This privacy policy applies to the use of the udansa app and the udansa.com website (hereinafter collectively referred to as “udansa”).
Privacy at a glance
General information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on the subject of privacy, please refer to our privacy policy listed below this text.Data collection on this website
Who is responsible for data collection on this website?Data processing on this website is carried out by the website operator. You can find the operator’s contact details in the section “Information on the controller” in this privacy policy.
How do we collect your data?
On the one hand, your data is collected when you provide it to us. This may, for example, be data that you enter in a contact form.
Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of page access). This data is collected automatically as soon as you access this website.
What do we use your data for?
Some of the data is collected to ensure that the website is provided without errors. Other data may be used to analyze your user behavior. If contracts can be concluded or initiated through the website, the transmitted data will also be processed for contract offers, orders or other service requests.
What rights do you have regarding your data?
You have the right at any time to receive, free of charge, information about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given your consent to data processing, you can withdraw this consent at any time with future effect. In addition, under certain circumstances, you have the right to request that the processing of your personal data be restricted. You also have the right to lodge a complaint with the competent supervisory authority.
You can contact us at any time about this and any other questions on the subject of privacy.
Analytics tools and tools from third parties
When you visit this website, your browsing behavior may be statistically analyzed. This is done primarily using so-called analytics programs.
Detailed information about these analytics programs can be found in the following privacy policy.
Hosting and Content Delivery Networks (CDN)
Cloudflare
We use the “Cloudflare” service. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter “Cloudflare”).
Cloudflare offers a globally distributed content delivery network with DNS. Technically, information is transferred between your browser and our website via Cloudflare’s network. This enables Cloudflare to analyze traffic between your browser and our website and to serve as a filter between our servers and potentially malicious traffic from the internet. Cloudflare may also use cookies or other technologies to recognize internet users, but these are used solely for the purpose described here.
Cloudflare is used on the basis of our legitimate interest in providing our website as reliably and securely as possible (Art. 6(1)(f) GDPR).
Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Details and further information on security and privacy at Cloudflare can be found here: https://www.cloudflare.com/privacypolicy/.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF is committed to complying with these data protection standards. You can obtain further information from the provider at the following link: https://www.dataprivacyframework.gov/participant/5666.
Data processing agreement
We have concluded a data processing agreement (DPA) for the use of the service mentioned above. This is a contract required by data protection law, which ensures that the service processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
Supabase
We host the database behind this website and our app with Supabase. The provider is Supabase, Inc., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 (hereinafter “Supabase”).
Supabase stores all data that you provide to us through this website or the app, or that is generated through your use of them, in particular account and profile data, bookings, messages and uploaded content. Our database is hosted in the Europe region (Frankfurt am Main, Germany); content data therefore remains within the European Union.
Its use is for the purpose of fulfilling our contractual obligations to our users (Art. 6(1)(b) GDPR) and in the interest of providing our services securely and efficiently (Art. 6(1)(f) GDPR).
We have concluded a data processing agreement (DPA) with Supabase. For more information, please see Supabase's privacy policy: https://supabase.com/privacy.
We use the “Cloudflare” service. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter “Cloudflare”).
Cloudflare offers a globally distributed content delivery network with DNS. Technically, information is transferred between your browser and our website via Cloudflare’s network. This enables Cloudflare to analyze traffic between your browser and our website and to serve as a filter between our servers and potentially malicious traffic from the internet. Cloudflare may also use cookies or other technologies to recognize internet users, but these are used solely for the purpose described here.
Cloudflare is used on the basis of our legitimate interest in providing our website as reliably and securely as possible (Art. 6(1)(f) GDPR).
Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Details and further information on security and privacy at Cloudflare can be found here: https://www.cloudflare.com/privacypolicy/.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF is committed to complying with these data protection standards. You can obtain further information from the provider at the following link: https://www.dataprivacyframework.gov/participant/5666.
Data processing agreement
We have concluded a data processing agreement (DPA) for the use of the service mentioned above. This is a contract required by data protection law, which ensures that the service processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.
Supabase
We host the database behind this website and our app with Supabase. The provider is Supabase, Inc., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513 (hereinafter “Supabase”).
Supabase stores all data that you provide to us through this website or the app, or that is generated through your use of them, in particular account and profile data, bookings, messages and uploaded content. Our database is hosted in the Europe region (Frankfurt am Main, Germany); content data therefore remains within the European Union.
Its use is for the purpose of fulfilling our contractual obligations to our users (Art. 6(1)(b) GDPR) and in the interest of providing our services securely and efficiently (Art. 6(1)(f) GDPR).
We have concluded a data processing agreement (DPA) with Supabase. For more information, please see Supabase's privacy policy: https://supabase.com/privacy.
General information and mandatory disclosures
Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use this website, various personal data are collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.
Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to completely protect data from access by third parties.
Information about the controller
The controller responsible for data processing on this website is:
udansa GmbH
c/o Impact Hub Dresden
Trompeterstraße 5
01069 Dresden
Germany
Telephone: 0152 24893845
Email: hi@udansa.com
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g. names, email addresses or similar).
Storage period
Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you submit a valid request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, erasure will take place once those grounds no longer apply.
General information on the legal bases for data processing on this website
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, if special categories of data under Art. 9(1) GDPR are processed. If you have expressly consented to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is additionally carried out on the basis of § 25(1) TDDDG. You may withdraw your consent at any time. If your data is required for the performance of a contract or to take steps prior to entering into a contract, we process your data on the basis of Art. 6(1)(b) GDPR. We also process your data if this is necessary to comply with a legal obligation, on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest under Art. 6(1)(f) GDPR. Information about the legal bases applicable in each individual case is provided in the following sections of this privacy policy.
Recipients of personal data
In the course of our business activities, we work with various external parties. This sometimes requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is necessary to perform a contract, if we are legally required to do so (e.g. disclosure of data to tax authorities), if we have a legitimate interest in disclosure under Art. 6(1)(f) GDPR, or if another legal basis permits the disclosure of data. When using data processors, we disclose our customers' personal data only on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.
Withdrawal of your consent to data processing
Many data processing operations are only possible with your express consent. You may withdraw consent you have already given at any time. The lawfulness of data processing carried out before the withdrawal remains unaffected by the withdrawal.
Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)
IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH ADVERTISING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR THE PURPOSE OF DIRECT ADVERTISING (OBJECTION PURSUANT TO ART. 21(2) GDPR).
Right to lodge a complaint with the competent supervisory authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged violation. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.
Access, rectification and erasure
Within the framework of applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipients, and the purpose of data processing, and, where applicable, the right to have this data rectified or erased. You can contact us at any time about this and any other questions on the subject of personal data.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. You can contact us at any time about this. The right to restriction of processing applies in the following cases:
If you contest the accuracy of your personal data stored by us, we generally need time to verify this. While the verification is ongoing, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of erasure.
If we no longer need your personal data, but you need it to establish, exercise, or defend legal claims, you have the right to request the restriction of the processing of your personal data instead of its erasure.
If you have lodged an objection pursuant to Art. 21(1) GDPR, a balancing of your interests against ours must be carried out. Until it has been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, this data may only be processed, apart from being stored, with your consent or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.
When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.
Encrypted payment transactions on this website
If you are required to provide us with your payment details (e.g. account number for direct debit) after concluding a paid contract, these details are required to process the payment.
Payment transactions using common payment methods (Visa/MasterCard, direct debit) are carried out exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.
With encrypted communication, your payment details that you transmit to us cannot be read by third parties.
Objection to advertising emails
The use of contact details published as part of the legal notice requirements for sending advertising and information materials that have not been expressly requested is hereby prohibited. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example through spam emails.
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.
When you use this website, various personal data are collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.
Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to completely protect data from access by third parties.
Information about the controller
The controller responsible for data processing on this website is:
udansa GmbH
c/o Impact Hub Dresden
Trompeterstraße 5
01069 Dresden
Germany
Telephone: 0152 24893845
Email: hi@udansa.com
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g. names, email addresses or similar).
Storage period
Unless a more specific storage period is stated in this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you submit a valid request for erasure or withdraw your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, erasure will take place once those grounds no longer apply.
General information on the legal bases for data processing on this website
If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, if special categories of data under Art. 9(1) GDPR are processed. If you have expressly consented to the transfer of personal data to third countries, data processing is also carried out on the basis of Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or to access to information on your device (e.g. via device fingerprinting), data processing is additionally carried out on the basis of § 25(1) TDDDG. You may withdraw your consent at any time. If your data is required for the performance of a contract or to take steps prior to entering into a contract, we process your data on the basis of Art. 6(1)(b) GDPR. We also process your data if this is necessary to comply with a legal obligation, on the basis of Art. 6(1)(c) GDPR. Data processing may also be carried out on the basis of our legitimate interest under Art. 6(1)(f) GDPR. Information about the legal bases applicable in each individual case is provided in the following sections of this privacy policy.
Recipients of personal data
In the course of our business activities, we work with various external parties. This sometimes requires the transfer of personal data to these external parties. We only disclose personal data to external parties if this is necessary to perform a contract, if we are legally required to do so (e.g. disclosure of data to tax authorities), if we have a legitimate interest in disclosure under Art. 6(1)(f) GDPR, or if another legal basis permits the disclosure of data. When using data processors, we disclose our customers' personal data only on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.
Withdrawal of your consent to data processing
Many data processing operations are only possible with your express consent. You may withdraw consent you have already given at any time. The lawfulness of data processing carried out before the withdrawal remains unaffected by the withdrawal.
Right to object to data collection in specific cases and to direct marketing (Art. 21 GDPR)
IF DATA PROCESSING IS CARRIED OUT ON THE BASIS OF ART. 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE RESPECTIVE LEGAL BASIS ON WHICH PROCESSING IS BASED CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA CONCERNED UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS AND FREEDOMS, OR THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE OR DEFENCE OF LEGAL CLAIMS (OBJECTION UNDER ART. 21(1) GDPR).
IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH ADVERTISING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS RELATED TO SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR THE PURPOSE OF DIRECT ADVERTISING (OBJECTION PURSUANT TO ART. 21(2) GDPR).
Right to lodge a complaint with the competent supervisory authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the place of the alleged violation. The right to lodge a complaint is without prejudice to any other administrative or judicial remedy.
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in performance of a contract provided to you or to a third party in a commonly used, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done where technically feasible.
Access, rectification and erasure
Within the framework of applicable legal provisions, you have the right at any time to obtain free information about your stored personal data, its origin and recipients, and the purpose of data processing, and, where applicable, the right to have this data rectified or erased. You can contact us at any time about this and any other questions on the subject of personal data.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. You can contact us at any time about this. The right to restriction of processing applies in the following cases:
If you contest the accuracy of your personal data stored by us, we generally need time to verify this. While the verification is ongoing, you have the right to request the restriction of the processing of your personal data.
If the processing of your personal data was/is unlawful, you can request the restriction of data processing instead of erasure.
If we no longer need your personal data, but you need it to establish, exercise, or defend legal claims, you have the right to request the restriction of the processing of your personal data instead of its erasure.
If you have lodged an objection pursuant to Art. 21(1) GDPR, a balancing of your interests against ours must be carried out. Until it has been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, this data may only be processed, apart from being stored, with your consent or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the European Union or a Member State.
SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator, this site uses SSL or TLS encryption. You can recognize an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.
When SSL or TLS encryption is enabled, the data you transmit to us cannot be read by third parties.
Encrypted payment transactions on this website
If you are required to provide us with your payment details (e.g. account number for direct debit) after concluding a paid contract, these details are required to process the payment.
Payment transactions using common payment methods (Visa/MasterCard, direct debit) are carried out exclusively via an encrypted SSL or TLS connection. You can recognize an encrypted connection by the browser's address bar changing from “http://” to “https://” and by the lock symbol in your browser bar.
With encrypted communication, your payment details that you transmit to us cannot be read by third parties.
Objection to advertising emails
The use of contact details published as part of the legal notice requirements for sending advertising and information materials that have not been expressly requested is hereby prohibited. The operators of the pages expressly reserve the right to take legal action in the event of unsolicited advertising information being sent, for example through spam emails.
Data collection on this website
Cookies
Our website uses so-called “cookies”. Cookies are small data files and do not cause any damage to your device. They are either stored on your device temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.
Cookies may come from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services from third-party companies into websites (e.g. cookies for processing payment services).
Cookies have various functions. Many cookies are technically necessary, as certain website features would not work without them (e.g. checkout or displaying videos). Other cookies may be used to analyze user behavior or for advertising purposes.
Cookies that are required to carry out the electronic communication process, to provide certain features you have requested (e.g. checkout), or to optimize the website (e.g. cookies for measuring website audiences) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure its services are provided without technical errors and in an optimized manner. If consent to the storage of cookies and similar recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG); consent may be withdrawn at any time.
You can configure your browser to notify you when cookies are set and to allow cookies only in individual cases, to exclude the acceptance of cookies in certain cases or in general, and to activate the automatic deletion of cookies when you close your browser. If cookies are disabled, the functionality of this website may be limited.
You can find out which cookies and services are used on this website in this Privacy Policy.
Consent to cookies and similar technologies
Our website obtains your consent to the storage of non-essential cookies and the use of comparable technologies through its own consent management system. No third-party service is loaded for this purpose: when you visit the website, no connection to external servers is established to obtain your consent.
We store your decision in the “udansa-consent" cookie on your device. It contains a randomly generated identifier, the time of your decision, the version of the consent request, and the categories you selected; it is valid for twelve months, after which we will ask you again. To be able to demonstrate that consent was given (Art. 7(1) GDPR), we also log the same identifier, the time, the categories selected, the language of the page, the country from which the website was accessed, and the browser type on our server. The IP address is not stored. The log is deleted after three years.
Until you have given consent, only technically necessary cookies are set. Services in the “Statistics” category (Google Analytics, Sentry Session Replay) are only loaded after you have given consent.
You can change or withdraw your consent at any time, with effect for the future. To do so, use the “Cookie settings” link in the footer of this website. There you will also find a complete overview of all cookies used, including their provider, purpose, and storage duration.
The legal basis for consent management is Art. 6(1)(c) GDPR in conjunction with § 25(1) TDDDG; the logging of consent is based on our obligation to demonstrate consent under Art. 7(1) GDPR.
Server log files
The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically sends to us. This includes:
Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address
This data is not combined with data from other sources.
This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring the website is displayed without technical errors and optimized, which requires the collection of server log files.
Inquiries by email, telephone, or fax
If you contact us by email, telephone, or fax, your inquiry, including all personal data arising from it (name, inquiry), will be stored and processed by us for the purpose of handling your request. We will not share this data without your consent.
This data is processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling inquiries sent to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), if this was requested; consent may be withdrawn at any time.
The data you send to us through contact inquiries will remain with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after we have finished handling your request). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.
Registration on this website
You can register on this website to use additional features on the site. We use the data you enter for this purpose only to provide the respective offer or service for which you have registered. The required information requested during registration must be provided in full. Otherwise, we will reject your registration.
We use the email address provided during registration to inform you about important changes, for example to the scope of our offer or about technically necessary changes.
The data entered during registration is processed for the purpose of carrying out the user relationship established through registration and, where applicable, initiating further contracts (Art. 6(1)(b) GDPR).
We store the data collected during registration for as long as you are registered on this website, and then delete it. Statutory retention periods remain unaffected.
Signing in with Clerk
We use the authentication service “Clerk” for registration and sign-in in the udansa app and on udansa.com. The provider is Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA (hereinafter “Clerk”).
Clerk processes, on our behalf, the data required to create and manage your account (e.g. email address, name, password hash, sign-in time, IP address) and also technically provides the sign-in options via Google, Facebook and Apple described below. The legal basis is Art. 6(1)(b) GDPR, as processing is necessary to fulfill the user agreement with you.
We have entered into a data processing agreement (DPA) with Clerk. Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses and Clerk’s certification under the “EU-US Data Privacy Framework” (DPF). For more information, see Clerk’s Privacy Policy: https://clerk.com/legal/privacy.
Signing in with Google
You can choose to sign in or register in the udansa app and on udansa.com using your Google account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”).
