Privacy notice
How we handle the details you give us when you apply for Black & Blood on 31 October 2026. Written under Articles 13 and 14 of the GDPR.
1. Who is responsible
Fifteen-Love GbR, Karl-von-Drais Straße 6, 60435 Frankfurt am Main, Germany, represented by Fabio C. Masilla.
Email info@fifteen-love.de, telephone +49 176 32901031.
[If a data protection officer has been appointed, give the contact details here. Most organisations of this size are not required to appoint one.]
2. In short
- We collect the details you type into the application form, and nothing else about you.
- They are stored on a database server in Frankfurt am Main, Germany.
- We use Brevo to send email. Your contact details are passed to Brevo for that purpose.
- There is no analytics, no advertising pixel, no tracking cookie and no embedded content from other sites.
- We do not sell your data and we do not pass it to anyone who is not named here.
3. What we collect when you apply
When you send the application form we store the following. Fields marked as required are the ones without which we cannot handle the application.
| What | Required | Why |
|---|---|---|
| First and last name | yes | To identify you and to make up the guest list at the door |
| Email address | yes | To send the confirmation and our decision |
| Mobile number | no | Guest list at the door and short-notice contact on the day |
| City | no | To judge whether you are travelling in, which matters for rooms |
| Instagram handle | required for VIP applications | To assess VIP applications |
| Guest type and category | yes | To route your application correctly |
| Number of people and their names | yes / no | Capacity planning and the guest list |
| Reach, platforms, portfolio link | no | Only for VIP applications |
| Company, role, website, partner model, budget range | partly | Only for brand enquiries |
| Number of rooms and nights | no | To request a room from the hotel for you |
| How you heard about it, free-text message | no | Optional. Helps us understand and answer you properly |
| Your consent choices, the time and the version of the text shown | yes | To be able to prove what you agreed to |
| A one-way hash of your IP address, and your browser identifier | automatic | Abuse prevention. The address itself is never stored in the clear |
4. Legal basis
- Handling your application, and the event itself. Article 6(1)(b) GDPR, since you are asking us to take steps towards a contract, and Article 6(1)(f) GDPR for our legitimate interest in organising a curated event. We also ask for your agreement in the form so that the position is clear to you.
- Newsletter. Article 6(1)(a) GDPR, your consent. Entirely optional, and you can withdraw it at any time.
- Photography and film at the event. Article 6(1)(a) GDPR where you have given consent, and Article 6(1)(f) GDPR for general views of the event where individuals are not the subject of the picture. German law on the right in one's own image also applies.
- Abuse prevention and server logs. Article 6(1)(f) GDPR, our legitimate interest in keeping the site working and free of automated submissions.
5. Who receives your data
Hosting
The website is delivered by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The database is operated by Neon Inc., 209 Orange Street, Wilmington, DE 19801, USA, on servers located in Frankfurt am Main, Germany. Both providers process data on our behalf under a data processing agreement in line with Article 28 GDPR. For the transfer of personal data to companies based in the United States, both providers rely on the Standard Contractual Clauses under Article 46(2)(c) GDPR; the applications and the stored data themselves are hosted inside the European Union.
Email delivery: Brevo
We use Brevo for the confirmation and for our decision emails. Brevo is operated by Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France, with a German entity, Brevo GmbH, in Berlin. Your name, email address and the details of your application are transferred to Brevo so that it can send and manage these messages. Brevo acts as our processor under a data processing agreement. Brevo is operated by Sendinblue SAS, 106 Boulevard Haussmann, 75008 Paris, France. Its servers are located within the European Union.
The hotel
If you ask for a room, we pass your name, the number of rooms and the nights to Roomers Berlin so that the hotel can hold and confirm the booking. From that point the hotel is a separate controller for the booking and its own privacy notice applies.
Ticketing
Tickets are sold through pretix, operated by rami.io GmbH, Zwinglistrasse 8, 69126 Heidelberg, Germany. If your application is successful we create a personal voucher there and send you a link to it. Only your name, your email address and the category you applied for are passed on. Accommodation is booked with and invoiced by Roomers Berlin directly - we only pass on your name if you ask us to.
