Privacy Policy

Please note: You are viewing the English version of the website. The legally binding version of this document is the German original, which you can find here.

1. Controller

The controller responsible for processing personal data on this website and in connection with ticket sales is:
XO Festival / Fasskeller Krefeld
Owner: K. Tuközoglu
Hülser Strasse 8
47798 Krefeld
Email: info@xo-festival.de

2. General information about processing

We process personal data only where necessary to operate xo-festival.de, event pages, ticket sales, payment processing, visitor communication, audience measurement and marketing. Personal data is any information relating to an identified or identifiable person. Processing is based on the applicable provisions of the GDPR and German law.

3. Server logs and technical delivery

When you access the website, technical data such as IP address, time, requested page, referrer, browser, operating system and response status may be processed in server logs. This is necessary to deliver the website securely, investigate faults and prevent misuse. The legal basis is Art. 6(1)(f) GDPR.

4. Cookies and similar technologies

We use cookies and similar technologies. Technically necessary cookies support sessions, security and checkout functions. Subject to the consent settings shown to you, Google Analytics and Meta Pixel may use cookies or comparable identifiers to measure page views, usage and campaign performance. You can change or withdraw consent for the future at any time through the available consent settings.

5. Google Analytics

We use Google Analytics to understand the use of the website, event pages and ticket checkout. Depending on your consent, usage and device information may be processed and transmitted to Google. The legal basis is Art. 6(1)(a) GDPR; consent can be withdrawn for the future. Google may process data outside the European Economic Area under the safeguards applicable to its service.

6. Meta Pixel

The Meta Pixel may record visits, interactions and purchase-related events so that we can measure advertising and create relevant audiences. This processing occurs only where the required consent has been given and is based on Art. 6(1)(a) GDPR. Meta may process data under its own responsibility, including outside the European Economic Area, subject to the safeguards applicable to its services.

7. Meta app, Instagram and Facebook

For technical connections to our Instagram and Facebook channels we use a Meta app and the Meta Graph API. If you contact or interact with us through these services, we may process identifiers, profile information made available to us, message content and technical metadata in order to respond, moderate content and manage communication. Meta Platforms Ireland Limited also processes data under its own privacy terms.

8. Contact form and direct enquiries

When you use our contact form or contact us directly, we process the details you provide, including name, email address, subject and message, to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual enquiries and otherwise Art. 6(1)(f) GDPR.

9. Pre-registration and ticket updates

For pre-registrations and ticket updates, we process the contact details, event selection and confirmations you provide. This allows us to record your interest, confirm registrations and inform you about the selected event. Processing is based on your request under Art. 6(1)(b) GDPR or, where applicable, your consent under Art. 6(1)(a) GDPR.

10. Ticket purchases and contract performance

During ticket purchase we process checkout details, customer and recipient information, selected tickets, amounts, order status, payment references and invoice data. The purposes are contract performance, ticket delivery, admission control, customer service, accounting and the prevention of duplicate or fraudulent transactions. The legal bases are Art. 6(1)(b) and (c) GDPR and, for security interests, Art. 6(1)(f) GDPR.

11. Payments through PayPal and Revolut

Ticket payments are processed through PayPal or Revolut Pay. When you select a payment method, the data necessary for processing is transmitted to the selected provider. Payment providers process data under their own responsibility and privacy terms. We receive transaction references and status information, but not your full payment credentials.

12. Order and payment emails

We use the contact details provided to send transactional emails about orders, payment status, tickets, invoices and important event-related changes. These messages are required to perform the contract and are not marketing newsletters.

13. Recipients and service providers

Data may be shared where necessary with hosting, email, payment, analytics, advertising, app infrastructure and other technical service providers. Processors are bound by appropriate agreements. Data is disclosed to authorities or other recipients only where required by law or necessary to establish, exercise or defend legal claims.

14. Android and iOS app and push notifications

The XO Festival app is available for Android and iOS. Push notifications are activated only after your explicit permission. A device-specific push token and technical delivery data are then processed through Expo and, on Android, Firebase Cloud Messaging; Apple Push Notification service may be used on iOS. You can disable notifications in the app or device settings at any time.

15. XO Account, Google sign-in and profile picture

For an XO Account we process your name, email address, password hash, verification status, optional date of birth, sessions and account preferences. If you use Google sign-in, we receive only the data required for sign-in from the openid, email and profile permissions. A profile picture is optional and can be replaced or deleted. Account data is used to provide the account, link eligible purchases and registrations, and secure access.

16. XO Status, points, invitations and check-ins

To provide XO Status functions, we may process qualifying ticket purchases, attendance check-ins, invitation relationships, point transactions, status tiers and audit information. This allows us to display progress and benefits, correct errors, process refunds and detect misuse. The legal basis is contract performance and our legitimate interest in securely operating the loyalty functions.

17. Request deletion of app, Meta and form data

You can request deletion through Delete your data or by emailing info@xo-festival.de. We verify the request and delete or anonymise data within our responsibility unless legal retention duties or other lawful grounds apply. Data processed independently by external providers must also be managed with those providers.

18. Retention periods

We retain personal data only for as long as required for the relevant purpose. Contract, payment, invoice and accounting records may be retained for longer to comply with commercial and tax law. Enquiries, pre-registrations and communication data are deleted when they have been dealt with and no legal obligation or legitimate interest requires continued storage.

19. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing, data portability and objection to certain processing. Where processing is based on consent, you may withdraw consent at any time for the future. You may contact us using the details above to exercise these rights.

20. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.