If you choose to sign in via Google, you will be redirected to Google’s login page. Once you have successfully signed in, Google sends us or Clerk the data required to create your udansa user account (e.g. name, email address, profile picture). We never receive your Google password.
This sign-in option is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you give by actively selecting it and may withdraw at any time with future effect by unlinking your account in your account settings or in your Google account under connected apps.
Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Google is certified under the “EU-US Data Privacy Framework” (DPF). For more information, please visit https://www.dataprivacyframework.gov/participant/5780 and see Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.
Signing in with Facebook
You can choose to sign in or register in the udansa app and on udansa.com using your Facebook account. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter “Meta”).
If you choose to sign in via Facebook, you will be redirected to Facebook’s login page. Once you have successfully signed in, Meta sends us or Clerk the data required to create your udansa user account (e.g. name, email address, profile picture). We never receive your Facebook password.
This sign-in option is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you give by actively selecting it and may withdraw at any time with future effect by unlinking your account in your account settings or in your Facebook account under connected apps.
Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Details can be found at https://www.facebook.com/legal/EU_data_transfer_addendum. Meta is certified under the “EU-US Data Privacy Framework” (DPF); for more information, visit https://www.dataprivacyframework.gov/participant/4452 and see Meta’s Privacy Policy: https://www.facebook.com/privacy/policy/.
Signing in with Apple
You can choose to sign in or register in the udansa app using your Apple ID (“Sign in with Apple”). The provider is Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, T23 YK84, Ireland (hereinafter “Apple”).
Once you have successfully signed in, Apple sends us or Clerk the data required to create your udansa user account (e.g. name and email address, or the anonymized forwarding email address provided by Apple if you choose “Hide My Email”). We never receive your Apple ID login credentials.
The use of this sign-in option is based on your consent pursuant to Art. 6(1)(a) GDPR, which you give by actively selecting this option and may withdraw at any time with effect for the future by unlinking your account in your account settings or in your Apple ID under connected apps.
Where applicable, data is transferred to the USA on the basis of the European Commission’s Standard Contractual Clauses. For more information, please see Apple’s privacy policy: https://www.apple.com/legal/privacy/de-ww/.
Signing in with TikTok (TikTok Login Kit)
You have the option to sign in or register in the udansa app using your TikTok account (the so-called TikTok Login Kit). The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (hereinafter “TikTok”).
If you choose to sign in with TikTok, you will be redirected to TikTok’s login page and asked to give your consent there. Once you have successfully signed in, TikTok will transmit to us the data required to create or match your udansa user account, such as your unique TikTok user ID, display name and profile picture, depending on the permissions requested and authorized by you on TikTok (scopes). We never receive your TikTok password; sign-in takes place exclusively on TikTok.
The TikTok Login Kit is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you give by actively selecting this sign-in option. You may withdraw this consent at any time with effect for the future by unlinking your udansa account from TikTok in your account settings or revoking access in your TikTok account under connected apps.
Where personal data is transferred to third countries (including the USA), this is based on the European Commission’s Standard Contractual Clauses. For more information, please see TikTok’s privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de.
Our website uses so-called “cookies”. Cookies are small data files and do not cause any damage to your device. They are either stored on your device temporarily for the duration of a session (session cookies) or permanently (permanent cookies). Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or they are automatically deleted by your web browser.
Cookies may come from us (first-party cookies) or from third-party companies (so-called third-party cookies). Third-party cookies enable the integration of certain services from third-party companies into websites (e.g. cookies for processing payment services).
Cookies have various functions. Many cookies are technically necessary, as certain website features would not work without them (e.g. checkout or displaying videos). Other cookies may be used to analyze user behavior or for advertising purposes.
Cookies that are required to carry out the electronic communication process, to provide certain features you have requested (e.g. checkout), or to optimize the website (e.g. cookies for measuring website audiences) (necessary cookies) are stored on the basis of Art. 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing necessary cookies to ensure its services are provided without technical errors and in an optimized manner. If consent to the storage of cookies and similar recognition technologies has been requested, processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG); consent may be withdrawn at any time.
You can configure your browser to notify you when cookies are set and to allow cookies only in individual cases, to exclude the acceptance of cookies in certain cases or in general, and to activate the automatic deletion of cookies when you close your browser. If cookies are disabled, the functionality of this website may be limited.
You can find out which cookies and services are used on this website in this Privacy Policy.
Consent to cookies and similar technologies
Our website obtains your consent to the storage of non-essential cookies and the use of comparable technologies through its own consent management system. No third-party service is loaded for this purpose: when you visit the website, no connection to external servers is established to obtain your consent.
We store your decision in the “udansa-consent" cookie on your device. It contains a randomly generated identifier, the time of your decision, the version of the consent request, and the categories you selected; it is valid for twelve months, after which we will ask you again. To be able to demonstrate that consent was given (Art. 7(1) GDPR), we also log the same identifier, the time, the categories selected, the language of the page, the country from which the website was accessed, and the browser type on our server. The IP address is not stored. The log is deleted after three years.
Until you have given consent, only technically necessary cookies are set. Services in the “Statistics” category (Google Analytics, Sentry Session Replay) are only loaded after you have given consent.
You can change or withdraw your consent at any time, with effect for the future. To do so, use the “Cookie settings” link in the footer of this website. There you will also find a complete overview of all cookies used, including their provider, purpose, and storage duration.
The legal basis for consent management is Art. 6(1)(c) GDPR in conjunction with § 25(1) TDDDG; the logging of consent is based on our obligation to demonstrate consent under Art. 7(1) GDPR.
Server log files
The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically sends to us. This includes:
Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address
This data is not combined with data from other sources.
This data is collected on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring the website is displayed without technical errors and optimized, which requires the collection of server log files.
Inquiries by email, telephone, or fax
If you contact us by email, telephone, or fax, your inquiry, including all personal data arising from it (name, inquiry), will be stored and processed by us for the purpose of handling your request. We will not share this data without your consent.
This data is processed on the basis of Art. 6(1)(b) GDPR if your inquiry is related to the performance of a contract or is necessary for taking steps prior to entering into a contract. In all other cases, processing is based on our legitimate interest in effectively handling inquiries sent to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR), if this was requested; consent may be withdrawn at any time.
The data you send to us through contact inquiries will remain with us until you ask us to delete it, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after we have finished handling your request). Mandatory statutory provisions, in particular statutory retention periods, remain unaffected.
Registration on this website
You can register on this website to use additional features on the site. We use the data you enter for this purpose only to provide the respective offer or service for which you have registered. The required information requested during registration must be provided in full. Otherwise, we will reject your registration.
We use the email address provided during registration to inform you about important changes, for example to the scope of our offer or about technically necessary changes.
The data entered during registration is processed for the purpose of carrying out the user relationship established through registration and, where applicable, initiating further contracts (Art. 6(1)(b) GDPR).
We store the data collected during registration for as long as you are registered on this website, and then delete it. Statutory retention periods remain unaffected.
Signing in with Clerk
We use the authentication service “Clerk” for registration and sign-in in the udansa app and on udansa.com. The provider is Clerk, Inc., 660 King Street, Unit 345, San Francisco, CA 94107, USA (hereinafter “Clerk”).
Clerk processes, on our behalf, the data required to create and manage your account (e.g. email address, name, password hash, sign-in time, IP address) and also technically provides the sign-in options via Google, Facebook and Apple described below. The legal basis is Art. 6(1)(b) GDPR, as processing is necessary to fulfill the user agreement with you.
We have entered into a data processing agreement (DPA) with Clerk. Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses and Clerk’s certification under the “EU-US Data Privacy Framework” (DPF). For more information, see Clerk’s Privacy Policy: https://clerk.com/legal/privacy.
Signing in with Google
You can choose to sign in or register in the udansa app and on udansa.com using your Google account. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”).
If you choose to sign in via Google, you will be redirected to Google’s login page. Once you have successfully signed in, Google sends us or Clerk the data required to create your udansa user account (e.g. name, email address, profile picture). We never receive your Google password.
This sign-in option is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you give by actively selecting it and may withdraw at any time with future effect by unlinking your account in your account settings or in your Google account under connected apps.
Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Google is certified under the “EU-US Data Privacy Framework” (DPF). For more information, please visit https://www.dataprivacyframework.gov/participant/5780 and see Google’s Privacy Policy: https://policies.google.com/privacy?hl=de.
Signing in with Facebook
You can choose to sign in or register in the udansa app and on udansa.com using your Facebook account. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter “Meta”).
If you choose to sign in via Facebook, you will be redirected to Facebook’s login page. Once you have successfully signed in, Meta sends us or Clerk the data required to create your udansa user account (e.g. name, email address, profile picture). We never receive your Facebook password.
This sign-in option is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you give by actively selecting it and may withdraw at any time with future effect by unlinking your account in your account settings or in your Facebook account under connected apps.
Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Details can be found at https://www.facebook.com/legal/EU_data_transfer_addendum. Meta is certified under the “EU-US Data Privacy Framework” (DPF); for more information, visit https://www.dataprivacyframework.gov/participant/4452 and see Meta’s Privacy Policy: https://www.facebook.com/privacy/policy/.
Signing in with Apple
You can choose to sign in or register in the udansa app using your Apple ID (“Sign in with Apple”). The provider is Apple Distribution International Limited, Hollyhill Industrial Estate, Hollyhill, Cork, T23 YK84, Ireland (hereinafter “Apple”).
Once you have successfully signed in, Apple sends us or Clerk the data required to create your udansa user account (e.g. name and email address, or the anonymized forwarding email address provided by Apple if you choose “Hide My Email”). We never receive your Apple ID login credentials.
The use of this sign-in option is based on your consent pursuant to Art. 6(1)(a) GDPR, which you give by actively selecting this option and may withdraw at any time with effect for the future by unlinking your account in your account settings or in your Apple ID under connected apps.
Where applicable, data is transferred to the USA on the basis of the European Commission’s Standard Contractual Clauses. For more information, please see Apple’s privacy policy: https://www.apple.com/legal/privacy/de-ww/.
Signing in with TikTok (TikTok Login Kit)
You have the option to sign in or register in the udansa app using your TikTok account (the so-called TikTok Login Kit). The provider is TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (hereinafter “TikTok”).
If you choose to sign in with TikTok, you will be redirected to TikTok’s login page and asked to give your consent there. Once you have successfully signed in, TikTok will transmit to us the data required to create or match your udansa user account, such as your unique TikTok user ID, display name and profile picture, depending on the permissions requested and authorized by you on TikTok (scopes). We never receive your TikTok password; sign-in takes place exclusively on TikTok.
The TikTok Login Kit is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR, which you give by actively selecting this sign-in option. You may withdraw this consent at any time with effect for the future by unlinking your udansa account from TikTok in your account settings or revoking access in your TikTok account under connected apps.
Where personal data is transferred to third countries (including the USA), this is based on the European Commission’s Standard Contractual Clauses. For more information, please see TikTok’s privacy policy: https://www.tiktok.com/legal/page/eea/privacy-policy/de.
Analytics tools and advertising
Google Analytics
This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables the website operator to analyze the behavior of website visitors. The website operator receives various usage data, such as page views, time spent on the website, operating systems used and the visitor’s source. This data is combined into a user ID and assigned to the website visitor’s respective device.
We can also use Google Analytics to record your mouse and scrolling movements and clicks. Google Analytics also uses various modeling approaches to supplement the collected data sets and uses machine learning technologies for data analysis.
Google Analytics uses technologies that enable users to be recognized for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). The information collected by Google about your use of this website is generally transmitted to and stored on a Google server in the USA.
This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time.
Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://privacy.google.com/businesses/controllerterms/mccs/.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when processing data in the USA. Every company certified under the DPF commits to complying with these data protection standards. You can find more information from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.
IP anonymization
Google Analytics IP anonymization is enabled. This means that your IP address is truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area before it is transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity and provide other services to the website operator relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.
Browser plugin
You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
For more information about how Google Analytics handles user data, please see Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.
Data processing agreement
We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.
Google Ads
In our app udansa-connect, we use Google Ads, an online advertising program provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads is not used on this website.
Google Ads enables us to display ads and evaluate which ads led to a registration (conversion tracking). A cookie is set or a comparable recognition technology is used.
This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.
Data transfers to the USA are based on the European Commission’s standard contractual clauses. You can find details here: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.
The company is certified under the “EU-US Data Privacy Framework” (DPF): https://www.dataprivacyframework.gov/participant/5780.
Meta Pixel
In our app udansa-connect, we use Meta’s visitor action pixel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter “Meta”). The Meta Pixel is not used on this website.
The Meta Pixel enables us to track which actions users take in the app (e.g. page views, completed registrations) in order to measure the effectiveness of our advertising. The data collected is anonymous to us, but Meta can link it to your Meta account and use it for its own advertising purposes.
This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.
Where personal data is collected on our properties and forwarded to Meta, we and Meta are jointly responsible for processing it (Art. 26 GDPR). You can find the agreement at https://www.facebook.com/legal/controller_addendum. Data transfers to the USA are based on the standard contractual clauses: https://www.facebook.com/legal/EU_data_transfer_addendum. Meta is certified under the DPF: https://www.dataprivacyframework.gov/participant/4452.
You can find further information in Meta’s Data Policy: https://www.facebook.com/privacy/policy/.
This website uses features of the web analytics service Google Analytics. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables the website operator to analyze the behavior of website visitors. The website operator receives various usage data, such as page views, time spent on the website, operating systems used and the visitor’s source. This data is combined into a user ID and assigned to the website visitor’s respective device.
We can also use Google Analytics to record your mouse and scrolling movements and clicks. Google Analytics also uses various modeling approaches to supplement the collected data sets and uses machine learning technologies for data analysis.
Google Analytics uses technologies that enable users to be recognized for the purpose of analyzing user behavior (e.g. cookies or device fingerprinting). The information collected by Google about your use of this website is generally transmitted to and stored on a Google server in the USA.
This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may withdraw your consent at any time.
Data transfers to the USA are based on the European Commission’s Standard Contractual Clauses. Details are available here: https://privacy.google.com/businesses/controllerterms/mccs/.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when processing data in the USA. Every company certified under the DPF commits to complying with these data protection standards. You can find more information from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.
IP anonymization
Google Analytics IP anonymization is enabled. This means that your IP address is truncated by Google within member states of the European Union or in other states party to the Agreement on the European Economic Area before it is transmitted to the USA. Only in exceptional cases is the full IP address transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information to evaluate your use of the website, compile reports on website activity and provide other services to the website operator relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics is not combined with other data held by Google.
Browser plugin
You can prevent Google from collecting and processing your data by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
For more information about how Google Analytics handles user data, please see Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.
Data processing agreement
We have concluded a data processing agreement with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.
Google Ads
In our app udansa-connect, we use Google Ads, an online advertising program provided by Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland. Google Ads is not used on this website.
Google Ads enables us to display ads and evaluate which ads led to a registration (conversion tracking). A cookie is set or a comparable recognition technology is used.
This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.
Data transfers to the USA are based on the European Commission’s standard contractual clauses. You can find details here: https://policies.google.com/privacy/frameworks and https://business.safety.google/controllerterms/.
The company is certified under the “EU-US Data Privacy Framework” (DPF): https://www.dataprivacyframework.gov/participant/5780.
Meta Pixel
In our app udansa-connect, we use Meta’s visitor action pixel. The provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter “Meta”). The Meta Pixel is not used on this website.
The Meta Pixel enables us to track which actions users take in the app (e.g. page views, completed registrations) in order to measure the effectiveness of our advertising. The data collected is anonymous to us, but Meta can link it to your Meta account and use it for its own advertising purposes.
This service is used on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.
Where personal data is collected on our properties and forwarded to Meta, we and Meta are jointly responsible for processing it (Art. 26 GDPR). You can find the agreement at https://www.facebook.com/legal/controller_addendum. Data transfers to the USA are based on the standard contractual clauses: https://www.facebook.com/legal/EU_data_transfer_addendum. Meta is certified under the DPF: https://www.dataprivacyframework.gov/participant/4452.
You can find further information in Meta’s Data Policy: https://www.facebook.com/privacy/policy/.
