Privacy Policy

1. Controller

The controller responsible for processing your personal data on this website is:

Westhafen GmbH
represented by Daylin Alvarez
Kreuzstraße 20
04103 Leipzig
Germany

Email: info@westhafen-leipzig.de

No data protection officer has been appointed, as our company is not legally required to do so.

If you have any questions about data protection, you can contact us at any time using the contact details above.

2. What this website is about and which data we process

Our website at https://westhafen-leipzig.de is primarily used to present events and offers from Westhafen. In particular, you can use the website to buy tickets or a season ticket, send general inquiries, or submit a request to rent our venue.

We process personal data on this website in particular:

• when you use our contact form,
• when you use the venue rental request form,
• when you purchase tickets or a season ticket,
• when server logs, cookies, or similar technologies are technically required when using the website,
• when you consent to tracking or marketing technologies.

We mainly use this data to provide and secure the website, respond to inquiries, process purchases, and improve our services.

Depending on the individual case, the legal bases are primarily:

• Art. 6(1)(b) GDPR, where processing is necessary for the performance of a contract or to take steps prior to entering into a contract,
• Art. 6(1)(f) GDPR, where we have a legitimate interest in a secure, functional, and efficient website,
• Art. 6(1)(a) GDPR, where you give us your consent, for example for statistics or marketing cookies.

3. Hosting and technical infrastructure

3.1 Website hosting (Vercel)

Our website is hosted by Vercel Inc., USA. Vercel provides the servers that deliver our pages and run our server-side functions.

When you access our website, Vercel processes in particular the following data:

• IP address,
• date and time of access,
• information about browser, device, and operating system,
• requested content and technical connection data.

Vercel processes this data on our behalf as a processor in accordance with Art. 28 GDPR. Appropriate safeguards are in place for transfers to the United States, in particular EU Standard Contractual Clauses and certification under the EU-US Data Privacy Framework.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable, and fast provision of the website.

3.2 Database and files (Supabase)

Our database, files, and parts of our business logic are operated for us by Supabase Inc., USA. Our project is set up so that personal data is stored in the eu-central-1 region in Frankfurt am Main.

This includes in particular orders and tickets, contact and venue rental requests, and the data from our own reach measurement (see section 6.1).

Supabase processes the data on our behalf as a processor in accordance with Art. 28 GDPR. Where subprocessors outside the EU are involved, appropriate safeguards are in place, in particular EU Standard Contractual Clauses.

3.3 Server infrastructure (ventureon GmbH)

ventureon GmbH in Germany develops and operates the platform behind this website on our behalf and is therefore another processor within the meaning of Art. 28 GDPR.

A data processing agreement has been concluded with ventureon GmbH.

3.4 Email delivery (Postmark)

We use Postmark (ActiveCampaign, LLC, USA) to send emails triggered through our website. This includes in particular order confirmations, tickets, ticket-related emails, and internal notifications about new form submissions.

In particular, the following data may be processed:

• email addresses of senders and recipients,
• content data of the message,
• technical metadata such as sending time, delivery status, and IP address.

If tickets are sent, Postmark may also process the corresponding ticket PDFs in order to deliver them to you or to recipients designated by you.

Postmark processes the data on our behalf. Where data is transferred to third countries, this takes place on the basis of appropriate safeguards, in particular EU Standard Contractual Clauses.

The legal basis is Art. 6(1)(b) GDPR insofar as sending is necessary for contract performance or to process your inquiry, and Art. 6(1)(f) GDPR for our legitimate interest in reliable communication.

3.5 Bot protection (Cloudflare Turnstile)

To protect our forms against spam, bots, and abusive automated access, we use Cloudflare Turnstile provided by Cloudflare Inc., USA.

Technically necessary information is processed in order to distinguish between human users and automated requests. This may include in particular IP address, browser and device information, referrer data, timestamps, and security-related telemetry data.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and forms against misuse.

3.6 Error monitoring (Sentry)

To detect and fix technical errors quickly, we use Sentry provided by Functional Software, Inc., USA. If an error occurs on the website, an error report is sent to Sentry.

