← Back to the start page

Privacy

This website is deliberately built lean. We set no cookies of our own and store nothing on your device. The page, the fonts and the visitor statistics all come from our own server. The one exception is the aftermovie, which is loaded from YouTube. What that means is explained below.

Our ticket shop is a separate matter, you will find it further down under Ticket shop.

Controller

Xenobase Events Pehr, Leinemann & Bork GbR
Goebenstr. 19, 65195 Wiesbaden, Germany
Email: kontakt@xenobase.de

Further details in the imprint. For data protection matters you can also write to us directly at datenschutz@xenobase.de.

Server log files

When you open the page, our host processes technically necessary data that your browser transmits automatically: the page requested, date and time, the volume of data transferred, browser type and IP address. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in stable and secure operation. This data is not combined with any other sources.

Hosting

The site runs on our own server at Hostinger International Ltd, Jonavos g. 60C, 44192 Kaunas, Lithuania. The server itself is located in Frankfurt am Main, Germany, so no transfer to a third country takes place. We have concluded a data processing agreement with the provider under Art. 28 GDPR. Details are in Hostinger's own privacy policy.

Fonts

The fonts used are delivered by our own server. There is no connection to Google Fonts and your IP address is not transmitted to any third party.

The aftermovie from YouTube

The aftermovie is hosted on YouTube and embedded directly on the front page. The player is loaded from youtube-nocookie.com as soon as you reach the Aftermovie section, no click is required. From that moment on, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, processes data under its own responsibility, including your IP address, information about your browser and device, and the address of the page you came from. A transfer to Google LLC in the United States cannot be ruled out.

Because we use youtube-nocookie.com, YouTube only sets cookies once you actually play the video. As long as you do not reach that section, no connection to YouTube is established at all.

The legal basis for the embedding is our legitimate interest in presenting the festival attractively, Art. 6(1)(f) GDPR. More on this in Google's privacy policy.

Cookies

We set no cookies of our own on this website and store nothing on your device. You therefore do not need a consent banner here. Only if you start the aftermovie does YouTube set its own cookies, see the section above.

The ticket shop at tickets.xenobase.de works slightly differently: it needs a few cookies for the shopping cart and sign-in to work at all. There is no tracking there either, so no consent banner is needed there. What the shop stores is set out under Ticket shop.

Visitor statistics with Umami

We want to know how many people visit the site and how they found their way here. For this we use Umami, open-source software running on our own server in Frankfurt am Main, Germany. No further provider is involved and nothing leaves the EU.

What is counted: the page requested, the referring source such as Instagram or Google, the country of origin, device type, browser and screen size. Umami works without cookies and without any identifier that would recognise you across several visits. Your IP address is used only briefly to determine the country and is not stored. The figures are therefore anonymous, we cannot draw any conclusion about you as a person.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in understanding whether our posts reach people. Consent under Section 25 TDDDG is not required, because nothing is stored on or read from your device.

Advertising

There is currently no advertising pixel on this site, not from Meta, TikTok or anyone else. Should that change, we will ask you for permission beforehand and name the provider here.

External links

We link to Instagram, TikTok, Google Maps, Google Calendar, Outlook Calendar and the ticket shop. Only when you click such a link do you leave this site, and the privacy terms of the respective provider then apply. Nothing is loaded from these providers before that.

Contacting us by email

If you write to us, we process your details solely in order to deal with your enquiry. The legal basis is Art. 6(1)(b) or (f) GDPR. We do not pass this data to third parties and delete it once the enquiry has been dealt with and no retention obligations stand in the way.

Newsletter and ticket drop list

On the home page you can put your email address on our list. We then write to you as soon as advance sale starts, and in between when there is festival news.

For this we process your email address, the language of the page you signed up on, and the times of your sign-up and your confirmation. We need those times as proof that the sign-up came from you. We do not store your IP address.