Newsletter
Newsletter data
If you want to receive the newsletter offered on the website, we need your email address and information that allows us to verify that you own the email address provided and agree to receive the newsletter. No other data is collected, or it is collected only on a voluntary basis. We use this data exclusively to send the requested information and do not share it with third parties.
The data entered in the newsletter subscription form is processed exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw your consent to the storage of your data and email address, and to their use to send the newsletter, at any time, for example via the “Unsubscribe” link in the newsletter. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal.
We store the data you provide to receive the newsletter until you unsubscribe from the newsletter, either with us or with the newsletter service provider, and delete it from the newsletter distribution list after you unsubscribe or the purpose no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our discretion in accordance with our legitimate interest under Art. 6(1)(f) GDPR.
This does not affect data stored by us for other purposes.
After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider on a blacklist if this is necessary to prevent future mailings. The data on the blacklist is used only for this purpose and is not combined with other data. This serves both your interests and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). There is no time limit on storage on the blacklist. You can object to this storage if your interests outweigh our legitimate interest.
Sending newsletters to existing customers
If you order goods or services from us and provide your email address in doing so, we may subsequently use this email address to send you newsletters, provided that we inform you of this in advance. In this case, the newsletter will contain direct advertising only for our own similar goods or services. You can cancel your subscription to this newsletter at any time. A corresponding link is provided in every newsletter for this purpose. In this case, the legal basis for sending the newsletter is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG.
After you unsubscribe from the newsletter mailing list, we may store your email address on a blacklist to prevent future mailings from being sent to you. The data on the blacklist is used only for this purpose and is not combined with other data. This serves both your interests and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). The data is stored on the blacklist for an indefinite period. You can object to this storage if your interests outweigh our legitimate interest.
Brevo (newsletter and email delivery)
We use Brevo to send our newsletter as well as confirmation and notification emails. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany (hereinafter “Brevo”).
Brevo processes your email address, name, language, and information about the relevant transaction (e.g. booking confirmation) on our behalf. As part of newsletter campaigns, Brevo may analyze whether and when an email was opened and which links were clicked.
The legal basis is your consent under Art. 6(1)(a) GDPR for the newsletter, or Art. 6(1)(b) GDPR for confirmation and notification emails sent as part of a contractual relationship.
We have concluded a data processing agreement with Brevo. Further information: https://www.brevo.com/de/legal/privacypolicy/.
When you sign up for the newsletter through this website, the information you enter is technically forwarded to Brevo via a service provided by Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. Lovable processes your email address and first name solely on our instructions as a data processor.
Resend
We send some service emails, such as the results of our dance style test, using Resend. The provider is Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The data processed includes your email address, first name, and the content of the relevant email. The legal basis is Art. 6(1)(a) GDPR (consent) or Art. 6(1)(b) GDPR. Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Further information: https://resend.com/legal/privacy-policy.
If you want to receive the newsletter offered on the website, we need your email address and information that allows us to verify that you own the email address provided and agree to receive the newsletter. No other data is collected, or it is collected only on a voluntary basis. We use this data exclusively to send the requested information and do not share it with third parties.
The data entered in the newsletter subscription form is processed exclusively on the basis of your consent (Art. 6(1)(a) GDPR). You can withdraw your consent to the storage of your data and email address, and to their use to send the newsletter, at any time, for example via the “Unsubscribe” link in the newsletter. The lawfulness of data processing operations already carried out remains unaffected by the withdrawal.
We store the data you provide to receive the newsletter until you unsubscribe from the newsletter, either with us or with the newsletter service provider, and delete it from the newsletter distribution list after you unsubscribe or the purpose no longer applies. We reserve the right to delete or block email addresses from our newsletter distribution list at our discretion in accordance with our legitimate interest under Art. 6(1)(f) GDPR.
This does not affect data stored by us for other purposes.
After you unsubscribe from the newsletter distribution list, your email address may be stored by us or the newsletter service provider on a blacklist if this is necessary to prevent future mailings. The data on the blacklist is used only for this purpose and is not combined with other data. This serves both your interests and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). There is no time limit on storage on the blacklist. You can object to this storage if your interests outweigh our legitimate interest.
Sending newsletters to existing customers
If you order goods or services from us and provide your email address in doing so, we may subsequently use this email address to send you newsletters, provided that we inform you of this in advance. In this case, the newsletter will contain direct advertising only for our own similar goods or services. You can cancel your subscription to this newsletter at any time. A corresponding link is provided in every newsletter for this purpose. In this case, the legal basis for sending the newsletter is Art. 6(1)(f) GDPR in conjunction with Section 7(3) UWG.
After you unsubscribe from the newsletter mailing list, we may store your email address on a blacklist to prevent future mailings from being sent to you. The data on the blacklist is used only for this purpose and is not combined with other data. This serves both your interests and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 6(1)(f) GDPR). The data is stored on the blacklist for an indefinite period. You can object to this storage if your interests outweigh our legitimate interest.
Brevo (newsletter and email delivery)
We use Brevo to send our newsletter as well as confirmation and notification emails. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany (hereinafter “Brevo”).
Brevo processes your email address, name, language, and information about the relevant transaction (e.g. booking confirmation) on our behalf. As part of newsletter campaigns, Brevo may analyze whether and when an email was opened and which links were clicked.
The legal basis is your consent under Art. 6(1)(a) GDPR for the newsletter, or Art. 6(1)(b) GDPR for confirmation and notification emails sent as part of a contractual relationship.
We have concluded a data processing agreement with Brevo. Further information: https://www.brevo.com/de/legal/privacypolicy/.
When you sign up for the newsletter through this website, the information you enter is technically forwarded to Brevo via a service provided by Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. Lovable processes your email address and first name solely on our instructions as a data processor.
Resend
We send some service emails, such as the results of our dance style test, using Resend. The provider is Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. The data processed includes your email address, first name, and the content of the relevant email. The legal basis is Art. 6(1)(a) GDPR (consent) or Art. 6(1)(b) GDPR. Data transfers to the USA are based on the European Commission's Standard Contractual Clauses. Further information: https://resend.com/legal/privacy-policy.
Plugins and tools
Google Fonts
This website uses Google Fonts, provided by Google, to display fonts consistently. When you visit a page, your browser loads the required fonts into its cache to display text and fonts correctly.
For this purpose, the browser you use must connect to Google's servers. This lets Google know that this website was accessed via your IP address. Google Fonts is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring that the typeface is displayed consistently on the website. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. You can withdraw your consent at any time.
If your browser does not support Google Fonts, a standard font from your computer will be used.
For more information about Google Fonts, visit https://developers.google.com/fonts/faq and read Google's privacy policy: https://policies.google.com/privacy?hl=de.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when processing data in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. For more information, contact the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.
OpenStreetMap
We embed maps from OpenStreetMap and use its address search (Nominatim). The provider is the OpenStreetMap Foundation, St Johns Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom (hereinafter “OSMF”). The European Commission has adopted an adequacy decision for the United Kingdom, meaning its level of data protection is equivalent to that of the European Union.
When you visit a page with a map, a connection is established to OSMF's servers. Your IP address and information about the map section displayed are transmitted. If you search for a place in our app or on this website, or use your device's location service, the search term you entered or the coordinates determined are also transmitted to Nominatim to identify the place and country.
OpenStreetMap is used in the interests of presenting our online services attractively and making it easy to find the places listed. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.
For more information, see the OSMF privacy policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy.
We do not use Google Maps. We merely link to Google Maps if you want to view directions to an event venue; data is only transferred to Google when you click this link.
Cloudflare Turnstile
We use Cloudflare Turnstile (hereinafter "Turnstile") on this website. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter "Cloudflare").
Turnstile is used to check whether data is entered on this website (e.g. in a contact form) by a person or by an automated program. To do this, Turnstile analyzes the behavior of the website visitor based on various characteristics.
This analysis begins automatically as soon as the website visitor accesses a website with Turnstile enabled. Turnstile analyzes various information for this purpose (e.g. IP address, time spent by the website visitor on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Cloudflare.
The data is stored and analyzed on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in protecting its online services from abusive automated scraping and SPAM. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.
Data processing is based on standard contractual clauses, which you can find here: https://www.cloudflare.com/cloudflare-customer-scc/.
For more information about Cloudflare Turnstile, please see the privacy policy at https://www.cloudflare.com/cloudflare-customer-dpa/.
The company is certified under the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can find out more from the provider at the following link: https://www.dataprivacyframework.gov/participant/5666.
Sentry (Error Analysis)
We use Sentry to detect and fix technical errors. The provider is Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA (hereinafter "Sentry").
If an error occurs in your browser or in our app, Sentry sends us an error report. This contains technical details such as the error message, program flow, browser type, operating system, and the address accessed. We have disabled the automatic collection of your IP address. The data is processed on servers in the European Union.
The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in detecting and fixing errors in our services.
Sentry may also create session recordings ("Session Replay") to help us trace what happened leading up to an error. These recordings are made only if you have consented to the Statistics category. In that case, the legal basis is Art. 6(1)(a) GDPR; you can withdraw your consent at any time via the cookie settings.
Data transfers to the USA are based on the European Commission's standard contractual clauses. The company is also certified under the "EU-US Data Privacy Framework". For more information: https://sentry.io/privacy/.
Cloudinary (Images and Videos)
Images and videos on this website and in our app are delivered and stored through Cloudinary. The provider is Cloudinary Inc., 3400 Central Expressway, Suite 110, Santa Clara, CA 95051, USA (hereinafter "Cloudinary").
When you access a page, your browser loads the images directly from Cloudinary's servers. Your IP address and technical details about your browser and device are transferred to Cloudinary. If you upload images yourself, they are stored by Cloudinary.
The legal basis is Art. 6(1)(f) GDPR; we have a legitimate interest in delivering our content quickly and reliably. To the extent that storing uploaded content is necessary to fulfill a contract, the legal basis is Art. 6(1)(b) GDPR.
We have entered into a data processing agreement with Cloudinary. Data transfers to the USA are based on the European Commission's standard contractual clauses. For more information: https://cloudinary.com/privacy.
This website uses Google Fonts, provided by Google, to display fonts consistently. When you visit a page, your browser loads the required fonts into its cache to display text and fonts correctly.
For this purpose, the browser you use must connect to Google's servers. This lets Google know that this website was accessed via your IP address. Google Fonts is used on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring that the typeface is displayed consistently on the website. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. You can withdraw your consent at any time.
If your browser does not support Google Fonts, a standard font from your computer will be used.
For more information about Google Fonts, visit https://developers.google.com/fonts/faq and read Google's privacy policy: https://policies.google.com/privacy?hl=de.
The company is certified under the “EU-US Data Privacy Framework” (DPF). The DPF is an agreement between the European Union and the USA intended to ensure compliance with European data protection standards when processing data in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. For more information, contact the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.
OpenStreetMap
We embed maps from OpenStreetMap and use its address search (Nominatim). The provider is the OpenStreetMap Foundation, St Johns Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom (hereinafter “OSMF”). The European Commission has adopted an adequacy decision for the United Kingdom, meaning its level of data protection is equivalent to that of the European Union.
When you visit a page with a map, a connection is established to OSMF's servers. Your IP address and information about the map section displayed are transmitted. If you search for a place in our app or on this website, or use your device's location service, the search term you entered or the coordinates determined are also transmitted to Nominatim to identify the place and country.
OpenStreetMap is used in the interests of presenting our online services attractively and making it easy to find the places listed. This constitutes a legitimate interest within the meaning of Art. 6(1)(f) GDPR. If consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time.
For more information, see the OSMF privacy policy: https://wiki.osmfoundation.org/wiki/Privacy_Policy.
We do not use Google Maps. We merely link to Google Maps if you want to view directions to an event venue; data is only transferred to Google when you click this link.
Cloudflare Turnstile
We use Cloudflare Turnstile (hereinafter "Turnstile") on this website. The provider is Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (hereinafter "Cloudflare").
Turnstile is used to check whether data is entered on this website (e.g. in a contact form) by a person or by an automated program. To do this, Turnstile analyzes the behavior of the website visitor based on various characteristics.
This analysis begins automatically as soon as the website visitor accesses a website with Turnstile enabled. Turnstile analyzes various information for this purpose (e.g. IP address, time spent by the website visitor on the website, or mouse movements made by the user). The data collected during the analysis is forwarded to Cloudflare.
The data is stored and analyzed on the basis of Art. 6(1)(f) GDPR. The website operator has a legitimate interest in protecting its online services from abusive automated scraping and SPAM. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent covers the storage of cookies or access to information on the user's device (e.g. device fingerprinting) within the meaning of the TDDDG. Consent may be withdrawn at any time.
Data processing is based on standard contractual clauses, which you can find here: https://www.cloudflare.com/cloudflare-customer-scc/.
For more information about Cloudflare Turnstile, please see the privacy policy at https://www.cloudflare.com/cloudflare-customer-dpa/.
The company is certified under the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that is intended to ensure compliance with European data protection standards when data is processed in the USA. Every company certified under the DPF undertakes to comply with these data protection standards. You can find out more from the provider at the following link: https://www.dataprivacyframework.gov/participant/5666.
Sentry (Error Analysis)
We use Sentry to detect and fix technical errors. The provider is Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA (hereinafter "Sentry").
If an error occurs in your browser or in our app, Sentry sends us an error report. This contains technical details such as the error message, program flow, browser type, operating system, and the address accessed. We have disabled the automatic collection of your IP address. The data is processed on servers in the European Union.
The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in detecting and fixing errors in our services.
Sentry may also create session recordings ("Session Replay") to help us trace what happened leading up to an error. These recordings are made only if you have consented to the Statistics category. In that case, the legal basis is Art. 6(1)(a) GDPR; you can withdraw your consent at any time via the cookie settings.
Data transfers to the USA are based on the European Commission's standard contractual clauses. The company is also certified under the "EU-US Data Privacy Framework". For more information: https://sentry.io/privacy/.
Cloudinary (Images and Videos)
Images and videos on this website and in our app are delivered and stored through Cloudinary. The provider is Cloudinary Inc., 3400 Central Expressway, Suite 110, Santa Clara, CA 95051, USA (hereinafter "Cloudinary").
When you access a page, your browser loads the images directly from Cloudinary's servers. Your IP address and technical details about your browser and device are transferred to Cloudinary. If you upload images yourself, they are stored by Cloudinary.
The legal basis is Art. 6(1)(f) GDPR; we have a legitimate interest in delivering our content quickly and reliably. To the extent that storing uploaded content is necessary to fulfill a contract, the legal basis is Art. 6(1)(b) GDPR.
We have entered into a data processing agreement with Cloudinary. Data transfers to the USA are based on the European Commission's standard contractual clauses. For more information: https://cloudinary.com/privacy.
eCommerce and Payment Providers
Processing of customer and contract data
We collect, process and use personal customer and contract data to establish, define the content of and amend our contractual relationships. We collect, process and use personal data relating to the use of this website (usage data) only to the extent necessary to enable the user to use the service or to bill for it. The legal basis for this is Art. 6(1)(b) GDPR.
The customer data collected will be deleted after completion of the order or termination of the business relationship and expiry of any applicable statutory retention periods. Statutory retention periods remain unaffected.
Data transfer upon conclusion of a contract for online shops, merchants and shipping of goods
If you order goods from us, we share your personal data with the transport company responsible for delivery and with the payment service provider commissioned to process the payment. We disclose only the data that the respective service provider needs to perform its task. The legal basis for this is Art. 6(1)(b) GDPR, which permits the processing of data to fulfill a contract or take pre-contractual measures. If you have given your consent in accordance with Art. 6(1)(a) GDPR, we will provide your email address to the transport company responsible for delivery so that it can inform you by email about the shipping status of your order; you can withdraw your consent at any time.
Data transfer upon conclusion of a contract for services and digital content
We transfer personal data to third parties only if this is necessary for the processing of the contract, for example to the bank commissioned to process the payment.
We do not transfer data beyond this, unless you have expressly consented to the transfer. We do not share your data with third parties without your express consent, for example for advertising purposes.
The basis for data processing is Art. 6(1)(b) GDPR, which permits the processing of data to fulfill a contract or take pre-contractual measures.
