Last updated: 06/10/2026
1. Controller
The controller responsible for the processing of your personal data on this website is:
Verein für Tanz und Kultur in Hamburg e.V. Sachsentor 13, 21029 Hamburg, Germany Register court: Amtsgericht Hamburg, Represented by the board: Luis Carlos Simoes Duarte Email: contact@timbatribe.com
We have not appointed a data protection officer, as we are not required to do so under Art. 37 GDPR and § 38 BDSG.
2. Your rights
Under the GDPR you have the following rights in relation to your personal data. To exercise any of them, write to contact@timbatribe.com.
- Access (Art. 15): to obtain confirmation of whether we process your data and to receive a copy of it.
- Rectification (Art. 16): to have inaccurate data corrected and incomplete data completed.
- Erasure (Art. 17): to have your data deleted, unless we are required to retain it.
- Restriction (Art. 18): to have processing restricted in the cases listed in that article.
- Data portability (Art. 20): to receive data you provided to us in a structured, machine-readable format.
- Objection (Art. 21): to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. Where we process your data for direct marketing, you may object at any time with no reason required, and we will stop that processing.
- Withdrawal of consent (Art. 7 (3)): to withdraw consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal is unaffected.
- Complaint (Art. 77): to lodge a complaint with a supervisory authority. The authority responsible for us is: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, mailbox@datenschutz.hamburg.de. You may also complain to the authority in your country of residence.
3. Legal bases we rely on
- Art. 6 (1) (a) GDPR — consent: analytics and marketing cookies, newsletter, and the use of photographs where consent is required.
- Art. 6 (1) (b) GDPR — performance of a contract: processing your order, issuing tickets, admission control, running the workshops you booked.
- Art. 6 (1) (c) GDPR — legal obligation: retention of invoices and accounting records under German commercial and tax law.
- Art. 6 (1) (f) GDPR — legitimate interests: operating and securing the website, preventing fraud and spam, documenting and promoting the festival.
Where we rely on legitimate interests, you may object under Art. 21 GDPR as described above.
4. What we process, why, and for how long
Purpose | Data | Legal basis | Retention |
|---|---|---|---|
Delivering the website | IP address, browser and device type, operating system, referring page, date and time of access, files requested | Art. 6 (1) (f) — secure and stable operation | Server log files deleted after 30 days |
Ticket purchase and contract performance | Name, email address, billing address, country, items ordered, payment method, order and invoice number | Art. 6 (1) (b) | Until the contract is fulfilled, then under the retention periods below |
Invoices and accounting records | Order and invoice data, VAT data | Art. 6 (1) (c) in conjunction with § 147 AO and § 257 HGB | 10 years from the end of the calendar year in which the invoice was issued |
Ticket personalisation and admission | Ticket holder name and email, ticket number, check-in status | Art. 6 (1) (b) | Deleted 12 months after the festival |
Workshop and bootcamp organisation | Dancing role, dancing level, chosen bootcamp or masterclass, T-shirt size | Art. 6 (1) (b) | Deleted 12 months after the festival |
Customer account, if you create one | Email address, password (hashed), order history | Art. 6 (1) (b) | Until you delete the account |
Email enquiries | Your name, email address and the content of your message | Art. 6 (1) (b) for contractual enquiries, otherwise Art. 6 (1) (f) | Deleted when the matter is settled and no retention period applies |
Newsletter and festival mailings | Email address, first name, dispatch and opening statistics | Art. 6 (1) (a) | Until you unsubscribe |
Spam protection on forms | IP address, browser data, interaction with the page | Art. 6 (1) (f) — preventing abuse | Governed by Google, see part 3 |
Analytics and reach measurement | Online identifiers, pages visited, interactions, approximate location | Art. 6 (1) (a) | Up to 14 months, see part 4 |
Advertising and conversion measurement | Online identifiers, pages visited, purchase events | Art. 6 (1) (a) | Up to 13 months, see part 4 |
Photographs and film at the event | Image and sound recordings in which you may be identifiable | Art. 6 (1) (f), and consent where required | Until you object, or until the material is no longer used |
5. Is providing your data mandatory?
The data marked as required at checkout is necessary for us to conclude and perform the contract. Without it we cannot sell you a ticket. All other data — newsletter subscription, analytics consent, optional profile fields — is voluntary and refusing it has no consequence for your purchase.
6. Automated decision-making
We do not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
7. Recipients of your data
We pass data to the following service providers, each bound by a data processing agreement under Art. 28 GDPR or acting as an independent controller where indicated. Transfers to the United States are made on the basis of the EU Standard Contractual Clauses and, where the provider is certified, the EU–US Data Privacy Framework (Art. 45, Art. 46 GDPR).
