Privacy Policy

Last updated: November 2026

This notice explains the personal data processed during website visits, enquiries and the use of optional services. Optional statistics and marketing services load only after your consent. SoundCloud requires a separate click to load a mix.

1. Controller and contact

2. Your rights

Subject to the statutory conditions, you have rights of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20). Please contact the address above to exercise these rights.

Under Art. 21 GDPR, you may object to processing based on Art. 6(1)(f) GDPR on grounds relating to your particular situation. You may object to direct marketing at any time. Under Art. 7(3) GDPR, you may withdraw consent at any time for the future, without affecting the lawfulness of earlier processing.

You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for our location is the Hessian Commissioner for Data Protection and Freedom of Information (Hessischer Beauftragter für Datenschutz und Informationsfreiheit). datenschutz.hessen.de

3. Website delivery, hosting and security

The website is delivered through Lovable Labs AB (Stockholm, Sweden) and the network of Cloudflare, Inc. (San Francisco, USA). This involves technically necessary connection data such as IP address, requested URL, time, browser and device information. Cloudflare also protects against automated abuse. Technical cookies such as __cf_bm and __dpl may be set. Fonts and images are delivered through our website infrastructure; no external Google Fonts are loaded.

Legal basis: Art. 6(1)(f) GDPR, our interest in secure and functional delivery. Strictly necessary device storage is covered by Section 25(2) TDDDG. HTTPS protects transmission. Hosting and security providers may process data outside the EU; exclusively EU-based processing is not promised.

Server logs are processed by the hosting providers for technical operation and security; retention periods follow their requirements.

4. Enquiries, database and email

When you contact us, we process your name, email address, optional phone number, event date, venue, guest count, occasion, message and the source of the form used. This serves to handle and respond to your enquiry and prepare a possible booking (Art. 6(1)(b) GDPR). Other correspondence is based on Art. 6(1)(f) GDPR, our interest in responding to your request. Statistics or marketing consent is not required to submit an enquiry.

The required form fields (name, event date, email and privacy confirmation) are necessary to process your enquiry. Without them, we cannot process your form enquiry. All other information is optional. Tracking and analysis are voluntary and take place only with your consent (Art. 13(2)(e) GDPR).

Enquiries and related processing records are stored in Lovable Cloud, using underlying Supabase database technology. The documented database connection is in eu-west-1 (Ireland). This does not establish EU-only processing for functions, logs, backups or support. Contact confirmations and notifications are sent through Plus Five Five, Inc. (Resend). Lovable Email is additionally provided in the system for login and system emails. Email services receive recipient, sender, subject and message content; transfers to the USA are possible.

To prevent abuse, we use a hidden check field and server-side limits based on IP address. Technical confirmation tokens and cf_contact_idem:* prevent duplicate enquiries; the stored submission result is valid for 24 hours. This technical validity is not the enquiry deletion period.

5. Consent and browser storage

Our own banner distinguishes Necessary, Statistics, Marketing and Preferences; Google reCAPTCHA has a separate choice. cf_cookie_consent_v1 stores current choices, time and notice version. cf_cookie_consent_history_v1 preserves earlier choices so withdrawal does not overwrite earlier acceptance. Choices remain in the browser until changed or deleted. Necessary consent management is based on Art. 6(1)(c) GDPR in conjunction with consent accountability requirements; necessary device access is covered by Section 25(2) TDDDG.

• Marketing: cf_attribution_v1 (first/last touch, UTM and click identifiers; 90-day logical validity), cf_city_lead_v1 (city/CTA origin, session, maximum two hours), cf_lead_event_sid and cf_dedupe_* (event grouping and duplicate prevention, generally up to 30 days). Without marketing consent, these optional data are neither stored nor transmitted.
• Statistics: cf_ab_visitor for award-link test variants (until withdrawal/deletion), cf_rum_session for the current session. Our own RUM measurements collect loading/interaction metrics, entry path, device and connection characteristics and a random session identifier and send them to Lovable Cloud; form entries are not collected for this purpose.
• Spam protection: cf_recaptcha_consent_v1 stores the separate reCAPTCHA choice. Login sessions, chunk_reload for error recovery and explicitly enabled admin/diagnostic settings serve technical functions, not general visitor tracking.

Optional processing is based on your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You may change your choices at any time. Withdrawal removes our optional identifiers and loaded media; already executed third-party scripts are stopped by reloading. Unsent entries may be lost. Earlier transfers cannot be undone. You can also delete provider cookies in your browser.

6. Google Tag Manager, Analytics 4 and Google Ads

Google Tag Manager loads only when you consent to statistics or marketing. Google Analytics is used for statistics, Google Ads for marketing. Google Tag Manager (GTM-MK9F76J) manages the tags. Google Analytics 4 evaluates page views, events and device/usage characteristics; Google Ads serves advertising measurement, campaign attribution and optimisation. URLs, events, IP/browser information, cookie and click identifiers may be processed. GA4 may use _ga cookies and advertising may use _gcl_* cookies; actual lifetimes depend on provider configuration. Without consent, no Google tracking container loads.

