Privacy policy

1. Controller

The controller for the processing of personal data within the meaning of Article 4(7) GDPR is:

Event Paradies Nimaro GmbH
Eibenweg 23
15827 Blankenfelde-Mahlow, Germany
Phone: +49 155 611 020 74
Email: info@event-paradies.de

Further details are in the legal notice. For any question about data protection, a message to info@event-paradies.de is enough.

2. Roles

The service is booked by a host who uses it to collect the photos of their party. Where the party is a private one, the household exemption of Article 2(2)(c) GDPR applies to the guests' pictures. Where the host does not use the service purely privately — for a company party, as a hotel or as an association —, that host is the controller for this data and the operator acts for them as a processor within the meaning of Article 28 GDPR. The terms are set out in the data processing agreement (German). For the host's own customer data — account, order, invoice — the operator is the controller.

3. Where the data is kept

Photos, videos and all related information are stored with Amazon Web Services in a data centre in Germany and encrypted at rest there. Transmission is encrypted. Storage and processing take place in that data centre only; we do not transfer any data to third countries.

Our contracting party is Amazon Web Services EMEA SARL, based in Luxembourg. Its parent company is based in the United States. Access from there is prohibited under the data processing agreement and is not technically provided for; as with any provider that has a US parent company, it cannot be ruled out with absolute certainty. We consider this acceptable because the data is encrypted at rest, stays in Germany and is deleted after the periods stated. Anyone unwilling to accept that residual risk should not use the service.

4. Guests' data

Anyone opening a gallery via the link or QR code enters a name once. Processed are:

• The name entered. It appears next to the uploaded pictures so it is clear who they came from, and in the leaderboard of the photo challenges.
• Uploaded photos and videos including the time of upload and the capture time from the image data. Location data in the image data is removed on upload and not stored.
• Hearts given and completed photo challenges including the corresponding proof photo and time.
• A random identifier in the device's browser, so that a guest is recognised when returning, only has to enter their name once and keeps their progress.
• Time and version of the confirmation the guest gives when joining.

The legal basis is Article 6(1)(b) GDPR — the processing is necessary to provide the service the guest requests by opening the gallery.

5. Confirmation when joining

On first opening, every guest confirms: “I will only upload photos and videos I have the rights to, and everyone shown in them has agreed to it.” This confirmation concerns the rights to the uploaded pictures, in particular the personality rights of the people shown. Anyone uploading pictures in which others are recognisable must have their agreement.

6. Hosts' data

• Email address and name for signing in and managing the gallery. Signing in works without a password, via a time-limited link sent by email.
• Billing address, for business customers additionally the company name and VAT identification number, and optionally a phone number for queries. This information is only collected for paid plans.
• Order data including plan, amount, payment status and a snapshot of the billing address at the time of the order. For paid orders this also covers when the customer agreed to immediate performance and which version of that text applied — this is required as evidence in relation to the right of withdrawal.
• Time and version of the agreement to the terms and conditions given by the host when ordering. Without that record it could not later be established which terms apply to the contract.
• A cover picture for the gallery, if the host uploads one. It is stored exactly like the guests' pictures, is only reachable through the gallery link and is never used as the preview image when the link is shared. If people are recognisable in it, the same applies as to any uploaded picture: the host needs their consent.
• Times of expiry reminders sent. On the paid plans, hosts receive an email fourteen days and three days before the end of the agreed retention period, reminding them to download their pictures. Only the time these notices were sent is stored, so that they are not repeated.

The legal basis is Article 6(1)(b) GDPR for performance of the contract — which includes the expiry reminders, because deletion on the agreed date is part of the contract — and Article 6(1)(c) GDPR for keeping the invoice data, which commercial and tax law require. These are service messages about an existing contract, not advertising.

7. Cookies

Only technically necessary cookies are set. Neither analytics nor advertising cookies are used, there is no reach measurement and no tracking. For that reason no consent banner is required. No content is loaded from third-party servers either — fonts, icons and scripts are hosted on our own server, so opening a page creates no connection to anyone else.

