Data Controller.
The data controller (Verantwortlicher) within the meaning of Art. 4(7) GDPR for the processing described in this policy is:
General information.
This policy applies to the public marketing website at biltix.de and www.biltix.de, including this page and the first-party analytics described in Section VI. It does not apply to the separate, authenticated Biltix product (app.biltix.de), which has its own data flows (user accounts, ticket sales, payment processing) not described here.
We take the protection of your personal data seriously and process it only to the extent necessary to operate this website. "Personal data" means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR), such as a name, email address, country of access, IP address.
This website does not set any cookies of its own, does not use advertising or cross-site tracking services, and does not build advertising profiles. The processing described below is limited to: (1) technically unavoidable server access logging by our hosting provider; (2) the embedded Calendly booking widget, which only loads if you click to load it; (3) our own self-hosted, cookie-free analytics; and (4) error-monitoring data that may be captured only if a technical fault occurs.
Server log files.
This website is hosted on servers operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Each time this website is accessed, the following data is automatically transmitted by your browser and temporarily recorded in server log files: IP address; date and time of the request; requested file/URL; referring URL; browser type and version; operating system; and the requesting internet service provider.
This data is processed solely to ensure technical operation, maintain system security, and enable error diagnosis. It is not merged with other data sources and is not used to identify individual visitors. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure, reliable operation of this website).
Retention. Server log data is retained only for as long as necessary for the purposes stated above, and is not kept indefinitely. [MISSING INFORMATION — MUST BE COMPLETED BEFORE PUBLIC USE: confirm and state the actual configured retention/deletion period for these specific logs once one is set up.]
A data processing agreement pursuant to Art. 28 GDPR has been concluded with Hetzner Online GmbH. Hetzner's privacy policy is available at hetzner.com/de/legal/privacy-policy.
Data protection enquiries.
You can reach us for any data-protection-related enquiry — including requests for information, erasure, or the exercise of any other right described in Section XII below — using the contact details in Section I. When you contact us, the personal data you provide (at minimum your email address and the content of your message) is stored solely to handle your enquiry and is not disclosed to third parties, except where necessary to comply with a legal obligation.
The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries directed to us), or Art. 6(1)(c) GDPR where responding is itself required by law. Your enquiry data is deleted once it has been fully resolved, unless a statutory retention obligation requires otherwise.
Third-party service: Calendly.
This website embeds the appointment-scheduling widget of Calendly LLC, 271 17th St NW, Suite 1000, Atlanta, GA 30363, USA, on the landing page.
The booking calendar only loads if you ask for it. No connection to Calendly is made when the landing page loads. Instead, a placeholder is shown with a notice that loading the calendar will transmit your IP address to Calendly. Only after you click "Load booking calendar" are Calendly's script and iframe (assets.calendly.com, calendly.com) retrieved — transmitting your IP address and standard browser/request data to Calendly LLC at that point. If you go on to book an appointment, the details you enter (e.g. name, email address) are submitted directly to Calendly and are not received or stored by us.
The legal basis for this processing is your consent (Art. 6(1)(a) GDPR), given by that click after being informed what it does, together with § 25(1) TDDDG for any resulting storage on your device. You may decline simply by not clicking — the rest of this website remains fully usable either way.
As Calendly LLC is located in the United States, this transfer is carried out on the basis of Standard Contractual Clauses (Art. 46(2)(c) GDPR). Calendly's own privacy policy is available at calendly.com/pages/privacy.
Cookies and reach measurement.
Aside from the Calendly widget described in Section V — which may set its own cookies once loaded; see Calendly's cookie policy for details — this website does not use cookies of any kind on our own part.
To understand how our website is used, we operate Umami, an open-source analytics tool, on our own server (the same Hetzner infrastructure described in Section III). The data never leaves our own infrastructure and is not transmitted to any third party.
