Privacy Policy

This is a translation for convenience. TheGerman version is the binding one.

1. Controller

2. What this site does and does not do

This website sets no cookies of its own. Fonts and icons are served from our own domain, so opening a page contacts no third party. Nothing that is not strictly necessary loads until you agree to it.

Your privacy choice is kept in your browser's local storage. It stays on your device and is never sent to us.

3. Hosting and server logs

This site is hosted by Netlify, Inc., 512 2nd Street, Suite 200, San Francisco, CA 94107, USA.

When you open a page, the web server processes technically necessary data: IP address, date and time, the page requested, the amount of data transferred, your browser, your operating system and the referring URL. This is needed to deliver the site and keep it stable and secure. The legal basis is Art. 6(1)(f) GDPR.

Netlify processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Processing in the United States cannot be ruled out; it takes place under Art. 44 ff. GDPR on the basis of the standard contractual clauses Netlify uses.

4. Google Maps

We offer a Google Maps map on the venue page. The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map only loads after you ask for it. Until you press "Load map", there is no connection to Google. After that, data such as your IP address, browser and device information, the time of the request and technical usage data are sent to Google. If you are signed in to a Google account at the same time, Google may associate the use with your account.

The legal basis is your consent under Art. 6(1)(a) GDPR together with § 25(1) TDDDG.

5. Google Analytics

We use Google Analytics 4 (Google Ireland Limited) to see which pages people visit. It loads only after you agree. Without your consent there is no measurement and no cookie is set.

After you agree, the following may be processed: a shortened IP address, device and browser information, the pages you open, how long you stay and the referring page. Google Analytics 4 always shortens the IP address and never stores it in full. Google signals and ad personalisation are off.

The legal basis is your consent under Art. 6(1)(a) GDPR together with § 25(1) TDDDG. You can withdraw it at any time from the cookie settings in the footer.

6. Bookings through Eversports

We use Eversports (Eversport GmbH, Jakov-Lind-Straße 13/H/5th floor, 1020 Vienna, Austria) to take and manage class bookings. Our site only links to Eversports; a connection is made when you follow one of those links.

A booking may involve your name, email address, phone number, booking data, payment and invoice data. Where Eversports provides booking and participant management for us, it acts as our processor under Art. 28 GDPR, and our own processing rests on Art. 6(1)(b) GDPR. Eversports' own platform features are covered by its own privacy information.

7. Urban Sports Club

Midnight Havana is a partner of Urban Sports GmbH, Novalisstraße 10, 10115 Berlin. If you attend on a membership, we receive your name, membership number, check-in information and the class, date and time. The legal basis is Art. 6(1)(b) GDPR.

8. Payments at the venue

Card payments are handled by SumUp (SumUp Limited, Block 8, Harcourt Centre, Charlotte Way, Dublin 2, D02 K580, Ireland). We never receive your full card details. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for the records we must keep. Paying cash involves no personal payment data.

9. Contacting us

If you write to us by email, on Instagram or on WhatsApp, we process what you send us in order to answer. The legal basis is Art. 6(1)(b) GDPR for booking-related messages and Art. 6(1)(f) GDPR otherwise. We delete the data once your enquiry is dealt with and nothing obliges us to keep it.

10. WhatsApp community and Instagram

Joining our WhatsApp community is voluntary. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, Ireland. Your mobile number, profile name, messages and the time of your messages may be processed. The legal basis is your consent under Art. 6(1)(a) GDPR, and you can leave at any time.

We run an Instagram profile (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland). Our site only links to it; no connection to Meta is made until you follow the link.

11. Photos and video at events

Photos and video may be taken at our events and used to document them and to promote Midnight Havana. For overview and group shots we rely on Art. 6(1)(f) GDPR together with §§ 22 and 23 of the German Art Copyright Act. For portraits of an individual we ask for consent under Art. 6(1)(a) GDPR.

If you would rather not be photographed or filmed, tell the event team or the photographer. You may object under Art. 21 GDPR to processing based on Art. 6(1)(f) GDPR.

12. How long we keep data

We keep personal data only as long as it is needed for the purpose it was collected for, unless commercial or tax law requires us to keep it longer.

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Where we process data under Art. 6(1)(f) GDPR, you have a right to object under Art. 21. You may withdraw any consent at any time with effect for the future.

14. Right to complain

Under Art. 77 GDPR you may complain to a supervisory authority. Ours is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, phone +49 30 13889-0, emailmailbox@datenschutz-berlin.de.

15. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

See also our terms and conditions and our imprint.