Privacy Policy

1. Controller

The controller responsible for processing personal data on this website, in the Android and iOS app and in connection with our offers is:
XO Festival
Owner: M. Uzbay
Breite Strasse 94
47798 Krefeld
Email: info@xo-festival.de

2. General information about processing

We process personal data only where necessary to operate xo-festival.de, the Android and iOS app, XO Accounts, the DJ directory, Specials, points, event pages, ticket sales, payment processing, visitor communication, audience measurement and marketing. Personal data is any information relating to an identified or identifiable person. Processing is based on the applicable provisions of the GDPR and German law.

3. Server logs and technical delivery

When you access the website, technical data such as IP address, time, requested page, referrer, browser, operating system and response status may be processed in server logs. This is necessary to deliver the website securely, investigate faults and prevent misuse. The legal basis is Art. 6(1)(f) GDPR.

4. Cookies and similar technologies

We use cookies and similar technologies. Technically necessary cookies support sessions, security and checkout functions. Google Analytics, Meta Pixel and, where configured, TikTok Pixel use cookies or comparable identifiers to measure page views, usage and campaign performance. Technically unnecessary storage or access requires consent under section 25 TDDDG. Visiting the website or acknowledging this policy is not such consent.

5. Google Analytics

We use Google Analytics to understand the use of the website, event pages and ticket checkout. Google Analytics is configured for this website through Google Tag Manager. Usage and device information, campaign parameters and purchase events may be transmitted to Google, including server-side measurement. Where consent is required, processing must be based on Art. 6(1)(a) GDPR; consent may be withdrawn for the future. Google may process data outside the European Economic Area under the safeguards applicable to its service.

6. Meta Pixel

The Meta Pixel may record visits, interactions and purchase-related events so that we can measure advertising and create relevant audiences. The Pixel is embedded in the website; purchase events may also be sent server-side. Matching data may include hashed contact details, cookie identifiers, IP address, browser information and campaign references. Hashing is pseudonymisation, not anonymisation. Where consent is required, processing must be based on Art. 6(1)(a) GDPR. Meta may process data under its own responsibility, including outside the European Economic Area, subject to the safeguards applicable to its services.

TikTok Pixel and Events API

Where enabled, TikTok Pixel and Events API measure campaigns and purchase events. Usage events, cookie/click identifiers, IP address, browser information, order references and hashed contact data may be sent to TikTok Technology Limited, Ireland. Processing in other countries is possible. The same consent requirements apply as for the marketing technologies above. See TikTok's privacy policy.

7. Meta app, Instagram and Facebook

For technical connections to our Instagram and Facebook channels we use a Meta app and the Meta Graph API. If you contact or interact with us through these services, we may process identifiers, profile information made available to us, message content and technical metadata in order to respond, moderate content and manage communication. Meta Platforms Ireland Limited also processes data under its own privacy terms.

8. Contact form and direct enquiries

When you use our contact form or contact us directly, we process the details you provide, including name, email address, subject and message, to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR for pre-contractual or contractual enquiries and otherwise Art. 6(1)(f) GDPR.

9. Pre-registration, event registration and ticket updates

For pre-registrations, event registrations and ticket updates, we process the contact details, event selection, date of birth and confirmations you provide. Older registrations may contain only the year of birth. This allows us to record your interest, confirm registrations and inform you about the selected event. Processing is based on your request under Art. 6(1)(b) GDPR or, where applicable, your consent under Art. 6(1)(a) GDPR.

10. Ticket purchases and contract performance

During ticket purchase we process checkout details, including your name, contact details, gender, date of birth and billing country, as well as customer and recipient information, selected tickets, amounts, order status, payment references and invoice data. Older orders may contain only the year of birth. The purposes are contract performance, ticket delivery, admission control, customer service, accounting and the prevention of duplicate or fraudulent transactions. The legal bases are Art. 6(1)(b) and (c) GDPR and, for security interests, Art. 6(1)(f) GDPR.

11. Payments through PayPal and Revolut

Ticket payments are processed through PayPal or Revolut Pay. When you select a payment method, the data necessary for processing is transmitted to the selected provider. Payment providers process data under their own responsibility and privacy terms. We receive transaction references and status information, but not your full payment credentials.

12. Order and payment emails

We use the contact details provided to send transactional emails about orders, payment status, tickets, invoices and important event-related changes. These messages are required to perform the contract and are not marketing newsletters.

13. Recipients and service providers

Data may be shared where necessary with hosting, email, payment, analytics, advertising, app infrastructure and other technical service providers. Processors are bound by appropriate agreements. Data is disclosed to authorities or other recipients only where required by law or necessary to establish, exercise or defend legal claims.

