Privacy Policy

1. Controller

The controller responsible for the processing of personal data on this website is:

2. Data We Collect

2.1 Account data (registered users only)

If you create an account, we collect your name, email address, and a hashed version of your password. We never store your plain-text password. This data is required to provide the account service (Art. 6(1)(b) GDPR).

2.2 Usage data

When you visit the site, our hosting provider (Vercel) automatically records your IP address, browser type, operating system, referring URL, and pages visited. This data is processed for security and to ensure the technical functioning of the site (Art. 6(1)(f) GDPR — legitimate interest).

2.3 Data you provide voluntarily

If you submit an event or contact us by email, we process the information you send us solely to respond to your request or review your submission (Art. 6(1)(b) GDPR).

3. Event Data

The events listed on Sponty are collected from publicly available sources, including Resident Advisor (ra.co) and other public event directories. We do not collect personal data about event attendees. Artist names and organiser names included in event listings are public information. If you are an artist or organiser and wish to have your name removed from a listing, please contact us at contact@sponty.me.

4. Cookies

We use only essential cookies — specifically a session cookie (next-auth.session-token) that keeps you signed in. This cookie is strictly necessary for authentication and is deleted when you sign out or it expires. We do not use advertising, analytics, or third-party tracking cookies.

See our Cookie Policy for full details.

5. Third-Party Services

6. Data Retention

• Account data: retained while your account is active. Deleted upon account deletion request within 30 days.
• Server access logs: retained by Vercel for up to 30 days.
• Email communications: retained for up to 1 year.
• Session tokens: expire after 30 days of inactivity.

7. Your Rights (GDPR)

Under the GDPR you have the following rights:

• Right of access (Art. 15): request a copy of the personal data we hold about you.
• Right to rectification (Art. 16): request correction of inaccurate data.
• Right to erasure (Art. 17): request deletion of your personal data.
• Right to restriction (Art. 18): request that we limit processing of your data.
• Right to data portability (Art. 20): request your data in a machine-readable format.
• Right to object (Art. 21): object to processing based on legitimate interests.

To exercise any of these rights, email us at contact@sponty.me. We will respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority. The competent authority in Germany is the relevant state data protection authority (Landesdatenschutzbehörde).

8. Data Security

We use HTTPS encryption for all data in transit. Passwords are hashed using bcrypt with a cost factor of 12. Access to the production database is restricted to authorised services only. We do not sell or rent your personal data to third parties.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users of material changes by email. The date at the top of this page indicates when the policy was last revised.

10. Contact

For any privacy-related questions or requests, please contact: contact@sponty.me