Payment services
We integrate payment services provided by third-party companies on our website. When you make a purchase from us, your payment data (e.g. name, payment amount, bank details, credit card number) is processed by the payment service provider for the purpose of processing the payment. The respective contractual and data protection provisions of the respective providers apply to these transactions. The payment service providers are used on the basis of Art. 6(1)(b) GDPR (contract processing) and in the interest of providing a payment process that is as smooth, convenient and secure as possible (Art. 6(1)(f) GDPR). Where your consent is requested for certain actions, Art. 6(1)(a) GDPR is the legal basis for data processing; you can withdraw your consent at any time with effect for the future.
We use the following payment services / payment service providers on this website:
Stripe
The provider for customers within the EU is Stripe Payments Europe, Ltd.,1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter “Stripe”).
We use Stripe to process payments for course and event bookings, as well as Premium memberships that you purchase through our website or the web section of our app. For Premium memberships, we provide Stripe with your email address, user ID and the selected product. You enter your payment details and billing address directly with Stripe; we do not receive your complete payment details. Stripe calculates the sales tax based on the billing address and issues the invoice. We receive your subscription status, the term and the invoice data from Stripe. The legal basis is Art. 6(1)(b) GDPR; for retaining invoice data, the legal basis is Art. 6(1)(c) GDPR in conjunction with tax and commercial law retention periods.
Data transfers to the USA are based on the EU Commission's standard contractual clauses. You can find details here: https://stripe.com/de/privacy and https://stripe.com/de/guides/general-data-protection-regulation.
You can read more about this in Stripe's privacy policy at the following link: https://stripe.com/de/privacy.
Paddle
Premium memberships that you purchased through our website or the web section of our app before November 5, 2026 will continue to be processed through Paddle until they end. The provider is Paddle.com Market Limited, Judd House, 18-29 Mora Street, London, EC1V 8BT, United Kingdom (hereinafter “Paddle”). Paddle acts as the seller of the service (Merchant of Record) and handles payment processing and invoicing.
Your email address, user ID and details of the selected product are transferred to Paddle. You enter your payment details directly with Paddle; we do not receive them. The legal basis is Art. 6(1)(b) GDPR. The EU Commission has adopted an adequacy decision for the United Kingdom. Further information: https://www.paddle.com/legal/privacy.
RevenueCat
We manage purchases within our app (in-app purchases through the App Store or Google Play) and Premium memberships that you purchase through our website with RevenueCat. The provider is RevenueCat, Inc., 631-633 Taraval Street #101, San Francisco, CA 94116, USA (hereinafter “RevenueCat”).
RevenueCat processes your user ID and information about the purchase process and the status of your membership on our behalf so that we can make unlocked features available across devices. For purchases made through our website, we transmit your user ID and your Stripe subscription ID to RevenueCat; RevenueCat retrieves the subscription details (product, term, status, amount) from Stripe. We do not transmit your email address or name. The legal basis is Art. 6(1)(b) GDPR.
We have entered into a data processing agreement with RevenueCat. The transfer of data to the USA is based on the European Commission’s Standard Contractual Clauses. Further information: https://www.revenuecat.com/privacy.
We collect, process and use personal customer and contract data to establish, define the content of and amend our contractual relationships. We collect, process and use personal data relating to the use of this website (usage data) only to the extent necessary to enable the user to use the service or to bill for it. The legal basis for this is Art. 6(1)(b) GDPR.
The customer data collected will be deleted after completion of the order or termination of the business relationship and expiry of any applicable statutory retention periods. Statutory retention periods remain unaffected.
Data transfer upon conclusion of a contract for online shops, merchants and shipping of goods
If you order goods from us, we share your personal data with the transport company responsible for delivery and with the payment service provider commissioned to process the payment. We disclose only the data that the respective service provider needs to perform its task. The legal basis for this is Art. 6(1)(b) GDPR, which permits the processing of data to fulfill a contract or take pre-contractual measures. If you have given your consent in accordance with Art. 6(1)(a) GDPR, we will provide your email address to the transport company responsible for delivery so that it can inform you by email about the shipping status of your order; you can withdraw your consent at any time.
Data transfer upon conclusion of a contract for services and digital content
We transfer personal data to third parties only if this is necessary for the processing of the contract, for example to the bank commissioned to process the payment.
We do not transfer data beyond this, unless you have expressly consented to the transfer. We do not share your data with third parties without your express consent, for example for advertising purposes.
The basis for data processing is Art. 6(1)(b) GDPR, which permits the processing of data to fulfill a contract or take pre-contractual measures.
Payment services
We integrate payment services provided by third-party companies on our website. When you make a purchase from us, your payment data (e.g. name, payment amount, bank details, credit card number) is processed by the payment service provider for the purpose of processing the payment. The respective contractual and data protection provisions of the respective providers apply to these transactions. The payment service providers are used on the basis of Art. 6(1)(b) GDPR (contract processing) and in the interest of providing a payment process that is as smooth, convenient and secure as possible (Art. 6(1)(f) GDPR). Where your consent is requested for certain actions, Art. 6(1)(a) GDPR is the legal basis for data processing; you can withdraw your consent at any time with effect for the future.
We use the following payment services / payment service providers on this website:
Stripe
The provider for customers within the EU is Stripe Payments Europe, Ltd.,1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (hereinafter “Stripe”).
We use Stripe to process payments for course and event bookings, as well as Premium memberships that you purchase through our website or the web section of our app. For Premium memberships, we provide Stripe with your email address, user ID and the selected product. You enter your payment details and billing address directly with Stripe; we do not receive your complete payment details. Stripe calculates the sales tax based on the billing address and issues the invoice. We receive your subscription status, the term and the invoice data from Stripe. The legal basis is Art. 6(1)(b) GDPR; for retaining invoice data, the legal basis is Art. 6(1)(c) GDPR in conjunction with tax and commercial law retention periods.
Data transfers to the USA are based on the EU Commission's standard contractual clauses. You can find details here: https://stripe.com/de/privacy and https://stripe.com/de/guides/general-data-protection-regulation.
You can read more about this in Stripe's privacy policy at the following link: https://stripe.com/de/privacy.
Paddle
Premium memberships that you purchased through our website or the web section of our app before November 5, 2026 will continue to be processed through Paddle until they end. The provider is Paddle.com Market Limited, Judd House, 18-29 Mora Street, London, EC1V 8BT, United Kingdom (hereinafter “Paddle”). Paddle acts as the seller of the service (Merchant of Record) and handles payment processing and invoicing.
Your email address, user ID and details of the selected product are transferred to Paddle. You enter your payment details directly with Paddle; we do not receive them. The legal basis is Art. 6(1)(b) GDPR. The EU Commission has adopted an adequacy decision for the United Kingdom. Further information: https://www.paddle.com/legal/privacy.
RevenueCat
We manage purchases within our app (in-app purchases through the App Store or Google Play) and Premium memberships that you purchase through our website with RevenueCat. The provider is RevenueCat, Inc., 631-633 Taraval Street #101, San Francisco, CA 94116, USA (hereinafter “RevenueCat”).
RevenueCat processes your user ID and information about the purchase process and the status of your membership on our behalf so that we can make unlocked features available across devices. For purchases made through our website, we transmit your user ID and your Stripe subscription ID to RevenueCat; RevenueCat retrieves the subscription details (product, term, status, amount) from Stripe. We do not transmit your email address or name. The legal basis is Art. 6(1)(b) GDPR.
We have entered into a data processing agreement with RevenueCat. The transfer of data to the USA is based on the European Commission’s Standard Contractual Clauses. Further information: https://www.revenuecat.com/privacy.
Our udansa-connect app
The following sections apply to our udansa-connect app, which lets you create a dance profile, find dance partners and connect with others. The app is intended for adults. The sections above also apply, in particular those concerning registration, hosting, payment providers and your rights.
Profile data
When setting up your profile, we process the information you provide yourself: first and last name, gender, optionally your date of birth and height, your dance level, your role (leading, following or both), your dance styles, your languages, your location, and optional details such as a description, goals, availability and favorite song. You can also enter search preferences, such as the preferred gender, age range, level and styles of your desired dance partner.
This data is visible to other app users to the extent that you have provided it. You can use the settings to control whether your age and activity status are displayed. The legal basis is Art. 6(1)(b) GDPR, as profile data is central to the service you have requested; optional additional information is processed on the basis of Art. 6(1)(a) GDPR.
Location data
To show you dance partners and offers nearby, we process your location. You can enter it yourself or use your device’s location services. If you use location services, the app requests permission once and determines your location only at that moment; there is no continuous or background location tracking.
We store your location, country and coordinates, which we use to calculate the distance to other profiles. Other users are shown only a rounded distance and your location, never your exact coordinates. To convert coordinates into a place name, we transmit the coordinates to Nominatim (see the OpenStreetMap section). The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time through your device’s system settings.
Photos
You can upload a profile picture, a background image and other pictures to a gallery, and send pictures in chat. The pictures are stored by Cloudinary (see the section on that service). Pictures sent in chat are stored as protected content and automatically deleted after 90 days. The legal basis is Art. 6(1)(b) GDPR.
Messages and groups
You can exchange individual and group messages, react to messages and take part in polls through the app. We store the content of your messages, timestamps, read status and any edits so that the conversation remains available on your devices. We also store when you were last active; you can turn off the display of this status in the settings.
The legal basis is Art. 6(1)(b) GDPR. Please note that messages are not end-to-end encrypted; they are stored on our servers and automatically analyzed as part of the content review described below.
Automatic translation of messages
If you are chatting with someone who has set a different language, we automatically translate your message so that it can be understood. To do this, the message text is transmitted through the AI interface of Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden, to a language model provided there by Google; a model from OpenAI is used as a backup. The translation is temporarily cached so that the same text does not need to be transmitted more than once. The legal basis is Art. 6(1)(b) GDPR.
Automatic content review
To protect our users from harassment and prohibited content, content is automatically reviewed before publication.
For this purpose, we transmit texts, including messages, profile texts, names and poll options, to OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Before uploading, we transmit images to Kozelo SAS (Sightengine), 16 bis rue dOdessa, 75014 Paris, France, which checks them for prohibited content.
If the review detects a violation, the content is not published and the incident is logged for evidentiary purposes. This review is an automated preliminary check, but not an automated decision with legal effect within the meaning of Art. 22 GDPR. If you believe that content has been blocked unfairly, contact hi@udansa.com; we will then review the case personally.
The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in keeping our platform free of unlawful and harassing content and in complying with our legal obligations.
Suggestions for dance partners (profiling)
To show you suitable profiles first, we automatically assess how well two profiles match. This assessment takes into account: dance styles you have in common, complementary roles, dance level, how often you practice, distance, recent activity, shared goals and events, as well as the search preferences you have specified, including age range. The result is shown to you as a percentage match.
In addition, we create a mathematical representation of your profile (a so-called embedding) based on the information in your profile, namely your first name, description, dance styles, role, level, goals and location, as well as your music scans from the last 90 days. This is used to find similar profiles. This calculation is carried out via the AI interface of Lovable Labs AB using a model from Google.
This process constitutes profiling within the meaning of the GDPR. It is used solely to determine the order of suggestions and has no legal effect on you; it does not involve an automated decision within the meaning of Art. 22 GDPR. The legal basis is Art. 6(1)(b) GDPR, as connecting you with suitable dance partners is the purpose of the app. You can object to this processing under Art. 21 GDPR.
Profile visits
When you open someone else's profile, we record this once per day. The person concerned can see who has visited their profile. Conversely, others can see when you have viewed their profile. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the transparency customary for a matchmaking platform and facilitating contacts.
Reporting and blocking
You can block other people and report people and listings. When you submit a report, we process your information and the data relating to the reported content, and send it by email to our support team. The legal basis is Art. 6(1)(f) GDPR and compliance with our obligations under the Digital Services Act (Art. 6(1)(c) GDPR).
Music recognition (song scan)
With the song scan, you can identify music around you and find out which dances it is suited to. When you start a scan, the app records a short excerpt using your device's microphone. Recording starts only when you initiate a scan yourself.
The excerpt is sent to the music recognition service AudD (https://audd.io) to identify the track, and to the AI interface of Lovable Labs AB, which analyzes it using a model from Google to determine suitable dances, time signature and tempo. On Apple devices, track recognition is also carried out using the device's built-in ShazamKit feature, without any data being transmitted to us.
We do not store the audio recording itself. We store the scan result, namely the title, artist, tempo, genre and suitable dances, as well as the time of the scan. You can view your scan history in the app. The recognized music characteristics are used in the suggestions for dance partners described above.
The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by starting the scan and granting microphone permission. You can withdraw your consent at any time in your device's system settings.
Dictation feature
You can dictate messages instead of typing them. On mobile devices, your operating system's speech recognition converts your speech to text. In some browsers, the recording is sent to the respective browser provider. The feature starts only when you explicitly activate it. The legal basis is Art. 6(1)(a) GDPR.
Push notifications
If you allow push notifications, we will notify you about new messages, contact requests and other events. To do this, we store a device identifier (push token), the platform and an identifier for your device. Notifications are sent using Firebase Cloud Messaging from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The notification text may include a preview of the message. You can choose in the app which events trigger a notification; you can revoke the permission entirely in your device's system settings. We delete the token when you log out. The legal basis is your consent under Art. 6(1)(a) GDPR.
Permissions on your device
Depending on the feature you use, the app requests the following permissions: camera and photo library (profile and chat pictures), location (nearby search), microphone (song scan), speech recognition (dictation feature), notifications (push notifications), calendar (adding confirmed appointments), contacts (selecting an individual person to invite) and Face ID or fingerprint (locking the app).
Permissions are requested only when you use the relevant feature and can be revoked at any time in your device's system settings. Your address book is not read or transmitted: when inviting someone, you select exactly one person in the system dialog, and their details are used only on your device to create the invitation. Face ID or fingerprint authentication is checked exclusively on your device; we never receive biometric data.
Internal notification of registrations
We automatically notify our team about new registrations through our internal messaging system. In doing so, the name, email address and language of the newly registered person are transmitted to Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; the technical forwarding is handled via Lovable Labs AB. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing timely support to new members.
Deleting your account
You can delete your account at any time in the app settings. This will delete your profile data, your photos, your location details, your dance and search profiles, your scan history, your push tokens, your profile visits and your block lists. Your account with our sign-in service and your entry with the newsletter delivery service provider will also be deleted.
For legal reasons, the following will not be deleted, but will be separated from you: messages that have already been sent, so that the conversation remains readable for the people you are communicating with; recorded violations of our rules; and the information we need to comply with statutory retention periods under tax and commercial law, in particular payment and invoice data under § 147 AO and § 257 HGB. We also store proof that the deletion has been carried out.
If you would like information about your data or a copy in a portable format, contact hi@udansa.com.
Profile data
When setting up your profile, we process the information you provide yourself: first and last name, gender, optionally your date of birth and height, your dance level, your role (leading, following or both), your dance styles, your languages, your location, and optional details such as a description, goals, availability and favorite song. You can also enter search preferences, such as the preferred gender, age range, level and styles of your desired dance partner.
This data is visible to other app users to the extent that you have provided it. You can use the settings to control whether your age and activity status are displayed. The legal basis is Art. 6(1)(b) GDPR, as profile data is central to the service you have requested; optional additional information is processed on the basis of Art. 6(1)(a) GDPR.
Location data
To show you dance partners and offers nearby, we process your location. You can enter it yourself or use your device’s location services. If you use location services, the app requests permission once and determines your location only at that moment; there is no continuous or background location tracking.
We store your location, country and coordinates, which we use to calculate the distance to other profiles. Other users are shown only a rounded distance and your location, never your exact coordinates. To convert coordinates into a place name, we transmit the coordinates to Nominatim (see the OpenStreetMap section). The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time through your device’s system settings.
Photos
You can upload a profile picture, a background image and other pictures to a gallery, and send pictures in chat. The pictures are stored by Cloudinary (see the section on that service). Pictures sent in chat are stored as protected content and automatically deleted after 90 days. The legal basis is Art. 6(1)(b) GDPR.
