1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR), other national data protection laws of the member states, and other data protection provisions is the operator of this online offering.
2. General information on data processing
2.1 Scope of the processing of personal data
As a rule, we collect and use the personal data of our users only to the extent necessary to provide a functional website and our content and services. The collection and use of our users' personal data regularly takes place only with the user's consent. An exception applies in cases where obtaining prior consent is not possible for factual reasons and the processing of the data is permitted by law.
2.2 Legal basis for the processing of personal data
Where we obtain the data subject's consent for processing operations involving personal data, Article 6(1)(a) GDPR serves as the legal basis. When processing personal data that is necessary for the performance of a contract to which the data subject is party, Article 6(1)(b) GDPR serves as the legal basis. This also applies to processing operations necessary to carry out pre-contractual measures.
2.3 Data deletion and storage period
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may continue if required by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted when a storage period prescribed by the aforementioned standards expires, unless further storage is necessary for the conclusion or performance of a contract.
3. Provision of the website and creation of log files
3.1 Description and scope of data processing
Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:
- IP address of the requesting device
- Date and time of the request
- Time zone difference from Greenwich Mean Time (GMT)
- Content of the request (specific page)
- Access status / HTTP status code
- Amount of data transferred in each case
- Website from which the request originates
- Browser and operating system of the device
3.2 Legal basis and purpose
The legal basis for the temporary storage of the data is Article 6(1)(f) GDPR. Storage in log files takes place to ensure the functionality of the website. The data also helps us optimize the website and ensure the security of our information technology systems. The data is not evaluated for marketing purposes in this context.
3.3 Storage period
The data is deleted as soon as it is no longer necessary for the purpose for which it was collected. In the case of data collection for providing the website, this is the case when the respective session ends. In the case of storage in log files, this happens after no more than seven days.
4. Registration and user account
4.1 Description and scope of data processing
On our website, users can register by providing personal data. The data is entered into an input form, transmitted to us, and stored. The following data is collected as part of the registration process:
- Email address (required)
- First name and last name (required)
- Phone number (optional)
- Address (street, postal code, city, country) (optional)
- Date of birth (optional)
- Gender (optional)
- Preferred language
The following data is also collected during login and while using the platform:
- Group memberships and roles (admin/member)
- Festival participation
- Vehicle assignments and route planning
- Financial data (expenses, payments, outstanding balances)
- Documents (tickets, admission passes, travel documents)
- Media content (photos and videos from festivals)
- Schedule selections (which acts are being attended)
- Camp-share contributions (equipment brought along)
4.2 Legal basis and purpose
If the user has given consent, the legal basis for processing the data is Article 6(1)(a) GDPR. If registration serves the performance of a contract to which the data subject is party or the implementation of pre-contractual measures, the additional legal basis is Article 6(1)(b) GDPR.
Registration is required to provide certain content and services on our website. Collection of optional data serves improved coordination within festival crews, for example an address for vehicle pickup or a phone number for on-site contact.
4.3 Storage period
The data is deleted as soon as it is no longer necessary for the purpose for which it was collected. For data collected during registration, this is the case when registration on our website is canceled or modified. You can delete your user account at any time by contacting the controller.
5. File uploads (documents and media)
5.1 Description
Users can upload documents, such as tickets and booking confirmations, as well as media such as photos and videos, to the platform. These files are stored on Backblaze B2 (encrypted, object storage).
5.2 Processed data
- Uploaded files (PDFs, images, videos)
- Metadata (file name, file size, upload time, MIME type)
- Optional: recording date for media (EXIF data)
- Associated group and festival
5.3 Legal basis
Article 6(1)(a) GDPR (consent through upload within a group) and Article 6(1)(b) GDPR (performance of a contract). For media content, the following applies: by uploading, you simultaneously grant other group members the right to view and download this content within the group.
5.4 Storage period
Files are stored as long as the associated group exists or until the user deletes the file. If a group is deleted, all associated files are completely deleted within 30 days.
6. Contact form and email contact
6.1 Description and scope
A contact form is available on our website that can be used for electronic contact. If a user uses this option, the data entered into the input form is transmitted to us and stored. This data includes:
- Email address
- Name (optional)
- Subject
- Message
6.2 Legal basis and purpose
The legal basis for processing the data is Article 6(1)(f) GDPR. If the email contact is aimed at concluding a contract, the additional legal basis for processing is Article 6(1)(b) GDPR. The processing of personal data serves us solely for handling the contact request.
6.3 Storage period
The data is deleted as soon as it is no longer necessary for the purpose for which it was collected. For personal data entered into the contact form and sent by email, this is the case when the respective conversation with the user has ended. The conversation is deemed ended when the circumstances indicate that the matter in question has been conclusively resolved.
7. Use of Google Maps
7.1 Description and scope
We use the Google Maps API for route planning within vehicle coordination. When the map feature is opened, data is transmitted to Google.
7.2 Processed data
- IP address
- Start and destination addresses (festival location)
- Time of the request
7.3 Legal basis
Article 6(1)(f) GDPR (legitimate interest in functional route planning). Google Maps is used only after consent via our cookie banner, if implemented, or can be disabled in the settings.
7.4 Note
Google Maps is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Data may be transferred to the United States. Google is certified under the EU-US Data Privacy Framework.
8. Cookies
Information on the use of cookies can be found in our Cookie Policy.
9. Your rights
As a data subject, you have the following rights against the controller:
- Right of access (Article 15 GDPR): You may request information about the personal data we process about you.
- Right to rectification (Article 16 GDPR): You may request the immediate correction of inaccurate or completion of incomplete personal data stored by us.
- Right to erasure (Article 17 GDPR): You may request the deletion of your personal data stored by us unless processing is necessary to comply with a legal obligation or to establish, exercise, or defend legal claims.
- Right to restriction of processing (Article 18 GDPR): You may request the restriction of processing of your personal data.
- Right to data portability (Article 20 GDPR): You may request that your data be provided in a structured, commonly used, machine-readable format or transmitted to another controller.
- Right to object (Article 21 GDPR): You may object to the processing of your personal data if it is based on Article 6(1)(e) or (f) GDPR.
- Withdrawal of consent (Article 7(3) GDPR): You have the right to withdraw any consent you have given at any time.
- Right to lodge a complaint (Article 77 GDPR): You have the right to lodge a complaint with a supervisory authority.
10. Data security
During your visit to the website, we use the widely adopted SSL (Secure Socket Layer) procedure in combination with the highest level of encryption supported by your browser. This applies both to the transmission of your data to our servers and to the transmission of your data to external services, for example Backblaze B2 for file uploads.
In addition, we implement technical and organizational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties.
11. Changes to this privacy policy
We reserve the right to amend this privacy policy so that it always complies with current legal requirements or to reflect changes to our services in this privacy policy. The new privacy policy will then apply to your next visit.
12. Privacy contact
If you have any questions about data protection, you can contact us at:
Email: support@crewmate.dev