Privacy & Cookies

Controller

The controller under the GDPR is TANGENT EVENTS e.U., Kenyongasse 23–25/805, 1070 Vienna, Austria, the organiser of SHPILKI. Email: office@tangent-events.com, phone: +43 660 6146485. We have not appointed a data protection officer, as there is no legal obligation to do so.

Principles

We process personal data under the GDPR, the Austrian Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG). We process only what the purposes below require and share it only with the service providers named here. There is no automated decision-making within the meaning of Art. 22 GDPR.

Hosting and server logs

The website is hosted by Vercel Inc. (USA). When you open it, technically necessary access data — your IP address, the date and time and technical details of the request — is processed briefly in server logs to deliver the site securely and prevent misuse. Legal basis: our legitimate interest (Art. 6 (1) (f) GDPR).

Images, audio and fonts

Photographs and audio previews are delivered by Cloudinary Ltd. (Israel/USA), which receives your IP address and technical request data to deliver them. Fonts are served from our own website; nothing is requested from Google Fonts. Legal basis: Art. 6 (1) (f) GDPR.

Cookies and storage

Your cookie choice is kept in a cookie (shpilki_consent) for six months. After you enter the password to the private coterie area, a signed session cookie keeps you signed in for 12 hours. Both are technically necessary and need no consent (§ 165 (3) TKG 2021). Optional cookies are set only if you accept them, as described below.

Optional analytics

Google Analytics (Google Ireland Limited) loads only if you accept Analytics and a measurement ID is configured. It measures visits in aggregate, with IP anonymisation requested. Legal basis: your consent (Art. 6 (1) (a) GDPR).

Optional marketing

The Meta Pixel (Meta Platforms Ireland Limited) loads only if you accept Marketing and a pixel ID is configured. It measures campaign visits and may let Meta process device and browsing information under its own terms. Legal basis: your consent (Art. 6 (1) (a) GDPR). You can withdraw consent at any time in Cookie settings in the footer.

Private coterie area

The password is checked on our server. To stop guessing, the IP address of each attempt is kept by Upstash, Inc. (USA) for about 15 minutes and then deleted automatically. Legal basis: Art. 6 (1) (f) GDPR.

Coterie introductions

When introductions are open, we collect the name, Instagram handle, email address and niche you enter. We keep them in a private Notion database (Notion Labs, Inc., USA) to review your introduction and record its status. Resend (Plus Five Five, Inc., USA) sends you a receipt and, after a decision, a confirmation or rejection email. To prevent misuse, the IP address of each submission is kept by Upstash for about 15 minutes.

Legal basis: steps you ask us to take before a possible collaboration (Art. 6 (1) (b) GDPR) and our legitimate interest in preventing misuse (lit. f). We keep an introduction for as long as the coterie relationship lasts, or until you ask us to delete it at kiss@shpilki.com.

Guestlist and tickets

Registration and ticket sales run on Luma (Luma Labs, Inc., USA). Luma’s registration window is loaded from Luma only when you select “Join the guestlist”; from then on Luma processes your data as an independent controller under its own privacy policy, and payments for paid tickets are processed by Luma’s payment provider.

Luma shares your registration with us — your name, email address and answers to the registration questions — so that we can manage the guestlist, check entry and contact you about the event. Legal basis: your registration (Art. 6 (1) (b) GDPR) and our legitimate interest in organising the event and controlling entry (lit. f).

Event emails

We use your email address for confirmations, reminders and changes to the event you registered for. We send news about future SHPILKI events only to guests who registered and did not object when they did (§ 174 (4) TKG 2021), or who consented. You can object at any time through the unsubscribe link or by email to office@tangent-events.com.

Photos and videos at events

We take photos and videos at our events for documentation and promotion, for example on this website and on social media. The legal basis is our legitimate interest in presenting SHPILKI (Art. 6 (1) (f) GDPR) or, for targeted portraits, your consent (lit. a). You can object to being photographed or published, on site with our team or by email to office@tangent-events.com; we take your right to your own image into account (§ 78 UrhG).

Social media

This site links to Instagram profiles but embeds no social media content, so the platforms receive data only when you follow a link, under their own privacy policies.

Recipients and processors

We share data only where needed for the purposes above. Data processing agreements under Art. 28 GDPR are in place with our processors:

Vercel Inc. (USA) — hosting. Cloudinary Ltd. (Israel/USA) — delivery of images and audio. Upstash, Inc. (USA) — short-term protection against misuse. Notion Labs, Inc. (USA) — coterie introductions. Resend (Plus Five Five, Inc., USA) — email.

Luma Labs, Inc. (USA) processes registrations and tickets as an independent controller. Google and Meta receive data only if you consent to optional cookies.

Transfers outside the EU

Some providers are based in the USA or Israel. Transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, the European Commission’s adequacy decision for Israel, or the Standard Contractual Clauses (Art. 44 et seq. GDPR). Details are available on request.

Retention

Server logs: short term, for security and operation. Misuse protection: about 15 minutes. Coterie introductions: as described above. Guestlist data: until the event and its follow-up are complete, unless you agree to more. Ticket and invoice records we hold: 7 years (§ 132 BAO). Cookie choice: six months. Private-area session: 12 hours.

Security

The website is delivered only over an encrypted connection (TLS/HTTPS), and access to personal data is restricted to the people who need it.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and withdrawal of consent with effect for the future (Art. 7 (3)). An informal email to office@tangent-events.com is enough.

Complaints

You can lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

Changes

We update this policy when the law or our processing changes; the version published here applies. Last updated: 26 September 2026.