1. Data Controller

The data controller responsible for the processing of your personal data is:

DanceClub
Aachen, Germany
Email: [email protected]

DanceClub operates the websites danceclub.app and hub.danceclub.app. DanceClub is a platform for social dancers to discover events, connect with other dancers, and for organizers to manage and promote dance events.

Given the size and nature of our operations, we are not required to appoint a Data Protection Officer (DPO) under Article 37 of the GDPR. For all data protection inquiries, please contact us at the email address above.

2. Information We Collect

Information you provide:

• Google account data: When you sign in with Google, we receive your name, email address, profile photo, locale, and Google account identifier
• Profile information: Username, display name, and profile image you upload
• Organizer verification data: First name, last name, and date of birth. This data is collected solely for the purpose of verifying organizer identity and preventing fraud. It is never displayed publicly on the platform and is not used for any other purpose
• Dance preferences: Dance styles you practice and your proficiency level for each style
• Language preferences: Languages you speak and your proficiency level
• Residency information: Current city and hometown if you choose to provide them
• Event interactions: Events you save, mark as "Going," or attend
• Social interactions: Users you follow, dance partner connections, trust ratings you give, and users you block
• Messages: Content you post in event message sections
• Event recommendations and contact form submissions

Information collected automatically:

• Precise location data: With your explicit permission (browser geolocation prompt), we collect your GPS coordinates (latitude and longitude) to show events near you, suggest nearby dancers, and enable distance-based filtering. You can revoke location permission at any time through your browser settings. The platform functions without location data, but some features (such as "Near Me") will not be available
• Timezone and locale: Your timezone and language preferences from your browser or Google account
• Connection status: Whether you are currently online, via WebSocket connections, to deliver real-time notifications. This status is held in memory only and is not persisted to any database
• Audit data: Timestamps of when records are created or modified, and the identifier of the user who performed the action

Information we do NOT collect:

• We do not collect IP addresses for tracking purposes
• We do not collect device fingerprints or user agent strings
• We do not use any third-party analytics, advertising, or tracking services

3. How We Use Your Information

• To provide and operate the DanceClub platform
• To authenticate you via Google OAuth and manage your session
• To display your public profile to other users according to your privacy settings
• To show relevant events based on your location, dance style preferences, and filters
• To process event attendance, follows, dance partner connections, and other social interactions
• To send notifications in real-time (team invitations, follow requests, event ownership transfers) and via email (event claim codes, team invitations)
• To verify organizer identity for event management access
• To enable distance-based event filtering and the "Near Me" feature
• To suggest nearby dancers in search results
• To improve the platform and fix issues

4. Publicly Available Event Information

To provide a comprehensive event directory for dancers, DanceClub may create event listings using publicly available information - such as event details posted on social media, public event pages, or ticketing platforms. This may include event names, dates, locations, descriptions, poster images, and organizer names that are already publicly visible.

The legal basis for this processing is our legitimate interest (GDPR Article 6(1)(f)) in providing dancers with a complete and reliable event discovery platform. We have assessed that this interest does not override the rights of event organizers, as the information is already publicly available and the listing provides additional exposure at no cost to the organizer.

If you are an event organizer and your event appears on DanceClub without your involvement, you can: (a) claim and manage the listing through Hub.DanceClub.app using the claim code provided to you; (b) request modifications to the listing; or (c) request complete removal of the listing by contacting us at [email protected]. We will process removal requests promptly.

5. Automated Decision-Making

DanceClub does not use automated decision-making or profiling that produces legal effects or similarly significant effects on you, as defined under Article 22 of the GDPR. Event review decisions (publish, reject, etc.) are made by human administrators.

6. Information Sharing

We do not sell, rent, or trade your personal data. We share information only in these cases:

• Public profile: Your display name, username, profile photo, dance styles, and upcoming events are visible to other users based on your privacy settings (public or private). Private profiles are visible only to approved followers
• Event attendance: If you mark "Going" on an event, this is visible according to your profile privacy settings
• Event teams: If you accept a team invitation for an event, your username and role may be displayed on the event page if you are set as an active team member
• Trust ratings: If you rate an organizer, your rating and optional comment may be associated with your account
• Service providers: We use third-party services that process data on our behalf under data processing agreements (see Section 10)
• Legal requirements: If required by law, court order, or governmental request, or to protect the rights, safety, or property of DanceClub, our users, or the public

7. Your Privacy Controls

• Account privacy: You can set your profile to public or private at any time. Private profiles restrict visibility of your information to approved followers only
• Granular privacy: You can control who sees your contact information and about-me section (everyone, followers only, etc.)
• Profile editing: You can update your name, username, and profile image at any time
• Location: You can revoke location permission through your browser settings at any time
• Blocking: You can block other users to prevent them from interacting with you
• Data deletion: You can request deletion of your account and associated data by contacting us at [email protected]. See Section 11 for details on how deletion is processed

8. Data Security

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS/TLS), secure authentication via Google OAuth with JWT tokens, HttpOnly and Secure cookie flags with SameSite protection, role-based access controls, hashed credentials, and isolated database schemas per service. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.