Recipients are Google Ireland Limited (Dublin, Ireland) and, where applicable, Google LLC (USA). Legal bases: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. Google describes the EU-U.S. Data Privacy Framework for covered US transfers and Standard Contractual Clauses for other transfers; applicable coverage depends on the terms of the specific service. Processing in the USA is possible. Google: transfer frameworks

With marketing consent, Google's Preferred Sources service may load so you can add Chris Force to your preferred Google sources. The provider is Google Ireland Limited (Dublin, Ireland). This may involve requests to news.google.com, play.google.com and www.gstatic.com and transfers of technical connection data such as IP address and browser information to Google. Transfers to the USA are possible. The legal basis is your marketing consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent, the button only leads to a Google page you actively open.

7. Google reCAPTCHA

We optionally use Google reCAPTCHA v3 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to protect forms from spam and automated abuse. reCAPTCHA evaluates technical data such as IP address, browser information, mouse movements and time spent and sends them to Google; a transfer to the USA is possible. Google returns a score; enquiries with a very low score are treated as spam.

reCAPTCHA loads and runs only as needed after your active, voluntary, separate consent in the cookie banner. Legal bases: Art. 6(1)(a) GDPR and Section 25(1) TDDDG. The choice is stored locally in the browser, separately from marketing. You may withdraw it in cookie settings or on the spam protection page. Reloading stops already loaded Google code. Without consent, the form remains protected by the check field; email and phone are also available. Spam protection · Google privacy

8. Venue search and travel calculation

For address suggestions, the entered venue text is sent through our server and Lovable's connector service to Google Maps Platform, together with technical search/session attributes and, where applicable, a Place ID. This suggestion function is linked to the separate reCAPTCHA consent in the form. No Google Maps map or Maps script is embedded. After an enquiry, we calculate driving distance and time from our location to the venue; Google receives the necessary origin/destination addresses, not your name, email or phone. Venue questions in the chat may also trigger route calculation. Enquiry-related route calculation is based on Art. 6(1)(b) GDPR; optional suggestions are based on Art. 6(1)(a) GDPR. Google/Lovable may process data in the USA; Google's transfer information above applies according to the service.

9. SoundCloud and external links

The mixes on The Party Stuff are provided through SoundCloud (SoundCloud Global Limited & Co. KG, Berlin). No player or external cover is requested before you click Load mix. Clicking consents to transfers for that player (Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG). SoundCloud receives IP/browser information, player/track identifiers and interaction data and may use its own storage technologies. Processing in the USA is possible. Permission applies only to the opened player; Unload mix or Reject all removes it. Opening cookie settings alone does not change your choice. SoundCloud privacy

Reviews are displayed locally without a ProvenExpert widget. Profile and social-media links open the external website only when you actively follow them; the provider's privacy information then applies.

10. Little Chris AI assistant

Little Chris is optional. We display an AI processing notice before the first message. Only when you send a message are its text and conversation context transmitted through Lovable to an OpenAI AI service to generate a response; processing in the USA is possible. Please do not enter personal data. The application does not store chat conversations in our enquiry database; this does not exclude logs held by hosting, gateway or model providers. Storage-free processing is not promised. Legal basis: Art. 6(1)(f) GDPR, our interest in promptly answering your voluntarily submitted questions.

11. Internal AI analysis of enquiries

To improve the website, we may analyse enquiries internally through Lovable using OpenAI. Texts are shortened and partially redacted: email addresses, phone-like numbers and links are automatically processed; names, places and other personal details may remain in free text. This is not full anonymisation. Another internal analysis path uses Anthropic through Lovable for aggregate page, booking and channel counts without contact fields or message texts. Transfers to the USA are possible. Legal basis: Art. 6(1)(f) GDPR, our interest in improving enquiry handling and the website. No automated decisions with legal or similarly significant effects are made about you (Art. 22 GDPR). You may object under Art. 21 GDPR.

12. Campaign attribution

Only with marketing consent do we capture campaign parameters, click identifiers, referrer host and entry path and, where applicable, associate them with your enquiry. This lets us evaluate advertising effectiveness and enquiry sources. Without consent, enquiries are processed without these optional attribution data. The actual form page remains part of the enquiry as its processing source. Google enquiry events are reported only according to consent; events blocked before consent are not replayed later. Legal bases for campaign attribution and advertising measurement: Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

13. Storage periods

• We delete enquiries without a booking twelve months after the last substantive update. Phone or email contact must be recorded as an update.
• We delete booked enquiries ten years after the later of the event or last substantive update. Booking history remains protected after status changes; records without a known event date are not automatically deleted. Tax documents must be retained separately under statutory periods (§ 147 AO, § 257 HGB).
• We delete never-booked enquiries marked as spam 30 days after classification.
• Linked enquiry events are also deleted when the enquiry is deleted. Sent emails, exports and backups must be managed separately.
• Browser identifiers have the periods stated above; withdrawal removes our optional identifiers. Server logs are processed by the hosting providers for technical operation and security; retention periods follow their requirements. Retention of other provider-held data depends on their respective terms.

14. Transfers outside the EU

The hosting, email, Google, media and AI services named above may use recipients or subprocessors outside the EU, particularly in the USA. Google publicly describes the EU-U.S. Data Privacy Framework and Standard Contractual Clauses; Cloudflare also publishes information on these transfer mechanisms. Coverage of specific processing depends on the recipient, service and contract. No unverified project-specific transfer mechanism is asserted here for AI and email services accessed indirectly through Lovable. Transfers to the USA are possible.

Cloudflare · Lovable · Resend · OpenAI