1. Who is responsible
The controller under the EU General Data Protection Regulation (GDPR) is:
Alex Vierdag, trading as plusfiveAm Mühlenbusch 56, 42781 Haan, Germany
Email: hello@plusfive.city
We have not appointed a data protection officer because the law does not require one for a business of our size. For any privacy question, write to the address above.
2. The short version
- We collect what we need to run nights: your first name, your email, the night you book and, if you tap it on your ticket, your age range.
- Your card is only charged if your night happens. We never see your full card number.
- Your table sees your first name and your chat messages, nothing else. The bar gets no personal data from us.
- No ads, no tracking cookies, and we never sell your data.
3. Visiting our website
Our website is hosted by Cloudflare. When you open it, your browser automatically sends technical data: your IP address, date and time, the page you requested, the referring page, browser and device type, and language settings. Cloudflare processes this data to deliver the website, to protect it against attacks and misuse, and to give us aggregated statistics such as the number of visits and the countries they come from. Cloudflare deletes this data after a short period according to its retention rules.
Legal basis: our legitimate interest in a secure, fast and working website (Art. 6(1)(f) GDPR).
We do not use analytics or advertising tools that store or read information on your device, and we do not use cookies for tracking. To detect and block malicious traffic, Cloudflare may set a strictly necessary security cookie. This is permitted without consent (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). Our fonts are hosted on our own website, so no connection to font providers is made.
4. Wishing for a city
What we collect: your email address, the city you wish for or signed up for with "I'm in", the link you came from (campaign, invite and partner parameters such as utm_source, utm_campaign, ref or g) and the time of your wish.
Why: to count your wish, to decide where we open next and to email you when plusfive opens in that city.
Legal basis: your consent, which you give when you send the wish (Art. 6(1)(a) GDPR). You can withdraw it at any time through the unsubscribe link in every email or by writing to us. This does not affect the lawfulness of processing before the withdrawal.
How long: until you unsubscribe or ask us to delete your wish. If we have not emailed you for 24 months, we delete it.
5. Booking a night
What we collect: your email address, your first name (you enter it on the Stripe payment page), the city and night you book, your age range if you tap it on your ticket page (optional), the link you came from (see section 4) and the status of your booking.
Payment: you enter your payment details on the payment page of Stripe. When you book, Stripe places a hold for the price on your card. The card is charged when your table is set, at 12:00 on the day or later that day if you book or wait for a table on the day; if you do not get a seat, the hold is cancelled. We receive the payment status, the amount, the type and country of your card and a technical identifier of the card (fingerprint) that lets us recognise the same card again; we use it only for our block list (section 9). We never see your full card number. For fraud prevention Stripe also processes technical data such as your IP address.
Why: to hold your seat, to decide whether your night takes place, to seat you at a table, to send you your ticket emails and to refund you where our terms say so.
Legal basis: performance of the contract with you and steps before it (Art. 6(1)(b) GDPR) and our record-keeping duties under tax and commercial law (Art. 6(1)(c) GDPR).
Stripe: our payment provider is Stripe Payments Europe, Limited, Dublin, Ireland. For some purposes, such as fraud prevention and compliance with financial regulation, Stripe acts as an independent controller under its own privacy policy.
How long: records of charged bookings for as long as German tax and commercial law requires, usually 8 years (§ 147 German Fiscal Code, § 257 German Commercial Code). All other booking data for 12 months after the night.
6. Your table
We put the tables for a night together automatically, in the order of booking. If more than one table is needed, we use the age range you gave us to seat people of a similar age together. This has no legal effect on you and does not affect you in a similarly significant way (Art. 22 GDPR).
What your table sees: your first name from the moment your table is set, and the messages you write in the table chat, including a short note if you tell your table that you cannot come. We never share your email address, surname or payment details with other guests. The bar receives no personal data from us; tables are reserved under the name plusfive and a table number.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
How long: table assignments for 12 months after the night, so we do not seat you with the same people again too soon. Then we delete them.
7. The table chat
On your ticket page your table can write to each other, for example to say that someone is running late. We store your first name, your messages and the time you sent them.
Who can read it: only the people at your table. We only look at messages when someone reports them to us or when we need to check a breach of our house rules.
Legal basis: performance of the contract, because the chat is part of how your table meets (Art. 6(1)(b) GDPR). If a message is reported, we keep it to handle the report, based on our legitimate interest in the safety of our guests (Art. 6(1)(f) GDPR).
How long: the chat closes at 06:00 the next morning, and we delete every message within 48 hours. Reported messages are kept until the report is settled.