No data is stored on or read from your device. Umami sets no cookies and uses no local storage, session storage, device fingerprinting, or comparable techniques. Because no information is stored in or accessed on your terminal equipment, the consent requirement under § 25 TDDDG does not apply, and no cookie banner is required for this processing.
The following information is recorded for each page view:
- The page visited and its title
- The referring website (referrer URL)
- Browser type, operating system, device type, screen size, and language
- An approximate geographic location (country, region, city) derived from the IP address
- Campaign parameters contained in the URL (e.g. UTM parameters), where present
- Interactions with specific elements, such as clicking the "Book a Demo" button
Your IP address and browser user agent are combined with a website identifier and a secret value that changes daily, and this combination is converted into an irreversible cryptographic hash used to recognise repeat page views within a visit. Your IP address itself is never stored — it is used transiently to generate this hash and to determine the approximate location above, then discarded. Because the secret value changes every day, the resulting identifier cannot be used to recognise you across different days.
The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in understanding the reach of our website and improving our content and services). Given that no cookies are used, no long-term personal identifiers are stored, and the data does not leave our own infrastructure, we consider the impact on your rights and freedoms to be minimal.
You have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR), using the contact address in Section I. You can also prevent this measurement by enabling "Do Not Track" in your browser or using a content blocker.
Retention. Measurement data is retained for a maximum of 12 months and is then deleted automatically by a scheduled process that runs daily on our own server.
Third-party service: Honeybadger.
This website's underlying technical infrastructure uses Honeybadger, an error-monitoring service operated by Honeybadger Industries, LLC (USA), to detect and diagnose technical faults. Honeybadger acts as our processor (Auftragsverarbeiter), processing data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Honeybadger is active for the entire Biltix application, including this marketing website, even though the website itself has no login or account features.
Honeybadger is only triggered when an unhandled technical error occurs while you are using this website — unlike the analytics described in Section VI, it does not run on every normal page view. When it is triggered, it captures data about the request that caused the error. The categories of data processed may include your IP address, browser and device information, the referring URL, the requested file/URL, and the date and time (timestamp) of the request.
The purpose of this processing is to ensure the technical stability, security, and functionality of the site and application, in the same category as the server log files described elsewhere in this policy. The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in identifying and fixing technical faults so that the website functions correctly). This processing takes place entirely server-side and does not store information on, or read information from, your device; it therefore does not require consent under the TDDDG.
The Honeybadger instance used by Biltix is hosted in the United States, so the data described above is transferred to and processed in the USA. Honeybadger does not currently self-certify under the EU-US Data Privacy Framework. This transfer is safeguarded by the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR contained in Honeybadger's Data Processing Addendum, supplemented by a UK IDTA for UK transfers. A copy of the applicable safeguards is available via Honeybadger's DPA at honeybadger.io/terms/data-processing-addendum/. Please note that data transferred to the USA may, despite these safeguards, be subject to access by US authorities, and that the level of data protection there may not fully correspond to that within the EU.
Error reports captured by Honeybadger are additionally forwarded to a Discord channel, via Honeybadger's built-in Discord integration, so that our team is notified of faults in real time. As a result, error data — which may include the categories described above, including your IP address — can reach a second recipient, Discord Inc. (or Discord Netherlands B.V. for users in the EU/EEA), a US-headquartered company, in addition to Honeybadger itself. This transfer is likewise based on the appropriate safeguards under Art. 46 GDPR provided in Discord's applicable data processing terms.
The legal basis for this processing is Art. 6(1)(f) GDPR (legitimate interest in identifying and fixing technical faults so the website functions correctly).
No other tracking.
No advertising, retargeting, or social-media tracking tools are used on this website. Specifically, this site does not use Google Analytics, Google Ads, the Meta/Facebook Pixel, any other third-party web analytics platform, social media plugins, or retargeting services. No advertising profiles are built.
Third parties, summarised.
