Privacy Policy

Köllektiv Dr. Robert Cyrus Araschmid Salierring 35 50677 Cologne, Germany info@koellektiv.com

When you apply for a place we collect: first and last name, email address, mobile number, the sleeping place you chose, which meals you eat with us, whether you need gluten-free food, whether you want to lend a hand on site and with what, and your room wishes and notes. We also store the language you chose and the moment you agreed to this policy.

If you put yourself on the waiting list we collect the same contact details, plus the room categories you are interested in, and your note.

Once you confirm your email address we create an account and additionally store a password you choose (encrypted).

For payment we store the amount, the deadline, the payment status and your report that you have transferred the money. The transfer itself goes through our bank; the bank statement shows the name and IBAN of the sender.

Internally we log who changed which booking and when, and which email went to which address — the first so that changes stay traceable, the second so that the same reminder does not reach you twice.

When you visit the site, our host processes technically necessary access data (IP address, time, page requested).

We process the booking form data to handle your booking, to give you your account and to send you the emails that go with it — confirmations, payment reminders, the shift plan. The legal basis is Art. 6(1)(b) GDPR (contract). The same applies to the waiting list, as a pre-contractual measure.

Whether you need gluten-free food is processed only with your consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR). You can answer no; we will then assume you do not need gluten-free food.

Whether and how you lend a hand is voluntary and has no effect on price or place. The basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw in the portal at any time.

The logs and the access data are processed on the basis of our legitimate interest in running the site securely and traceably (Art. 6(1)(f) GDPR).

If you book meals, our caterer Schmauserei gets their own access to our portal. There they see your name, your email address, which meals you booked, whether you need gluten-free food and whether it is paid. They can add a note of their own to your row, for instance an arrangement about the food.

They do not see bookings without a food package, and they do not see the rest of your booking either — sleeping place, phone number, room wishes.

On site in France, the kitchen and the crew work from lists built out of this data.

Whoever offers to help is given shifts by the crew. Once the plan is published, every guest who took on a task can see it — including the names of the people on the same shift. Guests who do not help do not see the plan.

If you withdraw your offer in the portal, the shifts planned for you disappear with it.

If you pass your place to a particular person, you enter their name and email address and can add a personal message. We send that person an invitation that carries your name and points to this policy. The legal basis is the legitimate interest, yours and theirs, in the place not going to waste (Art. 6(1)(f) GDPR). If they do not accept, we delete the invitation together with their data once it expires.

If you hand the place to the waiting list instead, an email goes to everyone on the list who wants to receive offers. Your name is not in it.

If the place is already paid for, the money moves directly between you and the person taking over — we refund nothing and never see the payment. For that you enter an account holder and IBAN; only the person who claimed the place sees them, and only until the handover is complete. In return you learn that person’s name and email address, so that you can match the incoming payment.

The link in these emails carries a secret: whoever holds it can take the place over. Do not pass it on. Once the deadline has passed, the link is worthless.

After the handover the booking carries the new guest’s details. Your name, your email address and the bank details you entered stay stored with the handover until we delete them along with the booking data.

Supabase (database and accounts, servers in Frankfurt), Vercel (running the website), Resend (sending email) and GitHub (encrypted backups in a private repository) process the data on our behalf under data processing agreements. Where data reaches the USA, we rely on the EU standard contractual clauses or on the adequacy decision for certified companies.

Schmauserei receives the details listed in the food package section above.

Other guests see your name in the shift plan if you help out, and, in a handover, the details described in the section above.

We do not sell data and only pass it on further where we are legally required to.

The home page embeds SoundCloud players so you can listen to the sets of past years. They only load once you scroll down to the music section — until then no request goes to SoundCloud.

When they do load, your browser fetches them straight from SoundCloud. SoundCloud thereby learns your IP address and technical details about your browser, and can set cookies; if you have an account there, the request can be linked to it. What SoundCloud does with that is beyond our control.

The provider is SoundCloud Global Limited & More Ltd, Rheinsberger Straße 76/77, 10115 Berlin, Germany. We embed the players because the music is part of the festival (Art. 6(1)(f) GDPR). Every other page — booking, waiting list, portal — works without SoundCloud.

We ourselves only use technically necessary cookies: one remembers your language choice, others keep you signed in after login. We do not use tracking or advertising cookies.

The SoundCloud player on the home page may set cookies of its own — see the section above.

Booking data is deleted six months after the festival ends, unless tax retention rules require otherwise. That includes the shift plan, change requests and completed handovers.

Waiting list entries are deleted with the booking data at the latest, and earlier at any time on request. Handover invitations nobody accepted are deleted once they expire. Accounts are deleted on request at any time.

We take an encrypted backup of the database every day and store it in a private repository on GitHub. Backups are deleted after 90 days — until then, something already deleted on our side may still be contained in one.

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw any consent — for the gluten-free answer or for helping out, say — at any time with effect for the future; both can be changed directly in the portal.

Write to info@koellektiv.com. You may also complain to a data protection authority; ours is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.