Messages and groups
You can exchange individual and group messages, react to messages and take part in polls through the app. We store the content of your messages, timestamps, read status and any edits so that the conversation remains available on your devices. We also store when you were last active; you can turn off the display of this status in the settings.
The legal basis is Art. 6(1)(b) GDPR. Please note that messages are not end-to-end encrypted; they are stored on our servers and automatically analyzed as part of the content review described below.
Automatic translation of messages
If you are chatting with someone who has set a different language, we automatically translate your message so that it can be understood. To do this, the message text is transmitted through the AI interface of Lovable Labs AB, Regeringsgatan 25, 111 53 Stockholm, Sweden, to a language model provided there by Google; a model from OpenAI is used as a backup. The translation is temporarily cached so that the same text does not need to be transmitted more than once. The legal basis is Art. 6(1)(b) GDPR.
Automatic content review
To protect our users from harassment and prohibited content, content is automatically reviewed before publication.
For this purpose, we transmit texts, including messages, profile texts, names and poll options, to OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. Before uploading, we transmit images to Kozelo SAS (Sightengine), 16 bis rue dOdessa, 75014 Paris, France, which checks them for prohibited content.
If the review detects a violation, the content is not published and the incident is logged for evidentiary purposes. This review is an automated preliminary check, but not an automated decision with legal effect within the meaning of Art. 22 GDPR. If you believe that content has been blocked unfairly, contact hi@udansa.com; we will then review the case personally.
The legal basis is Art. 6(1)(f) GDPR. We have a legitimate interest in keeping our platform free of unlawful and harassing content and in complying with our legal obligations.
Suggestions for dance partners (profiling)
To show you suitable profiles first, we automatically assess how well two profiles match. This assessment takes into account: dance styles you have in common, complementary roles, dance level, how often you practice, distance, recent activity, shared goals and events, as well as the search preferences you have specified, including age range. The result is shown to you as a percentage match.
In addition, we create a mathematical representation of your profile (a so-called embedding) based on the information in your profile, namely your first name, description, dance styles, role, level, goals and location, as well as your music scans from the last 90 days. This is used to find similar profiles. This calculation is carried out via the AI interface of Lovable Labs AB using a model from Google.
This process constitutes profiling within the meaning of the GDPR. It is used solely to determine the order of suggestions and has no legal effect on you; it does not involve an automated decision within the meaning of Art. 22 GDPR. The legal basis is Art. 6(1)(b) GDPR, as connecting you with suitable dance partners is the purpose of the app. You can object to this processing under Art. 21 GDPR.
Profile visits
When you open someone else's profile, we record this once per day. The person concerned can see who has visited their profile. Conversely, others can see when you have viewed their profile. The legal basis is Art. 6(1)(f) GDPR; the legitimate interest lies in the transparency customary for a matchmaking platform and facilitating contacts.
Reporting and blocking
You can block other people and report people and listings. When you submit a report, we process your information and the data relating to the reported content, and send it by email to our support team. The legal basis is Art. 6(1)(f) GDPR and compliance with our obligations under the Digital Services Act (Art. 6(1)(c) GDPR).
Music recognition (song scan)
With the song scan, you can identify music around you and find out which dances it is suited to. When you start a scan, the app records a short excerpt using your device's microphone. Recording starts only when you initiate a scan yourself.
The excerpt is sent to the music recognition service AudD (https://audd.io) to identify the track, and to the AI interface of Lovable Labs AB, which analyzes it using a model from Google to determine suitable dances, time signature and tempo. On Apple devices, track recognition is also carried out using the device's built-in ShazamKit feature, without any data being transmitted to us.
We do not store the audio recording itself. We store the scan result, namely the title, artist, tempo, genre and suitable dances, as well as the time of the scan. You can view your scan history in the app. The recognized music characteristics are used in the suggestions for dance partners described above.
The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by starting the scan and granting microphone permission. You can withdraw your consent at any time in your device's system settings.
Dictation feature
You can dictate messages instead of typing them. On mobile devices, your operating system's speech recognition converts your speech to text. In some browsers, the recording is sent to the respective browser provider. The feature starts only when you explicitly activate it. The legal basis is Art. 6(1)(a) GDPR.
Push notifications
If you allow push notifications, we will notify you about new messages, contact requests and other events. To do this, we store a device identifier (push token), the platform and an identifier for your device. Notifications are sent using Firebase Cloud Messaging from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The notification text may include a preview of the message. You can choose in the app which events trigger a notification; you can revoke the permission entirely in your device's system settings. We delete the token when you log out. The legal basis is your consent under Art. 6(1)(a) GDPR.
Permissions on your device
Depending on the feature you use, the app requests the following permissions: camera and photo library (profile and chat pictures), location (nearby search), microphone (song scan), speech recognition (dictation feature), notifications (push notifications), calendar (adding confirmed appointments), contacts (selecting an individual person to invite) and Face ID or fingerprint (locking the app).
Permissions are requested only when you use the relevant feature and can be revoked at any time in your device's system settings. Your address book is not read or transmitted: when inviting someone, you select exactly one person in the system dialog, and their details are used only on your device to create the invitation. Face ID or fingerprint authentication is checked exclusively on your device; we never receive biometric data.
Internal notification of registrations
We automatically notify our team about new registrations through our internal messaging system. In doing so, the name, email address and language of the newly registered person are transmitted to Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; the technical forwarding is handled via Lovable Labs AB. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing timely support to new members.
Deleting your account
You can delete your account at any time in the app settings. This will delete your profile data, your photos, your location details, your dance and search profiles, your scan history, your push tokens, your profile visits and your block lists. Your account with our sign-in service and your entry with the newsletter delivery service provider will also be deleted.
For legal reasons, the following will not be deleted, but will be separated from you: messages that have already been sent, so that the conversation remains readable for the people you are communicating with; recorded violations of our rules; and the information we need to comply with statutory retention periods under tax and commercial law, in particular payment and invoice data under § 147 AO and § 257 HGB. We also store proof that the deletion has been carried out.
If you would like information about your data or a copy in a portable format, contact hi@udansa.com.
Visits, notifications, sharing, invitations and dance plans in our app
The following sections supplement section 9. They describe functions of our app udansa-connect that keep you informed about news in your dance scene, let you share content and invite others and make it easier to arrange to go dancing. We are introducing these functions step by step; individual functions may therefore not yet be available to all users. The processing described in each case only takes place once a function is available to you.
Unless stated otherwise, we store the data in our database at Supabase in Frankfurt am Main (see section 2). Further recipients, where described, are Google for sending push notifications (Firebase Cloud Messaging, see "Push notifications" in section 9), Brevo for sending emails (see section 6), Cloudinary for preview images (see section 7) and other users, insofar as you make content visible to them. Your rights, in particular your right to object under Art. 21 GDPR and your right to withdraw consent at any time, are set out in section 3.
Visit days and time zone
When you open the app, we store once per day that you used the app on that day (visit day). We store the date, the time of your first visit on that day and whether this first visit took place during the day or at night (between 10 p.m. and 6 a.m.). A visit day starts at 4 a.m. local time, so that a night of dancing that ends after midnight still counts towards the previous day. We do not store how long you use the app, which content you view or a device identifier.
So that we know your local time, the app transmits the time zone set on your device when you open it. We store the time zone in your profile together with the time at which your device last reported a changed time zone. For counting visit days, we only adopt a new time zone once your device has reported it unchanged for 30 days, so that a trip does not shift the count.
We use this information to send notifications only at reasonable times at your location, to limit their number, to show you in the app what is new since your last visit, and to evaluate the use of our app in aggregated form (for example the number of active users per week and region). For these evaluations we use totals only, never individual profiles.
The legal basis is Art. 6 (1) (b) GDPR insofar as the information is required for the app functions you use, and otherwise Art. 6 (1) (f) GDPR. Our legitimate interest lies in sending notifications sparingly and at a suitable time of day and in improving our service on the basis of aggregated usage figures. Reading the time zone from your device is necessary to deliver the notifications you have requested at your local time (§ 25 (2) no. 2 TDDDG).
We delete individual visit days once six full calendar months have passed. After that, we only keep the number of your visit days and the number of night-time visit days per calendar month. These monthly figures and the time zone information in your profile are deleted together with your account.
Only if you have consented in the app to the "Statistics" category do we additionally store, for each visit day, in which areas of the app (for example Discover or Messages) your visits on that day began. The legal basis for this is your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG), which you can withdraw at any time with effect for the future. This information is deleted together with the visit day and is not included in the monthly figures.
Origin of your registration
In order to understand how people find udansa and to attribute invitations correctly, we store once after your registration where the registration came from. For this purpose, the app or your browser keeps a record in the local storage of your device of how you accessed udansa: the campaign parameters of the link you opened (utm_source, utm_medium, utm_campaign), where applicable the click identifier of an advertisement, the referring website, the page you opened, information from our website about the event or course you came from, and an invitation code if you followed a link with an invitation code.
Within seven days of your registration, the app transmits the following to us once: the channel (invitation, shared link, group link, advertisement, our website, other campaign, referring website, app store or direct access), the invitation code of the person whose link you used, the campaign parameters, the type and identifier of the first page you opened (for example a specific event), the platform (iOS, Android or web) and the time at which the visit was recorded. We do not transmit an IP address, a device identifier, the click identifier of an advertisement, the full address of the page you opened or any free text. If an invitation code was redeemed when you registered, we also note on the corresponding invitation the channel and, if the code came with the link you opened, the type and identifier of the page opened (for example an event, never the identifier of a dance plan or profile); we remove this page information there when you delete your account.
The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in learning which channels and which shared content lead to registrations and in attributing invitations. Insofar as benefits from our invitation programme are linked to an invitation, the legal basis is additionally Art. 6 (1) (b) GDPR. Storing this information on your device serves to attribute the link you opened and an invitation you followed to your registration (§ 25 (2) no. 2 TDDDG).
We store the information on the origin of your registration until you delete your account. You can remove the information in the local storage of your device at any time by deleting the website data in your browser or the data of the app.
Usage events in the app
The app reports a small number of events to us. We store only the type of event, a short technical reference (for example the identifier of a notification or the place in the app), your user ID and the time, never any content.
Only one event is required for notifications and is therefore reported by the app without separate consent: that you opened a push notification. We need this information to pause after several unopened notifications. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in not overwhelming you with notifications.
Events that serve analysis only are reported by the app only if you have consented to the "Statistics" category: that you were shown the request for permission to send notifications or the notice pointing to the system settings and how you responded to it, in each case with the place in the app (for example setup or settings) and the platform, that you shared content outside the app, which cards in the "Today" area were shown or used, and that you were shown a prompt to invite others. The legal basis is then your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG), which you can withdraw at any time.
We delete the events automatically after 90 days, at the latest together with your account.
Planning of notifications
Prompts intended to encourage you to use the app, such as a reminder of a pending request, new suitable people, the weekly brief or tips for getting started, are planned by an automated procedure. It decides according to fixed rules whether, when and through which channel a prompt is sent. Currently the following applies in particular: at most one such push prompt per day and at most three per week; sending only between 10 a.m. and 8 p.m. your local time, the weekly brief on Thursdays between 5 p.m. and 7 p.m.; after five unopened prompts in a row, a pause until you open the app again; minimum intervals between prompts of the same kind; never a push notification and an email for the same content. If we do not know your time zone, we derive it from the country of your location; if this is not clearly possible, we only send within a time window that fits all time zones of that country, or not at all. Notifications about a new message, a contact request or its acceptance are not affected by these rules and are still sent immediately.
The content of the prompts is based on data that is already available in the app, such as your requests and messages, your dance styles and your location, and the profiles and dance plans of other users that are visible to you. To check whether our prompts are useful, we do not send a randomly selected share of the planned prompts about discoveries, offers and getting started, and only note that the prompt was omitted (comparison group). During a trial phase, the procedure may also only log decisions without sending any prompts.
We log every decision with your user ID, the type of and reference to the occasion (for example the identifier of a request), the type of prompt, the decision (sent, or held back because of quiet hours, the maximum number, a pause or the comparison group), the channel, your local calendar day and the time. For prompts that were actually sent, we also store the channel and, if you open a push notification, the time it was opened. To comply with the maximum numbers, we create an entry for your local day for each push notification sent.
Sending push notifications is based on your consent (Art. 6 (1) (a) GDPR, see "Push notifications" in section 9). The planning, the logging and the evaluation of openings are based on Art. 6 (1) (f) GDPR; our legitimate interest lies in sending prompts only when there is an actual occasion, in limited numbers and at a suitable time, and in checking their usefulness. This does not involve any automated decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
We delete the log of decisions and the information on prompts sent after 180 days and the entries for the maximum numbers after 14 days, in each case at the latest together with your account.
Notification topics and permission for notifications
In the app settings you decide separately for each topic whether you want to receive notifications about it, including "Waiting for you" (open requests and unread messages), "Discoveries" (new people in your dance scene), "Weekly brief", "Tips for getting started", "Still searching?", "Come along" (people joining your dance plan) and "Invitations". If you have previously switched off the "Reminders" topic, these topics also remain switched off. We store your selection until you change it or delete your account.
The topic "Courses and events for you" covers notices about courses and events of dance schools and other providers that match your dance styles and your location. It is switched off by default; you can switch it on without any preselection when setting up notifications or in the settings. The same applies to the topic "News from udansa" with promotions and news from us. The legal basis for these two topics is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by switching the topic off. You receive these notices only as push notifications and in the app, not by email. We do not pass on any data about you to the providers of the courses and events.
So that you can receive notifications, the app asks during setup and at five suitable moments whether you would like to allow notifications: after your first contact request, when you open a request, when a request is accepted, when you create a dance plan or choose "I'm going" for an event, and on your second visit. Each of these moments asks at most once; in total the app asks at most five times in 30 days and with at least two days in between, and in the app only as long as your device can still show the system prompt. Whether you allow notifications changes nothing about the other functions of the app; there is no reward for it. If you have declined notifications on your device, the app shows a notice that opens the way to the system settings at most once every seven days. For these intervals, the app stores on your device when it asked or showed the notice, at which moments it has already asked, when you chose "Later" and on which day you first opened the app on this device. This information stays on your device; storing it is necessary for the function you use (§ 25 (2) no. 2 TDDDG). You grant and revoke the permission itself exclusively on your device.
"Updates" inbox
We additionally place planned prompts, milestones of invitations and similar messages in your "Updates" inbox in the app, even if no push notification was sent. For each entry we store the type of message, technical references such as identifiers, numbers and times (no texts and no names), the destination within the app, and the times of creation and of reading. The app only assembles the displayed text and the names of other people when you open the inbox; entries about people who have deleted their account, have been suspended or whom you have blocked are not displayed. Only you can see your inbox. The legal basis is Art. 6 (1) (b) GDPR. We delete entries automatically after 180 days, at the latest together with your account.
Emails from the app: consent, confirmation and unsubscribing
When you register, we inform you that we send messages about your account and occasional notices about udansa to your email address, and that you can object to the use of your email address for such notices at any time, in the settings or via the link in every email, without incurring any costs other than the transmission costs according to the basic rates. We send messages about your account, for example that a request is waiting for your reply, that a message is unread or that an appointment is coming up, on the basis of Art. 6 (1) (b) GDPR. Insofar as we send you notices about udansa's own services without consent, for example about setting up your profile, this is based on Art. 6 (1) (f) GDPR in conjunction with § 7 (3) UWG; our legitimate interest is direct marketing for our own services.
You only receive the weekly brief, tips for getting started and returning to the app, and notices about new suitable people by email with your express consent ("Weekly brief and tips by email"). The app asks for this without any preselection in the settings and at individual suitable moments, at these moments at most twice. After you agree, we send you an email with a confirmation link (double opt-in); we only send these emails once you have opened this link. The link is valid for seven days and can only be used once. On the basis of this consent you receive at most two such emails per week; if you have not been in the app for a longer time, at most three monthly overviews. We do not send offers from dance schools and other providers or promotions from udansa by email on the basis of this consent. The legal basis for sending is your consent under Art. 6 (1) (a) GDPR, which is at the same time the consent required under § 7 (2) UWG.