• Guest session — contains the identifier and the name, is signed and cannot be read by scripts, lifetime one year, separate per party.
• Host session — contains the account identifier, signed and not readable by scripts, lifetime 30 days. After that a new sign-in link is required.
• Access proof — only for galleries with an access code, records that the code was entered. Lifetime 90 days.
• Language choice — remembers whether the interface should be shown in German or English. It is only set when someone uses the switch themselves, contains nothing but “de” or “en” and no personal reference at all. Lifetime one year.

8. Protection against misuse

So that nobody floods someone else's mailbox with sign-in links, guesses a four-digit access code or swamps a gallery with uploads, the server counts how often the same action arrives from the same place within a short period. For this the IP address of the request is held in memory only and discarded after an hour at the latest — it is written neither to a database nor to a permanent file, and it is not combined with any other data. The legal basis is Article 6(1)(f) GDPR: the legitimate interest in protecting the service and other people's mailboxes from automated misuse.

In addition, the forms contain two input fields that are invisible to you, plus a measurement of the time between the page loading and the form being sent. Both serve only to tell a human apart from an automated program: a human cannot fill in the hidden fields and needs a few seconds to type. No personal data is collected in this process, no cookie is set and nothing is stored — the values are sent once with the form, checked and discarded. Your behaviour is not analysed and no third-party service is involved, which is why you never have to solve a puzzle („captcha“). The legal basis is likewise Article 6(1)(f) GDPR.

9. Recipients and service providers

• Amazon Web Services EMEA SARL — storage of the photos and videos, data centre in Germany. A data processing agreement is in place.
• goneo Internet GmbH, Minden — sending of our emails (sign-in link, order confirmation, reminder before expiry) via the outgoing mail server of the mailbox held there. Servers in Germany.
• Stripe Payments Europe Ltd., Dublin — handling payments for paid plans. Payment details such as card numbers or bank details are entered exclusively there and are at no point visible to the operator.
• The hosting provider running the application. When the site is accessed, log data necessarily arises there, including IP address, time and the address requested.

No disclosure to other third parties, no sale of data and no use for advertising takes place.

10. Retention and deletion

• Photos, videos, guests' names, hearts and completed challenges are deleted automatically and completely once the retention period booked by the host has expired. The period starts with the first picture uploaded, not with the order — a gallery with nothing in it uses up no time. The deletion date is shown in the gallery itself. On the paid plans we remind the host fourteen days and three days beforehand by email, so that deletion catches nobody unprepared; the short trial plan has no such reminder.
• The host can delete everything earlier at any time, without having to contact us.
• Guests can remove their own pictures themselves at any time.
• The gallery's cover picture is deleted together with the photos and videos. It has the same retention period and cannot outlast it. If the host replaces or removes it, the previous picture is deleted immediately.
• Prepared archives for download are deleted after fourteen days.
• Sign-in links expire after a short time and are deleted afterwards. In any case only an irreversible check value of the link is stored, never the link itself.
• Account and order data is kept for as long as commercial and tax retention periods require.

11. Who can see the pictures

Only people with the link or QR code of the party in question. The galleries are not public, are not indexed by search engines, and the storage location cannot be reached directly from outside — every retrieval goes through short-lived, signed addresses. The host can additionally set an access code and hide or delete individual pictures.

12. Rights of data subjects

Under the General Data Protection Regulation there is a right to

• access to the stored data (Article 15),
• rectification of inaccurate data (Article 16),
• erasure (Article 17),
• restriction of processing (Article 18),
• data portability (Article 20),
• object to the processing (Article 21).

A message to info@event-paradies.de is enough to exercise them. Independently of this, there is a right to lodge a complaint with a supervisory authority under Article 77 GDPR, in particular with the authority at your own place of residence.

13. Reports about content

Anyone reporting content they consider unlawful gives us their name, their email address and the reasons for the report. We process this information in order to examine the report, communicate the outcome and be able to document the case. The legal basis is Article 6(1)(c) GDPR in conjunction with Articles 16 and 17 of Regulation (EU) 2022/2065 on digital services. We inform the affected customer that a report has been received and what it concerns; we do not pass on the contact details of the reporting person unless this is necessary to pursue legal claims. Records of a report are kept for as long as claims arising from it can be brought.

14. No automated decision-making

There is no automated decision-making or profiling within the meaning of Article 22 GDPR. No automatic recognition of image content or faces is used.

15. Changes

This statement is adjusted as soon as the service changes. The version published here, with the date given above, applies.