Privacy Policy

Thank you for your interest in DJPlayThat. Protecting your personal data is important to us. Below we explain what data we collect, what we use it for and what rights you have.

1. Controller

The controller responsible for data processing on this website is:

We have not appointed a data protection officer because the statutory requirements for doing so are not met. If you have questions about data protection, please use the contact details above.

2. Roles at events

DJPlayThat is a tool for event organizers and DJs. Whoever uses the request feature at an event decides whether and for what purpose the guests' data is processed. The controller under data protection law is therefore whoever actually determines the purpose and use at the event concerned – as a rule the organizer who created the event with us. If the organizer in turn acts on behalf of someone else (for example a DJ for the host of a party), that person may also be a controller. In that respect we act as a processor under Art. 28 GDPR and only on our customer's instructions. Details are set out in our Data Processing Agreement.

For everything beyond that – operating the website, user accounts, billing and security – we ourselves are the controller within the meaning of the GDPR. If you are a guest and would like information about your data, please contact the organizer of your event first; we will of course support them and are also happy to help you directly.

3. Visiting our website

Hosting

We run the application and the database on our own server in Germany; no external hosting provider is involved. We make regular backups of the database. They are encrypted on our server before being uploaded and then stored on Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The key remains with us – Google cannot read the contents of the backups. It cannot be ruled out that Google also stores the encrypted files on servers outside the European Union. We delete backups after 30 days at the latest, and permanently – not merely to the trash. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in protection against data loss.

Server log files

Each time our pages are accessed, the web server automatically records technical data transmitted by your browser:

• IP address of the requesting device
• date and time of access
• address requested (URL) and amount of data transferred
• whether the request was successful (HTTP status code)
• browser type, browser version and operating system
• previously visited page (referrer), if transmitted

We need this data for technical reasons to deliver the website, to ensure its stability and security and to be able to trace attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and trouble-free operation. This data is not combined with other data sources or evaluated for advertising purposes.

Error and warning messages

If an error or an unusual event occurs in the application, we store the associated technical message so that we can identify and fix the problem. In individual cases these messages may contain your email address, an internal account identifier or a transaction number, but no IP address. They are accessible only to the operator, may be sent to the operator by email and are deleted automatically once they have not recurred for 90 days. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in secure and trouble-free operation.

Protection against misuse (rate limiting)

To prevent spam and automated mass requests, we briefly count in memory how many requests and votes arrive from an IP address. These counters are discarded automatically after a few minutes and are not stored permanently. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in preventing misuse).

Reach measurement with anonymous results

We would like to know how often our pages are viewed. For this we use no external service and no cookie; we count ourselves. For the counting we briefly process your IP address and browser identifier, which are personal data; only totals that do not relate to any person are stored permanently:

• The only thing stored is how often a type of page was viewed on a given day – for example “guest view, May 12, 143 views”. Neither the event viewed nor the time nor the IP address is recorded.
• To tell visitors' page views apart, we compute a checksum from the IP address and the browser identifier. The key used for this is random, exists only in memory and is regenerated every day. Recognition for these statistics is thus limited to one day: with the next day's key, the same visitor produces a different checksum. It serves only to avoid counting a visitor twice on the same day, is held in memory only, is not written to the database and is discarded at the end of the day at the latest. The IP address and browser identifier themselves are not retained for the counting.
• We also count which site visitors come to us from. Only the name of the referring server is recorded (such as “google” or “instagram”, or the domain name for other sites), never the full address you came from. If the link you clicked contains a campaign identifier (utm_source), we count that instead – shortened to at most 40 characters and restricted to letters, digits and a few punctuation marks. Such identifiers are set by whoever distributes the link; they are meant to name a channel, not a person.
• From the browser identifier we also derive a rough device type – phone, tablet or computer. Only the number of page views in each of the three groups is stored; the browser identifier itself is not.
• Finally, we count how often certain steps occurred: account created, email confirmed, payment started. We additionally count accounts created by the source with which the registration page itself was opened (as described above). The source is not carried along from page to page and is not stored with the account. These, too, are purely daily totals – in particular, we do not track whether the same person went through several of these steps.
• No usage profile is created, nothing is linked to your account or your song requests, and nothing is passed on to third parties.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in being able to assess how our service is used and how to develop it. For the counting we store nothing on your device and read nothing from it; we use only the details your browser sends to our server with every page request anyway (IP address, browser identifier, referrer). In our assessment, this does not require consent under section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Encryption

Our website is delivered exclusively in encrypted form over HTTPS (TLS). To keep the request lists up to date, your browser keeps a connection to our server open, which is likewise encrypted (WebSocket). Only the content of the page concerned is transmitted over it.

