Privacy Policy
Last updated: 02/11/2026
1. Controller
The controller responsible for the processing of your personal data on this website is:
Verein für Tanz und Kultur in Hamburg e.V. Sachsentor 13, 21029 Hamburg, Germany Register court: Amtsgericht Hamburg, VR 21797. Represented by the board: Luis Carlos Simoes Duarte. Email: info@crazy4latimba.com, telephone: +49 176 49653700
We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR and § 38 BDSG.
2. Your rights
Under the GDPR you have the following rights in relation to your personal data. To exercise any of them, write to info@crazy4latimba.com.
- Access (Art. 15): to obtain confirmation of whether we process your data and to receive a copy of it.
- Rectification (Art. 16): to have inaccurate data corrected and incomplete data completed.
- Erasure (Art. 17): to have your data deleted, unless we are required to retain it.
- Restriction (Art. 18): to have processing restricted in the cases listed in that article.
- Data portability (Art. 20): to receive data you provided to us in a structured, machine-readable format.
- Objection (Art. 21): to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. Where we process your data for direct marketing, you may object at any time with no reason required, and we will stop that processing.
- Withdrawal of consent (Art. 7 (3)): to withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal is unaffected.
- Complaint (Art. 77): to lodge a complaint with a supervisory authority. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, mailbox@datenschutz.hamburg.de. You may also complain to the authority in your country of residence.
3. Legal bases we rely on
- Art. 6 (1) (a) GDPR — consent: analytics and marketing cookies, newsletter, and the use of photographs where consent is required.
- Art. 6 (1) (b) GDPR — performance of a contract: processing your order, issuing tickets, admission control, running the workshops you booked.
- Art. 6 (1) (c) GDPR — legal obligation: retention of invoices and accounting records under German commercial and tax law.
- Art. 6 (1) (f) GDPR — legitimate interests: operating and securing the website, preventing fraud and spam, documenting and promoting the festival.
Where we rely on legitimate interests, you may object under Art. 21 GDPR as described above.
4. What we process, why, and for how long
Purpose | Data | Legal basis | Retention |
|---|---|---|---|
Delivering the website | IP address, browser and device type, operating system, referring page, date and time of access, files requested | Art. 6 (1) (f) — secure and stable operation | Server log files deleted after 30 days |
Ticket purchase and contract performance | Name and email address of the buyer and of each ticket holder, billing details where requested, items ordered, payment method and status, order number | Art. 6 (1) (b) | Until the contract is fulfilled, then under the retention periods below |
Invoices and accounting records | Order and invoice data, VAT data | Art. 6 (1) (c) in conjunction with § 147 AO and § 257 HGB | 10 years from the end of the calendar year in which the invoice was issued |
Ticket personalisation and admission | Ticket holder name and email, ticket number, check-in status | Art. 6 (1) (b) | Deleted 12 months after the festival |
Workshop and bootcamp organisation | Dancing role, dancing level, chosen bootcamp or masterclass, T-shirt size | Art. 6 (1) (b) | Deleted 12 months after the festival |
Ticket name change | Ticket number, names and email addresses of the current and the new ticket holder | Art. 6 (1) (b) | Deleted 12 months after the festival |
Email enquiries | Your name, email address and the content of your message | Art. 6 (1) (b) for contractual enquiries, otherwise Art. 6 (1) (f) | Deleted when the matter is settled and no retention period applies |
News about our future events for buyers and ticket holders | Name and email address | Art. 6 (1) (f) and § 7 (3) UWG | Until you object or unsubscribe |
Newsletter and festival mailings | Email address, first name, dispatch and opening statistics | Art. 6 (1) (a) | Until you unsubscribe |
Spam protection on forms | Hidden honeypot fields in the form, which people leave empty and automated programs fill in | Art. 6 (1) (f) — preventing abuse | Not stored; the check runs when the form is sent |
Analytics and reach measurement | Online identifiers, pages visited, interactions, approximate location | Art. 6 (1) (a) | Up to 14 months, see part 4 |
Advertising and conversion measurement | Online identifiers, pages visited, purchase events | Art. 6 (1) (a) | Up to 13 months, see part 4 |
Photographs and film at the event | Image and sound recordings in which you may be identifiable | Art. 6 (1) (f), and consent where required | Until you object, or until the material is no longer used |
Ticket shop. Our ticket shop is provided by pretix GmbH, Heidelberg, Germany, which processes the order data on our behalf under a data processing agreement (Art. 28 GDPR). When you open the checkout, it is loaded from pretix.eu.
