Privacy Policy

The controller responsible for processing personal data on this website is:

Kayoso Events (sole proprietorship) Owner: Kay A. Schink c/o Online-Impressum 11552 Europaring 90 53757 Sankt Augustin Germany Email: info@bearhood.de

Both websites run as applications on our own server, rented from Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany) and located in a data centre in the EU.

When you visit the website, the server processes technically necessary data, in particular your IP address, in order to deliver the page to your browser.

We do not keep an access log with IP addresses. The application only logs technical status and error messages; these logs are limited in size, are overwritten automatically and are deleted at the latest when the website is next updated.

To protect our forms against spam and abuse (for example the contact form, registrations and notifications), we also use your IP address briefly to limit too many requests in a short time. It is only held in the server’s memory, is not stored permanently and is discarded at the latest when the application restarts.

Legal basis: our legitimate interest in providing the website in a stable and secure way and in protecting it against abuse (Art. 6(1)(f) GDPR).

We only use technologies that are required for the website to work, unless you consent to more:

• “cc_cookie”: stores your choice in the consent banner so that we respect it on later visits. • “bh_locale”: stores your language (German or English) on bearhood.de for one year. • Login session: if you sign in, your session is kept in your browser’s storage. • Appearance and language: your light/dark mode setting and, on play.bearhood.de, your language choice are stored locally in your browser. • Only with your consent: “ph_…_posthog” (cookie and local storage) for analytics, see section 4.

Legal basis: § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR. Optional tools such as analytics are only loaded with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change your choice at any time via “Cookie settings” in the footer.

With your consent we use PostHog, a service of PostHog Inc. (USA), to understand how our website is used, to find errors and to improve the website. Our project is hosted in PostHog’s EU cloud in Frankfurt (Germany), and PostHog processes the data on our behalf under a data processing agreement. The data is sent via our own domain bearhood.de.

PostHog records: • Usage: which pages you visit, which elements you click (for example ticket links), how far you scroll, the referring website and campaign parameters in links (for example “utm_source”). • Technical data: browser, operating system, device type, screen size, language, approximate location (country and city) and page load times. • Errors: technical error messages that occur in your browser, so that we can fix them. • Session replays: a reconstruction of your visit (page content, mouse movements, clicks and scrolling), similar to a video. Everything you type into form fields is masked and never recorded. Pages in your user account are not recorded. • Registrations and newsletter: that you registered for an event (with the event and the number of people), cancelled a registration, or subscribed to, confirmed or unsubscribed from event notifications. Your name, email address and the other details from the form are not passed on.

To recognise your browser across visits, PostHog stores a random, pseudonymous ID in a cookie and in your browser’s local storage (“ph_…_posthog”, valid for one year). If you are signed in, PostHog also receives the internal ID of your user account (a random string, not your name or email address), so that your visits on different devices count as one person. PostHog does not track you across other websites. Your IP address is only used to determine your approximate location and is not stored.

PostHog deletes usage data automatically after one year and session replays after 30 days. If you want your data in PostHog deleted earlier, write to info@bearhood.de.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). You can withdraw it at any time via “Cookie settings” in the footer; PostHog then stops capturing and its ID is removed from your browser. Without consent, PostHog is not loaded.

Independently of your visit, we also copy figures from our own database to PostHog so that we can evaluate them together with the usage data: our events, the number of registrations and cancellations per event and day, and individual registrations and ticket purchases with only the event, number of people or tickets, sales channel, language and time. These copies contain no names, email addresses or other contact details and are not linked to your visits. Legal basis: our legitimate interest in evaluating our events (Art. 6(1)(f) GDPR).

You can create a user account. For this we process your email address, your password (stored only in encrypted form) or sign-in links, your username, an optional profile picture and your language setting. If you use community features, we also store your likes, bookmarks and comments; comments are visible to other visitors together with your username and profile picture.

Optionally, you can add your first and last name to your account. We use them to fill in your event registrations, and your first name to address you in emails. These details are not public, are stored encrypted and can be changed or deleted in your account at any time.