8. Emails we send
Ticket emails: your booking confirmation with our terms as a PDF, a short note when your night is confirmed or when you are waiting for a table on the day, the bar and your table when your table is set, your final table at 19:00 on the day or an email that your night does not take place, and messages about changes or refunds. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
After your night: a short feedback question and news about upcoming nights in your city. We send these because you booked with us (§ 7(3) of the German Act against Unfair Competition, UWG) and on the basis of our legitimate interest in improving plusfive and filling the next tables (Art. 6(1)(f) GDPR). You can object at any time, without any costs other than the basic transmission costs, through the unsubscribe link in every email or by writing to us.
We send our emails with Resend from addresses ending in @plusfive.city.
9. Reports and our block list
If you report something that happened at a night or in the chat, we process your report, your contact details and the data of the people involved to look into it. If someone seriously or repeatedly breaks our house rules, we put them on a block list with their email address, first name and card identifier (section 5), so that they cannot book again. A person decides every block, not an algorithm.
Legal basis: our legitimate interest, and that of our guests, in safe nights (Art. 6(1)(f) GDPR).
How long: reports until they are settled, and block list entries for up to 3 years after the last incident.
10. Photos and videos
We only take, share or repost photos and videos with the consent of everyone who can be recognized (Art. 6(1)(a) GDPR). Creators at a night must ask everyone at the table first, and anyone can say no. You can withdraw your consent at any time. We then remove the material from our own accounts.
11. Creators and partners
Creators: if you film a night with us, we process your handle, platform, city, email address, your personal link and its statistics, and the posts you publish about plusfive. Legal basis: our cooperation (Art. 6(1)(b) GDPR).
Partners: if your organisation shares plusfive with its residents or members, we process the name, email address and role of our contact person and count the bookings made through the partner link. We only share aggregated numbers with partners, never who booked. Legal basis: our cooperation and our legitimate interest in working with partners (Art. 6(1)(b) and (f) GDPR).
How long: for the duration of the cooperation, then 12 months.
12. Contacting us
Emails to hello@plusfive.city are forwarded by Cloudflare to our mailbox. If you email us or send us a direct message, we process your message and contact details to answer you (Art. 6(1)(b) GDPR if it concerns a booking, a creator cooperation or a partnership, otherwise Art. 6(1)(f) GDPR). We delete them once your request is settled, unless we have to keep them by law.
13. Our social media profiles
We have profiles on TikTok and Instagram. Our website only links to them; visiting our website does not send any data to these platforms. When you visit our profiles, the platforms process your data under their own responsibility and privacy policies. For the statistics the platforms provide to us about our profiles, we may be jointly responsible with the platform (Art. 26 GDPR).
14. Service providers and transfers outside the EU
We work with a small number of service providers. They process data only on our behalf and under a data processing agreement (Art. 28 GDPR), unless stated otherwise.
| Provider | What for | Transfers outside the EU |
|---|---|---|
| Cloudflare, Inc., USA | hosting, database, email forwarding, security | EU-US Data Privacy Framework, standard contractual clauses |
| Resend, Inc., USA | sending our emails | EU-US Data Privacy Framework |
| Stripe Payments Europe, Limited, Ireland | payments, card holds and refunds; partly an independent controller | possible transfer to Stripe, Inc., USA: EU-US Data Privacy Framework, standard contractual clauses |
For the USA, the European Commission has decided that companies certified under the EU-US Data Privacy Framework ensure an adequate level of data protection (Art. 45 GDPR). Where this does not apply, we rely on the EU standard contractual clauses (Art. 46(2)(c) GDPR).
15. Your rights
You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20), and to withdraw any consent with effect for the future (Art. 7(3)). To use these rights, email hello@plusfive.city.
Your right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time for reasons arising from your particular situation. You can object to emails about upcoming nights at any time and without giving reasons. Then we stop.
You also have the right to lodge a complaint with a data protection supervisory authority, for example in the country where you live or the one responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Düsseldorf, Germany.
16. Everything else
Do you have to give us your data?
For a wish we need your email address and city. For a booking we also need your first name and your payment details. Without these we cannot offer you the service. Your age range is optional.
Age
plusfive is only for adults: 18 or older, and 21 or older in the USA. We do not knowingly process data of minors.
Security
Our website is only available over an encrypted connection (TLS). Your ticket page is protected by a personal link that only you receive. Access to your data is limited to the people who run plusfive.
Changes to this policy
We update this policy when our service changes. The current version is always on this page.