switch.berlin

Legal · GDPR / DSGVO

Privacy policy.

Per-purpose lawful basis, retention schedule, and data-subject rights.

Controller

Verantwortlicher im Sinne der DSGVO / Controller under GDPR Art. 4(7):

Jonatan Snyders
Weisestr. 58, 12049 Berlin, Germany
E-Mail: hello@switch.berlin

Lawful basis for processing

We process personal data only where a lawful basis under GDPR Art. 6 or Art. 9 applies:

Purpose Legal basis
Account creation and login Art. 6(1)(b) — performance of contract
Attendance recording
Attendance on kink/queer events may reveal sexual orientation. Explicit consent is requested before the first attendance record is created. You may withdraw consent at any time from your profile (/me/); withdrawal permanently deletes all attendance records. 		Art. 9(2)(a) — explicit consent
Organizer event publishing
Event listings collected automatically from organizer websites and from Telegram channels and groups: public ones, and invite-only ones the operator's account is a member of. Listings from invite-only sources are shown only to vouched members. Berechtigtes Interesse: making announcements that organizers circulate themselves discoverable in a community-serving, searchable directory. Organizers may object to inclusion at any time via /takedown/ (Art. 21 GDPR) — no login required. Events may name their artists (people who teach, perform or play at them) as text, as the announcement bills them. Artist names are shown only to the audience of the event that credits them: a name on an event that is not public never reaches search engines, sitemaps, structured data, link previews or anonymous visitors. Credited artists may object through the same form without a login (the option I am credited on this event, with the event page, their name and a contact email). Staff then remove the credit within 72 hours and the name is not collected again from the same source. 		Art. 6(1)(f) — legitimate interest (Berechtigtes Interesse)
Flag and takedown reports Art. 6(1)(c) — legal obligation (DSA compliance)
Email delivery (transactional) Art. 6(1)(b) — necessary for the requested service

Special-category data — attendance (Art. 9 GDPR)

Attendance on kink and queer events constitutes special-category data under Art. 9 GDPR because it may reveal your sexual orientation. We process this data only with your explicit consent (Art. 9(2)(a)). Consent is requested once, before your first attendance record is created.

You may withdraw consent at any time from your profile page (/me/). Withdrawal is immediate and irreversible: all attendance records are permanently deleted (Art. 17 erasure). Withdrawal does not affect your account or other data.

Recipients and processors (Art. 13(1)(e) GDPR)

We share data with the following processors under appropriate data processing agreements (DPAs):

  • Hosting — Hetzner Online GmbH, Gunzenhausen, Germany — server infrastructure. EU-based; DPA in place. Your data is processed exclusively within the EU/EEA.
  • Email (transactional) — SMTP provider for transactional emails (account notifications). EU or SCC-covered transfer.
  • LLM processing — Requesty Ltd (LLM router) and OpenAI (OpenAI OpCo, LLC, USA; the model behind the router): large language model (LLM) extraction of event data from Telegram posts, including the images attached to them, and from organizer web pages. OpenAI is based in the United States; transfers are covered by Standard Contractual Clauses (SCC) pursuant to Art. 44ff GDPR. Every collected post is sent to the model once, before it is known whether it announces an event, so it may contain personal data its author wrote in the source channel. No data about users of this platform is sent.
  • Telegram — Telegram Messenger Inc.: source of event announcements, both forwarded by organizers and read from channels and groups the operator's own account is a member of. Telegram is an independent data controller for the source channels; this platform only reads messages there and never posts on anyone's behalf.
  • Search and hosted page reading (Jina, Firecrawl) — Jina (Jina AI GmbH, Berlin, Germany, an Elastic company) and Firecrawl (United States). Where either processes data outside the EU/EEA, the transfer rests on the Standard Contractual Clauses in its data processing agreement (Art. 46(2)(c) GDPR). The operator's search for the public page of an event known only from a Telegram post sends them search queries. When a website blocks a direct request, the event collector and the operator's source search may also have them read a page: an organizer's web page or a page linked from a post, including a post in an invite-only group. They receive the page's address and return its text, seeing only what anyone with the link can see. A link that is itself an access key (a group invite link, a form or file share link, or a link carrying a token) is never sent to them. At most 30 such reads a day.
  • Eventbrite — Eventbrite organizer search: receives organizer names only, to find an organizer's public page.
  • Source hunt (model provider) — The model provider of the operator's hunting agent receives post text and names to judge which public page matches an event.
  • GitHub — Host of the source-hunt log, kept in a private repository. What may be searched or logged depends on the event's visibility: for invite-only events no artist name is searched or logged, and their titles are never logged.
  • MapLibre / OpenStreetMap — OpenStreetMap Foundation (OSMF): map tile delivery for event location maps. Your IP address is transmitted per map load under the OSM Tile Usage Policy. MapLibre is an open-source rendering library; no data is shared with MapLibre itself.