No external content

We deliver all components of our pages – fonts, icons, scripts and design libraries – exclusively from our own server. We do not use a content delivery network or external fonts (such as Google Fonts). Simply visiting our pages therefore does not transmit your IP address to any third party.

There is one exception: when you enter a song request as a guest, your device queries Apple directly for the search suggestions. Details can be found under Song search via Apple.

4. Cookies and storage on your device

We do not use cookies for advertising, tracking or analytics. We use neither Google Analytics nor comparable services and do not integrate any advertising networks; our own reach measurement works without a cookie. Only what is technically necessary for operation is stored:

The cookies are required for sign-in and forms to work. We need the device identifier for as long as an event is running and its requests have not yet been anonymized: without it, we could neither prevent multiple votes nor mark your own requests. The remembered display name is part of the request feature you use by entering your name; it saves you from entering it again for every request. We therefore consider this storage strictly necessary within the meaning of section 25(2) no. 2 TDDDG and have limited its duration. The legal basis for the associated processing is Art. 6(1)(b) and (f) GDPR. You can delete the stored information earlier at any time in your browser settings.

5. Song requests and votes (guests)

If you take part in an event as a guest, you do not need a user account. The following is processed:

• the display name you freely choose,
• your song requests (artist, title, and genre and comment if given),
• your votes for other guests' requests,
• the device identifier described above and timestamps.

You can choose the display name freely – you do not have to give your real name. Other guests do not see your name: the guest view shows only the title, the artist and the number of votes. The name is visible only to the organizer and their team so that they can ask questions about a request. Please do not enter any sensitive information in requests and comments all the same.

The purpose of the processing is to provide the request feature at the event concerned. The legal basis is Art. 6(1)(f) GDPR: the organizer has a legitimate interest in letting guests make song requests and vote, in preventing multiple votes and in knowing who a request came from if there are questions. If there is a contract between you and the organizer on taking part in the event that includes the request feature, Art. 6(1)(b) GDPR may apply instead; which basis applies in the individual case is determined by the organizer as controller.

Using the request feature is voluntary. If you use it, the display name, artist and title are mandatory – a request cannot be sent without them; the device identifier is generated automatically. Genre and comment are optional and can be left empty. No later than 90 days after the event, this data is anonymized automatically (see Storage period).

Song search via Apple

So that you do not have to type out a title, the input field suggests matching songs. These suggestions come from Apple's public search (iTunes Search API). Your own device sends the query directly to Apple – the search terms do not pass through our server, and we do not learn what you search for.

Your IP address, the search term entered and your browser's technical details are transmitted to Apple. The query is triggered automatically as soon as you type something into the search field; you can avoid it by not using the request feature. The provider is Apple; for users in Europe, Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland is responsible. According to Apple, data is also transferred to Apple Inc. in the USA; Apple bases such transfers from the European Economic Area on the EU Commission's standard contractual clauses. Details are given in Apple's privacy policy.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest and that of the organizer lies in requests arriving with an unambiguous artist and title: only then can the DJ find the track requested and be shown its tempo and key. On the other side, Apple receives only the search term, your IP address and your browser's technical details – neither your display name nor the event nor the request you finally send – and the query is made only in response to your own input.

Song currently playing

If the DJ switches the feature on, a helper program on their laptop transmits the track currently playing to us so that it can be shown to the guests. Only the artist and title of the track are transmitted – no personal data of the guests. The display is hidden automatically if no new message arrives for an extended period.

Information about the requested tracks

So that the DJ can be shown the tempo and key of a request as well as matching further tracks, we query music databases and an AI service (currently ReccoBeats and SoundNet's song analysis for tempo and key, Google's Gemini for the track suggestions, and ListenBrainz by the MetaBrainz Foundation and Apple's track search). Our server makes these queries, and only the artist and title of the track are transmitted. Neither your IP address nor your name, your device or any other information about you is transmitted – the services do not learn that an event is involved or who requested the song. We store the result so that the same track is queried only once. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in giving the DJ useful support in choosing music.

