also contact us using the details in section 1; we delete your record even if it has no remaining entries.
Saved festivals
The saved list stores only which festivals you have assigned to your account. You can remove entries at any time. When the last entry is removed and there are no active subscriptions, ratings or photos, your record is deleted.
Festival radar
You can enable “Festival radar” in your account: an email at most once a week about new festivals matching your saved list, new editions of saved events and the dates of your upcoming festivals. We use only your own saved list (the categories and countries of saved festivals). The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time using the switch in your account or the disable link in each radar email.
Update subscriptions
You can subscribe to updates on a festival detail page. We collect your first name and email address. We send a confirmation email after you sign up (double opt-in); we send updates only after you confirm your address, for example when the date, venue, line-up, price or description of the event changes. We use this data solely for update emails and do not pass it on to third parties.
The legal basis is your consent (Article 6(1)(a) GDPR). You may withdraw it at any time for the future: every update email contains an unsubscribe link, you can cancel all subscriptions at once via “Unsubscribe from updates” in the footer, or you can contact us using the details in section 1. After you unsubscribe, we delete your data unless other subscriptions, saved entries, ratings or photos remain. Unconfirmed sign-ups are automatically deleted after seven days.
Series ratings and visitor photos
If you rate a festival series or upload a photo, we store the link to your passwordless account, the year, the stars and optional review text, or the image and optional caption. You can choose a year that has no listed edition. We publish contributions only after editorial review. Your first name appears with ratings. For photos, we publish the approved image, year and optional caption. For new photo uploads, we also publish your first name alongside the photo and in the image viewer after approval. Photos uploaded before this change remain unattributed unless you choose to show your name. Your email address is never displayed publicly. Before approval, images are stored privately on our server. We convert images to WebP, limit their resolution and remove file metadata such as location data.
The legal basis for ratings, photo uploads and the announced first-name publication with new photos is Article 6(1)(b) GDPR. If you later choose to show your first name with an older photo, this is based on your consent (Article 6(1)(a) GDPR). You may withdraw this consent at any time on the photo upload page. You can also hide your first name on newer photos there without deleting the photo. You can delete your ratings and photos in your account or on the upload page; photo files are removed too. Deleting your account removes all associated contributions. We do not share them with third parties for advertising.
12. Contacting us
If you contact us by email or telephone, we process the data you provide (such as your name, contact details and message) to handle your enquiry. The legal basis is Article 6(1)(b) GDPR where your enquiry concerns a service offered by the website; otherwise it is Article 6(1)(f) GDPR. We delete the data once it is no longer needed to handle your enquiry, unless a statutory retention obligation applies.
13. Editorial information about artists
Artist pages contain editorially reviewed information about performing artists (stage name, description, official website and, where applicable, a credited photo). This information comes from publicly available sources, in particular official websites and press materials. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is providing editorial information about publicly performing artists. The people concerned may contact us at any time to have information corrected or removed (see sections 15 and 16).
14. Retention periods
Unless a more specific period is stated in this policy, we keep personal data only as long as necessary for the relevant purpose. We then delete or anonymise it unless statutory retention requirements apply.
15. Your rights
You have the following rights against us:
- Access to processed data (Article 15 GDPR);
- Correction of inaccurate data (Article 16 GDPR);
- Erasure (Article 17 GDPR);
- Restriction of processing (Article 18 GDPR);
- Data portability (Article 20 GDPR).
Right to object (Article 21 GDPR): You may object at any time, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR. We will then stop processing the relevant data unless there are compelling legitimate grounds for doing so.
To exercise your rights, an informal message to the contact details in section 1 is sufficient.
16. Right to complain to a supervisory authority
You have the right to complain to a data protection supervisory authority (Article 77 GDPR). The authority responsible for us is the Independent Data Protection Centre of Saarland (Unabhängiges Datenschutzzentrum Saarland), Fritz-Dobisch-Straße 12, 66111 Saarbrücken. You may also contact the authority where you live.
17. No automated decision-making
We do not use automated decision-making, including profiling, within the meaning of Article 22 GDPR.
18. Changes to this policy
Last updated: July 2026. We update this privacy policy when the website or the legal situation changes.