Privacy Policy

The controller responsible for processing personal data on this website is:

Kayoso Events (sole proprietorship) Owner: Kay A. Schink c/o Online-Impressum 11552 Europaring 90 53757 Sankt Augustin Germany Email: info@bearhood.de

Both websites run as applications on our own server, rented from Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) and located in a data centre in the EU.

When you visit the website, the server processes technically necessary data, in particular your IP address, in order to deliver the page to your browser.

We do not keep an access log with IP addresses. The application only logs technical status and error messages; these logs are limited in size, are overwritten automatically and are deleted at the latest when the website is next updated.

To protect our forms against spam and abuse (for example the contact form, registrations and notifications), we also use your IP address briefly to limit too many requests in a short time. It is only held in the server’s memory, is not stored permanently and is discarded at the latest when the application restarts.

Legal basis: our legitimate interest in providing the website in a stable and secure way and in protecting it against abuse (Art. 6(1)(f) GDPR).

We only use technologies that are required for the website to work, unless you consent to more:

• “cc_cookie”: stores your choice in the consent banner so that we respect it on later visits. • “bh_locale”: stores your language (German or English) on bearhood.de for one year. • Login session: if you sign in, your session is kept in your browser’s storage. • Appearance and language: your light/dark mode setting and, on play.bearhood.de, your language choice are stored locally in your browser.

Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. Optional tools such as analytics are only loaded with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change your choice at any time via “Cookie settings” in the footer.

With your consent we use Plausible Analytics, which we host ourselves on our server. Plausible creates anonymous, aggregated statistics such as page views, referring websites, approximate country and clicks on links to other websites (for example ticket links).

Plausible does not use cookies, does not store personal data and does not track you across websites or devices. IP addresses are only used briefly to determine the country and to create a daily changing identifier; they are not stored.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” in the footer. Without consent, the Plausible script is not loaded.

You can create a user account. For this we process your email address, your password (stored only in encrypted form) or sign-in links, your username, an optional profile picture and your language setting. If you use community features, we also store your likes, bookmarks and comments; comments are visible to other visitors.

Accounts and the database are provided by Supabase Inc. (USA). Our project is located in a data centre in Ireland (EU). Supabase processes the data on our behalf.

To secure your login, Supabase stores the IP address and browser for each session. This data is deleted when you sign out, and at the latest 30 days after the session was last used. Supabase also keeps short-lived technical logs for security purposes.

Legal basis: Art. 6(1)(b) GDPR (providing the features you use). You can change your email address in your account; the change only takes effect once you have confirmed it via both the old and the new address. You can delete your account at any time yourself in your account settings or by writing to info@bearhood.de. This also deletes your profile, profile picture, comments, likes, saved events, ticket reminders and event notifications.

Members of the Bearhood team can create a public profile on our website with name, role, short bio, profile picture and links to their social media accounts. Creating such a profile is voluntary; the data can be changed or removed at any time.

Legal basis: consent (Art. 6(1)(a) GDPR).

You can sign up for notifications about new events. We use a double opt-in: after signing up you receive an email and must confirm the subscription. We store your email address, your language, the time of sign-up and confirmation, and technical tokens for confirmation and unsubscribing.

Legal basis: your consent (Art. 6(1)(a) GDPR). Every notification contains an unsubscribe link; after unsubscribing, or when you delete your user account, we delete your email address. If you change the email address of your account, the subscription moves to the new address.

If you are signed in, you can ask to be notified as soon as tickets for an event are available. We store which event the reminder is for and link it to your user account. Legal basis: Art. 6(1)(b) GDPR. We delete reminders automatically once the event is over; all that remains is the anonymous number of reminders per event.

For some events you register directly on our website. We process first name, last name, email address, phone number if provided and an optional note. You receive a confirmation email with a link to view or cancel your registration.

We use the data to plan the event, for admission and to contact you about changes. Legal basis: Art. 6(1)(b) GDPR. We delete registrations automatically three months after the event. All that remains are anonymous figures (how many registrations and cancellations there were per day) that cannot be traced back to you.

If you contact us via the contact form or by email, we process your name, email address, subject and message to answer your request. Messages from the contact form are stored in our database and forwarded to us by email.

Legal basis: Art. 6(1)(b) GDPR for requests related to a contract, otherwise our legitimate interest in answering your request (Art. 6(1)(f) GDPR). We delete messages from the contact form automatically six months after receipt, and the copy in our mailbox after six months as well, unless statutory retention obligations apply (for example to business correspondence). All that remains is the anonymous number of messages per month.

