Privacy Policy
Privacy Policy
for Website and App of IBDAA Platform
1. Data Controller
The controller responsible for data processing within the meaning of the General Data Protection Regulation (GDPR) is:
IBDAA Platform
Firas Al-Ahmedi
Morgenberg 14
51061 Cologne
Germany
Email: info@ibdaa.de
2. General Information on Data Processing
We process personal data exclusively in accordance with:
-
the General Data Protection Regulation (GDPR)
-
the German Federal Data Protection Act (BDSG)
-
the Telecommunications Digital Services Data Protection Act (TTDSG)
-
the Digital Services Act (DDG – German implementation)
Processing is carried out on the basis of:
-
Art. 6(1)(a) GDPR (consent)
-
Art. 6(1)(b) GDPR (performance of a contract)
-
Art. 6(1)(f) GDPR (legitimate interest)
Our legitimate interest lies in ensuring security, stability, prevention of misuse, and optimization of our services.
3. Data Collection When Visiting the Website (Server Log Files)
When accessing our website, the following data is automatically processed:
-
IP address
-
Date and time of access
-
Browser type and version
-
Operating system
-
Referrer URL
This data is technically necessary to ensure the functionality and security of the website (Art. 6(1)(f) GDPR).
The data is stored for a maximum of 7 days and then deleted or anonymized unless retention is required for security reasons.
4. Registration and User Account (App)
When creating a user account, we process:
-
Name
-
Email address
-
Profile picture
-
Optional additional information (e.g., location)
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Data is stored as long as the account exists.
After deletion of the account, personal data will be deleted unless statutory retention obligations apply (e.g., 6 or 10 years under German commercial and tax law for paid transactions).
5. App Permissions (Camera and Photo Gallery)
The app may request access to:
-
Camera
-
Photo gallery
Processing takes place:
-
locally on the user’s device, or
-
after active selection by the user
Legal basis: Art. 6(1)(a) GDPR (consent).
Permissions can be revoked at any time via device settings.
6. User Content, Copyright and Indemnification
Users are solely responsible for the content they upload.
By uploading content, users confirm that:
-
they own all necessary copyrights and usage rights
-
no third-party personality rights are violated
-
no trademark or other proprietary rights are infringed
The user indemnifies IBDAA Platform against all third-party claims arising from legal violations caused by uploaded content, including reasonable legal defense costs.
We act as a service provider within the meaning of the German Digital Services Act (DDG) and will remove unlawful content immediately upon obtaining knowledge of it.
7. Children and Minors
Use of the platform by persons under 16 years of age is permitted only with parental consent.
We reserve the right to request appropriate proof of consent.
If unlawful data processing of minors becomes known, the data will be deleted immediately.
8. Analytics Tools (Google Analytics & Firebase)
We use Google Analytics and Firebase to analyze and improve our services.
Activation occurs only after prior consent (opt-in) in accordance with Art. 6(1)(a) GDPR and Section 25 TTDSG.
IP addresses are processed in anonymized form.
Data transfers to third countries (e.g., USA) occur exclusively on the basis of appropriate safeguards pursuant to Art. 44 et seq. GDPR, in particular:
-
EU-US Data Privacy Framework
-
Standard Contractual Clauses of the European Commission
Consent can be revoked at any time via the consent tool (cookie banner) or app settings.
9. Cookies
Our website uses technically necessary cookies to ensure functionality.
Analytics or tracking cookies are set only after explicit consent (opt-in procedure in accordance with TTDSG).
10. Ticket Sales and Third-Party Providers (e.g., Eventbrite, Amazon)
For ticket sales or external services, we use third-party providers such as Eventbrite or Amazon.
When redirected to external platforms, data processing is carried out on the basis of:
-
Art. 6(1)(b) GDPR (performance of a contract), or
-
Art. 6(1)(f) GDPR (legitimate interest)
From the moment of redirection, data processing is subject exclusively to the privacy policies of the respective provider.
We have no influence over their data processing.
11. Disclosure of Data
Personal data will only be disclosed if:
-
there is a legal obligation,
-
it is necessary for contract performance,
-
legitimate interests justify the disclosure, or
-
explicit consent has been given.
12. Data Retention
Personal data is stored only as long as:
-
the specific purpose exists,
-
statutory retention periods require it, or
-
legitimate interests justify retention.
13. Rights of Data Subjects
You have the right to:
-
Access (Art. 15 GDPR)
-
Rectification (Art. 16 GDPR)
-
Erasure (Art. 17 GDPR)
-
Restriction of processing (Art. 18 GDPR)
-
Data portability (Art. 20 GDPR)
-
Object to processing (Art. 21 GDPR)
-
Withdraw consent with effect for the future
You also have the right to lodge a complaint with a supervisory authority.
The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.
14. Liability for External Links
Our website may contain links to external websites.
The respective operators are solely responsible for their content.