It contains in particular the error description, the page accessed, the time, and information about browser, device, and operating system. We remove cookies, access keys, and URL parameters before transmission. Your session is not recorded on the website.

Sentry processes the data on our behalf. Appropriate safeguards are in place for transfers to the United States, in particular EU Standard Contractual Clauses.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in an error-free and secure website.

3.7 Payment processing (Stripe)

We use Stripe Payments Europe, Ltd. for payment processing when purchasing tickets and season tickets.

For the purchase of individual tickets, we use Stripe Payment Intents in particular. For the purchase of a season ticket, we use Stripe Checkout.

Through Stripe, we offer the following payment methods in particular:

• card payment,
• Apple Pay,
• Google Pay,
• PayPal,
• Klarna.

When you start a purchase process, a connection is established to Stripe. Stripe processes the data required for payment processing under its own responsibility. This may include, in particular, payment data, transaction data, technical connection data, and billing-related information.

In connection with ticket purchases, we ourselves process in particular the email address you provide and purchase- and ticket-related information to the extent necessary for processing.

Depending on the selected payment method, additional payment service providers or method-specific providers may also be involved in payment processing. In this case, processing is carried out in accordance with the respective terms and privacy notices of those providers.

The legal basis is Art. 6(1)(b) GDPR, as the processing is necessary for the performance of the purchase contract.

4. Contact inquiries, venue rental requests, ticket purchases, and job openings

4.1 Contact form

If you contact us via the contact form on our website, we process the information you provide there. This includes in particular:

• first and last name,
• email address,
• what your inquiry is about,
• message.

Your inquiry is stored in our database, and our team is notified by email via Postmark. Questions about tickets are forwarded to the person responsible for them. We do not send you a confirmation of receipt.

The legal basis is Art. 6(1)(b) GDPR if the inquiry concerns a specific contractual or pre-contractual matter, and otherwise Art. 6(1)(f) GDPR. Our legitimate interest lies in orderly and user-friendly communication.

4.2 “Rent the venue” form

If you submit a request through our website to rent our venue, we process the information you provide in the corresponding form. This includes in particular:

• first and last name,
• company name,
• email address,
• phone number,
• occasion,
• date of the event,
• number of guests,
• message.

The request is stored in our database like a contact inquiry, and our team is notified by email. We use this data to review your request, contact you, and prepare a possible venue rental organizationally.

The legal basis is Art. 6(1)(b) GDPR insofar as the request is aimed at entering into a contract, and otherwise Art. 6(1)(f) GDPR.

4.3 Ticket purchases and season ticket

If you purchase tickets or a season ticket via our website, we process the data required for contract performance.

This includes in particular:

• email address,
• order numbers,
• ticket IDs,
• QR codes,
• information about the purchased ticket or season ticket,
• information about order and delivery status.

We store this data in our database at Supabase. Payment processing is carried out via Stripe. Tickets are delivered by email through Postmark and may include ticket PDFs.

If you forward tickets to other people or arrange for tickets to be sent directly to other people, we also process the recipient email address you provide and the ticket assignment in order to deliver the respective ticket to the correct person.

The legal basis is Art. 6(1)(b) GDPR.

4.4 Job openings via JOIN

On our “Jobs” page, we embed the job listing of the application portal JOIN provided by JOIN Solutions AG, Switzerland. When you open the page, your browser loads the listing directly from JOIN’s servers. In particular, your IP address and browser and device information are transmitted to JOIN.

Applications are not processed through this website, but exclusively via the JOIN platform, where JOIN’s privacy notice and terms of use apply. An adequacy decision of the European Commission exists for Switzerland.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in presenting our job openings in an up-to-date and clear manner.

5. Cookies and similar technologies

5.1 General information

We use cookies and similar technologies on our website. Some of them are technically necessary, while others serve convenience, statistical, or marketing purposes.

When you first visit our website, you can use our cookie banner to choose which categories may be activated. Non-essential technologies are only set or loaded once you have given your consent. You can change or withdraw your selection at any time via “Cookie Settings” in the footer of every page.

