← Back to the start page

Privacy

This website is deliberately built lean. We set no cookies of our own and store nothing on your device. The page, the fonts and the visitor statistics all come from our own server. The one exception is the aftermovie, which is loaded from YouTube. What that means is explained below.

Our ticket shop is a separate matter — you will find it further down under Ticket shop.

Controller

Xenobase Events Pehr, Leinemann & Bork GbR
Goebenstr. 19, 65195 Wiesbaden, Germany
Email: kontakt@xenobase.de

Further details in the imprint. For data protection matters you can also write to us directly at datenschutz@xenobase.de.

Server log files

When you open the page, our host processes technically necessary data that your browser transmits automatically: the page requested, date and time, the volume of data transferred, browser type and IP address. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in stable and secure operation. This data is not combined with any other sources.

Hosting

The site runs on our own server at Hostinger International Ltd, Jonavos g. 60C, 44192 Kaunas, Lithuania. The server itself is located in Frankfurt am Main, Germany, so no transfer to a third country takes place. We have concluded a data processing agreement with the provider under Art. 28 GDPR. Details are in Hostinger's own privacy policy.

Fonts

The fonts used are delivered by our own server. There is no connection to Google Fonts and your IP address is not transmitted to any third party.

The aftermovie from YouTube

The aftermovie is hosted on YouTube and embedded directly on the front page. The player is loaded from youtube-nocookie.com as soon as you reach the Aftermovie section — no click is required. From that moment on, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes data under its own responsibility, including your IP address, information about your browser and device, and the address of the page you came from. A transfer to Google LLC in the United States cannot be ruled out.

Because we use youtube-nocookie.com, YouTube only sets cookies once you actually play the video. As long as you do not reach that section, no connection to YouTube is established at all.

The legal basis for the embedding is our legitimate interest in presenting the festival attractively, Art. 6(1)(f) GDPR. More on this in Google's privacy policy.

Cookies

We set no cookies of our own on this website and store nothing on your device. You therefore do not need a consent banner here. Only if you start the aftermovie does YouTube set its own cookies, see the section above.

The ticket shop at tickets.xenobase.de works slightly differently: it needs a few cookies for the shopping cart and sign-in to work at all. There is no tracking there either, so no consent banner is needed there. What the shop stores is set out under Ticket shop.

Visitor statistics with Umami

We want to know how many people visit the site and how they found their way here. For this we use Umami, open-source software running on our own server in Frankfurt am Main, Germany. No further provider is involved and nothing leaves the EU.

What is counted: the page requested, the referring source such as Instagram or Google, the country of origin, device type, browser and screen size. Umami works without cookies and without any identifier that would recognise you across several visits. Your IP address is used only briefly to determine the country and is not stored. The figures are therefore anonymous — we cannot draw any conclusion about you as a person.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in understanding whether our posts reach people. Consent under Section 25 TDDDG is not required, because nothing is stored on or read from your device.

Advertising

There is currently no advertising pixel on this site — not from Meta, TikTok or anyone else. Should that change, we will ask you for permission beforehand and name the provider here.

External links

We link to Instagram, TikTok, Google Maps, Google Calendar, Outlook Calendar and the ticket shop. Only when you click such a link do you leave this site, and the privacy terms of the respective provider then apply. Nothing is loaded from these providers before that.

Contacting us by email

If you write to us, we process your details solely in order to deal with your enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR. We do not pass this data to third parties and delete it once the enquiry has been dealt with and no retention obligations stand in the way.

Waiting list for the ticket drop

On the home page you can put your email address on our list. We then write to you as soon as advance sale starts, and in between when there is festival news.

For this we process your email address, the language of the page you signed up on, and the times of your sign-up and your confirmation. We need those times as proof that the sign-up came from you. We do not store your IP address.

Sign-up uses the double opt-in procedure: after you submit the form you get an email with a confirmation link. Only when you click it are you on the list. If you do not click, we delete the pending entry automatically after seven days.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future: every email carries an unsubscribe link, and one click deletes your address completely. You can also simply write to datenschutz@xenobase.de.