9. Cookies

DanceClub uses the following strictly necessary cookies, all set with HttpOnly, Secure, and SameSite flags:

• accessToken: Authentication token for your current session
• refreshToken: Used to maintain your session across visits
• viewerId: Your user identifier for the current session

These cookies are essential for the platform to function and are exempt from consent requirements under the ePrivacy Directive (Article 5(3)) as they are strictly necessary for providing the service you have requested. We do not use any third-party advertising, analytics, or tracking cookies. You can clear cookies through your browser settings, which will log you out.

10. Third-Party Services and International Data Transfers

We use the following third-party services that may process your data:

• Google (OAuth and Maps): For authentication and event location display. Google LLC is based in the United States. Data transfers are covered by the EU-U.S. Data Privacy Framework
• Cloudflare (R2 storage): For storing uploaded files (profile images, event posters). Cloudflare, Inc. is based in the United States. Data transfers are covered by Standard Contractual Clauses (SCCs)
• Resend: For sending transactional emails (team invitations, event claim codes, notifications). Resend, Inc. is based in the United States. Data transfers are covered by Standard Contractual Clauses (SCCs)
• Hetzner: For web application hosting. Hetzner Online GmbH is based in Germany (EU). Data is stored and processed within the European Union

These service providers process data on our behalf and are contractually obligated to protect your data in accordance with applicable data protection laws. We do not use any third-party analytics or advertising services.

11. Data Retention and Deletion

We retain your data for as long as your account is active and as needed to provide you with our services.

When you request account deletion:

• Your account is deactivated and your data is flagged as deleted in our systems (soft deletion)
• Your profile is no longer visible to other users and you can no longer log in
• Uploaded files (profile images) are permanently removed from storage
• Soft-deleted data is retained for up to 30 days to allow for account recovery and to comply with legal obligations, after which it is permanently purged

We may retain certain data beyond this period where required by law (e.g., financial records, fraud prevention) or where we have a legitimate interest that overrides your rights.

12. Children

DanceClub is not intended for children under 16. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16, we will take steps to delete that data promptly. If you believe a child has provided us with personal data, please contact us immediately at [email protected].

13. Your Rights Under the GDPR

If you are located in the European Economic Area, you have the following rights under the General Data Protection Regulation:

• Right of access (Art. 15): Request a copy of the personal data we hold about you
• Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
• Right to erasure (Art. 17): Request deletion of your personal data
• Right to restriction (Art. 18): Request that we restrict the processing of your data
• Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format
• Right to object (Art. 21): Object to processing based on legitimate interests
• Right to withdraw consent (Art. 7): Withdraw consent at any time where processing is based on consent (e.g., location data). Withdrawal does not affect the lawfulness of processing performed before withdrawal
• Right to lodge a complaint: You may lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement. The competent authority for our operations is the Landesbeauftragte fur Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days of receiving your request. If we need additional time (up to 60 additional days), we will inform you of the reason for the extension.

14. Legal Basis for Processing

We process your personal data based on the following legal grounds under Article 6(1) of the GDPR:

• Performance of a contract (Art. 6(1)(b)): Processing necessary to provide the DanceClub service you have requested - including account creation, profile management, event discovery, social features, and notifications
• Consent (Art. 6(1)(a)): Precise location data collection (via browser geolocation prompt) and optional profile information such as residency, dance preferences, and language preferences
• Legitimate interest (Art. 6(1)(f)): Platform security, fraud prevention, service improvement, and event content moderation. Our legitimate interests do not override your fundamental rights and freedoms
• Legal obligation (Art. 6(1)(c)): Where we are required to retain data by applicable law

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the platform or via email before the changes take effect. The "Last updated" date at the top of this policy indicates when it was last revised. Continued use of DanceClub after the effective date of any changes constitutes your acceptance of the updated policy. If you do not agree with the revised policy, you should stop using the platform and request deletion of your data.

16. Contact

For questions about this Privacy Policy, to exercise your data rights, or to report a data protection concern, contact us at [email protected].