5.2 Categories and technologies used

• Required
  Store your selection in the cookie banner (cookies wz_consent and wz_categories, 12 months). This is necessary to respect your decision.
• Preferences
  Remember settings, for example that you closed the notice about the English version of the website (an entry in your browser’s local storage).
• Statistics
  Google Analytics 4 (see section 6.2) with Google’s cookies, in particular _ga.
• Marketing
  Recognition of your browser for our own measurement (cookie wz_visitor, 12 months, see section 6.1) as well as Meta Pixel and TikTok Pixel with these providers’ cookies, in particular _fbp, _fbc, and _ttp (see sections 6.3 and 6.4).

5.3 Consent management

Your selection in the cookie banner is stored for 12 months. After that, we will ask you again.

The legal basis for storing your selection is Section 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(c) and (f) GDPR. The legal basis for all other non-essential cookies and similar technologies is your consent pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

6. Reach measurement, web analytics, and embedded content

We want to understand how our website is used and how successful our advertising is. For this purpose, we use our own measurement and, only with your consent, analytics and marketing technologies from third parties.

6.1 Our own reach measurement

We count page views and certain actions on our website, such as opening an event page, starting a ticket purchase, or submitting a form. The data is stored in our own database at Supabase in Frankfurt and is not passed on to third parties.

Without consent, we do not store anything on your device. To avoid counting visits twice, we derive a daily value from your IP address and browser identifier that changes every day; the IP address and browser identifier themselves are not stored. This means you cannot be identified as a person. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in improving our services.

With consent to marketing, we set the cookie wz_visitor with a random identifier. This allows us to combine your visits, record the origin of your first visit (such as a campaign or referring website), and link a later ticket purchase, a form inquiry, or a visit via a link from one of our emails to this identifier. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR. If you withdraw it, we remove the link immediately; the events remain only as an anonymous count.

6.2 Google Analytics 4

If you consent to statistics, we use Google Analytics 4 provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics sets cookies to analyze the use of the website, such as pages viewed, time spent, approximate origin, and device and browser information. Google Analytics 4 does not store IP addresses.

Data may be transferred to Google LLC in the United States. Google is certified under the EU-US Data Privacy Framework.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

6.3 Meta Pixel and Conversions API

If you consent to marketing, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. The pixel reports page views and sets the cookies _fbp and _fbc.

In addition, we report conversions such as a ticket purchase or a form inquiry directly from our server to Meta via the Conversions API, also only with your consent. This includes in particular your hashed email address and name, the Meta cookies, your IP address and browser identifier, as well as the order value and the tickets purchased. This allows Meta to determine whether a purchase can be attributed to an advertisement.

For the period between starting and completing a purchase, we store the Meta cookies, IP address, and browser identifier for up to 90 days.

Data may be transferred to Meta Platforms, Inc. in the United States. Meta is certified under the EU-US Data Privacy Framework.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

6.4 TikTok Pixel and Events API

If you consent to marketing, we also use the TikTok Pixel provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland, as well as server-side transmissions via the TikTok Events API.

This allows us to evaluate the reach and success of our campaigns. In particular, page views, device and browser information, conversions, and hashed email addresses may be processed. The pixel sets in particular the cookie _ttp.

Data may be transferred to third countries, in particular to the United States and Singapore. TikTok uses EU Standard Contractual Clauses for this purpose.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

6.5 SoundCloud embeds

Content from SoundCloud may be embedded in lineups or on event pages. These embeds are only loaded after you have consented to marketing.

When a SoundCloud embed is loaded, a connection is established to SoundCloud servers. In this context, personal data, in particular IP address, browser information, and usage data, may be transmitted to SoundCloud.

The legal basis is your consent pursuant to Art. 6(1)(a) GDPR.

6.6 Map display (OpenFreeMap)

In the footer we show a map with our location. The map data comes from OpenStreetMap; your browser loads the map tiles from the OpenFreeMap service (openfreemap.org).

As soon as the footer becomes visible, your browser requests the tiles directly from OpenFreeMap. Your IP address, information about your browser and device, and the map section shown are transmitted. No cookies are set.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is a directions map without tracking.

7. Data transfers to third countries

Some of the service providers we use are based outside the European Union or the European Economic Area, or may transfer data there. This applies in particular to service providers in the United States.

