PRIVACY POLICY

1. Data Controller

The data controller within the meaning of the General Data Protection Regulation (GDPR) and other applicable data protection laws is:

MI Ventrix UG (Haftungsbeschränkt)
Lange Straße 35
73033 Göppingen
Germany
Email: contact@vortexfestival.de
Website: vortexfestival.com

2. General Information on Data Processing

We process personal data of our users only to the extent necessary to provide a functioning website and our content and services. Personal data is generally processed only with the user's consent, except where prior consent is not possible for practical reasons and processing is permitted by law.

3. Legal Bases for Processing

Where we obtain consent for processing personal data, Art. 6(1)(a) GDPR serves as the legal basis. For processing necessary for the performance of a contract, Art. 6(1)(b) GDPR applies. For compliance with legal obligations, Art. 6(1)(c) GDPR applies. Where processing is based on our legitimate interests, Art. 6(1)(f) GDPR serves as the legal basis.

4. Data Retention and Deletion

Personal data is deleted or blocked as soon as the purpose for storing it no longer applies. Storage may continue beyond this point where required by European or national legislation. Data is also blocked or deleted when a statutory retention period expires. The following retention periods apply:

Ticketing and booking data (event-related data): 10 years pursuant to § 147 AO (German Fiscal Code, statutory retention obligation)
Newsletter data: until withdrawal of consent; deleted promptly thereafter
Contact enquiries: 3 years after conclusion of communication (statute of limitations)
Server log files: 7 days (automatically deleted by hosting provider)
Cashless payment data (Orderbird): 10 years pursuant to § 147 AO

5. Hosting

Our website is hosted by:

Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany

When you visit our website, Strato automatically collects information in server log files transmitted by your browser. This includes: IP address, date and time of access, URL requested, data volume transferred, browser type and version, and operating system. This data is automatically deleted after 7 days. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). Further information: https://www.strato.de/datenschutz/

6. Ticketing – ticket.io

We use ticket.io (Ticket i/O GmbH) for ticket sales. When purchasing a ticket, the following data is transmitted to and processed by ticket.io: name, email address, payment data, and the selected ticket category.

ticket.io uses Amazon CloudFront (Amazon Web Services EMEA SARL) as a content delivery network to improve security and delivery speed. Your IP address may be transmitted to AWS servers. AWS has implemented enhanced compliance measures for international data transfers based on EU Standard Contractual Clauses (SCCs).

We have concluded a data processing agreement with ticket.io in accordance with Art. 28 GDPR. The legal basis for processing is Art. 6(1)(b) GDPR (performance of a contract). Ticketing data is retained for 10 years in accordance with statutory retention obligations under tax law.

7. On-Site Cashless Payment – Orderbird

At our events, we use Orderbird (orderbird GmbH, Charlottenstraße 4, 10969 Berlin, Germany) for cashless on-site payments. For card and mobile payments, the data required for the transaction is processed (transaction amount, payment method, timestamp). Personal payment data such as card numbers is processed exclusively by the respective payment service provider and is not stored by us.

Processing is based on Art. 6(1)(b) GDPR (performance of a contract). Transaction data is retained for 10 years in accordance with statutory tax retention obligations. Further information: https://www.orderbird.com/de/datenschutzerklaerung

8. Merchandise Sales – PayPal

For merchandise sales, we offer PayPal as a payment option. The operator is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. When you select PayPal, the data required for payment processing is transmitted to PayPal (name, address, email address, IP address, and other transaction-related data).

Processing is based on Art. 6(1)(b) GDPR. Further information on PayPal's data protection practices: https://www.paypal.com/de/webapps/mpp/ua/privacy-full

9. Newsletter – Brevo

We send newsletters via Brevo (Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany). When you subscribe to our newsletter, your email address and – if provided – your name will be transmitted to and stored by Brevo.

The newsletter is sent exclusively on the basis of your consent pursuant to Art. 6(1)(a) GDPR. Subscription uses a double opt-in process: after signing up, you will receive a confirmation email. Your address is only added to our mailing list after you confirm the link contained in that email.

You may withdraw your consent and unsubscribe at any time – via the unsubscribe link in any newsletter email or by emailing contact@vortexfestival.com. Your data will be deleted promptly upon withdrawal.

Our newsletter emails may contain a tracking pixel that transmits anonymised information to us about whether the email was opened or links were clicked. This applies to both newsletter subscribers and existing customers contacted on the basis of § 7(3) UWG (German Act Against Unfair Competition – existing customer privilege). You may object to this tracking at any time by emailing contact@vortexfestival.com. The legal basis for tracking is Art. 6(1)(f) GDPR (legitimate interest in evaluating and optimising our communications).

If you have previously purchased a ticket for one of our events, we may contact you by email regarding similar upcoming events on the basis of § 7(3) UWG without requiring separate consent. You were informed of this at the time of purchase via the data protection notice in our ticket shop. You may object to receiving such emails at any time via the unsubscribe link in any email or by contacting contact@vortexfestival.com.

We have concluded a data processing agreement with Brevo in accordance with Art. 28 GDPR. Further information: https://www.brevo.com/de/legal/privacypolicy/

10. Instagram

Our website contains links to our Instagram profile. The operator is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland. When you click on the link and access Instagram, data is transmitted to Instagram. We have no influence over the type or scope of data collected by Instagram. Further information: https://help.instagram.com/155833707900388

11. Cookies

Our website uses cookies – small text files stored on your device. Technically necessary cookies are used on the basis of Art. 6(1)(f) GDPR. For non-essential cookies, we obtain your consent (Art. 6(1)(a) GDPR).

You can prevent cookies from being stored via your browser settings. Please note that doing so may mean that not all features of our website are fully available.

12. Contact

If you contact us by email or via a contact form, the data you provide (name, email address, message content) will be stored for the purpose of processing your enquiry. Your data will not be passed on to third parties without your consent. The legal basis is Art. 6(1)(f) GDPR. Data will be deleted once it is no longer needed for the purpose for which it was collected, at the latest after 3 years.

13. Photo and Video Recordings at Events

Photo, film, and audio recordings are made at our events. These serve to document, report on, and promote the event as well as future comparable events, and may be published on our website and social media channels (in particular Instagram, TikTok, YouTube).

Recordings generally consist of overview, stage, atmosphere, and audience shots in which individual attendees are not deliberately featured as the primary subject. Processing is based on Art. 6(1)(f) GDPR (legitimate interest in documenting and promoting the event) as well as §§ 22, 23 of the German Art Copyright Act (KUG).

You may object to the use of recordings in which you are recognisably depicted at any time – in person to our staff on site, or subsequently by email to contact@vortexfestival.com.

14. Your Rights

With regard to your personal data, you have the following rights:

Right of access (Art. 15 GDPR)
Right to rectification (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object (Art. 21 GDPR)
Right to withdraw consent (Art. 7(3) GDPR)

To exercise your rights, please contact us at: contact@vortexfestival.com

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Baden-Württemberg is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-WürttembergLautenschlagerstraße 20, 70173 Stuttgart, Germany https://www.baden-wuerttemberg.datenschutz.de

15. Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

16. Changes to This Privacy Policy

We reserve the right to update this Privacy Policy at any time to reflect changes in legal requirements or our services. The current version is always available at vortexfestival.com/privacy-1.

Last updated: May 2026 · MI Ventrix UG (Haftungsbeschränkt) · vortexfestival.com