Personalised tickets and ID check at the entrance. Our tickets are personalised. To prevent ticket fraud and unauthorised resale, we compare the name on your official photo ID with the name on your ticket at the entrance. We only look at your ID; we do not copy, scan or store it. The legal basis is the performance of the contract (Art. 6 (1) (b) GDPR) and our legitimate interest in ensuring that only the rightful ticket holder is admitted (Art. 6 (1) (f) GDPR).
Ticket name change. If you buy a “Ticket Name Change”, we process the ticket number and the names and email addresses of the previous and the new ticket holder that you enter in the order, in order to check the request, send the new ticket holder their ticket by email and invalidate the previous ticket (Art. 6 (1) (b) GDPR).
Information about the festival. By buying a ticket for yourself or for another person, you agree that we may contact you and the ticket holders named in your order by email about changes to the event and organisational matters, for example the schedule, the venue, entry or the programme (Art. 6 (1) (b) GDPR). Important information about your ticket may be sent to you in any case.
5. Is providing your data mandatory?
The data marked as required at checkout is necessary for us to conclude and perform the contract. Without it we cannot sell you a ticket. All other data — newsletter subscription, analytics consent, optional profile fields — is voluntary and refusing it has no consequence for your purchase.
6. Automated decision-making
We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
7. Recipients of your data
We pass data to the following service providers, each bound by a data processing agreement under Art. 28 GDPR or acting as an independent controller where indicated. Transfers to the United States are made on the basis of the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework (Art. 45, Art. 46 GDPR).
Provider | Purpose | Location |
|---|---|---|
Hostinger International Ltd. | Website hosting, server logs, email | EU |
pretix GmbH | Ticket shop: orders, personalised tickets, name changes, check-in at the entrance | Germany |
Amazon Web Services EMEA SARL (Amazon SES) | Sending our emails | Luxembourg / USA |
Stripe Payments Europe, Ltd. | Card and Klarna payments; Stripe is an independent controller for fraud prevention | Ireland / USA |
PayPal (Europe) S.à r.l. et Cie, S.C.A. | PayPal payments; independent controller | Luxembourg / USA |
Google Ireland Limited | Google Analytics, Google Tag Manager, Google Ads conversion measurement, Site Kit | Ireland / USA |
Meta Platforms Ireland Limited | Meta pixel and Conversions API for advertising measurement; joint controller for the collection and transmission of pixel data under Art. 26 GDPR | Ireland / USA |
Automattic Inc. (Gravatar) | Profile pictures shown next to published comments | USA |
CookieYes Limited | Consent management and storage of your consent record | Ireland / EU |
Adobe Systems Software Ireland Ltd. (Adobe Fonts / Typekit) | Delivery of the website’s typefaces | Ireland / USA |
WPFunnels / FluentCRM (self-hosted) | Email campaigns; data stays on our own server | EU |
Beyond these, we disclose data only where we are legally obliged to do so, or where it is necessary to establish, exercise or defend legal claims.
Instructors and partners. Where you book a bootcamp or masterclass, we share the participant list — name and email address — with the instructor teaching it, so that they can organise the session and the WhatsApp group announced at booking. The legal basis is Art. 6 (1) (b) GDPR.
8. Payment data
We do not receive or store your full card number. When you pay by card, Klarna or PayPal, the payment data is entered directly with the payment provider and transmitted to them. We receive only the transaction status, the last four digits where applicable, and the information needed to allocate the payment to your order. The providers’ own privacy policies apply to their processing:
- Stripe: https://stripe.com/privacy
- PayPal: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
9. Spam protection
To keep spam out of our contact form, we use hidden honeypot fields. People cannot see them, so only automated programs fill them in. We reject a submission if a honeypot is filled in, or if the field our site adds with JavaScript is missing. The check runs on our own server. No data goes to third parties and no cookies are set. The legal basis is Art. 6 (1) (f) GDPR: our legitimate interest in preventing abuse and spam.