For clarity, the following table summarizes every external party that can receive data as a result of visiting this website. Umami (Section VI) is not listed here because it runs entirely on our own infrastructure and is not a third party.
| Service | Purpose | Data involved | Location / transfer basis |
|---|---|---|---|
| Hetzner Online GmbH | Web hosting | Server access log data (IP, request metadata) | Germany (EU) — no international transfer |
| Calendly LLC | Appointment scheduling widget (loads only on click) | IP address once clicked; name/email if a booking is made | USA — SCCs; also DPF-listed |
| Honeybadger | Error monitoring (triggers only on technical faults) | IP address, browser and device information, accessed URL, the requested file/URL, date and time of the request | USA — SCCs, not DPF-certified. USA — 2021 EU SCCs (incorporated by reference in Honeybadger's DPA); UK-origin data also under the UK IDTA. Not DPF-certified. |
| Discord | Real-time team notification of errors Honeybadger captures (downstream of Honeybadger, not contacted directly) | Error details, timestamp, and environment | USA/EU — controller split: Discord Netherlands BV for EEA users, Discord Inc. for all others. Transfer basis (EEA/UK/Swiss → US): EU-US Data Privacy Framework + UK Extension + Swiss-US DPF (Discord certified), with 2021 EU SCCs (Modules 1 & 2) as fallback. |
International transfers.
Where personal data is transferred to a service provider located outside the European Union / European Economic Area (Calendly and, unless configured for EU residency, Honeybadger — both US-based), such a transfer is only carried out on the basis of a valid transfer mechanism recognized under Art. 44–49 GDPR — in particular Standard Contractual Clauses (Art. 46(2)(c) GDPR), and, where applicable, the recipient's self-certification under the EU-US Data Privacy Framework adequacy decision. The EU-US Data Privacy Framework adequacy decision remains in force as of the date of this policy, though it is subject to ongoing legal challenge before the Court of Justice of the European Union; this policy will be updated if that changes materially.
Data security and encryption.
We implement appropriate technical and organisational measures to protect your data against unauthorised access, manipulation, loss, or destruction. This website uses TLS/SSL encryption for all connections — you can verify this by checking that your browser shows https:// and a padlock icon in the address bar.
Automated decision-making.
No automated decision-making or profiling within the meaning of Art. 22 GDPR takes place on this website.
Children's privacy.
This website is directed at business users (event organisers) evaluating Biltix as a ticketing platform, not at children. We do not knowingly collect personal data from individuals under the age of 16. If you believe a child has provided us with personal data (for example, through the Calendly booking widget), please contact us using the details in Section I so it can be addressed.
Your rights as a data subject.
You have the following rights regarding the processing of your personal data. To exercise any of them, contact us using the details in Section I.
-
15Art. GDPR
Right of access
Confirmation of whether we process your data, and a copy of it along with information on purpose, source, and recipients.
-
16Art. GDPR
Right to rectification
Correction of inaccurate data or completion of incomplete data, without undue delay.
-
17Art. GDPR
Right to erasure
Deletion of your data where there is no longer a lawful basis for processing it and no statutory retention obligation applies.
-
18Art. GDPR
Right to restriction of processing
Restriction of processing, e.g. while you contest the accuracy of your data or have objected to its processing.
-
20Art. GDPR
Right to data portability
Receipt of your data in a structured, commonly used, machine-readable format, and its transmission to another controller.
-
21Art. GDPR
Right to object
Objection, on grounds relating to your particular situation, to processing based on legitimate interests.
-
7(3)Art. GDPR
Right to withdraw consent
Withdrawal of any consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
Right to lodge a complaint.
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe our processing of your personal data infringes the GDPR. You may contact the authority for your habitual residence, place of work, or the place of the alleged infringement.
Changes to this policy.
This privacy policy is current as of August. 2026 We may update this policy from time to time to reflect changes to this website or to comply with amended legal requirements. The version published on this page is always the current one.