Last updated: October 2026. The German version of this privacy policy is legally binding.

1. Controller

Stefan Steinert
Finkenweg 44
91629 Weihenzell
Germany
E-mail: whzoa@stefan-steinert.de

This website, the WHZOA-ID and the WHZOA app are a private, non-commercial demo project. The festival and the named organiser are fictional. The data processing described below nevertheless actually takes place as soon as you use the website or the app.

2. Hosting and server log files

The website, the WHZOA-ID and the ticket shop run on servers of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes data on my behalf under a data processing agreement (Art. 28 GDPR).

With every request, the web server automatically stores: IP address, date and time, requested URL, referrer URL, amount of data transferred, HTTP status code, and browser and operating system (user agent). This data is technically required to deliver the site and keep it secure (Art. 6 (1) (f) GDPR). Log files are deleted after 90 days.

3. Cookies

The website does not set any tracking or marketing cookies. A session cookie (fe_typo_user) is only set when you log in. It is technically required for the login (Section 25 (2) no. 2 TDDDG) and is deleted when you close your browser.

4. Contact by e-mail

If you send me an e-mail, I process your e-mail address and the content of your message in order to answer your request (Art. 6 (1) (b) or (f) GDPR). The message is deleted once the matter is settled and no retention obligation applies.

5. WHZOA-ID (user account)

Logging in to the website and the app uses a central user account, the WHZOA-ID (self-hosted at whzoa-id.stefan-steinert.de). The data you provide during registration (in particular name, e-mail address, password as a hash) and technical login information are processed. The legal basis is Art. 6 (1) (b) GDPR. You can view and change your data in the WHZOA-ID account console. You can have your account deleted at any time, e.g. in the app (Profile → Delete data) or by e-mail.

6. Ticket shop

The ticket shop at whzoa-ticket.stefan-steinert.de is a separate service (ticket shop software pretix). There I process the data you enter when placing an order (e.g. name, e-mail address, order details) in order to handle the order (Art. 6 (1) (b) GDPR). As this is a demo project, no real tickets are sold.

7. External links

The website links to external services, e.g. a Discord server. Data is only transferred to the respective provider once you click the link. The respective provider is responsible for any processing there.

8. Instagram feed

The website displays posts from the project's Instagram account. Instagram is provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The posts are retrieved via the Instagram interface. When they are displayed, images are loaded from Meta's servers, which transmits your IP address and information about your browser to Meta. Data may be transferred to Meta Platforms, Inc. in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). The legal basis is my legitimate interest in an appealing presentation of the project (Art. 6 (1) (f) GDPR). For more information, see Instagram's privacy policy: privacycenter.instagram.com/policy.

9. WHZOA app

The app uses Google Firebase services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework (adequacy decision of the European Commission, Art. 45 GDPR). A data processing agreement with Google is in place.

9.1 Content

News, bands, running order, stages, map content and vendors are loaded from Cloud Firestore. For technical reasons, your IP address is transmitted to Google in the process (Art. 6 (1) (f) GDPR).

9.2 Login and profile

You log in with your WHZOA-ID; Firebase Authentication stores a user ID and the profile data provided by the WHZOA-ID (name, e-mail address). If you upload a profile picture, it is stored in Firebase Cloud Storage. The legal basis is Art. 6 (1) (b) GDPR. Using "Delete data" in your profile deletes your account and the associated data.

9.3 Tickets

When you add a ticket to the app, the ticket code is sent to a Cloud Function (Frankfurt region, europe-west3), which retrieves the ticket holder's name and the ticket type from the ticket shop. The ticket is then stored locally on your device only (Art. 6 (1) (b) GDPR). You can remove it in the app at any time.

9.4 Push notifications

If you allow notifications, Firebase Cloud Messaging creates a device token and the app subscribes to a notification channel for your language. I cannot see individual devices. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw in the app settings or your device settings.

9.5 Location and map

If you share your location, your position is shown on the festival map. Your location does not leave your device for this. Map tiles are loaded from the servers of the OpenStreetMap Foundation (tile.openstreetmap.org, United Kingdom), which receive your IP address and the app identifier (Art. 6 (1) (f) GDPR). An adequacy decision of the European Commission exists for the United Kingdom.

9.6 Crowd tracking (optional)

Only if you enable both location and "Crowd Tracking" does the app, while it is active, transmit your position (latitude and longitude) with a timestamp to Cloud Firestore about every five minutes. The transmission uses a randomly generated identifier that is not linked to your account, your name or your device. Only the most recent position is stored. Positions are displayed on a map in the admin area to identify visitor flows and improve safety; only I have access to it. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time in the settings. Stored positions are deleted after 30 days.

9.7 Usage statistics, crash reports, performance monitoring

The app offers three optional services, each of which you can consent to individually. Without your consent they are disabled and no data is collected:

• Analytics (Google Analytics for Firebase): pseudonymous usage data, e.g. screens viewed, app instance ID, device type, operating system, app version and approximate location based on the IP address, to understand which parts of the app are used. The data is deleted after 2 months.
• Crash reports (Firebase Crashlytics): information about crashes and errors, e.g. stack trace, device type, operating system, app version and an installation ID, to fix bugs. Reports are deleted after 90 days.
• Performance monitoring (Firebase Performance Monitoring): loading times and network performance of the app, to improve it.

The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). You decide when you first start the app and can change your choice at any time with effect for the future in the app settings. If you withdraw consent for crash reports, reports not yet sent are deleted from your device.

9.8 Data stored locally

Settings, favourites, saved tickets and received notifications are stored locally on your device only and are deleted when you uninstall the app.

10. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent you have given at any time with effect for the future (Art. 7 (3) GDPR). An informal e-mail to the address above is sufficient.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.