Last updated: 23 September 2026

This English language version is for convenience purposes only. The German language version at www.dawawas.de/inhalte/datenschutz/ is the only legally binding version. In case of contradictions the German version prevails. German law applies.

Below we inform you about the collection of personal data when using our website and apps. Personal data are all data that can be related to you personally, e.g. name, address, e-mail addresses, usage behaviour.

I. General

Controller within the meaning of Art. 4(7) GDPR: conceptspace GmbH, Brüsseler Platz 8, 50672 Cologne, Germany (also “dawawas”), e-mail: info@dawawas.de, phone: +49 221 - 560 371 34 (see also Imprint).

No data protection officer is appointed, as the statutory requirements for this are not met. Please send privacy requests to the controller at the contact details above.

The supervisory authority responsible for us is the North Rhine-Westphalia Commissioner for Data Protection and Freedom of Information (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

Our service is intended for persons aged 16 and over. Persons under 16 may use dawawas only with parental/guardian consent (Art. 8 GDPR).

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

II. Your rights

(1) You have the following rights regarding your personal data: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).

(2) Withdrawal of consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. Processing before withdrawal remains lawful. You can disable push notifications at any time in your device settings or dawawas settings. Third-party content you activated by click (see III. (2) c) is not loaded automatically again on the next page visit.

(3) Right to object (Art. 21 GDPR) — separate notice: You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. We will then no longer process the data unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Please send objections to the contact details under I.

(4) You also have the right to lodge a complaint with a supervisory authority, in particular the authority named under I.

(5) Rights of persons without a dawawas account: Even without an account you may exercise the rights above — e.g. if you appear in an uploaded photo or received an invitation. You do not need an account or our app. Use the form at https://www.dawawas.de/melden or write to info@dawawas.de. See also III. (7) and III. (8).

(6) Retention periods (Art. 13(2)(a) GDPR): We store personal data only as long as necessary for the respective purposes or as required by law. In particular:

• Server log files: typically 30 days,
• Login cookies: until logout, for a maximum of 12 months,
• Account data and uploaded content: until account/content deletion; in backups for up to 30 days thereafter (see III. (4) d),
• Photo locations: until the uploader removes the location or the photo is deleted,
• Contact enquiries by account holders: for the duration of the account, plus six months after account deletion; contact enquiries without an account: six months after final handling (see III. (3)),
• Content reports: until the procedure is closed, thereafter only as required to establish, exercise or defend legal claims (see III. (8)),
• Invitation data of persons without an account: until the invitation is accepted, declined or withdrawn or the related context ends (see III. (7)),
• Device and push tokens: until device unlink, disconnection or account deletion,
• Invoices and booking records eight years, commercial letters six years, books and records ten years (§ 147 AO, § 257 HGB).

III. Processing of data

(1) Use of our website

a) Server log files: Accesses are logged for internal purposes (security, error analysis, operations): requested file, date/time, data volume, status, browser, IP address and referring domain. We delete these data within 30 days unless longer retention is required for security or evidence in an individual case. Legal basis: Art. 6(1)(f) GDPR.

b) Cookies and similar technologies: We only use cookies and similar technologies that are strictly necessary to provide the service you expressly requested — in particular session and login cookies and security functions. No consent is required under § 25(2) no. 2 TDDDG. Legal basis: Art. 6(1)(b) GDPR where required for use of your account, otherwise Art. 6(1)(f) GDPR. Session cookies are deleted when you close the browser. Login cookies remain until logout, for a maximum of the period under II. (6). You may delete cookies in your browser at any time. We do not use cookies for analytics, advertising or marketing. YouTube videos (on the start page, the explainer-video page and similar pages) are only loaded when you activate them by click (see III. (2) c). The map display for photos and events is available only to logged-in users and is loaded only when you activate it by click (see III. (4) b).

(2) Analytics, social media and embedded content

a) No usage analytics: We use no web analytics or tracking tool — neither third-party cookies nor first-party/server-side usage analytics. Our apps also contain no analytics, tracking, advertising or crash-reporting services and use no advertising ID.

b) Meta / Facebook: Provider for users in the EEA is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). Sharing: no connection to Meta is made when you merely visit our pages; Meta’s share function is only invoked after you click. Facebook login: optional; you are redirected to Meta only after clicking the button. Meta transmits login data (e.g. name, e-mail) to us to the extent you grant them and learns that you use dawawas. Legal basis: Art. 6(1)(b) GDPR. Meta privacy policy: https://www.facebook.com/privacy/policy/. Transfers to third countries: see III. (9).

c) YouTube videos: On the start page, the explainer-video page and similar pages we offer videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). No connection to YouTube is made on page load. Only when you click the video is the YouTube player API loaded and the video embedded in privacy-enhanced mode (youtube-nocookie.com). In particular your IP address, browser and device information and our page URL may be transmitted to Google, and YouTube may store or read cookies or similar technologies. By clicking you consent to this processing (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). Transfers to the USA may occur; see III. (9). Details: https://policies.google.com/privacy.

(3) Contact

If you contact us by e-mail or contact form, we process the data you provide (e-mail address, name and phone number if any, and the content of your enquiry) to handle your request. If you have a dawawas account, we associate the enquiry with your account so that later enquiries remain in context. We store the correspondence for the duration of your account. If you delete your account, we retain the correspondence for a further six months — for example so that a request you sent shortly before deletion can still be completed and traced. We then delete it. If you do not have a dawawas account, we delete your enquiry six months after it has been finally handled. Statutory retention (e.g. contract/billing) is as under II. (6).