Where personal data is transferred to a third country, we ensure that there is a legally permissible basis for doing so. This may be the case in particular through:

• an adequacy decision by the European Commission, for example for Switzerland or for companies certified under the EU-US Data Privacy Framework,
• the conclusion of EU Standard Contractual Clauses,
• your explicit consent,
• the necessity of the transfer for the performance of a contract.

Third-country transfers may in particular occur in connection with the following services:

• Vercel,
• Supabase and certain subprocessors used there,
• Postmark,
• Cloudflare,
• Sentry,
• Stripe,
• JOIN,
• Google,
• Meta,
• TikTok,
• SoundCloud.

If you would like more detailed information about the safeguards used, you can contact us at any time.

8. Storage period and deletion

We store personal data only for as long as this is necessary for the respective purposes or as long as statutory retention obligations apply.

8.1 Contact and venue rental inquiries

We store data from contact inquiries and venue rental requests for as long as necessary to process your request and for further communication. In addition, commercial and tax retention obligations may apply if the inquiry results in a contractual relationship.

8.2 Ticketing and order data

We store data relating to ticket purchases and season tickets, in particular email addresses, order numbers, ticket IDs, QR codes, and delivery-related information, within the scope of statutory retention obligations.

The storage period is based in particular on commercial and tax law requirements. Once the relevant periods have expired, the data is deleted or anonymized unless another legal basis exists for further storage.

8.3 Measurement data

The identifier in the cookie wz_visitor and your selection in the cookie banner are valid for 12 months. We remove the link between an identifier and a purchase or inquiry after 24 months without any new activity. Data we keep for Meta’s Conversions API is deleted after 90 days at the latest. Events counted without consent contain no identifier and no IP address.

8.4 Server logs and security data

We generally store technical log data and security-related information only for as long as necessary to ensure operation, detect misuse, and defend against attacks.

8.5 Backups

We create encrypted backups in order to prevent data loss. These backups are stored in a rolling process and are overwritten or deleted after the respective backup cycle expires.

8.6 General deletion criteria

Personal data is deleted or anonymized as soon as:

• the purpose of processing no longer applies,
• there are no longer any statutory retention obligations,
• no legitimate interests or other legal grounds prevent deletion.

9. Security and protection of your data

We take technical and organizational measures to protect your personal data against loss, misuse, unauthorized access, and other unlawful processing.

These measures include in particular:

• encrypted transmission via TLS/SSL,
• secured server and infrastructure environments,
• access restrictions based on the need-to-know principle,
• regular backups,
• security measures against automated attacks and misuse.

Despite all measures, complete security on the internet can never be guaranteed. However, we continuously adapt our protective measures to the current state of the art.

10. Your rights as a data subject

Under the GDPR, you have the following rights in particular:

• access pursuant to Art. 15 GDPR,
• rectification pursuant to Art. 16 GDPR,
• erasure pursuant to Art. 17 GDPR,
• restriction of processing pursuant to Art. 18 GDPR,
• data portability pursuant to Art. 20 GDPR,
• objection pursuant to Art. 21 GDPR,
• withdrawal of consent already given pursuant to Art. 7(3) GDPR with effect for the future.

If you would like to exercise any of these rights, you can contact us at any time using the contact details above.

11. Changes to this privacy policy

We reserve the right to amend this privacy policy if our website, our services, the technologies we use, or the legal requirements change.

You can always find the current version at https://westhafen-leipzig.de/datenschutz.

12. Questions, complaints, and competent supervisory authority

If you have any questions or concerns about data protection, you can contact us at any time:

Westhafen GmbH
Kreuzstraße 20
04103 Leipzig
Germany
Email: info@westhafen-leipzig.de

If you believe that the processing of your personal data violates applicable data protection law, you also have the right to lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.

The authority primarily responsible for us is:

Saxon Data Protection and Transparency Commissioner
Maternistraße 17
01067 Dresden
Germany
Phone: +49 351 85471-101
Email: post@sdtb.sachsen.de
Website: www.datenschutz.sachsen.de

Of course, you can also contact any other data protection authority responsible for you. However, we would appreciate it if you contacted us first so that we can work together to find a solution.