Privacy

Controller

Manfred Bausch, Richard-Kuenzer-Str. 1c, 79102 Freiburg im Breisgau, Email: kontakt@trisonia.eu

Hosting and server logs

Trisonia runs on servers operated by Hetzner Online GmbH in Germany. When you open a page, the server processes technically necessary data such as your IP address, the time, the address requested and the browser identifier in order to deliver the page and fend off attacks. Server logs are kept for no more than 14 days. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). A data processing agreement (Art. 28 GDPR) is in place with Hetzner.

Backups

The Trisonia database is backed up every day so that nothing is lost after an outage. The backups are kept on the server and on a computer of the controller and are deleted after 7 days at the most. Data we delete is therefore also gone from the backups no later than 7 days afterwards. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Cookie and browser storage

Trisonia sets a technically necessary session cookie (_trisonia_key). It protects forms against misuse and is deleted when you close your browser. Only if you tick “Remember region and genre” on the home page do we set a second cookie (trisonia_auswahl). It contains the chosen region and genres so that the home page shows them on your next visit; it is valid for one year and is deleted as soon as you untick the box. If you choose a light or dark theme, your browser remembers this locally (phx:theme); this setting never leaves your device. All of this is strictly necessary for the function you requested (§ 25 (2) TDDDG, German Telecommunications Digital Services Data Protection Act), which is why there is no cookie banner.

If you hide a note (for example about holidays) with “×”, your browser remembers this only until you close the tab (sessionStorage, trisonia:notice-hidden). This information does not leave your device either.

Visitor count without cookies, no third-party servers

To see whether and how Trisonia is used, we count page views ourselves, without a cookie and without a third-party service: per day, how often each page was opened, in which language, and which website visitors came from (only its domain, such as www.google.com). To count the visitors of a day, the server derives a short value from the IP address and the browser identifier, using a secret key that is created anew every day at midnight. This value exists only in memory, never reaches the database or the log, and can no longer be linked to anyone the next day. Only daily totals are stored, for 400 days. Nothing is stored on or read from your device for this. The legal basis is our legitimate interest in knowing whether and how Trisonia is used (Art. 6(1)(f) GDPR).

We don’t embed any third-party services. Fonts, the map and all files come from Trisonia itself; opening a page sends no requests to other servers. Only when you follow a link, for example to a venue’s or platform’s site, do their privacy policies apply.

Newsletter

For the newsletter, we store your email address, the regions, genres and language you chose, the times of your sign-up, confirmation, last confirmation email and last issue, and how many confirmation emails we sent (three at the most). The legal basis is your consent (Art. 6(1)(a) GDPR), which you give via the link in the confirmation email (double opt-in).

If you don’t confirm, we delete the subscription after 3 days. The unsubscribe link in every email lets you withdraw your consent; your data is then deleted from the database immediately and is also gone from the backups after 7 days at the most. We also delete addresses that cannot be delivered to or that receive a complaint.

The emails are sent on our behalf by Lettermint (Lettermint B.V., Netherlands) under a data processing agreement (Art. 28 GDPR). We track neither opens nor clicks.

The emails show the Trisonia logo as an image from www.trisonia.eu, at the same address for all recipients. If your email program loads it, your request is kept in the server's access log for at most 14 days, like any page view; we do not analyse who opens an email. If it does not load images, you see the name instead.

Feedback

If you send feedback via “Get involved”, we store the type, your text, the name if you give one, the language of the page, the time, and our status and reply. We do not ask for an email address and we do not store an IP address. The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by sending it.

To prevent abuse, we count how many feedback messages came from the same connection in the last hour. For this we derive an encrypted short value from the IP address, using a key that is newly created every day. The value and the count are kept only in memory, for one day at the most, and never go into the database or the logs. The legal basis is our legitimate interest in protection against abuse (Art. 6(1)(f) GDPR).

We review all feedback before it appears publicly; all visitors then see the type, text, name or “anonymous”, date and our reply. Feedback is deleted if we do not publish it or if you ask us to: write to the contact address and give the text and date.

So that we see new feedback quickly, Trisonia sends its text with the kind, the name (if given) and the language by email to the operator, through the same email service as the newsletter (Lettermint). The email contains no data we do not store anyway.

Calendars, feeds and AI interface

Calendar subscriptions, the feed of new concerts and the interface for AI assistants (MCP) provide concert data only. They require no sign-up and store nothing about you, apart from the server logs.

We count how often per day the calendar subscription, the feed and the AI interface are fetched and, for the calendar and the feed, using the same method as for visitors, how many different programs fetch them. Here too, only daily totals are stored.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw your consent. An email to the address above is all it takes.

You can also lodge a complaint with a supervisory authority, for example the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.