We send emails such as sign-in links, confirmations, contact form messages and event notifications via Resend (Resend Inc., USA). Delivery runs via a data centre in Ireland (EU); as Resend is a US company, access from the USA cannot be ruled out (see section 17).

We are currently moving notifications sent to many recipients to our own mail server (mail.bearhood.de), which we operate on a server of STRATO AG (Berlin, Germany).

The service providers only process your email address and the content of the message in order to deliver it.

We sell tickets mainly via Eventbrite; for some events we also use payment links from Stripe. For events held together with partners, tickets may be sold via other platforms, for example eventjet (events at Club Sauna by Boiler) or directly by the venue with payment via PayPal (events at Club Culture Houze). The platform used is stated with each event.

When you buy a ticket, the respective platform is responsible for the purchase and payment process under its own privacy policy. As the organiser we receive the data needed to run the event (in particular name, email address, ticket type and check-in status) and use it for admission and guest lists. Legal basis: Art. 6(1)(b) GDPR.

If you buy via a Stripe payment link, the payment is processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). Your name, email address, billing address and payment details are processed for this. We receive your name, email address and billing address and the confirmation that the payment was made; we do not see your full card details. For some purposes, such as fraud prevention and legal obligations, Stripe is a controller in its own right (https://stripe.com/privacy). We keep payment records for as long as tax law requires (up to ten years).

Links from our website to ticket shops may contain a short code that shows the platform that the purchase came from our website. We only see aggregated sales figures from this.

Photos and videos may be taken at our events. We use them to document our events, for reporting and public relations and to present future events, for example in the gallery on our website, on our social media channels and in print. Where special photo rules apply at an event, we announce them in the event description or on site.

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). If you appear in a photo and want it removed, you can request this directly in the gallery when signed in (we store the request with your user ID and an optional reason) or write to info@bearhood.de. We remove the photo promptly. If you delete your account, the request is kept without the link to your account so that the photo is still removed.

To enforce house bans under our terms and conditions and to protect our guests, we keep a list that only our core team can access. It contains the name, the period of the ban, the reason as a category, the decision and whether the person was informed. If necessary, we pass the name on to the security staff of the venue, and we compare the list with the guest list before large events.

Legal basis: our legitimate interest in protecting our guests and enforcing house bans (Art. 6(1)(f) GDPR). The data is stored until the ban ends; permanent bans are reviewed every two years.

We run accounts on Instagram and Facebook (Meta Platforms Ireland Ltd.). When you visit them, Meta’s privacy policies apply. For the statistics Meta provides about our pages (Insights), we and Meta are jointly responsible (Art. 26 GDPR); Meta is the primary contact for your rights in this respect.

We are also present on TikTok and Resident Advisor; their privacy policies apply there. We do not embed social media content on our website; we only link to it.

Our website contains links to other websites, for example ticket shops, social networks or maps. Once you follow such a link, the privacy policy of that website applies.

Supabase, Resend and Stripe are US companies or belong to a US group. Although our data is stored or processed in data centres in the EU or by EU subsidiaries, access from the USA cannot be ruled out. Such transfers are based on the EU-US Data Privacy Framework or on EU standard contractual clauses (Art. 44 et seq. GDPR).

We store personal data only as long as needed for the purposes stated above or as required by statutory retention obligations. The specific periods are given in the sections above. After that, the data is deleted or anonymised.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Where we process data based on our legitimate interest, you can object to this processing at any time for reasons arising from your particular situation.

To exercise your rights, simply write to info@bearhood.de.

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59-61 10555 Berlin https://www.datenschutz-berlin.de

We protect your data with appropriate technical and organisational measures, including encrypted transmission (TLS), access to admin functions limited to the core team and a log of changes made in the admin area, whose entries we delete automatically after three months. When you choose a password, our server checks anonymously whether it appears in known data breaches (Pwned Passwords by Have I Been Pwned): only the first five characters of a hash of the password are transmitted, never the password itself or your IP address.

Bearhood is constantly being developed further. The features, technologies and service providers we use may therefore change, and we update this policy accordingly. We are working on gradually moving more services to providers based in Germany or the EU, or running them ourselves, as we already do with our analytics and our mail server.

The version published on this website applies. Last updated: 8 October 2026.