Privacy Policy

This translation is provided for convenience. Only the German version is legally binding.

1. Controller

The controller responsible for processing personal data on this website is:

Nablus Labs UG i.G. (haftungsbeschränkt) Wrangelstraße 77, 10997 Berlin, Deutschland Email: support@ramzihijjawi.me Phone: +4917647134578

2. Overview

We process personal data only as far as necessary to run the website, sell tickets and admit guests to the event. We use no analytics, tracking or advertising services and send no newsletters.

3. Hosting and server log files

The website runs on servers provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen. When you open the website, the server automatically processes data sent by your browser: IP address, date and time of access, page requested, referrer URL, browser type and operating system. This is technically necessary to deliver the website and keep it secure (Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation). Log data is deleted after 14 days at the latest. We have a data processing agreement with the hosting provider under Art. 28 GDPR.

4. Buying tickets

When you buy tickets, we process your name, email address, order details (event, ticket type, quantity, price, time) and payment status. Your name is shown on the tickets. This is necessary to perform the contract (Art. 6(1)(b) GDPR). Without a name and email address we cannot issue tickets.

We keep order and invoice data for eight years because of commercial and tax law obligations (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB). It is deleted afterwards.

When you buy, we create a customer account for your email address (name and email address, no password). Under "My tickets" you can request a sign-in link to that address and then see all your orders. The link works once and for 15 minutes. For this we store the sign-in (time, IP address, browser) and set a session cookie that lasts until you sign out, at most 14 days. The legal basis is Art. 6(1)(b) GDPR. We delete the account on request; order data is kept for the period above.

5. Payment processing by Stripe

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). The checkout page loads Stripe's payment form; you enter your payment details (e.g. card number) directly with Stripe and they are not sent to us. Stripe also receives the amount, the order reference and your name and email address. Stripe sets technically necessary cookies on the checkout page for fraud prevention.

The legal bases are Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR (fraud prevention). Stripe processes some data as an independent controller, for example to meet legal obligations. Data may be transferred to the USA; Stripe is certified under the EU-US Data Privacy Framework and has also concluded standard contractual clauses. More information: https://stripe.com/privacy

6. Sending emails via Resend

We send order confirmations, tickets and sign-in links using Resend (Resend, Inc., USA). This processes your email address, your name and the content of the email (order details and tickets). The legal basis is Art. 6(1)(b) GDPR. We have a data processing agreement with Resend; transfers to the USA are covered by standard contractual clauses.

7. Admission

At the entrance, the QR code on your ticket is scanned. We store whether and when a ticket was used, to stop a ticket from being used more than once (Art. 6(1)(b) and (f) GDPR).

8. Cookies

We only use technically necessary cookies (§ 25(2) no. 2 TDDDG): one cookie that stores your language choice, Stripe's cookies on the checkout page (see section 5) and session cookies for signed-in buyers and administrators (see section 4). No consent is required for these. Fonts are loaded from our own server.

9. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). Contact us at support@ramzihijjawi.me.

You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement.

10. Security

All data is transmitted encrypted (TLS). No automated decision-making, including profiling, takes place.