To manage and prove your consent, we store in your account settings: the status (not given, requested, confirmed or withdrawn), the times of the request, the confirmation and the withdrawal, the place in the app where you agreed, the version and language of the consent text you agreed to (at the request and again at the confirmation), a hash value of the one-time confirmation code (the code itself is only contained in the email; the hash value is deleted after confirmation or withdrawal), how often and when the app last asked you, and the number of confirmation emails requested on a given day (at most five per day). Storage for the purpose of proving consent is based on Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR. To comply with the maximum of two emails per week, we also note the type and time of each email sent on the basis of the consent; we remove notes older than 30 days when the next email is sent. All of this information is deleted together with your account.
You can withdraw your consent at any time with one tap in the settings or via the link in each of these emails. The link leads to an unsubscribe page that does not require you to sign in. It states what ends and what remains, and only unsubscribes you when you tap there; merely opening it, for example by a link checker of your email program, changes nothing. The unsubscription is authorised solely by a signature in the link; the page shows no information about you. The unsubscribe link of other emails from udansa also leads to this page. Each of these emails also contains a notice of your right to object and an unsubscribe link for the respective topic; this link only stops the sending of the emails concerned, your settings for push notifications remain unchanged. We store which topics you have unsubscribed from by email in your notification settings; you can undo the unsubscription there.
We send the confirmation email and the emails mentioned via Brevo (see "Brevo" in section 6). For this purpose, Brevo processes your email address, your name, your language and the content of the email on our behalf. If you withdraw your consent, we remove your email address from our newsletter distribution list at Brevo and do not add it there again automatically afterwards.
Weekly brief, monthly brief and notices for getting started and returning
The weekly brief "Your dance weekend" arrives on Thursdays between 5 p.m. and 7 p.m. your local time if you have been in the app in the last 30 days and have not switched off the "Weekly brief" topic. It names your connections who are going dancing at the weekend (only dance plans you may see by name), up to three new people with their city or distance, open requests and unread messages and, only if you have switched on the topic "Courses and events for you", dance evenings in your dance styles. We only send it if at least two of these parts contain something: as a push notification, otherwise by email with your confirmed consent, otherwise only to your inbox. If you have not been in the app for 90, 120 or 150 days, we send you a monthly brief by email with your confirmed consent, at most one in 25 days, never as a push notification and without offers from providers.
We send new members one notice each on the first, third, seventh and 14th day after registration, but only if there is a specific occasion, such as a pending request, a new person in your dance style or dance plans in your area; if there is no occasion, the notice is omitted. We remind you of an incomplete setup and of an incomplete profile at most twice each, and of the profile not at all if you have switched off "Complete your profile". If you have not been in the app for 3, 10, 30 or 60 days, you receive at most one notice per stage and absence, again only with a specific occasion. We also point out a new person in your dance style within a radius of 50 kilometres (at most once in three days) and that one of your connections is going dancing today or tomorrow. You only receive notices about courses and events with the topic "Courses and events for you" switched on, and only as push notifications and in the app.
The rules under "Planning of notifications" and your notification topics apply to all of these notices. You only receive them by email with your confirmed consent; only the reminders about setup and profile are also sent by email without consent, with a notice of your right to object (see above). As a new person, we only name you in such notices to others if you have completed setup and have a real photo, your profile is not private, you have not hidden your activity status and there is neither a block nor already a connection between you, and then with the name under which you appear publicly in the app and your city or a distance rounded to whole kilometres. Your dance plans only appear in such notices to your connections and only if you have chosen "My connections". We never state how many people there are in a region.
The legal basis for push notifications is your consent (Art. 6 (1) (a) GDPR), for emails your consent or, for the reminders about setup and profile, Art. 6 (1) (f) GDPR in conjunction with § 7 (3) UWG, and for inbox entries and naming other members Art. 6 (1) (b) GDPR, as getting to know other dancers is the purpose of the app.
"Today" area and dance question of the day
At the top of the Discover area, the app shows what is waiting for you (open requests, unread messages and new connections without a message), what is new since your last visit (up to three new people with their city or distance, and how often your profile was viewed), and a dance question of the day. We take your last visit from your visit days. As new people we only show profiles with completed setup and a real photo; people who have made their profile private or hidden their activity status do not appear there, nor do people with whom there is a block.
You answer the dance question voluntarily by choosing one of the predefined answers. We store one answer per question with your user ID, your visit day and the time; if the question comes back after 30 days, you see your earlier answer. Others never see your answer individually, only the distribution of all answers in percent, only once there are at least five answers and only from answers given before their own day began, so that the result does not change while someone is watching and no individual answer can be recognised. We store your answers until you delete your account. The legal basis is Art. 6 (1) (b) GDPR.
Welcome question, "Your start" and first successes
During setup, the app asks without any preselection whether dancers from your area may say hello to you. Your answer ("Yes, gladly" or "Rather not") is voluntary; we store it in your profile, and others do not see it. At present we do not use it for any further function; before we introduce a way of greeting new members, we will supplement this policy. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time via hi@udansa.com.
The "Your start" card shows you which first steps you have already taken, such as setting up your profile, uploading a photo, saving an event or course, recognising a song or taking part in a poll, your first connection and your first conversation. It is based on data that is already available in the app; only you see it, and we do not compare it with anyone. The app marks your first connection, your first conversation and your first dance plan once with a short notice if they took place no more than 14 days ago, and places an entry in your inbox; there is no push notification or email for this. So that the notice appears only once, we store which of these moments you have seen and when, until you delete your account. The legal basis is Art. 6 (1) (b) GDPR.
Sharing links, link previews and invitation code
You can share events, courses, dance plans, results of the Song-Scan, groups, your invitation and, if you enable it, your profile outside the app via the share function of your device, for example via a messenger. Shared links lead to a function on our server at Supabase (see section 2). If a messenger or social network (for example WhatsApp, iMessage, Telegram, Facebook or Instagram) retrieves such a link in order to display a preview, it delivers a preview with a title, a short description and a preview image. Preview images never show a person; they are created at Cloudinary from the image of the event or course with date and place, or from our logo. For an enabled profile preview, or for a dance plan for which you have chosen to show your first name, the title may contain your first name. Messengers usually store such previews in their chats; we have no influence on this. A shared result of the Song-Scan shows the title, suitable dances and tempo, but no information about who performed the scan. People who open the link are forwarded to the corresponding public page.
We count how often shared links are opened without any reference to a person: per day, we only store the number of calls per type of content and type of sharing, separated by whether a person opened the link or a service retrieved a preview. We do not store an invitation code, an IP address or a device identifier in the process. When a link is called, our servers technically process your IP address and information about your browser in order to answer the request (see "Server log files" in section 4). The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in meaningful link previews and in measuring how often shared content is opened.
Links that you share outside the app contain your personal invitation code and the information that the link was shared and through which channel (utm_source, utm_medium). If someone opens such a link, the page opened keeps the code, the type and identifier of the page and whether it was an invitation link in the local storage of the device, so that a subsequent registration can be attributed to the link (see "Origin of your registration"); a code already stored there is not overwritten. Only the code of an invitation link is redeemed automatically after registration and can trigger benefits from our invitation programme. For all other shared links, for example to events, courses, dance plans, groups, profiles or songs, the code serves only to measure which shared content leads to registrations; it brings no benefit to you or to the new person. The legal basis is Art. 6 (1) (f) GDPR, and for the invitation programme Art. 6 (1) (b) GDPR; the code is stored on the device in accordance with § 25 (2) no. 2 TDDDG.
Links to the app stores and install referrer on Android
If you open our app in the browser of a mobile device, a banner points to the app at most once every seven days; your browser stores on your device when it last appeared. Links to Google Play, for example in the banner, in the notice about notifications in the browser or on the invitation page, contain in the parameter "referrer" the information that the link comes from us (utm_source, utm_medium) and, if an invitation code or the code of a shared link is stored on your device, this code with the type and, where applicable, the identifier of the page on which it was stored. Links to Apple's App Store do not contain any such information; there you enter an invitation code yourself during setup. In Safari, Apple's banner for our app receives the page opened and the code, so that the installed app opens the same page.
After installation, Google Play passes this parameter to the app via the Play Install Referrer interface. Our Android app reads it once when it is first started and treats it like a link that was opened: it pre-fills an invitation code in the invitation code field of the setup, the code of another shared link serves only for measurement, and campaign parameters and click identifiers are included in the information on the origin of your registration. The app does not store the text that was read; it only notes on your device when it read it and which code it adopted. It does not read an advertising ID or any other identifier of your device. The legal basis is Art. 6 (1) (f) GDPR, and for benefits from the invitation programme Art. 6 (1) (b) GDPR; our legitimate interest lies in attributing an installation to the link through which it came about. Reading the parameter and storing the information on your device serve this attribution (§ 25 (2) no. 2 TDDDG).
Invitation programme
The invitation function gives you a personal invitation code and an invitation link. Anyone who opens your link sees your first name and your profile picture on the invitation page. If someone registers via your link or enters your code during setup, we store an invitation with your code, the user ID of the invited person, the time and the channel (see "Origin of your registration"). Benefits are only granted for invitations via this dedicated invitation path.
For each invitation we record two milestones. E1: the invited person's profile is ready (setup completed, real photo, dance style and place); the invited person then receives 30 days of Premium. E2: after that, the invited person has their first connection, or a conversation in which both write, with a third person who has been on udansa for at least 30 days; you then receive 7 days of Premium, credited 7 days after E2. If the invited person deletes their account or is suspended during this waiting period, your days lapse. Days are granted for at most three invited people in 30 days and ten in 365 days; beyond that we record E2 without days. If you have a paid subscription running, we keep the days as credit until it ends. If the invited person takes out a subscription, you additionally receive Premium days as before. Whether a milestone has been reached is checked hourly by an automated procedure on the basis of profile, photo, connections and whether both people have written in a conversation, never on the basis of content. For each milestone we store whom it rewards, the channel of the invitation, when it was reached, the type and number of days, the waiting period, whether the days were credited or lapsed, and when we sent a notification about it. We look into more than five new invitations with one code on a single day to prevent misuse.
In the app you only see your invitations as anonymous steps (registered, profile ready, first connection) and the status of your days, without a name, identifier or date. If an invited person has deleted their account, it says that the person is no longer on udansa; if days lapse for another reason, we do not state the reason. When a person you invited reaches a milestone, you receive a notification and an entry in your inbox, both without a name; we inform the person who receives days with a notification. We only send these notifications between 10 a.m. and 8 p.m. local time. The invited person sees the status of their own gift. After your first connection, the app places a one-time notice about inviting others in your inbox; if you hide the invitation card, the app remembers this on your device and does not show it for 30 days.
The legal basis is Art. 6 (1) (b) GDPR (participation in the invitation programme under its terms), and for the check for misuse Art. 6 (1) (f) GDPR. We store an invitation and your milestone E2 until you as the inviting person delete your account, and the invited person's milestone E1 until that person deletes their account; the invited person keeps their gift even if you delete your account.
Public profile preview
If you expressly enable it, your profile receives a public preview that you can share, for example together with a dance partner request. This function is switched off by default. The preview only shows your first name (or your username if you have hidden your name), one photo, your dance styles, your dance level, your city and whether you are looking for a dance partner, never your last name, your description text or your age. Anyone with the link can view it without an account, but it is blocked for search engines (noindex). The preview is located under a randomly generated identifier, not under your user ID; we store this identifier and the time it was enabled in your profile. Private, suspended and deleted profiles do not receive a preview.
You can switch the preview off again at any time in the app. The identifier is then deleted, previous links no longer show the preview, and enabling it again creates a new identifier. Previews that messengers have already stored in chats remain visible there. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by switching the preview off.
Group links from members
Where the group allows it, members can create and share invitation links to their group, also as a QR code or for printing. For each link we store the group, a hash value of the randomly generated link (not the link itself), who created it, the way it left the app (sharing, copying, QR code or printout), how often it was used, its expiry and, where applicable, its revocation. A link is valid for 30 days and opens the group at most 50 times; each member can create at most 20 links per hour. Anyone who opens the link sees, before joining, the name under which the person who created it appears publicly in the app and, from three members, the number of members. If someone joins the group as a new member via your link, you receive a notification with their public name, at most three per hour. If someone registers via a group link, we note the group link with the group as the origin (see "Origin of your registration").
A link only opens the group as long as the person who created it is a member; if that person leaves the group or is removed, we revoke their links. For this purpose we note in the membership history whether a membership ended by leaving or by removal; a person who was removed cannot return via another member's link, only via a link from the people who manage the group or from the organiser, or if they are added again. Those who manage a group see the members' links that still open the group, with the public name of the person who created them, the way, the time of creation, the expiry and the uses, and can revoke them. We store the information on a link as long as the group exists; we remove the note of who created it together with that person's account. The legal basis is Art. 6 (1) (b) GDPR, and for the limits to prevent misuse Art. 6 (1) (f) GDPR.
Dance plans ("I'm going dancing")
With a dance plan you let others in the app know that you are going dancing on a particular day, today or up to 13 days in advance. We store the day and time, the place (an event or course from our list, or a freely entered place name with city), coordinates of the place rounded to about one kilometre, the dance style, your choice of visibility and the time of creation.
You choose who learns about it, without any preselection. With "My connections", your confirmed connections see your dance plan with your name and your photo. With "Only as a number", you never appear with your name in the app. In both cases, other users within a radius of 25 kilometres are only shown the number of people going dancing on that day, and only once there are at least three. People you have blocked or who have blocked you do not see your dance plans. We store your choice as the default for further dance plans; you can change it for each dance plan.
A dance plan ends at 4 a.m. local time after the evening in question and is deleted automatically two days later; you can delete it earlier at any time. We store your default visibility setting until you delete your account. The legal basis is Art. 6 (1) (b) GDPR.
Organisers whom we have approved can enter recurring public dance evenings (series). We show series to users in the area with title, place, time and dance style, but without any information about a person. Internally, we store which account created the series. Series can be reported; we review reports and hide series in the event of violations (see "Reporting and blocking" in section 9). A series is deleted two days after its last date. The legal basis is Art. 6 (1) (b) GDPR, and for handling reports Art. 6 (1) (f) GDPR.
"Who's coming along?" and joining without an account
You can share your dance plan as a link so that others can come along. The public page of the dance plan shows the event or place, date, time and dance style. It only shows your first name if you expressly choose this for the dance plan in question and have not hidden your name in the app; it never shows a photo, your last name or an identifier. The page is blocked for search engines (noindex) and no longer shows any person after the date. On event and course pages, we show how many people from udansa are going only once there are at least three, and without names; only your connections see names, and only if you have chosen "My connections".
People without an account can say "I'm coming along" on the page. For this we only ask for a first name, no email address and no other information. The first name is stored with the dance plan and shown to the person who shared the dance plan, including as a notification (for example "Mara is coming along"); that person can remove guests again. We do not send any advertising to guests. To prevent misuse, we accept at most 20 guests per dance plan and at most ten replies per hour, each first name only once, and automatically check the first name according to fixed rules, without passing it on to third parties: at most 30 characters, only letters, spaces, hyphens and apostrophes, and no word from a list of offensive or misleading terms. We do not store a first name that was rejected. We delete the first name automatically 48 hours after the end of the dance plan (4 a.m. local time after the evening), or earlier together with the dance plan. The legal basis for processing the data of guests is Art. 6 (1) (b) GDPR, as we pass on the reply to the inviting person at the guest's request; the misuse check is based on Art. 6 (1) (f) GDPR.
If you join with an account or register via such a link, we create a dance plan of your own and note on it who invited you. The inviting person sees your reply with the name under which you appear publicly in the app and receives at most one notification about it per dance plan. So that it is not repeated, we store that and when your reply to this dance plan was reported; we delete this note together with your account or with the inviting person's dance plan. We remove the note of who invited you if the inviting person deletes their account.
Order of suggestions and expiry of requests
So that contact requests reach people who actually reply, when ordering search results and suggestions we take into account, in addition to the criteria mentioned under "Suggestions for dance partners (profiling)" in section 9, whether a person has been active in the last 14 days and their responsiveness. We calculate responsiveness daily from the contact requests a person has received in the past 90 days (excluding the last seven days) and the share of those that were accepted, declined or ended by blocking; with few requests, the value is evened out towards the middle. People who have hidden their activity status are ranked in such a way that the order does not reveal their status. Responsiveness is never shown to anyone and is never rewarded; it only affects the order, never whether a profile can be found.
