Privacy & Cookies

Controller

The controller under the GDPR is TANGENT EVENTS e.U., Kenyongasse 23–25/805, 1070 Vienna, Austria, the organiser of SHPILKI. Email: office@tangent-events.com, phone: +43 660 6146485. We have not appointed a data protection officer, as there is no legal obligation to do so.

Principles

We process personal data under the GDPR, the Austrian Data Protection Act (DSG) and the Telecommunications Act 2021 (TKG). We process only what the purposes below require and share it only with the service providers named here. There is no automated decision-making within the meaning of Art. 22 GDPR.

Hosting and server logs

The website is hosted by Vercel Inc. (USA). When you open it, technically necessary access data — your IP address, the date and time and technical details of the request — is processed briefly in server logs to deliver the site securely and prevent misuse. Legal basis: our legitimate interest (Art. 6 (1) (f) GDPR).

Images and fonts

Campaign photographs are delivered by Cloudinary Ltd. (Israel/USA); event galleries and their downloads are delivered from photos.shpilki.com by Cloudflare, Inc. (USA). Both receive your IP address and technical request data to deliver the files. Fonts are served from our own website; nothing is requested from Google Fonts. Legal basis: Art. 6 (1) (f) GDPR.

Cookies and storage

Your cookie choice is kept in a cookie (shpilki_consent) for six months. After you enter the password to the private coterie area, a signed session cookie keeps you signed in for 12 hours. Both are technically necessary and need no consent (§ 165 (3) TKG 2021). Optional cookies are set only if you accept them, as described below.

Visit statistics

Vercel Web Analytics (Vercel Inc., USA) counts visits without cookies and without storing anything on your device. It records the page, the referring site, country, browser and device type, and recognises a visit only by a hash of the request that is discarded after 24 hours, so we see aggregated statistics and never an individual. Legal basis: our legitimate interest in knowing how the site is used (Art. 6 (1) (f) GDPR).

Optional analytics

Google Analytics 4 (Google Ireland Limited) loads only if you accept Analytics and a measurement ID is configured. It measures in aggregate which pages are read, where visits come from and a few actions: which “Join the guestlist” button was pressed, whether the registration window opened, a completed registration on Luma (its order number and value only, never your name or email), a coterie introduction being sent, a request to join the email list and its confirmation (never the address), the Instagram link, and in the galleries which kind of download was made and how many photographs it held, or that a photo or gallery link was shared (never which photograph). Google Analytics 4 does not log or store IP addresses; the data is kept for 14 months. Legal basis: your consent (Art. 6 (1) (a) GDPR).

Optional marketing

The Meta Pixel (Meta Platforms Ireland Limited) loads only if you accept Marketing and a pixel ID is configured. It measures visits from campaigns and the steps that follow — opening the registration window, completing a registration (order number and value only) and sending a coterie introduction — so that we can see what our advertising achieves. Meta may process device and browsing information under its own terms. If you accept Marketing, Google also receives your consent for advertising measurement. If you also arrived through a tagged link, we keep its source, medium and campaign name in a cookie (shpilki_source) for 30 days, so that a registration on a later visit still reaches Luma with them; ad click IDs are not stored. Without Marketing, these tags are kept only for the visit you arrived with. Legal basis: your consent (Art. 6 (1) (a) GDPR). You can withdraw consent at any time in Cookie settings in the footer.

Private coterie area

The password is checked on our server. To stop guessing, the IP address of each attempt is kept by Upstash, Inc. (USA) for about 15 minutes and then deleted automatically. Legal basis: Art. 6 (1) (f) GDPR.

Coterie introductions

When introductions are open, we collect the name, Instagram handle, email address and niche you enter. We keep them in a private Notion database (Notion Labs, Inc., USA) to review your introduction and record its status. Resend (Plus Five Five, Inc., USA) sends you a receipt and, after a decision, a confirmation or rejection email. To prevent misuse, the IP address of each submission is kept by Upstash for about 15 minutes.

Legal basis: steps you ask us to take before a possible collaboration (Art. 6 (1) (b) GDPR) and our legitimate interest in preventing misuse (lit. f). We keep an introduction for as long as the coterie relationship lasts, or until you ask us to delete it at kiss@shpilki.com.

Guestlist and tickets

Registration and ticket sales run on Luma (Luma Labs, Inc., USA). Luma’s registration window is loaded from Luma only when you select “Join the guestlist”; from then on Luma processes your data as an independent controller under its own privacy policy, and payments for paid tickets are processed by Luma’s payment provider.