The app uses Expo for push and update infrastructure, Google for sign-in and Android push, Apple for iOS sign-in and push, and Sentry for diagnostics. These services receive data transmitted for the respective functions described here; accounts and the DJ directory are managed on XO infrastructure. Provider information: Expo, Google and Apple.

14. Android and iOS app and push notifications

The XO Festival app is available for Android and iOS. Push notifications are activated only after your explicit permission. A device-specific push token and technical delivery data are then processed through Expo and, on Android, Firebase Cloud Messaging; Apple Push Notification service may be used on iOS. You can disable notifications in the app or device settings at any time.

Ticket purchases in the app: For events with in-app ticket sales, you enter the buyer details listed in section 10 directly in the app, which transmits them to our servers in encrypted form. So that you can continue a started purchase after restarting the app, the app keeps the reservation identifier and a random access key in your device's protected storage until the order is completed or has expired. For payment, the app opens the PayPal or Revolut page in a browser window (section 11); payment details are never entered or processed in the app.

Specials and prize draws: For the 11:11 reaction game, we store started attempts, measured times in milliseconds and the resulting ranking with your XO Account. This lets us enforce the daily attempt limit, compare best times and select winners after the game. Game attempts and leaderboard rows are deleted with the account when it is deleted.

Local app data and permissions: Sign-in tokens and technical reservation data use protected device storage. Tickets, invoices and ticket PDFs are cached by account and device in private app storage for offline access. Public content and settings are also cached. Logout and account deletion initiate removal of personal caches and PDFs; storage failures can prevent complete local deletion. App/device settings can then be used to remove app data. You choose individual photos with the system picker; we do not upload your entire library. Sharing, directions and calendar actions use system or browser features without requesting access to your contacts, calendar or precise device location. Mobile sign-in tokens are limited to 90 days; expiry does not automatically delete local offline tickets. The legal basis is Art. 6(1)(b) GDPR; necessary local storage serves expressly requested functions (section 25(2)(2) TDDDG).

Own diagnostic channel and app updates: Technical error identifiers, error type, platform, app/build version, operating system and technical route path may be sent to our diagnostic endpoint and logged. Free-form message contents, passwords and payment data are not part of this diagnostic payload. Checking and downloading compatible app updates connects to Expo's update infrastructure and involves IP address, technical request data and app/runtime version information. This is based on legitimate interests in fixing errors and secure operation (Art. 6(1)(f) GDPR), and for necessary contractual updates also Art. 6(1)(b) GDPR.

Error diagnostics with Sentry: In distributed app versions, we use Sentry (Functional Software, Inc., USA) to identify errors and crashes and keep the app stable. Technical reports include stack traces, app version and build, operating system, device model and technical navigation or network events. Your IP address may also be processed during transmission. We use Sentry's EU data region; access from other countries, particularly the USA, remains possible. The app removes account profiles, additional free-form data fields and URL query parameters from JavaScript error reports. Screenshots, screen recordings (Session Replay) and performance tracing are disabled. The legal basis is our legitimate interest in secure and stable app operation (Art. 6(1)(f) GDPR). For more information, see Sentry's privacy policy.

Optional app analytics: With your consent, we use Google Analytics for Firebase (Google Ireland Limited) to measure screen views, public event views, checkout steps, opened push notifications and confirmed ticket purchases. Google processes a random app installation identifier, session identifier, app version, operating system, device model and usage events. During transmission your IP address may be processed and used to derive an approximate location. For confirmed purchases our server transmits the order reference, ticket type, quantity, currency and amount with the app identifier. Names, email addresses, Friends IDs and payment credentials are not transmitted for this app analytics. Advertising identifiers, personalised advertising and cross-account user identification are disabled. Analytics remains off without consent. You can withdraw consent at any time under Mehr → App-Analyse; this stops future collection and resets the local analytics identifier. Withdrawal does not automatically delete previously transmitted data. Identifier-associated user and event data in GA4 currently have a 14-month retention setting; new user activity restarts the user-data retention period. Aggregated reports may remain available longer. Processing outside the EEA, particularly in the USA, is possible under the safeguards applicable to Google's service. The legal bases are Art. 6(1)(a) GDPR and section 25(1) TDDDG. See Google's privacy policy.

15. XO Account, Google/Apple sign-in and profile picture

Your optional account picture is private. When you send a friendship request, its recipient can see your first name and picture. After a request is accepted, both friends can see each other's first name and optional picture. Requests and friend lists do not display surnames or email addresses.