Before you send a request to a person who has not been in the app for more than 30 days, the app points out that the person has not been around for a while, without stating a date. If the person has hidden their activity status or if there is a block, no notice is shown.
Open contact requests expire after 30 days. We note the time of expiry; the requesting person then sees the request as expired and can send a new request. Until it expires, we remind the person who received the request of the open request up to three times, within the limits of their notification settings.
The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in requests being answered and suggestions pointing to people who can be reached. Calculating responsiveness and taking it into account in the order constitute profiling; this does not involve an automated decision within the meaning of Art. 22 GDPR. You can object to this processing under Art. 21 GDPR. Responsiveness is recalculated daily, is dropped if you have not received any requests in the period mentioned, and is deleted at the latest together with your account.
Voluntary question when deleting your account
When you delete your account, the app asks voluntarily what was missing. You can choose one of the predefined answers ("Nobody near me", "Not my dance style", "Too many messages", "Just wanted to look around" or "Something else") or skip the question; the question has no free text field. The deletion does not depend on your answer. We store your answer as a short code in the record of the deletion of your account (see "Deletion of your account" in section 9), together with a reason in your own words if you give one voluntarily in the deletion dialogue as before. The record also contains your user ID, the time of the deletion, the age of your account in days, whether you had Premium, the number of your messages and connections, and technical information on whether all deletion steps succeeded. We evaluate answers and reasons only in aggregated form in order to improve our service. The legal basis for your answer and your reason is your consent, which you give by providing them voluntarily (Art. 6 (1) (a) GDPR), and for the other information in the record Art. 6 (1) (f) GDPR; our legitimate interest lies in being able to prove that the deletion was carried out and to evaluate reasons for leaving in aggregated form.
Deletion of the data mentioned in this section together with your account
When you delete your account, the data described in this section is deleted in addition to the data mentioned under "Deletion of your account" in section 9, even if the respective storage period has not yet expired: your visit days and monthly figures, your time zone information, the origin of your registration, your usage events, the log of notification planning and the information on prompts sent to you, your inbox, the information on your email consent including the version of the consent text and on emails sent, your settings for notification topics and your unsubscriptions from individual email topics, your answers to the dance question, your answer to the welcome question, the notes on first successes marked, your invitation code, your invitations and the milestones of the invitation programme that reward you, the activation and identifier of your profile preview, your dance plans including replies from guests, the notes on reported replies and your default visibility setting, and your responsiveness. In dance plans of other people, we remove the note that you invited them; in group links you created, the note that they come from you, and these links no longer open the group; in the invitation via which you registered, the page you opened. This invitation remains with the inviting person with your internal user ID and the channel. Entries in other people's inboxes that refer to you only contain an internal identifier and are no longer displayed after the deletion. Apart from that, only figures without any reference to a person, such as the daily count of link calls, and the record of the deletion are retained.
Unless stated otherwise, we store the data in our database at Supabase in Frankfurt am Main (see section 2). Further recipients, where described, are Google for sending push notifications (Firebase Cloud Messaging, see "Push notifications" in section 9), Brevo for sending emails (see section 6), Cloudinary for preview images (see section 7) and other users, insofar as you make content visible to them. Your rights, in particular your right to object under Art. 21 GDPR and your right to withdraw consent at any time, are set out in section 3.
Visit days and time zone
When you open the app, we store once per day that you used the app on that day (visit day). We store the date, the time of your first visit on that day and whether this first visit took place during the day or at night (between 10 p.m. and 6 a.m.). A visit day starts at 4 a.m. local time, so that a night of dancing that ends after midnight still counts towards the previous day. We do not store how long you use the app, which content you view or a device identifier.
So that we know your local time, the app transmits the time zone set on your device when you open it. We store the time zone in your profile together with the time at which your device last reported a changed time zone. For counting visit days, we only adopt a new time zone once your device has reported it unchanged for 30 days, so that a trip does not shift the count.
We use this information to send notifications only at reasonable times at your location, to limit their number, to show you in the app what is new since your last visit, and to evaluate the use of our app in aggregated form (for example the number of active users per week and region). For these evaluations we use totals only, never individual profiles.
The legal basis is Art. 6 (1) (b) GDPR insofar as the information is required for the app functions you use, and otherwise Art. 6 (1) (f) GDPR. Our legitimate interest lies in sending notifications sparingly and at a suitable time of day and in improving our service on the basis of aggregated usage figures. Reading the time zone from your device is necessary to deliver the notifications you have requested at your local time (§ 25 (2) no. 2 TDDDG).
We delete individual visit days once six full calendar months have passed. After that, we only keep the number of your visit days and the number of night-time visit days per calendar month. These monthly figures and the time zone information in your profile are deleted together with your account.
Only if you have consented in the app to the "Statistics" category do we additionally store, for each visit day, in which areas of the app (for example Discover or Messages) your visits on that day began. The legal basis for this is your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG), which you can withdraw at any time with effect for the future. This information is deleted together with the visit day and is not included in the monthly figures.
Origin of your registration
In order to understand how people find udansa and to attribute invitations correctly, we store once after your registration where the registration came from. For this purpose, the app or your browser keeps a record in the local storage of your device of how you accessed udansa: the campaign parameters of the link you opened (utm_source, utm_medium, utm_campaign), where applicable the click identifier of an advertisement, the referring website, the page you opened, information from our website about the event or course you came from, and an invitation code if you followed a link with an invitation code.
Within seven days of your registration, the app transmits the following to us once: the channel (invitation, shared link, group link, advertisement, our website, other campaign, referring website, app store or direct access), the invitation code of the person whose link you used, the campaign parameters, the type and identifier of the first page you opened (for example a specific event), the platform (iOS, Android or web) and the time at which the visit was recorded. We do not transmit an IP address, a device identifier, the click identifier of an advertisement, the full address of the page you opened or any free text. If an invitation code was redeemed when you registered, we also note on the corresponding invitation the channel and, if the code came with the link you opened, the type and identifier of the page opened (for example an event, never the identifier of a dance plan or profile); we remove this page information there when you delete your account.
The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in learning which channels and which shared content lead to registrations and in attributing invitations. Insofar as benefits from our invitation programme are linked to an invitation, the legal basis is additionally Art. 6 (1) (b) GDPR. Storing this information on your device serves to attribute the link you opened and an invitation you followed to your registration (§ 25 (2) no. 2 TDDDG).
We store the information on the origin of your registration until you delete your account. You can remove the information in the local storage of your device at any time by deleting the website data in your browser or the data of the app.
Usage events in the app
The app reports a small number of events to us. We store only the type of event, a short technical reference (for example the identifier of a notification or the place in the app), your user ID and the time, never any content.
Only one event is required for notifications and is therefore reported by the app without separate consent: that you opened a push notification. We need this information to pause after several unopened notifications. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in not overwhelming you with notifications.
Events that serve analysis only are reported by the app only if you have consented to the "Statistics" category: that you were shown the request for permission to send notifications or the notice pointing to the system settings and how you responded to it, in each case with the place in the app (for example setup or settings) and the platform, that you shared content outside the app, which cards in the "Today" area were shown or used, and that you were shown a prompt to invite others. The legal basis is then your consent (Art. 6 (1) (a) GDPR and § 25 (1) TDDDG), which you can withdraw at any time.
We delete the events automatically after 90 days, at the latest together with your account.
Planning of notifications
Prompts intended to encourage you to use the app, such as a reminder of a pending request, new suitable people, the weekly brief or tips for getting started, are planned by an automated procedure. It decides according to fixed rules whether, when and through which channel a prompt is sent. Currently the following applies in particular: at most one such push prompt per day and at most three per week; sending only between 10 a.m. and 8 p.m. your local time, the weekly brief on Thursdays between 5 p.m. and 7 p.m.; after five unopened prompts in a row, a pause until you open the app again; minimum intervals between prompts of the same kind; never a push notification and an email for the same content. If we do not know your time zone, we derive it from the country of your location; if this is not clearly possible, we only send within a time window that fits all time zones of that country, or not at all. Notifications about a new message, a contact request or its acceptance are not affected by these rules and are still sent immediately.
The content of the prompts is based on data that is already available in the app, such as your requests and messages, your dance styles and your location, and the profiles and dance plans of other users that are visible to you. To check whether our prompts are useful, we do not send a randomly selected share of the planned prompts about discoveries, offers and getting started, and only note that the prompt was omitted (comparison group). During a trial phase, the procedure may also only log decisions without sending any prompts.
We log every decision with your user ID, the type of and reference to the occasion (for example the identifier of a request), the type of prompt, the decision (sent, or held back because of quiet hours, the maximum number, a pause or the comparison group), the channel, your local calendar day and the time. For prompts that were actually sent, we also store the channel and, if you open a push notification, the time it was opened. To comply with the maximum numbers, we create an entry for your local day for each push notification sent.
Sending push notifications is based on your consent (Art. 6 (1) (a) GDPR, see "Push notifications" in section 9). The planning, the logging and the evaluation of openings are based on Art. 6 (1) (f) GDPR; our legitimate interest lies in sending prompts only when there is an actual occasion, in limited numbers and at a suitable time, and in checking their usefulness. This does not involve any automated decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR).
We delete the log of decisions and the information on prompts sent after 180 days and the entries for the maximum numbers after 14 days, in each case at the latest together with your account.
Notification topics and permission for notifications
In the app settings you decide separately for each topic whether you want to receive notifications about it, including "Waiting for you" (open requests and unread messages), "Discoveries" (new people in your dance scene), "Weekly brief", "Tips for getting started", "Still searching?", "Come along" (people joining your dance plan) and "Invitations". If you have previously switched off the "Reminders" topic, these topics also remain switched off. We store your selection until you change it or delete your account.
The topic "Courses and events for you" covers notices about courses and events of dance schools and other providers that match your dance styles and your location. It is switched off by default; you can switch it on without any preselection when setting up notifications or in the settings. The same applies to the topic "News from udansa" with promotions and news from us. The legal basis for these two topics is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by switching the topic off. You receive these notices only as push notifications and in the app, not by email. We do not pass on any data about you to the providers of the courses and events.
So that you can receive notifications, the app asks during setup and at five suitable moments whether you would like to allow notifications: after your first contact request, when you open a request, when a request is accepted, when you create a dance plan or choose "I'm going" for an event, and on your second visit. Each of these moments asks at most once; in total the app asks at most five times in 30 days and with at least two days in between, and in the app only as long as your device can still show the system prompt. Whether you allow notifications changes nothing about the other functions of the app; there is no reward for it. If you have declined notifications on your device, the app shows a notice that opens the way to the system settings at most once every seven days. For these intervals, the app stores on your device when it asked or showed the notice, at which moments it has already asked, when you chose "Later" and on which day you first opened the app on this device. This information stays on your device; storing it is necessary for the function you use (§ 25 (2) no. 2 TDDDG). You grant and revoke the permission itself exclusively on your device.
"Updates" inbox
We additionally place planned prompts, milestones of invitations and similar messages in your "Updates" inbox in the app, even if no push notification was sent. For each entry we store the type of message, technical references such as identifiers, numbers and times (no texts and no names), the destination within the app, and the times of creation and of reading. The app only assembles the displayed text and the names of other people when you open the inbox; entries about people who have deleted their account, have been suspended or whom you have blocked are not displayed. Only you can see your inbox. The legal basis is Art. 6 (1) (b) GDPR. We delete entries automatically after 180 days, at the latest together with your account.
Emails from the app: consent, confirmation and unsubscribing
When you register, we inform you that we send messages about your account and occasional notices about udansa to your email address, and that you can object to the use of your email address for such notices at any time, in the settings or via the link in every email, without incurring any costs other than the transmission costs according to the basic rates. We send messages about your account, for example that a request is waiting for your reply, that a message is unread or that an appointment is coming up, on the basis of Art. 6 (1) (b) GDPR. Insofar as we send you notices about udansa's own services without consent, for example about setting up your profile, this is based on Art. 6 (1) (f) GDPR in conjunction with § 7 (3) UWG; our legitimate interest is direct marketing for our own services.
You only receive the weekly brief, tips for getting started and returning to the app, and notices about new suitable people by email with your express consent ("Weekly brief and tips by email"). The app asks for this without any preselection in the settings and at individual suitable moments, at these moments at most twice. After you agree, we send you an email with a confirmation link (double opt-in); we only send these emails once you have opened this link. The link is valid for seven days and can only be used once. On the basis of this consent you receive at most two such emails per week; if you have not been in the app for a longer time, at most three monthly overviews. We do not send offers from dance schools and other providers or promotions from udansa by email on the basis of this consent. The legal basis for sending is your consent under Art. 6 (1) (a) GDPR, which is at the same time the consent required under § 7 (2) UWG.
To manage and prove your consent, we store in your account settings: the status (not given, requested, confirmed or withdrawn), the times of the request, the confirmation and the withdrawal, the place in the app where you agreed, the version and language of the consent text you agreed to (at the request and again at the confirmation), a hash value of the one-time confirmation code (the code itself is only contained in the email; the hash value is deleted after confirmation or withdrawal), how often and when the app last asked you, and the number of confirmation emails requested on a given day (at most five per day). Storage for the purpose of proving consent is based on Art. 6 (1) (c) GDPR in conjunction with Art. 7 (1) GDPR. To comply with the maximum of two emails per week, we also note the type and time of each email sent on the basis of the consent; we remove notes older than 30 days when the next email is sent. All of this information is deleted together with your account.
You can withdraw your consent at any time with one tap in the settings or via the link in each of these emails. The link leads to an unsubscribe page that does not require you to sign in. It states what ends and what remains, and only unsubscribes you when you tap there; merely opening it, for example by a link checker of your email program, changes nothing. The unsubscription is authorised solely by a signature in the link; the page shows no information about you. The unsubscribe link of other emails from udansa also leads to this page. Each of these emails also contains a notice of your right to object and an unsubscribe link for the respective topic; this link only stops the sending of the emails concerned, your settings for push notifications remain unchanged. We store which topics you have unsubscribed from by email in your notification settings; you can undo the unsubscription there.
We send the confirmation email and the emails mentioned via Brevo (see "Brevo" in section 6). For this purpose, Brevo processes your email address, your name, your language and the content of the email on our behalf. If you withdraw your consent, we remove your email address from our newsletter distribution list at Brevo and do not add it there again automatically afterwards.
Weekly brief, monthly brief and notices for getting started and returning
The weekly brief "Your dance weekend" arrives on Thursdays between 5 p.m. and 7 p.m. your local time if you have been in the app in the last 30 days and have not switched off the "Weekly brief" topic. It names your connections who are going dancing at the weekend (only dance plans you may see by name), up to three new people with their city or distance, open requests and unread messages and, only if you have switched on the topic "Courses and events for you", dance evenings in your dance styles. We only send it if at least two of these parts contain something: as a push notification, otherwise by email with your confirmed consent, otherwise only to your inbox. If you have not been in the app for 90, 120 or 150 days, we send you a monthly brief by email with your confirmed consent, at most one in 25 days, never as a push notification and without offers from providers.
We send new members one notice each on the first, third, seventh and 14th day after registration, but only if there is a specific occasion, such as a pending request, a new person in your dance style or dance plans in your area; if there is no occasion, the notice is omitted. We remind you of an incomplete setup and of an incomplete profile at most twice each, and of the profile not at all if you have switched off "Complete your profile". If you have not been in the app for 3, 10, 30 or 60 days, you receive at most one notice per stage and absence, again only with a specific occasion. We also point out a new person in your dance style within a radius of 50 kilometres (at most once in three days) and that one of your connections is going dancing today or tomorrow. You only receive notices about courses and events with the topic "Courses and events for you" switched on, and only as push notifications and in the app.