Accounts and the database are provided by Supabase Inc. (USA). Our project is located in a data centre in Ireland (EU). Supabase processes the data on our behalf.

To secure your login, Supabase stores the IP address and browser for each session. This data is deleted when you sign out, and at the latest 30 days after the session was last used. Supabase also keeps short-lived technical logs for security purposes.

Legal basis: Art. 6(1)(b) GDPR (providing the features you use). You can change your email address in your account; the change only takes effect once you have confirmed it via both the old and the new address. You can delete your account at any time yourself in your account settings or by writing to info@bearhood.de. This also deletes your profile, personal details, profile picture, comments, likes, saved events, ticket reminders and event notifications.

Members of the Bearhood team can create a public profile on our website with name, role, short bio, profile picture and links to their social media accounts. Creating such a profile is voluntary; the data can be changed or removed at any time.

Legal basis: consent (Art. 6(1)(a) GDPR).

You can sign up for notifications about new events. We use a double opt-in: after signing up you receive an email and must confirm the subscription. We store your email address, your language, the time of sign-up and confirmation, and technical tokens for confirmation and unsubscribing. So that you do not receive a notification twice, we also store which event we sent it to you for; we delete this entry automatically one day after the event.

Legal basis: your consent (Art. 6(1)(a) GDPR). Every notification contains an unsubscribe link; after unsubscribing, or when you delete your user account, we delete your email address. If you change the email address of your account, the subscription moves to the new address.

If you are signed in, you can ask to be notified as soon as tickets for an event are available. We store which event the reminder is for and link it to your user account. Legal basis: Art. 6(1)(b) GDPR. We delete reminders automatically once the event is over; all that remains is the anonymous number of reminders per event.

For some events you register directly on our website. We process first name, last name, email address, phone number if provided, the number of people you register (up to 6, without names of your companions) and an optional note. You receive a confirmation email with a link to view or cancel your registration.

If you have a user account with the same email address, we link the registration to it. You then also see it in your account under “My events”, where you can change or cancel it. If you delete your account, the registration remains, only without the link.

We use the data to plan the event, for admission and to contact you about changes. Legal basis: Art. 6(1)(b) GDPR. We delete registrations automatically three months after the event. All that remains are anonymous figures (how many registrations and cancellations there were per day) that cannot be traced back to you.

If you contact us via the contact form or by email, we process your name, email address, subject and message to answer your request. Messages from the contact form are stored in our database and forwarded to us by email.

Legal basis: Art. 6(1)(b) GDPR for requests related to a contract, otherwise our legitimate interest in answering your request (Art. 6(1)(f) GDPR). We delete messages from the contact form automatically six months after receipt, and the copy in our mailbox after six months as well, unless statutory retention obligations apply (for example to business correspondence). All that remains is the anonymous number of messages per month.

We send emails such as sign-in links, confirmations, contact form messages and event notifications via Resend (Resend Inc., USA). Delivery runs via a data centre in Ireland (EU); as Resend is a US company, access from the USA cannot be ruled out (see section 17).

Notifications sent to many recipients (new events, ticket and event reminders) go out via our own mail server (mail.bearhood.de), which we operate on a server of STRATO AG (Berlin, Germany). For addresses whose email service is hosted by Microsoft (e.g. Outlook, Hotmail), these notifications are still sent via Resend for deliverability reasons.

The service providers only process your email address and the content of the message in order to deliver it.

We sell tickets mainly via Eventbrite; for some events we also use payment links from Stripe. For events held together with partners, tickets may be sold via other platforms, for example eventjet (events at Club Sauna by Boiler) or directly by the venue with payment via PayPal (events at Club Culture Houze). The platform used is stated with each event.

When you buy a ticket, the respective platform is responsible for the purchase and payment process under its own privacy policy. As the organiser we receive the data needed to run the event (in particular name, email address, ticket type and check-in status) and use it for admission and guest lists. Legal basis: Art. 6(1)(b) GDPR.