6. User account for organizers

An account is required to use the service as an organizer or DJ. We process:

• your email address (which is also your login name),
• your password, which is stored exclusively as a non-reversible hash,
• information on the confirmation of your email address and on failed login attempts (protection against unauthorized access),
• the time of your last login and your last activity – only the time in each case, neither IP address nor device nor the page viewed. Both help us identify accounts that are no longer used and answer questions about access; no history is created, and the two values are overwritten each time,
• the time at which you accepted our Terms and Conditions including the Data Processing Agreement, together with the version valid at the time and the wording of the consent,
• for paid purchases, the time and wording (including version) of your declaration on the early expiry of the right of withdrawal, and the time and recipient address of the contract confirmation we send you by email,
• the events you create (name, period, description, design) and team assignments.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract for use) and, with regard to the security features and the proof of acceptance of the Terms, Art. 6(1)(f) GDPR. We keep the records relating to purchases because we thereby meet statutory obligations (Art. 6(1)(c) GDPR in conjunction with section 312f of the German Civil Code, BGB) and must be able to defend ourselves against claims (Art. 6(1)(f) GDPR).

Team invitations

Organizers can invite other people to their team. If the person invited does not yet have an account, we receive their email address from the inviting organizer – not from the person themselves. We use it to create an account without a password, assign it to the team or event and send a single invitation with a link for setting the password; the email names the inviting person and refers to this privacy policy. We do not receive any further details from the organizer. The legal basis is Art. 6(1)(f) GDPR; the organizer's legitimate interest and ours lies in enabling teamwork. As long as no password has been set, the account cannot be used. If the invitation is not accepted within 30 days, we automatically delete the account created for it and the team assignment; the person invited or the organizer can also have it deleted earlier.

Billing details

For paid purchases, you can store your company name, first and last name, address, country and VAT identification number in the account settings. These details appear on your invoices. The legal basis is Art. 6(1)(b) GDPR and Art. 6(1)(c) GDPR in conjunction with the retention obligations under commercial and tax law.

Emails

We send emails only when there is a reason: invitations to a team, links to confirm your address and to reset your password, and purchase confirmations and invoices. We do not send a newsletter or advertising emails. To send emails we use the mail server of our email and domain provider ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany, with whom we have a data processing agreement. The recipient address and the content of the email concerned are processed; the servers are located in Germany. The links for confirming your address, resetting your password and in invitations are valid for one day; nothing additional is stored by us for them.

Cancellation via “Cancel contracts here”

If you cancel using our cancellation button, we process the data entered there (email address, name, contract canceled, type and time of the cancellation, and the reason and further contract details if given), the time of receipt to the second, and the time and recipient address of the confirmation of receipt we send you by email. We do not store an IP address. The legal basis is Art. 6(1)(c) GDPR in conjunction with section 312k BGB and Art. 6(1)(f) GDPR (proof of receipt in the event of a dispute). Your cancellation is business correspondence; we therefore keep this information for the statutory period (6 years from the end of the year of the cancellation, section 147 of the German Fiscal Code) and then delete it automatically.

Withdrawal via “Withdraw from contract”

If you withdraw from a contract using our withdrawal function, we process in the same way the data entered there (email address, name, contract concerned and further details if given), the time of receipt to the second, and the time and recipient address of the confirmation of receipt. We do not store an IP address here either. The legal basis is Art. 6(1)(c) GDPR in conjunction with section 356a BGB and Art. 6(1)(f) GDPR (proof of receipt in the event of a dispute). Retention and deletion are the same as for cancellations (6 years from the end of the year of receipt).

Reports via “Report content”

If you report content using our form “Report content”, we process the information you provide there (where the content is, the reason and – only if you give them – your name and email address), the time of receipt and, where applicable, the time and recipient address of the confirmation of receipt. We do not store an IP address. The legal basis is Art. 6(1)(f) GDPR (reviewing and removing unlawful content, proof of handling). Retention and deletion are the same as for cancellations (6 years from the end of the year of receipt).

7. Payment processing (Stripe)

For paid purchases (Event Pass and Pro) we use the payment service provider Stripe. The provider for users in the European Economic Area is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

When you start a purchase, you are redirected to a payment page operated by Stripe. You enter your card or bank account details only there; we never receive or store this data. We transmit to Stripe your email address and – if stored – your name, billing address and VAT ID so that correct invoices can be issued. From Stripe we receive the confirmation of the payment with amount, payment status and invoice data as well as customer, transaction and, where applicable, subscription identifiers in order to assign your purchase to your account.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract). Stripe also processes data in the USA. The recipient there is Stripe, LLC, which is certified under the EU-US Data Privacy Framework; the transfer is thus based on the EU Commission's adequacy decision (Art. 45 GDPR). Where the Data Privacy Framework does not apply, the EU Commission's standard contractual clauses apply under Stripe's contract terms (stripe.com/legal/dta). Details of the processing by Stripe can be found at stripe.com/privacy.