The rules under "Planning of notifications" and your notification topics apply to all of these notices. You only receive them by email with your confirmed consent; only the reminders about setup and profile are also sent by email without consent, with a notice of your right to object (see above). As a new person, we only name you in such notices to others if you have completed setup and have a real photo, your profile is not private, you have not hidden your activity status and there is neither a block nor already a connection between you, and then with the name under which you appear publicly in the app and your city or a distance rounded to whole kilometres. Your dance plans only appear in such notices to your connections and only if you have chosen "My connections". We never state how many people there are in a region.
The legal basis for push notifications is your consent (Art. 6 (1) (a) GDPR), for emails your consent or, for the reminders about setup and profile, Art. 6 (1) (f) GDPR in conjunction with § 7 (3) UWG, and for inbox entries and naming other members Art. 6 (1) (b) GDPR, as getting to know other dancers is the purpose of the app.
"Today" area and dance question of the day
At the top of the Discover area, the app shows what is waiting for you (open requests, unread messages and new connections without a message), what is new since your last visit (up to three new people with their city or distance, and how often your profile was viewed), and a dance question of the day. We take your last visit from your visit days. As new people we only show profiles with completed setup and a real photo; people who have made their profile private or hidden their activity status do not appear there, nor do people with whom there is a block.
You answer the dance question voluntarily by choosing one of the predefined answers. We store one answer per question with your user ID, your visit day and the time; if the question comes back after 30 days, you see your earlier answer. Others never see your answer individually, only the distribution of all answers in percent, only once there are at least five answers and only from answers given before their own day began, so that the result does not change while someone is watching and no individual answer can be recognised. We store your answers until you delete your account. The legal basis is Art. 6 (1) (b) GDPR.
Welcome question, "Your start" and first successes
During setup, the app asks without any preselection whether dancers from your area may say hello to you. Your answer ("Yes, gladly" or "Rather not") is voluntary; we store it in your profile, and others do not see it. At present we do not use it for any further function; before we introduce a way of greeting new members, we will supplement this policy. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time via hi@udansa.com.
The "Your start" card shows you which first steps you have already taken, such as setting up your profile, uploading a photo, saving an event or course, recognising a song or taking part in a poll, your first connection and your first conversation. It is based on data that is already available in the app; only you see it, and we do not compare it with anyone. The app marks your first connection, your first conversation and your first dance plan once with a short notice if they took place no more than 14 days ago, and places an entry in your inbox; there is no push notification or email for this. So that the notice appears only once, we store which of these moments you have seen and when, until you delete your account. The legal basis is Art. 6 (1) (b) GDPR.
Sharing links, link previews and invitation code
You can share events, courses, dance plans, results of the Song-Scan, groups, your invitation and, if you enable it, your profile outside the app via the share function of your device, for example via a messenger. Shared links lead to a function on our server at Supabase (see section 2). If a messenger or social network (for example WhatsApp, iMessage, Telegram, Facebook or Instagram) retrieves such a link in order to display a preview, it delivers a preview with a title, a short description and a preview image. Preview images never show a person; they are created at Cloudinary from the image of the event or course with date and place, or from our logo. For an enabled profile preview, or for a dance plan for which you have chosen to show your first name, the title may contain your first name. Messengers usually store such previews in their chats; we have no influence on this. A shared result of the Song-Scan shows the title, suitable dances and tempo, but no information about who performed the scan. People who open the link are forwarded to the corresponding public page.
We count how often shared links are opened without any reference to a person: per day, we only store the number of calls per type of content and type of sharing, separated by whether a person opened the link or a service retrieved a preview. We do not store an invitation code, an IP address or a device identifier in the process. When a link is called, our servers technically process your IP address and information about your browser in order to answer the request (see "Server log files" in section 4). The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in meaningful link previews and in measuring how often shared content is opened.
Links that you share outside the app contain your personal invitation code and the information that the link was shared and through which channel (utm_source, utm_medium). If someone opens such a link, the page opened keeps the code, the type and identifier of the page and whether it was an invitation link in the local storage of the device, so that a subsequent registration can be attributed to the link (see "Origin of your registration"); a code already stored there is not overwritten. Only the code of an invitation link is redeemed automatically after registration and can trigger benefits from our invitation programme. For all other shared links, for example to events, courses, dance plans, groups, profiles or songs, the code serves only to measure which shared content leads to registrations; it brings no benefit to you or to the new person. The legal basis is Art. 6 (1) (f) GDPR, and for the invitation programme Art. 6 (1) (b) GDPR; the code is stored on the device in accordance with § 25 (2) no. 2 TDDDG.
Links to the app stores and install referrer on Android
If you open our app in the browser of a mobile device, a banner points to the app at most once every seven days; your browser stores on your device when it last appeared. Links to Google Play, for example in the banner, in the notice about notifications in the browser or on the invitation page, contain in the parameter "referrer" the information that the link comes from us (utm_source, utm_medium) and, if an invitation code or the code of a shared link is stored on your device, this code with the type and, where applicable, the identifier of the page on which it was stored. Links to Apple's App Store do not contain any such information; there you enter an invitation code yourself during setup. In Safari, Apple's banner for our app receives the page opened and the code, so that the installed app opens the same page.
After installation, Google Play passes this parameter to the app via the Play Install Referrer interface. Our Android app reads it once when it is first started and treats it like a link that was opened: it pre-fills an invitation code in the invitation code field of the setup, the code of another shared link serves only for measurement, and campaign parameters and click identifiers are included in the information on the origin of your registration. The app does not store the text that was read; it only notes on your device when it read it and which code it adopted. It does not read an advertising ID or any other identifier of your device. The legal basis is Art. 6 (1) (f) GDPR, and for benefits from the invitation programme Art. 6 (1) (b) GDPR; our legitimate interest lies in attributing an installation to the link through which it came about. Reading the parameter and storing the information on your device serve this attribution (§ 25 (2) no. 2 TDDDG).
Invitation programme
The invitation function gives you a personal invitation code and an invitation link. Anyone who opens your link sees your first name and your profile picture on the invitation page. If someone registers via your link or enters your code during setup, we store an invitation with your code, the user ID of the invited person, the time and the channel (see "Origin of your registration"). Benefits are only granted for invitations via this dedicated invitation path.
For each invitation we record two milestones. E1: the invited person's profile is ready (setup completed, real photo, dance style and place); the invited person then receives 30 days of Premium. E2: after that, the invited person has their first connection, or a conversation in which both write, with a third person who has been on udansa for at least 30 days; you then receive 7 days of Premium, credited 7 days after E2. If the invited person deletes their account or is suspended during this waiting period, your days lapse. Days are granted for at most three invited people in 30 days and ten in 365 days; beyond that we record E2 without days. If you have a paid subscription running, we keep the days as credit until it ends. If the invited person takes out a subscription, you additionally receive Premium days as before. Whether a milestone has been reached is checked hourly by an automated procedure on the basis of profile, photo, connections and whether both people have written in a conversation, never on the basis of content. For each milestone we store whom it rewards, the channel of the invitation, when it was reached, the type and number of days, the waiting period, whether the days were credited or lapsed, and when we sent a notification about it. We look into more than five new invitations with one code on a single day to prevent misuse.
In the app you only see your invitations as anonymous steps (registered, profile ready, first connection) and the status of your days, without a name, identifier or date. If an invited person has deleted their account, it says that the person is no longer on udansa; if days lapse for another reason, we do not state the reason. When a person you invited reaches a milestone, you receive a notification and an entry in your inbox, both without a name; we inform the person who receives days with a notification. We only send these notifications between 10 a.m. and 8 p.m. local time. The invited person sees the status of their own gift. After your first connection, the app places a one-time notice about inviting others in your inbox; if you hide the invitation card, the app remembers this on your device and does not show it for 30 days.
The legal basis is Art. 6 (1) (b) GDPR (participation in the invitation programme under its terms), and for the check for misuse Art. 6 (1) (f) GDPR. We store an invitation and your milestone E2 until you as the inviting person delete your account, and the invited person's milestone E1 until that person deletes their account; the invited person keeps their gift even if you delete your account.
Public profile preview
If you expressly enable it, your profile receives a public preview that you can share, for example together with a dance partner request. This function is switched off by default. The preview only shows your first name (or your username if you have hidden your name), one photo, your dance styles, your dance level, your city and whether you are looking for a dance partner, never your last name, your description text or your age. Anyone with the link can view it without an account, but it is blocked for search engines (noindex). The preview is located under a randomly generated identifier, not under your user ID; we store this identifier and the time it was enabled in your profile. Private, suspended and deleted profiles do not receive a preview.
You can switch the preview off again at any time in the app. The identifier is then deleted, previous links no longer show the preview, and enabling it again creates a new identifier. Previews that messengers have already stored in chats remain visible there. The legal basis is your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by switching the preview off.
Group links from members
Where the group allows it, members can create and share invitation links to their group, also as a QR code or for printing. For each link we store the group, a hash value of the randomly generated link (not the link itself), who created it, the way it left the app (sharing, copying, QR code or printout), how often it was used, its expiry and, where applicable, its revocation. A link is valid for 30 days and opens the group at most 50 times; each member can create at most 20 links per hour. Anyone who opens the link sees, before joining, the name under which the person who created it appears publicly in the app and, from three members, the number of members. If someone joins the group as a new member via your link, you receive a notification with their public name, at most three per hour. If someone registers via a group link, we note the group link with the group as the origin (see "Origin of your registration").
A link only opens the group as long as the person who created it is a member; if that person leaves the group or is removed, we revoke their links. For this purpose we note in the membership history whether a membership ended by leaving or by removal; a person who was removed cannot return via another member's link, only via a link from the people who manage the group or from the organiser, or if they are added again. Those who manage a group see the members' links that still open the group, with the public name of the person who created them, the way, the time of creation, the expiry and the uses, and can revoke them. We store the information on a link as long as the group exists; we remove the note of who created it together with that person's account. The legal basis is Art. 6 (1) (b) GDPR, and for the limits to prevent misuse Art. 6 (1) (f) GDPR.
Dance plans ("I'm going dancing")
With a dance plan you let others in the app know that you are going dancing on a particular day, today or up to 13 days in advance. We store the day and time, the place (an event or course from our list, or a freely entered place name with city), coordinates of the place rounded to about one kilometre, the dance style, your choice of visibility and the time of creation.
You choose who learns about it, without any preselection. With "My connections", your confirmed connections see your dance plan with your name and your photo. With "Only as a number", you never appear with your name in the app. In both cases, other users within a radius of 25 kilometres are only shown the number of people going dancing on that day, and only once there are at least three. People you have blocked or who have blocked you do not see your dance plans. We store your choice as the default for further dance plans; you can change it for each dance plan.
A dance plan ends at 4 a.m. local time after the evening in question and is deleted automatically two days later; you can delete it earlier at any time. We store your default visibility setting until you delete your account. The legal basis is Art. 6 (1) (b) GDPR.
Organisers whom we have approved can enter recurring public dance evenings (series). We show series to users in the area with title, place, time and dance style, but without any information about a person. Internally, we store which account created the series. Series can be reported; we review reports and hide series in the event of violations (see "Reporting and blocking" in section 9). A series is deleted two days after its last date. The legal basis is Art. 6 (1) (b) GDPR, and for handling reports Art. 6 (1) (f) GDPR.
"Who's coming along?" and joining without an account
You can share your dance plan as a link so that others can come along. The public page of the dance plan shows the event or place, date, time and dance style. It only shows your first name if you expressly choose this for the dance plan in question and have not hidden your name in the app; it never shows a photo, your last name or an identifier. The page is blocked for search engines (noindex) and no longer shows any person after the date. On event and course pages, we show how many people from udansa are going only once there are at least three, and without names; only your connections see names, and only if you have chosen "My connections".
People without an account can say "I'm coming along" on the page. For this we only ask for a first name, no email address and no other information. The first name is stored with the dance plan and shown to the person who shared the dance plan, including as a notification (for example "Mara is coming along"); that person can remove guests again. We do not send any advertising to guests. To prevent misuse, we accept at most 20 guests per dance plan and at most ten replies per hour, each first name only once, and automatically check the first name according to fixed rules, without passing it on to third parties: at most 30 characters, only letters, spaces, hyphens and apostrophes, and no word from a list of offensive or misleading terms. We do not store a first name that was rejected. We delete the first name automatically 48 hours after the end of the dance plan (4 a.m. local time after the evening), or earlier together with the dance plan. The legal basis for processing the data of guests is Art. 6 (1) (b) GDPR, as we pass on the reply to the inviting person at the guest's request; the misuse check is based on Art. 6 (1) (f) GDPR.
If you join with an account or register via such a link, we create a dance plan of your own and note on it who invited you. The inviting person sees your reply with the name under which you appear publicly in the app and receives at most one notification about it per dance plan. So that it is not repeated, we store that and when your reply to this dance plan was reported; we delete this note together with your account or with the inviting person's dance plan. We remove the note of who invited you if the inviting person deletes their account.
Order of suggestions and expiry of requests
So that contact requests reach people who actually reply, when ordering search results and suggestions we take into account, in addition to the criteria mentioned under "Suggestions for dance partners (profiling)" in section 9, whether a person has been active in the last 14 days and their responsiveness. We calculate responsiveness daily from the contact requests a person has received in the past 90 days (excluding the last seven days) and the share of those that were accepted, declined or ended by blocking; with few requests, the value is evened out towards the middle. People who have hidden their activity status are ranked in such a way that the order does not reveal their status. Responsiveness is never shown to anyone and is never rewarded; it only affects the order, never whether a profile can be found.
Before you send a request to a person who has not been in the app for more than 30 days, the app points out that the person has not been around for a while, without stating a date. If the person has hidden their activity status or if there is a block, no notice is shown.
Open contact requests expire after 30 days. We note the time of expiry; the requesting person then sees the request as expired and can send a new request. Until it expires, we remind the person who received the request of the open request up to three times, within the limits of their notification settings.
The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in requests being answered and suggestions pointing to people who can be reached. Calculating responsiveness and taking it into account in the order constitute profiling; this does not involve an automated decision within the meaning of Art. 22 GDPR. You can object to this processing under Art. 21 GDPR. Responsiveness is recalculated daily, is dropped if you have not received any requests in the period mentioned, and is deleted at the latest together with your account.
Voluntary question when deleting your account
When you delete your account, the app asks voluntarily what was missing. You can choose one of the predefined answers ("Nobody near me", "Not my dance style", "Too many messages", "Just wanted to look around" or "Something else") or skip the question; the question has no free text field. The deletion does not depend on your answer. We store your answer as a short code in the record of the deletion of your account (see "Deletion of your account" in section 9), together with a reason in your own words if you give one voluntarily in the deletion dialogue as before. The record also contains your user ID, the time of the deletion, the age of your account in days, whether you had Premium, the number of your messages and connections, and technical information on whether all deletion steps succeeded. We evaluate answers and reasons only in aggregated form in order to improve our service. The legal basis for your answer and your reason is your consent, which you give by providing them voluntarily (Art. 6 (1) (a) GDPR), and for the other information in the record Art. 6 (1) (f) GDPR; our legitimate interest lies in being able to prove that the deletion was carried out and to evaluate reasons for leaving in aggregated form.
Deletion of the data mentioned in this section together with your account
When you delete your account, the data described in this section is deleted in addition to the data mentioned under "Deletion of your account" in section 9, even if the respective storage period has not yet expired: your visit days and monthly figures, your time zone information, the origin of your registration, your usage events, the log of notification planning and the information on prompts sent to you, your inbox, the information on your email consent including the version of the consent text and on emails sent, your settings for notification topics and your unsubscriptions from individual email topics, your answers to the dance question, your answer to the welcome question, the notes on first successes marked, your invitation code, your invitations and the milestones of the invitation programme that reward you, the activation and identifier of your profile preview, your dance plans including replies from guests, the notes on reported replies and your default visibility setting, and your responsiveness. In dance plans of other people, we remove the note that you invited them; in group links you created, the note that they come from you, and these links no longer open the group; in the invitation via which you registered, the page you opened. This invitation remains with the inviting person with your internal user ID and the channel. Entries in other people's inboxes that refer to you only contain an internal identifier and are no longer displayed after the deletion. Apart from that, only figures without any reference to a person, such as the daily count of link calls, and the record of the deletion are retained.
