Tangosummer
Cart

Privacy policy

This is a translation for your convenience. The German version applies.

This page explains which personal data we process on this website, when you book and at our events, for what purpose and on which legal basis, and what rights you have.

1. Controller

Achim Schaller
Tangosummer
Cunostraße 8
60388 Frankfurt am Main
Germany
E-mail: info@tangosummer.com

We are not required to appoint a data protection officer. Please send questions about data protection to the address above.

2. Visiting the website

The website runs on a server of IONOS SE in Germany. With every request the server stores in log files the IP address, date and time, the address requested, the amount of data transferred, the page visited before, and the browser and operating system. We need this to run the website securely and reliably and to detect attacks (Art. 6 (1) (f) GDPR). The log files are deleted after 14 days. [check]

To prevent abuse, such as a large number of sign-in attempts, the website remembers IP addresses for a short time (one hour at most).

3. Cookies, fonts and videos

We only use cookies the website needs to work: a session cookie that keeps your cart and your sign-in (it expires after two weeks) and a security cookie that protects forms against misuse. Without them no order is possible. The legal basis is § 25 (2) no. 2 TDDDG and Art. 6 (1) (b) and (f) GDPR. We use no analytics, tracking or advertising cookies.

Fonts, pictures and scripts of the website come from our own server, not from third parties.

Videos from YouTube and Vimeo are only shown as a preview. Only when you click “Play video” does your browser connect to the provider: for YouTube in privacy-enhanced mode to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for Vimeo to Vimeo.com, Inc., New York, USA. The provider learns at least your IP address and the page on which you play the video; data may be transferred to the USA. The legal basis is your consent by clicking (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

4. Customer account

When you sign up or order for the first time, we create a customer account for your e-mail address. You sign in with a link we send you by e-mail, or with a password of your own; we store only an irreversible hash of it. If you wish, signing in also asks for a code from an authenticator app. In the account you find your orders, tickets, invoices and photos, and you enter the names of the participants; while you are signed in, it also keeps your cart. The legal basis is the performance of the contract or steps taken at your request before entering into it (Art. 6 (1) (b) GDPR).

5. Booking tickets

When you order, we process your first and last name, e-mail address, billing address (required for invoices above 250 euros, otherwise optional), company name (optional), country and preferred dance role, the tickets ordered with the names of the participants, payment method and payment status, and invoices and credit notes. We need these data to handle the order, issue tickets, check them at the entrance, balance the roles in the workshops and write invoices (Art. 6 (1) (b) GDPR), and to meet our tax retention duties (Art. 6 (1) (c) GDPR). We cannot accept an order without a name and an e-mail address.

We keep a history of what happens with an order – payments, refunds, e-mails sent – so that we can answer questions and prove payments (Art. 6 (1) (b), (c) and (f) GDPR).

If you join a waiting list, we store your e-mail address and the place you want and let you know as soon as it becomes free (Art. 6 (1) (b) GDPR).

6. Entrance and teachers

On festival days our entrance team sees the internal name on the ticket, the events booked for the day and the dance role. Teachers see the participants of their own workshops, with the internal name you choose in your profile: first name (default), last name, dance name or first and last name. If teachers want to write to participants, our system sends the message; they do not see the e-mail addresses. Every access to participant data is logged. The legal basis is Art. 6 (1) (b) GDPR, for the log Art. 6 (1) (f) GDPR (protecting your data against unauthorised access).

7. Payments

PayPal: If you pay with PayPal, we send you to PayPal and pass on the amount and the order number. PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, processes your payment data under its own responsibility; see PayPal's privacy statement.

Card and other payment methods: These payments are handled by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. You enter your card details directly at Stripe; we never receive them. We pass on the amount, the order number and your e-mail address. Stripe also processes data under its own responsibility, for example to prevent fraud, and also in the USA; see Stripe's privacy policy.

Bank transfer: To match transfers to orders we import the transactions of our account; we see the name, account details and reference of the sender.

The legal basis in each case is the performance of the contract (Art. 6 (1) (b) GDPR).

8. E-mails and customer service

We send confirmations, tickets, invoices and other messages about your order by e-mail. We store the content of these e-mails so that we can see what we sent you when you ask; we do not store sign-in links. When you write to us, we store your message and our reply and link both to your account and your order. The legal basis is Art. 6 (1) (b) and (f) GDPR. Our e-mails run through our own mail server; outgoing e-mails are delivered on our behalf by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

9. AI-assisted reply drafts

To answer enquiries faster, our team can have an AI service suggest a draft reply. For this, the text of your message (without quoted earlier e-mails) and the items and status of your order are sent to Anthropic Ireland, Limited, Dublin, Ireland. Your address and bank details are not sent. A person checks every draft and changes it where needed before it is sent; there are no automated decisions. Anthropic acts as our processor and does not use the data to train its models. Processing by its parent company Anthropic, PBC in the USA is possible; it is covered by the European Commission's standard contractual clauses (Art. 46 (2) (c) GDPR). The legal basis is our legitimate interest in prompt customer service (Art. 6 (1) (f) GDPR); you may object at any time.

10. News about coming festivals

If you tick “Send me news about future festivals” when ordering, we occasionally send you information about our events (Art. 6 (1) (a) GDPR). You can withdraw your consent at any time with effect for the future, for example by e-mail to info@tangosummer.com.

11. Photos and videos at the events

Photographers and videographers engaged by us take pictures and films at our events; you may be recognisable on them. We use them to document the events, to make them available to the participants and to present our events. The legal basis is our legitimate interest in this (Art. 6 (1) (f) GDPR). Portraits that show one person in the centre are published only with consent (Art. 6 (1) (a) GDPR).

Photos in the account: The photos of a day or an event are visible only to signed-in people with a ticket for that day or event; we may release single pictures to all signed-in customers. The pictures stay on our server and are delivered only through short-lived, personal links.

Website and social networks: We publish selected pictures on our website and on our pages on Facebook and Instagram (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). There they can be seen worldwide, and Meta may transfer data to the USA.

Objection: You can object to being photographed on site to the photographers or beforehand by e-mail, and to a publication at any time (Art. 21 GDPR). We then remove the picture concerned. We cannot recall copies third parties have already made.

We keep the pictures for as long as we use them to document and present our events.

12. Recipients

We have contracts under Art. 28 GDPR with our processors.

13. Transfers outside the EU

With Stripe, PayPal, Anthropic and Meta, and after your click with YouTube and Vimeo, data may reach the USA. If the recipient is certified under the EU-US Data Privacy Framework, the transfer is based on the European Commission's adequacy decision (Art. 45 GDPR), otherwise on standard contractual clauses (Art. 46 (2) (c) GDPR).

14. How long we keep data

We delete personal data as soon as we no longer need them for the purpose and no retention duty applies. We keep invoices and accounting records for eight years and business letters for six years (§ 147 of the German Fiscal Code, AO); the period starts at the end of the calendar year. We delete your customer account on request; data we must keep are blocked until the period ends.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7 (3) GDPR).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation. We then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. You may object to the use of your data for advertising without giving reasons.

An e-mail to info@tangosummer.com is enough.

Complaints: You may lodge a complaint with a data protection supervisory authority. Ours is Der Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 31 63, 65021 Wiesbaden, Germany, poststelle@datenschutz.hessen.de.

16. Automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR and create no profiles.

Version of 13 November 2026