Provider | Purpose | Location |
|---|---|---|
Hostinger International Ltd. | Website hosting, server logs, email | EU |
Stripe Payments Europe, Ltd. | Card and Klarna payments; Stripe is an independent controller for fraud prevention | Ireland / USA |
PayPal (Europe) S.à r.l. et Cie, S.C.A. | PayPal payments; independent controller | Luxembourg / USA |
Google Ireland Limited | Google Analytics, Google Tag Manager, Google Ads conversion measurement, reCAPTCHA, Site Kit | Ireland / USA |
Meta Platforms Ireland Limited | Meta pixel and Conversions API for advertising measurement; joint controller for the collection and transmission of pixel data under Art. 26 GDPR | Ireland / USA |
Automattic Inc. (Jetpack, WordPress.com, Gravatar) | Site statistics, security and performance functions | USA |
CookieYes Limited | Consent management and storage of your consent record | Ireland / EU |
Adobe Systems Software Ireland Ltd. (Adobe Fonts / Typekit) | Delivery of the website’s typefaces | Ireland / USA |
WPFunnels / FluentCRM (self-hosted) | Email campaigns; data stays on our own server | EU |
Beyond these, we disclose data only where we are legally obliged to do so, or where it is necessary to establish, exercise or defend legal claims.
Instructors and partners. Where you book a bootcamp or masterclass, we share the participant list — name and email address — with the instructor teaching it, so that they can organise the session and the WhatsApp group announced at booking. The legal basis is Art. 6 (1) (b) GDPR.
8. Payment data
We do not receive or store your full card number. When you pay by card, Klarna or PayPal, the payment data is entered directly with the payment provider and transmitted to them. We receive only the transaction status, the last four digits where applicable, and the information needed to allocate the payment to your order. The providers’ own privacy policies apply to their processing:
- Stripe: https://stripe.com/privacy
- PayPal: https://www.paypal.com/de/webapps/mpp/ua/privacy-full
9. Google reCAPTCHA
We use Google reCAPTCHA to distinguish human input from automated input on our forms. This transmits your IP address and information about your interaction with the page to Google. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in preventing abuse and spam. Further information: https://policies.google.com/privacy
10. Adobe Fonts
Typefaces on this site are loaded from Adobe’s servers, which transmits your IP address to Adobe. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in a consistent presentation of our site. Further information: https://www.adobe.com/privacy/policy.html
11. Cookies and similar technologies
We use cookies and comparable technologies. Those that are strictly necessary to provide the service you requested are set on the basis of § 25 (2) TDDDG. All others — analytics, advertising and functional cookies — are set only with your consent under § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.
You can withdraw or change your consent at any time through the cookie settings link in the footer of this website. Withdrawal takes effect for the future.
Category | Set by | What it does |
|---|---|---|
Necessary | Our website, WooCommerce, Stripe, PayPal, CookieYes | Session, shopping basket, checkout, fraud prevention, storing your consent choice |
Functional | Our website | Remembering preferences you set |
Analytics | Google Analytics, Automattic (Jetpack) | Measuring how the site is used so we can improve it |
Advertising | Meta pixel, Google Ads, PixelYourSite | Measuring the success of our advertising and showing relevant ads |
12. Google Analytics
With your consent we use Google Analytics 4 to understand how our site is used. Google processes online identifiers and usage data on our behalf; IP addresses are shortened within the EU before any transfer. Data is retained for a maximum of 14 months. Legal basis: Art. 6 (1) (a) GDPR. Opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
13. Meta pixel and Conversions API
With your consent we use the Meta pixel and the Conversions API to measure the effectiveness of our advertising on Facebook and Instagram and to show our ads to relevant audiences. For this, information about your visit — including pages viewed and purchases — is transmitted to Meta, in part from your browser and in part from our server. Where data is transmitted from our server, contact details such as your email address are hashed before transmission.
For the collection and transmission of this data we and Meta Platforms Ireland Limited are joint controllers under Art. 26 GDPR. The essential content of that arrangement is available at https://www.facebook.com/legal/controller_addendum. Meta’s processing after transmission is its own responsibility; see https://www.facebook.com/privacy/policy
Legal basis: Art. 6 (1) (a) GDPR. You can withdraw consent at any time through the cookie settings.
14. Google Ads
With your consent we measure which of our advertisements lead to a ticket purchase, and may show advertising to people who have visited our site. Legal basis: Art. 6 (1) (a) GDPR. Further information: https://policies.google.com/technologies/ads
15. Jetpack and WordPress.com statistics
With your consent, Automattic Inc. collects aggregated statistics about visits to our site. Legal basis: Art. 6 (1) (a) GDPR. Further information: https://automattic.com/privacy/
16. Newsletter and festival mailings
If you subscribe, we send you information about the festival and future editions. We use the double opt-in procedure: you receive an email asking you to confirm your subscription, and we log the confirmation. You can unsubscribe at any time using the link in every mailing or by writing to contact@timbatribe.com. Legal basis: Art. 6 (1) (a) GDPR.
Where you have bought a ticket from us, we may send you information about similar offerings of ours on the basis of § 7 (3) UWG. You may object to this at any time without cost beyond the basic transmission charges.
17. Photographs and film at the festival
Photographs and film are made at the event and may be published on our website and social media channels to document and promote the festival. The legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in documenting and promoting our event — and, where a recording focuses on you individually, your consent.
You may object to the publication of recordings in which you are identifiable at any time at contact@timbatribe.com, and we will remove the material from our own channels.
18. Security
This website uses TLS encryption. We take appropriate technical and organisational measures to protect your data against loss, misuse and unauthorised access. Please note that transmission over the internet can never be entirely secure.
19. Children
Our services are not directed at children under 16. We do not knowingly collect data from children under 16 without the consent of a parent or guardian. If you believe a child has provided us with personal data, please contact us and we will delete it.
20. Changes to this policy
We update this policy when our services or the legal position change. The version published here applies.