We also store where the sign-up came from, for example this website, our browser game or the ticket shop, if you tick the newsletter box there. If you sign up in several places, each one is recorded. For promotions we may link a personal code to your address, for example a discount code for the ticket shop, and put it into our email to you.

We only measure opens and clicks if you tick the optional box for it when signing up. Each email to you then contains an invisible counting image, and its links pass through our own server before taking you to the target. This tells us whether you opened an email and which link you clicked. Without the tick there is no counting image and no redirect. The legal basis is again your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time by emailing us, or by unsubscribing.

Signing up in the ticket shop. On the last page of your order in the ticket shop you can tick a box to receive the newsletter. The box is optional, not pre-ticked and has no effect on your order. If you tick it, we record against your order that you ticked it, when, in which language and with which wording. This is our proof of your consent. Your email address and language then go to our newsletter server, and you get the email with the confirmation link like with any other sign-up. If you do not tick the box, nothing is passed to the newsletter.

A newsletter that fits what you bought. If you are signed up for the newsletter, we match your address against the orders in our ticket shop. Against your address we then store which events you bought tickets for, which items (for example the ticket type or a pre-ordered shirt) and whether the order is paid or cancelled. This way we only send emails to the people they concern, for example travel information only to people with a ticket for Festival 2027, or a shirt pick-up reminder only to those who ordered one. We only use our own order data, no data from other providers, and pass nothing on. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in sending you relevant rather than unnecessary emails. You can object at any time; an email to datenschutz@xenobase.de is enough. We then stop matching your address and delete the stored purchases, and you keep receiving the newsletter. If you unsubscribe, we delete this information together with your address. Your order in the ticket shop itself is not affected and is deleted as described in the section Ticket shop.

Sign-up uses the double opt-in procedure: after you submit the form you get an email with a confirmation link. Only when you click it are you on the list. If you do not click, we delete the pending entry automatically after seven days.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future: every email carries an unsubscribe link, and one click deletes your address completely. You can also simply write to datenschutz@xenobase.de.

Sign-ups, codes and sending run through our own server in Frankfurt am Main. The controller stays the same, Xenobase Events Pehr, Leinemann & Bork GbR. The addresses are held there in a database, and sending runs through our own mail server. No newsletter provider is involved and your address is not passed on to anyone. Unsubscribing deletes your address, and we also delete it if we stop the newsletter.

The game Unlock the Line-up and the giveaway

We run the browser game Unlock the Line-up. Anyone who finishes a level can also enter a giveaway. The rules are in the giveaway terms.

Playing without entering the giveaway

We store your runs, the times you achieve and, if you enter them, three initials. Entering initials is optional. The initials of the first five players to finish each level are shown in the game and in our posts on Instagram and TikTok. We do not keep IP addresses permanently.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in running the game.

The giveaway

If you enter the giveaway, we store your email address and your initials. We use them only to run the draw and to notify the winners. You will not receive a newsletter or any advertising as a result.

We name the winners in a reel on Instagram and TikTok: by their initials or, if they have consented, by their Instagram or TikTok name.

We only ask winners for a shipping address and, if needed, a size, by email. To ship the prize, we pass the address on to the delivery company.

The legal basis is Art. 6(1)(b) GDPR, running the giveaway you have entered.

Instagram and TikTok names

In the game you can allow us to name you with your Instagram or TikTok name, either as a winner or as the first to finish a level. We only store that name with your consent and only use it to name and tag you in our posts on Instagram and TikTok. It is not shown publicly in the game, and nobody outside our team sees it.

The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time with effect for the future by emailing datenschutz@xenobase.de.

Publishing on Instagram and TikTok

Whatever we show in our posts (initials, your Instagram or TikTok name if you consented, and the tag of your account) is passed to the platform: for Instagram to Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, for TikTok to TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. Both process this data as independent controllers, and a transfer to the USA or other third countries cannot be ruled out. Details are in the privacy policies of Instagram and TikTok.

How long we keep this data

Hosting of the game

The game and the giveaway run on servers in Germany that we operate ourselves. That is also where the entries we draw the winners from are kept. Nothing is passed on to third parties, except to the shipping company for the prize.