If you buy via a Stripe payment link, the payment is processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). Your name, email address, billing address and payment details are processed for this. We receive your name, email address and billing address and the confirmation that the payment was made; we do not see your full card details. For some purposes, such as fraud prevention and legal obligations, Stripe is a controller in its own right (https://stripe.com/privacy). We keep payment records for as long as tax law requires (up to ten years).

If you have an account on bearhood.de and buy a ticket for one of our events on Eventbrite or pay for one through one of our Stripe payment links with the same email address, we show the event under "My events" in your account. For this we regularly fetch the orders for our upcoming events from Eventbrite and Stripe and store per order only the event, the number of tickets or places, the order or payment number and a pseudonymised check value (hash) of the email address; no names and no email address in plain text. We also store the check value if you do not (yet) have an account, so that an account created later can show them. Cancelled or refunded orders are removed at the next sync; all entries are deleted three months after the event. Legal basis: Art. 6(1)(b) GDPR for account holders, otherwise our legitimate interest in showing buyers their tickets and payments in their account (Art. 6(1)(f) GDPR).

Links from our website to ticket shops may contain a short code that shows the platform that the purchase came from our website. We only see aggregated sales figures from this.

Photos and videos may be taken at our events. We use them to document our events, for reporting and public relations and to present future events, for example in the gallery on our website, on our social media channels and in print. Where special photo rules apply at an event, we announce them in the event description or on site.

Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). If you appear in a photo and want it removed, you can request this directly in the gallery when signed in (we store the request with your user ID and an optional reason) or write to info@bearhood.de. We remove the photo promptly. If you delete your account, the request is kept without the link to your account so that the photo is still removed.

To enforce house bans under our terms and conditions and to protect our guests, we keep a list that only our core team can access. It contains the name, the period of the ban, the reason as a category, the decision and whether the person was informed. If necessary, we pass the name on to the security staff of the venue, and we compare the list with the guest list before large events.

Legal basis: our legitimate interest in protecting our guests and enforcing house bans (Art. 6(1)(f) GDPR). The data is stored until the ban ends; permanent bans are reviewed every two years.

We run accounts on Instagram and Facebook (Meta Platforms Ireland Ltd.). When you visit them, Meta’s privacy policies apply. For the statistics Meta provides about our pages (Insights), we and Meta are jointly responsible (Art. 26 GDPR); Meta is the primary contact for your rights in this respect.

We are also present on TikTok and Resident Advisor; their privacy policies apply there. We do not embed social media content on our website; we only link to it.

Our website contains links to other websites, for example ticket shops, social networks or maps. Once you follow such a link, the privacy policy of that website applies.

Supabase, Resend, Stripe and PostHog are US companies or belong to a US group. Although our data is stored or processed in data centres in the EU or by EU subsidiaries, access from the USA cannot be ruled out. Such transfers are based on the EU-US Data Privacy Framework or on EU standard contractual clauses (Art. 44 et seq. GDPR).

We store personal data only as long as needed for the purposes stated above or as required by statutory retention obligations. The specific periods are given in the sections above. After that, the data is deleted or anonymised.

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

Where we process data based on our legitimate interest, you can object to this processing at any time for reasons arising from your particular situation.

To exercise your rights, simply write to info@bearhood.de.

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59-61 10555 Berlin https://www.datenschutz-berlin.de

We protect your data with appropriate technical and organisational measures, including encrypted transmission (TLS), access to admin functions limited to the core team and a log of changes made in the admin area, whose entries we delete automatically after three months. When you choose a password, our server checks anonymously whether it appears in known data breaches (Pwned Passwords by Have I Been Pwned): only the first five characters of a hash of the password are transmitted, never the password itself or your IP address.

Bearhood is constantly being developed further. The features, technologies and service providers we use may therefore change, and we update this policy accordingly. We are working on gradually moving more services to providers based in Germany or the EU, or running them ourselves, as we already do with our mail server.

The version published on this website applies. Last updated: 18 October 2026.