For an XO Account we process your name, gender, email address, password hash, verification status, date of birth required for a new registration (which can later be cleared), sessions and account preferences. If you use Google sign-in, we receive only the data required for sign-in from the openid, email and profile permissions. A profile picture is optional and can be replaced or deleted. Account data is used to provide the account, link eligible purchases and registrations, and secure access.

Sign in with Apple: On iOS, we process Apple's verified account identifier, the supplied email address (including an Apple relay address) and, where supplied, your name. Necessary Apple credentials are used to verify and revoke the link; we do not receive your Apple password. Account deletion triggers revocation. Account and sign-in management are based on Art. 6(1)(b) GDPR, and abuse prevention on Art. 6(1)(f) GDPR.

Public artist profile (DJ profile): If you voluntarily create an artist profile, we publish your artist name, your main photo and up to three additional photos, federal state, genres, short biography and submitted links in the public artist directory. Guests can also see these details; private account information such as your email address is not displayed. You can edit or delete your artist profile and its photos. Deleting the profile or account removes the artist profile and all of its photos. For moderation, we process profile reports and your account-based hidden-artist preferences; hiding artists is available only to signed-in users. There is no automatic content review or external transmission for content review. Publication requested by you is based on Art. 6(1)(b) GDPR; report handling, publication suspensions and admin audit records on our legitimate interest in protecting users and third-party rights (Art. 6(1)(f) GDPR). Reports contain a profile reference, reason, optional explanation and, for signed-in users, an account reference. Do not include unnecessary sensitive data about others. Reports and moderation records can remain after profile or account deletion for handling and abuse prevention as long as necessary; Profile references are removed when the profile is deleted. Hidden-artist preferences and reports retain the affected account reference and artist name after profile deletion so recreating a profile does not bypass moderation. Account deletion removes the corresponding hidden-artist preferences and account references. Third parties may copy public content, and we cannot fully recall their independent copies. Opening a profile link connects you to the external platform and its own data processing.

16. XO Status, points, invitations and check-ins

To provide XO Status functions, we may process qualifying ticket purchases, attendance check-ins, invitation relationships, point transactions, status tiers and audit information. This allows us to display progress and benefits, correct errors, process refunds and detect misuse. The legal basis is contract performance and our legitimate interest in securely operating the loyalty functions.

Friendships by Friends-ID: A request requires entering a Friends-ID; there is no name search. A mutual friendship is created only when its recipient explicitly accepts. You can decline or cancel requests and remove friends, which ends the corresponding access to the first name and picture. Removing a friend preserves an existing inviter assignment and its bonus rules. To allow no more than two requests per sender and recipient overall, we retain resolved requests until either account is deleted. Requests and friend lists are not persistently stored in the app. Enabled push notifications announce new requests and acceptance without names or Friends-IDs. This processing provides the account function you request.

17. Request deletion of app, Meta and form data

You can request deletion through Delete your data or by emailing info@xo-festival.de. We verify the request and delete or anonymise data within our responsibility unless legal retention duties or other lawful grounds apply. Data processed independently by external providers must also be managed with those providers.

Legal bases, external services and providing data

Necessary ticket purchases, free registrations, account functions and promotion administration are based on Art. 6(1)(b) GDPR, and legally required invoice and accounting records on (c). General enquiries, security and moderation are based on (f); newsletter advertising outside statutory exceptions requires separate consent under (a). Account registration, creating a DJ profile or acknowledging this policy is not newsletter or tracking consent. Missing mandatory information prevents us from providing the requested function; additional links and non-required information are optional. There are no solely automated decisions with legal or similarly significant effects. Rankings and points are functional calculations; administrators select winners and take moderation measures.

External services may involve transfers or access outside the European Economic Area. The requirements of Art. 44 et seq. GDPR must be met, for example by a valid adequacy decision covering the specific recipient or appropriate safeguards such as EU standard contractual clauses. Information about the safeguards for a specific service can be requested at info@xo-festival.de.

18. Retention periods

We retain personal data only for as long as required for the relevant purpose. Contract, payment, invoice and accounting records may be retained for longer to comply with commercial and tax law. Enquiries, pre-registrations and communication data are deleted when they have been dealt with and no legal obligation or legitimate interest requires continued storage.

19. Your rights

Subject to the statutory requirements, you have the right of access, rectification, erasure, restriction of processing, data portability and objection to certain processing. Where processing is based on consent, you may withdraw consent at any time for the future. You may contact us using the details above to exercise these rights.

20. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for North Rhine-Westphalia is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.