Privacy policy

Overview

BLOCK.DJ (block.dj) is an online booking platform. Registered users – individuals or organisations, hereinafter “hosts” – publish booking pages on which guests can book appointments, event places or shifts. This privacy policy explains which personal data is processed, for what purpose, on what legal basis and for how long. Personal data is any information that can be used to identify you personally.

Controller

The controller responsible for data processing on this platform is:

G. Block
.
.
Deutschland
Email: support@block.dj

Hosts

When you book an appointment, the respective host receives your details in order to prepare and hold the appointment. If a host links their own legal notice and privacy information on their booking page, that information also applies to their processing. Questions about a specific appointment are best directed to the host.

Hosting and server log files

BLOCK.DJ is operated by the following provider, where all platform data is stored:

ALL-INKL.COM – Neue Medien Münnich
Hauptstraße 68, 02742 Friedersdorf, Deutschland

With every request, the server automatically stores access data (server log files): IP address, date and time, requested address, amount of data transferred, referring page, browser and operating system. This data serves the security and stability of operations (Art. 6 (1) (f) GDPR), is not combined with other data and is deleted automatically after a short time.

We have concluded a data processing agreement with the hosting provider pursuant to Art. 28 GDPR.

Privacy information of the hosting provider: https://all-inkl.com/datenschutzinformationen/

Encryption

All pages are transmitted exclusively via encrypted connections (HTTPS/TLS). Passwords are only stored as secure hashes; mail server credentials, two-factor keys and webhook secrets are stored encrypted in the database.

Cookies and local storage

BLOCK.DJ does not use cookies for advertising or analytics and does not include any tracking services. Only technically necessary storage is used:

• a session cookie set when sign-in and management pages are opened (host sign-in and protection against misuse); it expires after inactivity and is deleted when signing out,
• the cookie “meet_guest” when you sign in as a guest via an email link (guest portal, confirmation of your email address); it contains your confirmed address in signed form and expires after 7 days without use or when you sign out,
• the cookie “meet_kiosk” on devices an organiser has connected as a check-in access (kiosk tablet or scanner); it only contains a random device identifier and is valid until the device is signed out or the access expires,
• a marker in your browser’s session storage so the page keeps its scroll position while you browse the calendar,
• if the app is installed: an offline page in the browser cache (service worker) that is shown without an internet connection.

The legal basis is § 25 (2) no. 2 TDDDG, as this storage is strictly necessary for the service you request, as well as Art. 6 (1) (b) and (f) GDPR. No consent is required.

Booking appointments

When you book an appointment via a booking page, we process the details required for the booking:

• name and email address,
• the selected time, time zone and language,
• your answers to questions the host asks in the form (e.g. phone number or topic),
• the location or video conference link of the appointment,
• for paid appointments the price, payment method and payment status,
• booking history (time, status, confirmation, rescheduling, cancellation).

The purpose is to arrange, confirm and hold the appointment, including confirmation, reminder and change emails with a calendar file (.ics). The legal basis is Art. 6 (1) (b) GDPR. If a host enters an appointment for you, the processing is based on their legitimate interest in organising their appointments (Art. 6 (1) (f) GDPR).

The recipient of your details is the host of the booking page; for organisations, also the members who hold or manage the appointment. Your details are not passed on to other third parties.

Unconfirmed bookings expire automatically. 18 months after the appointment, name, email address, answers and notes are anonymised automatically; data without personal reference is kept for statistics. Statutory retention obligations remain unaffected.

Details about other people

When booking, you can name other people: additional guests of an appointment (email address) and, for events, companions (name and, if requested, email address). Hosts can also invite people to an event by email – individually, from their address book or via a spreadsheet – and transfer a ticket to another person. These people receive the related emails (invitation, confirmation, ticket, reminder, cancellation), are stored like guests and anonymised after 18 months. Anyone who provides details about other people should inform them and refer them to this notice. The legal basis is Art. 6 (1) (b) and (f) GDPR (organising the shared appointment).

Payment

For paid appointments and events we store the price, any redeemed discount code, the chosen payment method (on site or bank transfer) and whether payment has been made. BLOCK.DJ does not process payments itself and does not use a payment service: with a bank transfer you pay the host directly. For this we show the host’s account holder, IBAN and BIC together with the amount and payment reference – on the confirmation page, in the confirmation email and in the ticket, also as a QR code for banking apps (GiroCode) generated on our server. The host records the receipt of payment; if a payment is open, the host can set up an email reminder. The legal basis is Art. 6 (1) (b) GDPR; the host’s statutory retention obligations remain unaffected.

Events and tickets

When you register for an event, we additionally process the selected ticket category, a ticket code with QR code, your place on the waiting list if applicable, and the time of check-in and check-out at the entrance. This data is used for admission control and to organise the event (Art. 6 (1) (b) GDPR) and is stored and anonymised like bookings.

If an event shows who is coming, your first name only appears if you explicitly agree when registering (Art. 6 (1) (a) GDPR); you can withdraw this consent from the host at any time without cancelling your registration. For admission, the organiser can connect tablets and helpers’ phones as check-in access; these show the guests’ name, ticket code and status, but no email addresses. The programme, hosts and speakers of an event (name, picture, short text) are entered by the organiser.

Shift planning

Hosts can invite people by email to sign up for shifts. We process the invitees’ name, email address and language as well as their answers (commitment, standby, decline) with time stamps. The purpose is planning the shifts (Art. 6 (1) (b) or (f) GDPR). The data is deleted together with the shift, at the latest 18 months after its last date.