The addresses are held in a database on our own server in Frankfurt am Main. Sending runs through our own mail server at mail.xenobase.de, on that same machine. No newsletter provider is involved and your address is not passed on to anyone. We delete it as soon as you unsubscribe, and at the latest once the festival is over and we no longer need the list.

Ticket shop

We run our ticket shop at tickets.xenobase.de ourselves, using the open-source software pretix on our own server. Your order data does not go to an external ticketing company — it stays with us.

The server is operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. We have concluded a data processing agreement with IONOS under Art. 28 GDPR.

The shop loads no fonts from Google and contains no analytics or tracking service. It only sets the cookies it needs to work: a session identifier, protection against form abuse, and the link to your shopping cart. These cookies are technically necessary within the meaning of Section 25(2) no. 2 TDDDG, so we do not ask for your consent for them.

What we process when you buy a ticket

To sell you a ticket and send it to you, we need your email address. Alongside it we process the data your order produces anyway: order number, time of order, tickets and items purchased, price, payment method, order status, and the QR code on your ticket.

You may provide a billing address, but you do not have to. We only need it if you require an invoice showing a full address — for instance because you are buying for a business, or because your order exceeds 250 euros.

The legal basis is Art. 6(1)(b) GDPR, performance of our contract with you. Without this data we cannot sell you a ticket.

Payment

Depending on how you pay, different providers are involved:

From these providers we only receive confirmation of whether your payment succeeded, a transaction number and the amount. We never see your card or login details — you enter them directly with the payment provider.

The payment providers process your data as controllers in their own right, not on our behalf. What happens there is set out in their own privacy notices: PayPal · SumUp

The legal basis is Art. 6(1)(b) GDPR.

Invoices

We issue an invoice for your order and send it to you by email. We are required to retain invoices for ten years under Section 147 of the German Fiscal Code and Section 14b of the German VAT Act. We therefore cannot delete this data, even at your request. It is held by us and by our tax advisors, who act for us within the statutory framework.

The legal basis is Art. 6(1)(c) GDPR, compliance with a legal obligation.

Emails about your order

We send order confirmation, payment confirmation, invoice and ticket by email, using the mail server of STRATO GmbH, Pascalstraße 10, 10587 Berlin, with whom we have also concluded a data processing agreement. We do not send you advertising — only what relates to your order.

The legal basis is Art. 6(1)(b) GDPR.

Admission to the event

At the entrance we scan the QR code on your ticket. We record that the ticket was redeemed, when, and on which device, so that the same ticket cannot be used twice. The legal basis is Art. 6(1)(b) GDPR.

Merchandise pre-orders

If you pre-order a shirt, we store the item and size against your order and record whether you collected it. If you withdraw from the purchase, we additionally need your name and bank details in order to refund you.

The legal basis is Art. 6(1)(b) GDPR.

Shop server logs

Like any website, the shop logs technical access data: IP address, time, requested address, status code, browser type. We need this to find faults and fend off attacks. These logs are deleted after seven days.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure operation.

How long we keep order data

We delete your contact details and the information relating to your order three months after the event. Until then we need them to handle questions, refunds and withdrawals.

Invoices and the data they contain are excluded — we must retain those for ten years, as set out above.

Photography and filming at the event

Photographs and video are taken at our events. We use the material for the aftermovie, the website and social media. If you would rather not appear in a picture, tell the team on site or write to us afterwards at kontakt@xenobase.de.

Your rights

You have the right to:

Write to us at datenschutz@xenobase.de to exercise any of these.

One note on erasure: while the statutory retention period for invoices is running, we cannot delete that data. We will, however, restrict its processing to what the law requires of us.

Last updated

This policy reflects the position as of 6 September 2026. The ticket shop was added on that date. If a newsletter or advertising pixels are added, we will update this page.