Retention schedule (Aufbewahrungsdauer)

Data category Retention period
Attendance records Until consent is withdrawn; deleted immediately on withdrawal (Art. 17).
Ratings and reviews Until user account is deleted or the review is removed on request.
Flag / takedown reports 3 years (DSA record-keeping obligation).
RawMessage (Telegram ingestion) Collected posts that announce no event: text, images and sender deleted immediately after the model's check. Images of posts that announce events: deleted once the events are extracted, except one reduced copy of the flyer, kept as the event's picture, credited to the organizer on their Switch profile and removed on request via the takedown route. A flyer from an invite-only source is shown only to vouched members. A post whose extraction failed keeps its images until the purge. 90 days after Switch received a post, its text, images and other collected content are purged; the Telegram sender ID stays with the record.
EmailFailure 30 days, then purged.
User accounts Until account deletion is requested by the user or by an administrator.
Session cookies Session duration (browser close) or login expiry.

Your rights (Betroffenenrechte)

Under GDPR, you have the following rights:

  • Access (Art. 15): Request a copy of the personal data we hold about you.
  • Rectification (Art. 16): Request correction of inaccurate or incomplete data.
  • Erasure (Art. 17): Request deletion of your data ('right to be forgotten').
  • Restriction (Art. 18): Request we restrict processing of your data in certain circumstances.
  • Portability (Art. 20): Request your data in a structured, machine-readable format.
  • Objection (Art. 21): Object to processing based on legitimate interest (Art. 6(1)(f)). For organizers: you have the right to object at any time to the inclusion of your event listings on this platform. Submit a takedown request at /takedown/ — no login required. Objections are processed within 72 hours.
  • Withdraw consent (Art. 7(3)): You may withdraw your Art. 9 attendance consent at any time via your profile page (/me/). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise rights other than consent withdrawal and organizer objection, contact us at hello@switch.berlin.

Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority (BlnBDI):

Berliner Beauftragte für Datenschutz und Informationsfreiheit (BlnBDI)
Alt-Moabit 59–61, 10555 Berlin
E-Mail: mailbox@datenschutz-berlin.de
Tel: +49 30 13889-0
https://www.datenschutz-berlin.de

Automated processing (Art. 13(2)(f) GDPR)

Event data is extracted from Telegram messages and organizer web pages using a large language model (LLM). Web pages, including pages linked from posts, are read directly, or through Jina or Firecrawl when a site blocks direct requests (see Recipients and processors). This process is used only for structuring event announcements and does not make legally significant decisions about users. Events of organizers who have not claimed their profile are listed without per-event human review; a human handles failed or uncertain extractions. Organizers who claim their profile approve their own collected events before they are listed.

No automated decision-making with legal effect (Art. 22 GDPR) is applied to users.

Cookies (TTDSG §25)

This platform uses a single session cookie for the age gate. The age-gate cookie is strictly necessary to provide the service you have explicitly requested — 18+ content access (TTDSG §25(2) Nr. 2). No consent banner is required for this cookie. No tracking, analytics, or advertising cookies are used.

Minimum age (JuSchG)

This platform is restricted to users aged 18 and over (JuSchG §§ 4, 5). By passing the age gate, you confirm you are at least 18 years old. We do not knowingly collect personal data from persons under 18. If we become aware that a minor has registered, the account will be suspended immediately.

Last updated · 2026-04-22