Paying for your ticket
You choose how to pay during checkout. We never see your card or account details: they go straight from your browser to the payment provider.
- Card and Google Pay - Stripe Payments Europe, Ltd., The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland, together with its parent Stripe, Inc. in the United States. Stripe receives your payment details, the amount and your email address. stripe.com/privacy
- PayPal - PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you pay this way, PayPal receives the amount and your email address and processes your login under its own responsibility. PayPal privacy statement
The legal basis is Article 6(1)(b) GDPR: without a payment there is no ticket.
Partners of the evening
We do not pass your application to sponsors or partners. Where a partner brings its own guests, that partner collects those details itself and is responsible for them.
6. Transfers outside the EU
Your application, the database and the email service all stay inside the European Union. There is one exception, and it only arises if you pay by card:
Stripe. Your contractual partner for the payment is Stripe Payments Europe, Ltd. in Ireland, but the group processes card data through Stripe, Inc. in the United States. Stripe is certified under the EU-US Data Privacy Framework, and the transfer is additionally based on the European Commission's standard contractual clauses. If you would rather your data did not leave the EU, pay with PayPal, which processes in Luxembourg.
Beyond that we plan no transfer outside the European Union. Should one become necessary, it will only take place on the basis of an adequacy decision or the standard contractual clauses, and we will update this notice.
7. Cookies and tracking
This site sets no cookies for visitors, uses no analytics, no advertising pixels and no embedded content from other providers. Fonts and images are served from our own server. That is why there is no consent banner: there is nothing to consent to under section 25 of the German TDDDG.
One cookie exists, and only for us: signing in to the internal administration area sets a session cookie. It is strictly necessary for that function and is never set for ordinary visitors.
8. Server logs
Our server records each request with the time, the page requested, the status, the browser identifier and a one-way hash of the IP address. We use this to find faults and to detect abuse. These records are deleted after 14 days.
9. How long we keep things
| Category | Kept until |
|---|---|
| Applications that were declined or withdrawn | Deleted three months after the event |
| Applications of guests who attended | Deleted twelve months after the event, unless a longer period is required by law |
| Brand and partner enquiries | Kept for the business relationship, then in line with statutory retention rules |
| Newsletter subscription | Until you withdraw it |
| Record of consent | Three years after the consent ends, so that we can prove it if challenged |
| Server logs | [14 days] |
10. Photography and film at the event
Photographs and film are made during the evening for the aftermovie, a photo set and the channels of Red Tree, Roomers Berlin and the partners of the night. There are signs at the entrance and the crew is recognisable.
You can decline. Tell us at the door or write to info@fifteen-love.de, and we will note it and pass it to the crew. If you appear in a picture that has already been published and want it taken down, write to the same address and we will remove it as far as we are able.
11. Your rights
Under the GDPR you have the right to:
- ask what data we hold about you and receive a copy (Article 15)
- have inaccurate data corrected (Article 16)
- have your data deleted (Article 17)
- have processing restricted (Article 18)
- receive your data in a portable form (Article 20)
- object to processing based on our legitimate interest (Article 21)
- withdraw a consent at any time, with effect for the future (Article 7(3))
One email to info@fifteen-love.de is enough. We answer within one month.
Every newsletter contains an unsubscribe link. Using it is enough to withdraw that consent.
12. Complaints
You can complain to a supervisory authority. The one responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany. You may also complain to the authority where you live or work.
13. Automated decisions
There are none. Every application is read and decided by a person. There is no profiling and no automated scoring.
14. Do you have to give us this data?
No. Giving it is voluntary. Without a name and an email address we cannot process an application, so in that sense they are necessary for taking part. The optional fields have no effect on whether your application is accepted, except where they help us judge a VIP or brand enquiry.
15. Changes
We will update this notice if the site or the way we handle data changes. The current version always applies.
Version 1.0, last updated 5 September 2026. The consent wording shown in the form carries the version number that is recorded with every application, so we can always tell which text you were shown.