Abuse protection: If you use our contact or report form without being logged in, or if you delete your account, we use Cloudflare Turnstile (Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA) to prevent automated requests. In particular your IP address and browser and device information are transmitted to Cloudflare. Legal basis: Art. 6(1)(f) GDPR. Transfers to the USA may occur; see III. (9). If you do not wish to use Turnstile on the contact or report form, write to info@dawawas.de. Other legal bases: Art. 6(1)(b), (f) or (c) GDPR as applicable.

(4) Registration, account and use of our services

a) We process registration data (required and optional) and uploaded photos/content. Visibility follows your settings. We do not disclose personal data to third parties outside dawawas unless you consent, we are legally obliged, or disclosure is to processors under Art. 28 GDPR (see lit. h). PayPal and the Apple/Google services named herein act as independent controllers. Legal basis: Art. 6(1)(b) GDPR.

b) Image metadata, location and map: EXIF metadata (e.g. capture time, camera info, GPS) may be used for sorting and cataloguing (Art. 6(1)(b) GDPR). If location data exist, we may store the capture location separately and show it on a small map. The map is available only to logged-in users with access to the event; guests of public events see neither map nor location. Uploaders may change or remove the location. Location data are removed from the image files we deliver for display. Google Maps (Google Ireland Limited): no connection to Google Maps is made on page load. Only when you click “Karte anzeigen” is the map loaded from Google. In particular your IP address, browser/device information and the map view (and thus the photo location) may be transmitted to Google, which may store or read cookies or similar technologies. By clicking you consent to this processing (Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG). Transfers: see III. (9). Originals: Premium users may download unchanged originals including all original metadata/GPS; changing/removing the location in dawawas does not affect the original. We do not perform automatic face recognition or person tagging.

c) Premium payments via PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, as independent controller. PayPal account, debit/credit card or (where offered) SEPA may be used. We receive in particular transaction/subscription IDs, payment status and possibly payer name/e-mail; we do not receive full card or account numbers. PayPal privacy policy: https://www.paypal.com/uk/webapps/mpp/ua/privacy-full. Legal basis: Art. 6(1)(b) and, for billing records, Art. 6(1)(c) GDPR.

d) Deleted content is removed from the live system without restoration; backups may retain it for up to 30 days and are used only for disaster recovery. Account deletion: Settings → Delete or contact us. Exceptions under II. (6) (e.g. billing, support correspondence).

e) Service e-mail notifications (new photos, invitations, anniversaries); no marketing e-mails. Sent via our Host Europe mail infrastructure. Adjust/unsubscribe in settings. Legal basis: Art. 6(1)(b) GDPR.

f) Smart TV linking via a code shown on the TV and entered on the website (Art. 6(1)(b) GDPR).

g) Apps from Apple App Store / Google Play (Apple/Google as independent controllers). Push via Apple APNs (Apple Distribution International Ltd., Cork) and Firebase Cloud Messaging / Google Ireland Limited; tokens and message content may be transmitted; US transfers possible (III. (9)). Legal basis: Art. 6(1)(b) GDPR. Maps in the apps use Google Maps (Google Ireland Limited); provider, transmitted data and third-country transfers correspond to lit. b. Loading only after a click applies to the website.

h) Hosting: Host Europe GmbH and Amazon Web Services EMEA SARL as processors under Art. 28 GDPR; storage contractually limited to Germany; access by AWS, Inc. (US) cannot be fully excluded (III. (9)).

(5) There is no obligation to provide personal data merely to visit the website. Registration or Premium requires the data necessary for those purposes.

(6) Unless otherwise stated, legal basis for service processing is Art. 6(1)(b) GDPR.

(7) Invitations to persons without a dawawas account

Users may invite others by e-mail or link. E-mail invitations: we process the invitee’s e-mail address and, where provided, name, your name and the related event, solely based on your individual action; no automatic reminders or marketing. Link invitations: we receive no invitee data until the link is opened. You are responsible for selecting recipients. We store invitation data while open and delete them when accepted, declined or withdrawn, at latest when the event or your account is deleted. Resending occurs only if you actively trigger it. Legal basis: Art. 6(1)(f) GDPR. Information for invitees (Art. 14 GDPR): your e-mail address comes from the inviter; you may object and request erasure via the invitation e-mail link, /melden or info@dawawas.de.

(8) Depicted persons and reporting content

Uploaded photos may show further persons. The uploading user is responsible for selection/upload; we are controller for storage and provision on the platform. Where depicted persons are unknown to us, we inform via this policy (Art. 14(5)(b) GDPR). To request removal without an account, use https://www.dawawas.de/melden or info@dawawas.de. The same form allows reports of illegal content (Art. 16 DSA / Digital Services Act). Logged-in users also find report links on photos and events. We process form data (content URL/ID, reasons, name/e-mail if provided) to review the report, confirm receipt and communicate our decision. If we remove or restrict content we inform the affected user with reasons (Art. 17 DSA); we generally do not pass on your name/e-mail. We store reports until the procedure is closed and thereafter only as needed for traceability or legal claims. Legal basis: Art. 6(1)(c) GDPR in conjunction with Arts. 16 and 17 DSA, and Art. 6(1)(f) GDPR.

(9) International transfers (e.g. Meta, PayPal, AWS, Apple, Google — FCM, Maps, YouTube — or Cloudflare Turnstile) rely on the EU-US Data Privacy Framework where certified and/or EU Standard Contractual Clauses, plus additional measures where required. The former Privacy Shield is no longer a valid basis (CJEU Schrems II, 16 July 2020).

Cologne, 23 September 2026