Guest portal and email confirmation

Under “My appointments” you can manage your bookings without an account. On request we send a sign-in link to your email address; you also receive such a link if a booking page is restricted to certain email addresses. After you open it, we set the cookie “meet_guest” described above. To prevent misuse, we briefly store the IP address for forms and sign-ins in order to limit the number of requests. The legal basis is Art. 6 (1) (b) and (f) GDPR.

Sending emails

We send emails such as confirmations, reminders and invitations via the mail server of ALL-INKL.COM – Neue Medien Münnich. To be able to trace delivery problems, we store every email sent, including recipient, content and attachments, for 90 days and then delete it automatically (Art. 6 (1) (f) GDPR).

Hosts’ address book

Hosts have an address book that stores the name, email address and language of people who booked with them, received a link or an invitation from them, or whom they added themselves, possibly with a private note and assignment to contact groups (e.g. for duties or access lists). The address book serves to organise appointments (Art. 6 (1) (f) GDPR); entries not used for 18 months are deleted automatically.

Host accounts

For hosts we process account data (name, email address, password hash, settings, booking page details and images, optionally a two-factor key), a log of security-relevant events such as sign-ins with IP address, and usage statistics (sessions and active time per day). The purpose is to provide, secure and improve the platform (Art. 6 (1) (b) and (f) GDPR). The log and usage statistics are deleted after 18 months. Hosts can export their data as a ZIP file at any time under Profile → Security (Art. 20 GDPR) and delete their account there themselves; it is locked immediately and permanently deleted with all data after 14 days.

If hosts connect their calendars via an ICS link, the server fetches these calendars regularly and stores only the busy periods to prevent double bookings. Guests only see free times.

Visit statistics

We count how often a booking page is opened – as a plain total per day and page. No cookies are set and neither IP addresses nor any other characteristics that could identify you are stored. The daily totals are deleted after 24 months.

Search engines and link previews

All pages of BLOCK.DJ are blocked for search engines (noindex).

If a link to a booking or event page is shared, messengers and social networks may fetch the page’s title, description and cover image for a preview. Guest data is not included.

Spam protection (Cloudflare Turnstile)

To protect individual forms against automated requests we use Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the form loads, technical data from your browser (including IP address and browser characteristics) is transmitted to Cloudflare and analysed there to distinguish humans from bots. The legal basis is our legitimate interest in preventing misuse (Art. 6 (1) (f) GDPR). Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

Video conferences (BLOCK MEET)

If BLOCK MEET is chosen as the location of an appointment, BLOCK.DJ automatically creates a separate conference room with a random name and sends the link with the confirmation. The link is only shared with you, the host and any additional guests of the appointment.

BLOCK MEET at meet.block.dj is a video conferencing service we operate ourselves; it can also be used independently of a booking, and this section applies to any use. No account is needed. We process:

• your IP address and technical connection data of your device (browser, operating system, network),
• the name of the conference room and the display name you choose freely (your real name is not required),
• audio, video, screen shares and chat messages while you are in the room.

Audio, video and chat are only transmitted during the conference and are neither recorded nor stored. The transmission is encrypted; with more than two people it runs via our server, with two people it may be established directly between the devices – the other side then technically receives your IP address. Camera and microphone are only used if you allow them in your browser. We do not use any third-party services for this.

The video service runs on a server provided by:
ALL-INKL.COM – Neue Medien Münnich
Hauptstraße 68, 02742 Friedersdorf, Deutschland

For operational security the server stores connection logs (IP address, time, room name) and deletes them after 7 days. We have concluded a data processing agreement with the hosting provider pursuant to Art. 28 GDPR.

Privacy information of the hosting provider: https://all-inkl.com/datenschutzinformationen/

The legal basis is Art. 6 (1) (b) GDPR if the conference belongs to a booked appointment, otherwise our legitimate interest in a data-minimising communication service (Art. 6 (1) (f) GDPR).

If a host uses another service (such as Zoom, Google Meet or Microsoft Teams) or adds their own online link to an event, you only receive this link with a confirmed booking. BLOCK.DJ does not transmit any data to that provider; its privacy terms only apply once you open the link.

Map, calendar and sharing links

For in-person appointments we show a link to route planning on Google Maps; event and ticket pages also offer links to add a date to Google Calendar or Outlook or to share the page via WhatsApp or e-mail. Maps and third-party services are not embedded and no fonts or scripts are loaded from third parties; data only reaches the respective provider when you click one of these links.

Transfers to third countries

Data is only transferred to countries outside the EU or EEA in connection with Cloudflare Turnstile (see above). Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR).

Your rights

You have the right at any time to

• access your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) and
• withdraw any consent given with effect for the future (Art. 7 (3) GDPR).

Please contact the controller named above. You can also view your bookings yourself in the guest portal and – where the host allows it – reschedule or cancel them.

Right to object: Where processing is based on our legitimate interest (Art. 6 (1) (f) GDPR), you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless compelling legitimate grounds prevail or the processing serves the establishment, exercise or defence of legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, place of work or the alleged infringement.

Required details and automated decisions

Name and email address are required for a booking; without them we cannot confirm the appointment. Further details are voluntary unless the host marks them as required.

There is no automated decision-making, including profiling (Art. 22 GDPR).