Privacy policy

1. Controller

Hellas Event Center GmbH, Nico-Flatau-Platz 4, 30926 Seelze-Letter, represented by Pavel Mass and Irina Schatalova. Telephone +49 152 01551117, e-mail hellas.event.center@gmail.com. Please direct data protection enquiries to this address (subject "Datenschutz"). A data protection officer cannot currently be appointed pursuant to § 38 BDSG.

2. Hosting and server logs

This application is operated by Lovable (Lovable Labs Incorporated) and their infrastructure partners (including Cloudflare, Supabase). When accessed, technically necessary data (IP address, time, page accessed, browser) are processed to provide the site securely (Art. 6 Abs. 1 lit. f DSGVO). The website hellas-event.de is operated via WordPress at our hosting provider. A transfer to the USA takes place on the basis of the EU-US Data Privacy Framework or on the basis of standard contractual clauses.

3. Cookies and consent

Technically necessary storage (e.g. language selection, login, shopping cart) is used by us pursuant to § 25 Abs. 2 TDDDG without consent. Analysis, marketing and external media content (e.g. YouTube videos, Meta Pixel, Google Analytics) are only loaded after your consent (§ 25 Abs. 1 TDDDG, Art. 6 Abs. 1 lit. a DSGVO). You may revoke your consent at any time via the link "Cookie-Einstellungen" in the page footer.

4. Ticket purchases, reservations and enquiries

For orders, reservations, pre-orders and enquiries we process name, e-mail, telephone number, booking details and messages for the performance of the contract (Art. 6 Abs. 1 lit. b DSGVO). Tax and commercial retention obligations (up to 10 years, Art. 6 Abs. 1 lit. c DSGVO) remain unaffected; other data we delete as soon as they are no longer required, at the latest 3 years after the last booking.

Payments: Stripe Payments Europe Ltd., Ireland (card details are processed directly by Stripe). Tickets via Gastro.Digital / GastroGuide: Their privacy notices also apply.

Confirmation emails are sent by our email service provider on our behalf.

4a. ID data and admission

To verify age, hand over prizes and enforce our premises rules, we inspect official ID documents and record names and dates of birth if necessary (Art. 6 para. 1 points c and f GDPR). ID documents are not copied. We retain records of entry bans for up to 2 years.

5. Customer account and loyalty programme

If you create a customer account, we store your login details, bookings and loyalty points until you delete the account (Art. 6 para. 1 point b GDPR). When you sign in with Google, we receive your name and email address from Google Ireland Ltd.

6. WhatsApp, phone and e-mail

If you contact us via WhatsApp (WhatsApp Ireland Ltd. / Meta), we process your number and messages to handle your enquiry. WhatsApp may transfer metadata to the USA. Alternatively, you can contact us by email or phone.

7. Newsletter and event information

We only send newsletters with your consent using a double opt-in process (Art. 6 para. 1 point a GDPR). You can unsubscribe at any time using the link in each message.

7a. Event information for existing customers

If you have purchased tickets from us or booked an event, we may send information about similar of our own events to the e-mail address provided for that purpose (§ 7 Abs. 3 UWG, Art. 6 Abs. 1 lit. f DSGVO). You may object at any time, without incurring costs other than transmission costs at basic rates; an unsubscribe link is included in every message. Advertising via WhatsApp, SMS or telephone takes place only with your explicit consent.

8. Embedded videos and social media

We embed YouTube videos (Google Ireland Ltd.) in privacy-enhanced mode and only with your consent. We operate our Instagram and Facebook profiles jointly with Meta Platforms Ireland Ltd. (Art. 26 GDPR).

8a. Photo, video and audio recordings at events

At events we make recordings for documentation and promotion (website, social media, newsletter, print, press). Legal basis: legitimate interest (Art. 6 Abs. 1 lit. f DSGVO) and § 23 KUG; for targeted portrait or model shots your consent (Art. 6 Abs. 1 lit. a DSGVO). You can object at any time (Art. 21 DSGVO) – on site to staff or by e-mail; we will then remove recognizable individual images. Materials that have already been printed cannot be recalled. Further details in § 12 AGB.

8b. Prize draws

For the conduct of prize draws we process name, contact details and entry fee (Art. 6 Abs. 1 lit. b DSGVO). Winners are published only with consent. The data are deleted after completion and handover of the prize, at the latest after 3 months. For campaigns on Instagram or Facebook Meta additionally processes data according to its own provisions.

8c. Video surveillance

Entrance, outdoor and checkout areas may be monitored by video surveillance to protect people and property (Art. 6 para. 1 point f GDPR). These areas are marked. Recordings are generally retained for 72 hours, and longer only to preserve evidence.

9. Artificial intelligence

We use AI services via the Lovable AI Gateway for automatic translations and text suggestions. Only the texts to be translated are transmitted, not payment data. AI outputs are labelled and reviewed before publication.

10. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR), as well as the right to withdraw your consent with effect for the future.

Right to lodge a complaint: The State Commissioner for Data Protection of Lower Saxony, Prinzenstraße 5, 30159 Hannover, www.lfd.niedersachsen.de.

11. Data security

We encrypt all data in transit (TLS). Only authorised employees with individually assigned roles can access customer data; access is logged.

12. Website statistics

On hellas-event.de we count page views and clicks (e.g. on buy, WhatsApp, form) only with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR). We do not store names, e-mail addresses or full IP addresses, only page, event, language and time. The statistics are visible only to authorised staff and are deleted after 14 months at the latest.

13. Recipients, processors and third countries

Your data is only received by parties who need it for the stated purposes: our hosting and IT providers (Lovable, Cloudflare, Supabase, WordPress host), payment service Stripe, ticket service Gastro.Digital/GastroGuide, e-mail delivery service, Meta (WhatsApp, Instagram, Facebook) and Google (sign-in, YouTube). Contracts under Art. 28 GDPR are in place with processors. Tax advisers and authorities receive data only where we are legally obliged.

Where data is transferred to the USA or other third countries, this is based on an adequacy decision (EU-US Data Privacy Framework, Art. 45 GDPR) or EU standard contractual clauses (Art. 46 GDPR). A copy of the safeguards is available on request.

14. Obligation to provide data and automated decisions

For bookings and ticket purchases we need your name and a means of contact; without this information we cannot conclude the contract. All other information is voluntary. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

15. Right to object (Art. 21 GDPR)

WHERE WE PROCESS DATA ON THE BASIS OF OUR LEGITIMATE INTEREST (ART. 6(1)(F) GDPR), YOU MAY OBJECT AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. WE WILL THEN NO LONGER PROCESS THE DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS.

YOU MAY OBJECT TO PROCESSING FOR DIRECT MARKETING AT ANY TIME WITHOUT GIVING REASONS; WE WILL THEN NO LONGER USE YOUR DATA FOR THIS PURPOSE. An informal message to hellas.event.center@gmail.com is sufficient.

16. Changes to this privacy policy

We update this privacy policy when our services or the legal situation change. The version published here applies; the date is shown at the top of the page.

Reservation and ordering systems

For reservations we use the reservation tool of Gastro.Digital (mes.mo GmbH, Herdweg 16, 73035 Göppingen). For orders and some reservations we also use Liefersoft, a service of Lieferplatz.de GmbH, Sokelantstr. 23, 30165 Hannover (HRB 210777, Amtsgericht Hannover). The reservation or order data you enter and technical connection data are transmitted to the respective service for receipt, confirmation and management (Art. 6(1)(b) GDPR). Data processing agreements are in place or being concluded with both providers.