10. Adobe Fonts
Typefaces on this site are loaded from Adobe’s servers, which transmits your IP address to Adobe. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in a consistent presentation of our site. Further information: https://www.adobe.com/privacy/policy.html
11. Cookies and similar technologies
We use cookies and comparable technologies. Those that are strictly necessary to provide the service you requested are set on the basis of § 25 (2) TDDDG. All others — analytics, advertising and functional cookies — are set only with your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.
You can withdraw or change your consent at any time through the cookie settings link in the footer of this website. Withdrawal takes effect for the future.
Category | Set by | What it does |
|---|---|---|
Necessary | Our website, the pretix ticket shop, CookieYes | Session, your open shopping cart in the ticket shop, storing your consent choice. The checkout is loaded from pretix.eu, which sets the cookies it needs there |
Functional | Our website | Remembering preferences you set |
Analytics | Google Analytics | Measuring how the site is used so we can improve it |
Advertising | Meta pixel, Google Ads, PixelYourSite | Measuring the success of our advertising and showing relevant ads |
12. Google Analytics
With your consent we use Google Analytics 4 to understand how our site is used. Google processes online identifiers and usage data on our behalf; IP addresses are shortened within the EU before any transfer. Data is retained for a maximum of 14 months. Legal basis: Art. 6 (1) (a) GDPR. Opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
13. Meta pixel and Conversions API
With your consent we use the Meta pixel and the Conversions API to measure the effectiveness of our advertising on Facebook and Instagram and to show our ads to relevant audiences. For this, information about your visit — including pages viewed and purchases — is transmitted to Meta, in part from your browser and in part from our server. Where data is transmitted from our server, contact details such as your email address are hashed before transmission.
For the collection and transmission of this data we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR. The essential content of that arrangement is available at https://www.facebook.com/legal/controller_addendum. Meta’s processing after transmission is its own responsibility; see https://www.facebook.com/privacy/policy
Legal basis: Art. 6 (1) (a) GDPR. You can withdraw consent at any time through the cookie settings.
14. Google Ads
With your consent we measure which of our advertisements lead to a ticket purchase, and may show advertising to people who have visited our site. Legal basis: Art. 6 (1) (a) GDPR. Further information: https://policies.google.com/technologies/ads
15. Newsletter and festival mailings
If you subscribe, we send you information about the festival and future editions. We use the double opt-in procedure: you receive an email asking you to confirm your subscription, and we log the confirmation. You can unsubscribe at any time using the link in every mailing or by writing to info@crazy4latimba.com. Legal basis: Art. 6 (1) (a) GDPR.
News about future events. By buying a ticket for yourself or for another person, you also agree that we may use the email addresses of the buyer and the ticket holders to tell you about future editions of Crazy 4 La Timba and other events we organise under our group name Timbatribe, such as UNiDANZA. These emails come from us, Verein für Tanz und Kultur in Hamburg e.V., the organiser of all Timbatribe events; we do not pass your data to other organisers. The legal basis is our legitimate interest in promoting our own events to our guests (Art. 6 (1) (f) GDPR and § 7 (3) of the German Act against Unfair Competition, UWG). You can object to these emails at any time, at no cost other than the usual transmission costs: every email contains an unsubscribe link, or write to info@crazy4latimba.com. If you buy a ticket for another person, please pass this information on to them. We keep the contact data for these emails until you unsubscribe; after that we only keep your email address marked as unsubscribed, so that you receive no more promotional emails.
16. Photographs and film at the festival
Photographs and film are made at the event and may be published on our website and social media channels to document and promote the festival. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in documenting and promoting our event — and, where a recording focuses on you individually, your consent.
You may object to the publication of recordings in which you are identifiable at any time at info@crazy4latimba.com, and we will remove the material from our own channels.
17. Security
This website uses TLS encryption. We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Please note that transmission over the internet can never be entirely secure.
18. Children
Our services are not directed at children under 16. We do not knowingly collect data from children under 16 without the consent of a parent or guardian. If you believe a child has provided us with personal data, please contact us and we will delete it.
19. Changes to this policy
We update this policy when our services or the legal position change. The version published here applies.