If your billing address is in an EU member state other than Germany, payment and tax are handled through the service Link, part of the Stripe group (Sold through Link, LLC; marked in the checkout as “Sold through Link”). Link then processes the details mentioned above as a separate controller in order to handle payment, taxes, the invoice and the receipt. From Link or Stripe we receive the same details as described above. Details can be found at link.com/privacy.

Tips via PayPal.Me

Organizers can add a tip link to PayPal.Me in the guest view. This is a simple link – a connection to PayPal is only established, and your data only transferred there, when you click it. No PayPal content is embedded in our pages, and the payment does not go through us. PayPal's privacy policy then applies.

8. Recipients of your data

We do not pass on your data for advertising purposes and do not sell it. Data is passed on only to the following recipients:

Beyond this, we pass on data only if we are legally obliged to do so, for example to law enforcement authorities.

9. Storage period

• We store account data for as long as your account exists. After it is deleted, we remove the associated data including your events and the requests they contain – except for the documents and records listed below, which we keep longer because of statutory obligations or to defend against claims.
• Song requests, display names and votes are anonymized automatically no later than 90 days after the end of the event: the display name, device identifier and free-text comments are removed irrevocably, as are the names and identifiers attached to votes. What remains is the artist, title and genre of the request, the number of votes, the times of the request and the votes, and whether and when the track was played – without reference to a name or device. Artist and title can be entered freely; please do not enter details about persons there. Organizers can of course delete requests or entire events at any time before that, and on request we remove individual entries at short notice.
• We keep invoices and other accounting records for eight years because of obligations under commercial and tax law, business correspondence relating to a contract for six years, and books and annual financial statements for ten years – in each case from the end of the calendar year (section 147 of the German Fiscal Code, section 257 of the German Commercial Code). The data is blocked for ongoing use.
• Cancellations and withdrawals made via our forms are business correspondence. We delete them, together with the confirmation of receipt, automatically 6 years after the end of the year in which the declaration was received.
• Records relating to purchases (your declaration on the expiry of the right of withdrawal, the time and recipient address of the contract confirmation) belong to the contract confirmation and are treated like it: we delete them automatically 6 years after the end of the year of the purchase.
• We keep the proof of your acceptance of the Terms and the Data Processing Agreement for as long as your account exists and beyond that until the standard limitation period has expired (three years from the end of the year in which the account was deleted).
• Team invitations that are not accepted: we delete the account created for this purpose and not yet activated, together with the team assignment, automatically after 30 days, or earlier at the request of the person invited or of the organizer. Independently of this, the links in our emails expire after one day.
• We delete error and warning messages 90 days after they last occurred.
• Database backups contain the state of the database at the time in encrypted form and are deleted after 30 days at the latest. Until then, data that has already been deleted or anonymized may still be contained in them. If we have to restore a backup, the periods do not start again: they continue to be based on the original points in time, and the automatic deletions and anonymizations are run again immediately after the restore.
• Server log files are deleted regularly, after 30 days at the latest.
• We keep the counts from reach measurement permanently. They contain only totals per day and page type and do not allow any conclusions about individual persons.

10. Your rights

You have the following rights in relation to us regarding your personal data:

• Access to information on whether and which data we process about you (Art. 15 GDPR)
• Rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR)
• Erasure of your data, unless retention obligations prevent this (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability in a commonly used, machine-readable format (Art. 20 GDPR)
• Withdrawal of consent you have given, with effect for the future (Art. 7(3) GDPR); this does not affect the lawfulness of processing carried out before the withdrawal

Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data that is based on Art. 6(1)(f) GDPR (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defense of legal claims.

To exercise your rights, an informal message to info@djplaythat.de is sufficient.

11. Right to lodge a complaint with a supervisory authority

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data infringes the GDPR (Art. 77 GDPR). You can contact the supervisory authority of your place of residence or the authority responsible for us:

12. Data security

We take technical and organizational measures to protect your data against loss, tampering and unauthorized access. These include encrypted transmission throughout (TLS), storing passwords exclusively as a hash, automatic account lockout after several failed logins, access restrictions on the database and ongoing updates of our server software. Our measures are continuously adapted in line with technical developments.

13. No automated decision-making

There is no automated decision-making, including profiling, under Art. 22 GDPR.

14. Changes to this privacy policy

We adapt this privacy policy when our services or the legal situation change. The version available on this page applies.

Last updated: October 2026 · See also our legal notice.