Luma shares your registration with us — your name, email address and answers to the registration questions — so that we can manage the guestlist, check entry and contact you about the event. If you came through a tagged link, such as an ambassador’s link or one of our campaigns, its tags (source, campaign name and similar) go to Luma with your registration, so that we can see which ambassador or campaign brought you. Legal basis: your registration (Art. 6 (1) (b) GDPR) and our legitimate interest in organising the event, controlling entry and knowing which ambassadors and campaigns bring guests (lit. f).

Event emails

We use your email address for confirmations, reminders and changes to the event you registered for. We send news about future SHPILKI events only to guests who registered and did not object when they did (§ 174 (4) TKG 2021), or who consented. You can object at any time through the unsubscribe link or by email to office@tangent-events.com.

Email list

If you sign up for news about the next SHPILKI night, we store your email address, the time of sign-up and confirmation, the wording you agreed to and, if you arrived through a tagged link, its source and campaign name, in a private Notion database (Notion Labs, Inc., USA). We first send one email asking you to confirm; until you do, you receive nothing else, and an unconfirmed sign-up is deleted after 30 days. Once confirmed, your address is added to our mailing list at Resend (Plus Five Five, Inc., USA), which sends our announcements. Every email has an unsubscribe link, and you can also write to kiss@shpilki.com. Legal basis: your consent (Art. 6 (1) (a) GDPR, § 174 TKG 2021), which you can withdraw at any time with effect for the future.

Photos and videos at events

We take photos and videos at our events for documentation and promotion, for example on this website and on social media. The legal basis is our legitimate interest in presenting SHPILKI (Art. 6 (1) (f) GDPR) or, for targeted portraits, your consent (lit. a). You can object to being photographed or published, on site with our team or by email to office@tangent-events.com; we take your right to your own image into account (§ 78 UrhG). Event galleries on this website show photographs by the credited photographers; anyone can view and download them, and single photographs have their own page that search engines may list. Every photograph has a “Request removal” link (an email to kiss@shpilki.com with the photograph’s number): we hide it from the site promptly, normally within a day, and then delete it and every download copy we hold. Copies other people saved or shared before that are outside our control.

Social media

This site links to Instagram profiles but embeds no social media content, so the platforms receive data only when you follow a link, under their own privacy policies.

Recipients and processors

We share data only where needed for the purposes above. Data processing agreements under Art. 28 GDPR are in place with our processors:

Vercel Inc. (USA) — hosting and cookieless visit statistics. Cloudinary Ltd. (Israel/USA) — delivery of images. Upstash, Inc. (USA) — short-term protection against misuse. Cloudflare, Inc. (USA) — storage and delivery of event galleries. Notion Labs, Inc. (USA) — coterie introductions and the email list. Resend (Plus Five Five, Inc., USA) — email.

Luma Labs, Inc. (USA) processes registrations and tickets as an independent controller. Google and Meta receive data only if you consent to optional cookies.

Transfers outside the EU

Some providers are based in the USA or Israel. Transfers rely on the EU-U.S. Data Privacy Framework where the provider is certified, the European Commission’s adequacy decision for Israel, or the Standard Contractual Clauses (Art. 44 et seq. GDPR). Details are available on request.

Retention

Server logs: short term, for security and operation. Misuse protection: about 15 minutes. Coterie introductions: as described above. Guestlist data: until the event and its follow-up are complete, unless you agree to more. Ticket and invoice records we hold: 7 years (§ 132 BAO). Visit statistics: aggregated only; the visitor hash is discarded after 24 hours. Google Analytics: 14 months. Cookie choice: six months. Campaign source: 30 days. Private-area session: 12 hours. Email list: until you unsubscribe; unconfirmed sign-ups are deleted after 30 days. Gallery photographs: as long as the gallery is published, unless removal is requested.

Security

The website is delivered only over an encrypted connection (TLS/HTTPS), and access to personal data is restricted to the people who need it.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection to processing based on legitimate interests (Art. 21) and withdrawal of consent with effect for the future (Art. 7 (3)). An informal email to office@tangent-events.com is enough.

Complaints

You can lodge a complaint with a supervisory authority. In Austria this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, www.dsb.gv.at.

Changes

We update this policy when the law or our processing changes; the version published here applies. Last updated: 25 October 2026.