Privacy notice

The controller is [NAME], [ANSCHRIFT]. Contact for data protection requests: [E-MAIL]. These details must be completed before publication.

This portal is served through Lovable and uses Lovable Cloud for its database and authentication. Requests involve technically necessary connection data, including IP address, time, requested URL, browser/device information and response status. Search filters are stored in the URL and may consequently appear in logs, browser history and shared links. Do not use personal information as search filters.

Processing supports delivery, security and troubleshooting under Article 6(1)(f) GDPR (legitimate interest in a secure, available service). The application logs errors. Where Lovable diagnostic hooks are supplied, error messages, stack traces and page paths may be sent to the platform. Application code does not define fixed retention periods for hosting or server logs. Actual retention and platform functions must be verified with the provider and added before publication.

OpenStreetMap tiles load only after you select “Agree and load map”. The tile provider receives your IP address, technical request data and requested map areas; depending on browser settings, origin information may also be transmitted. The legal basis is consent under Article 6(1)(a) GDPR. Select “Withdraw map consent” to stop the map. This cannot undo earlier transfers. The event list remains usable without consent. Consent is kept only in the displayed map’s memory, not in a persistent cookie.

For radius searches, the server sends the entered place to Nominatim (nominatim.openstreetmap.org). The service receives the place and server IP; the application does not explicitly forward the visitor’s IP. Results are temporarily cached in server-instance memory. The legal basis is Article 6(1)(f) GDPR (interest in providing the requested location search). Enter towns or regions rather than private addresses. Provider information: https://osmfoundation.org/wiki/Privacy_Policy.

When you submit a natural-language query, the server processes it through the Lovable AI Gateway and the OpenAI model provider selected in code. The complete input, UI language and search instructions are transmitted to derive discipline, distance, date or location filters. Any resulting location may then be searched through Nominatim.

Do not enter personal, confidential or sensitive data. The legal basis is Article 6(1)(f) GDPR (interest in providing the search you request). The application does not create a permanent conversation archive of its own. This does not establish the gateway’s or model provider’s logging or retention practices; their actual periods and contractual terms must be verified before publication. Manual filters can be used without AI search.

The organizer form processes a required contact email, optional contact name, event name, event date, city, country, disciplines and optional event and registration URLs. A record ID, submission time, review status and any link to an adopted event are also stored. Data is inserted directly into Lovable Cloud and reviewed by authorized administrators. The privacy checkbox is checked in the form but is not stored as a separate consent record.

The purpose is review, follow-up, correction and possible publication of event facts. Contact fields are not part of the public event display. The legal basis is Article 6(1)(f) GDPR (interest in an accurate calendar and handling requested submissions), or Article 6(1)(b) for contract-related enquiries where applicable. The checkbox acknowledges the notice and permits handling; it is not a marketing opt-in.

There is currently no separate contact form. The contact page uses the email placeholder [E-MAIL]. Email correspondence involves the sender’s address, message and any voluntarily supplied information. The operator’s contact email provider has not yet been specified.

Application code has no automatic submission deletion, and an operational retention period has not been verified. Records require manual deletion when their purpose ends, unless legal obligations or justified reasons require continued retention. Retention, deletion responsibility, procedure and backup handling must be established before publication. Requests can be sent to [E-MAIL].

Public browsing does not require an account. Editorial access uses Lovable Cloud email-and-password sign-in, processing email, account ID, a securely hashed password, authentication and technical security data and session tokens. A link is emailed only to set or reset the password; permission to access administration is checked separately. The configured email delivery provider is not identifiable from application code.

The authentication library stores session data locally in the browser. Tokens may remain until expiry, sign-out or browser-storage removal and may be refreshed during the session. Lovable editor preview may additionally use platform-managed session synchronization. The legal basis is Article 6(1)(f) GDPR (interest in access control and editorial operation), or Article 6(1)(b) where a relevant contractual relationship applies.

Selecting a language stores it in the “lang” cookie for one year and under the same key in localStorage without automatic expiry. This serves only your explicitly chosen language preference (Section 25(2)(2) TDDDG; Article 6(1)(f) GDPR). You can delete the cookie and browser storage in your browser settings. Search filters are in the URL, not a dedicated filter cookie. Public filters do not use an application-owned sessionStorage entry.

Font files, SVG flags and icons are served locally with this website, without Google Fonts or an icon CDN connection. No application-owned advertising/analytics tags, social embeds or third-party video players were found in the audited code. This does not rule out functions injected by the hosting platform, which must be checked separately before publication.

Organizer and registration links lead to third-party websites. Opening them requests those sites, whose privacy terms apply. The application does not request GPS/browser geolocation.

Depending on the function, recipients include authorized editors, hosting/cloud providers, Lovable AI Gateway and OpenAI, OpenStreetMap/Nominatim, and the configured email service. Exact contracting entities, subprocessors, regions and mail providers cannot all be established from code alone.

Processing outside the EU/EEA, including in the United States and through international infrastructure, is possible. Actual adequacy arrangements or safeguards under Articles 44 et seq. GDPR must be verified before publication. This draft does not claim that particular standard contractual clauses, certifications or EU-only storage have been agreed. Add verified recipients, regions, transfer grounds and how to obtain copies of safeguards through [E-MAIL].

The language cookie lasts one year; local language storage has no automatic expiry. Map consent and geocoding caches are temporary memory data. Admin account data and submissions are held in Lovable Cloud without a general automatic deletion routine in the application. Code does not establish hosting, email or AI provider retention periods. Retention depends on purpose and legal obligations; concrete periods and a working deletion procedure must be completed before publication.

Subject to the statutory conditions, you have rights of access (Article 15), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20 GDPR). You may object to legitimate-interest processing on grounds relating to your particular situation (Article 21). Consent can be withdrawn at any time for future processing without affecting previous lawful processing. Contact [E-MAIL]; a proportionate identity check may be necessary.

You may complain to a data protection supervisory authority (Article 77 GDPR), particularly where you live, work or believe an infringement occurred. The authority competent for the controller must be added once the controller’s location is supplied.

Maps are optional. Mandatory organizer fields, including contact email, are necessary to submit the form; contact name is optional. An email is needed for admin login. There is no general statutory obligation to supply these details to us.

AI converts search requests into filters and some event data is processed automatically. No automated decision-making, including profiling under Article 22 GDPR, produces legal or similarly significant effects concerning you.

9 November 2026. Controller details, provider/contracts and retention arrangements remain incomplete; this draft is not cleared for publication until they are resolved. These texts were drafted with AI assistance and do not replace legal advice.