Ticket shop

We run our ticket shop at tickets.xenobase.de ourselves, using the open-source software pretix on our own server. Your order data does not go to an external ticketing company, it stays with us.

The server is operated by IONOS SE, Elgendorfer Straße 57, 56410 Montabaur, Germany. We have concluded a data processing agreement with IONOS under Art. 28 GDPR.

The shop loads no fonts from Google and contains no analytics or tracking service. It only sets the cookies it needs to work: a session identifier, protection against form abuse, and the link to your shopping cart. These cookies are technically necessary within the meaning of Section 25(2) no. 2 TDDDG, so we do not ask for your consent for them.

What we process when you buy a ticket

To sell you a ticket and send it to you, we need your email address. Alongside it we process the data your order produces anyway: order number, time of order, tickets and items purchased, price, payment method, order status, and the QR code on your ticket.

You may provide a billing address, but you do not have to. We only need it if you require an invoice showing a full address, for instance because you are buying for a business, or because your order exceeds 250 euros.

The legal basis is Art. 6(1)(b) GDPR, performance of our contract with you. Without this data we cannot sell you a ticket.

Payment

Depending on how you pay, different providers are involved:

From these providers we only receive confirmation of whether your payment succeeded, a transaction number and the amount. We never see your card or login details: you enter them directly with the payment provider.

The payment providers process your data as controllers in their own right, not on our behalf. What happens there is set out in their own privacy notices: PayPal · SumUp

The legal basis is Art. 6(1)(b) GDPR.

Invoices

We issue an invoice for your order and send it to you by email. We are required to retain invoices for ten years under Section 147 of the German Fiscal Code and Section 14b of the German VAT Act. We therefore cannot delete this data, even at your request. It is held by us and by our tax advisors, who act for us within the statutory framework.

The legal basis is Art. 6(1)(c) GDPR, compliance with a legal obligation.

Emails about your order

We send order confirmation, payment confirmation, invoice and ticket by email, through our own mail server. These emails carry no advertising, only what relates to your order. You only receive the newsletter if you tick it when ordering and confirm it by email; see the section Newsletter.

The legal basis is Art. 6(1)(b) GDPR.

Admission to the event

At the entrance we scan the QR code on your ticket. We record that the ticket was redeemed, when, and on which device, so that the same ticket cannot be used twice. The legal basis is Art. 6(1)(b) GDPR.

Merchandise pre-orders

If you pre-order a shirt, we store the item and size against your order and record whether you collected it. If you withdraw from the purchase, we additionally need your name and bank details in order to refund you.

The legal basis is Art. 6(1)(b) GDPR.

Shop server logs

Like any website, the shop logs technical access data: IP address, time, requested address, status code, browser type. We need this to find faults and fend off attacks. These logs are deleted after seven days.

The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in secure operation.

How long we keep order data

We delete your contact details and the information relating to your order three months after the event. Until then we need them to handle questions, refunds and withdrawals.

Invoices and the data they contain are excluded, we must retain those for ten years, as set out above.

Photography and filming at the event

Photographs and video are taken at our events. We use the material for the aftermovie, the website and social media. If you would rather not appear in a picture, tell the team on site or write to us afterwards at kontakt@xenobase.de.

Your rights

You have the right to:

Write to us at datenschutz@xenobase.de to exercise any of these.

One note on erasure: while the statutory retention period for invoices is running, we cannot delete that data. We will, however, restrict its processing to what the law requires of us.

Last updated

This policy reflects the position as of 6 November 2026. On that date you can also sign up for the newsletter in the ticket shop, and we tailor the newsletter to your purchases in the ticket shop. On 6 November 2026 the ticket drop list became our newsletter, with optional measurement of opens and clicks, and we added the game Unlock the Line-up with its giveaway and the ticket shop at tickets.xenobase.de. If advertising pixels are added, we will update this page.