Privacy notice
How we handle the details you give us when you apply for Black & Blood on 31 October 2026. Written under Articles 13 and 14 of the GDPR.
1. Who is responsible
[Full legal name of the entity], [street, postcode] Frankfurt am Main, Germany, represented by Fabio C. Masilla.
Email fabio@fifteen-love.de, telephone +49 176 32901031.
[If a data protection officer has been appointed, give the contact details here. Most organisations of this size are not required to appoint one.]
2. In short
- We collect the details you type into the application form, and nothing else about you.
- They are stored on our own server in [country of the hosting provider, Germany if you follow our recommendation].
- We use Brevo to send email. Your contact details are passed to Brevo for that purpose.
- There is no analytics, no advertising pixel, no tracking cookie and no embedded content from other sites.
- We do not sell your data and we do not pass it to anyone who is not named here.
3. What we collect when you apply
When you send the application form we store the following. Fields marked as required are the ones without which we cannot handle the application.
| What | Required | Why |
|---|---|---|
| First and last name | yes | To identify you and to make up the guest list at the door |
| Email address | yes | To send the confirmation and our decision |
| Mobile number | no | Guest list at the door and short-notice contact on the day |
| City | no | To judge whether you are travelling in, which matters for rooms |
| Instagram handle | required for creators | To assess creator applications |
| Guest type and category | yes | To route your application correctly |
| Number of people and their names | yes / no | Capacity planning and the guest list |
| Reach, platforms, portfolio link | no | Only for creator applications |
| Company, role, website, partner model, budget range | partly | Only for brand enquiries |
| Number of rooms and nights | no | To request a room from the hotel for you |
| How you heard about it, free-text message | no | Optional. Helps us understand and answer you properly |
| Your consent choices, the time and the version of the text shown | yes | To be able to prove what you agreed to |
| A one-way hash of your IP address, and your browser identifier | automatic | Abuse prevention. The address itself is never stored in the clear |
4. Legal basis
- Handling your application, and the event itself. Article 6(1)(b) GDPR, since you are asking us to take steps towards a contract, and Article 6(1)(f) GDPR for our legitimate interest in organising a curated event. We also ask for your agreement in the form so that the position is clear to you.
- Newsletter. Article 6(1)(a) GDPR, your consent. Entirely optional, and you can withdraw it at any time.
- Photography and film at the event. Article 6(1)(a) GDPR where you have given consent, and Article 6(1)(f) GDPR for general views of the event where individuals are not the subject of the picture. German law on the right in one's own image also applies.
- Abuse prevention and server logs. Article 6(1)(f) GDPR, our legitimate interest in keeping the site working and free of automated submissions.
5. Who receives your data
Hosting
The site and the database run on a server operated by [hosting provider, address, country]. The provider processes data on our behalf under a data processing agreement in line with Article 28 GDPR. [Confirm that the agreement is in place and that the server is inside the EU.]
Email delivery: Brevo
We use Brevo for the confirmation and for our decision emails. Brevo is operated by Brevo SAS, 106 boulevard Haussmann, 75008 Paris, France, with a German entity, Brevo GmbH, in Berlin. Your name, email address and the details of your application are transferred to Brevo so that it can send and manage these messages. Brevo acts as our processor under a data processing agreement. [Accept the data processing agreement in your Brevo account and keep a copy. Brevo states that its servers are in the EU; verify this for your account and note the result here.]
The hotel
If you ask for a room, we pass your name, the number of rooms and the nights to the Roomers Berlin Steinplatz so that the hotel can hold and confirm the booking. From that point the hotel is a separate controller for the booking and its own privacy notice applies.
Ticketing
[If tickets are sold through an external service, name the provider, its address and the country here, and state what is passed to it. If you send a payment link instead, describe that arrangement.]
Partners of the evening
We do not pass your application to sponsors or partners. Where a partner brings its own guests, that partner collects those details itself and is responsible for them.
6. Transfers outside the EU
We do not plan any transfer of personal data outside the European Union. Should one become necessary, it will only take place on the basis of an adequacy decision or the European Commission's standard contractual clauses, and we will update this notice.
7. Cookies and tracking
This site sets no cookies for visitors, uses no analytics, no advertising pixels and no embedded content from other providers. Fonts and images are served from our own server. That is why there is no consent banner: there is nothing to consent to under section 25 of the German TDDDG.
One cookie exists, and only for us: signing in to the internal administration area sets a session cookie. It is strictly necessary for that function and is never set for ordinary visitors.
8. Server logs
Our server records each request with the time, the page requested, the status, the browser identifier and a one-way hash of the IP address. We use this to find faults and to detect abuse. These records are deleted after [retention period, we suggest 14 days].
9. How long we keep things
| Category | Kept until |
|---|---|
| Applications that were declined or withdrawn | Deleted three months after the event |
| Applications of guests who attended | Deleted twelve months after the event, unless a longer period is required by law |
| Brand and partner enquiries | Kept for the business relationship, then in line with statutory retention rules |
| Newsletter subscription | Until you withdraw it |
| Record of consent | Three years after the consent ends, so that we can prove it if challenged |
| Server logs | [14 days] |
10. Photography and film at the event
Photographs and film are made during the evening for the aftermovie, a photo set and the channels of Red Tree, the Roomers Berlin and the partners of the night. There are signs at the entrance and the crew is recognisable.
You can decline. Tell us at the door or write to fabio@fifteen-love.de, and we will note it and pass it to the crew. If you appear in a picture that has already been published and want it taken down, write to the same address and we will remove it as far as we are able.
11. Your rights
Under the GDPR you have the right to:
- ask what data we hold about you and receive a copy (Article 15)
- have inaccurate data corrected (Article 16)
- have your data deleted (Article 17)
- have processing restricted (Article 18)
- receive your data in a portable form (Article 20)
- object to processing based on our legitimate interest (Article 21)
- withdraw a consent at any time, with effect for the future (Article 7(3))
One email to fabio@fifteen-love.de is enough. We answer within one month.
Every newsletter contains an unsubscribe link. Using it is enough to withdraw that consent.
12. Complaints
You can complain to a supervisory authority. The one responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information, Postfach 3163, 65021 Wiesbaden, Germany. You may also complain to the authority where you live or work.
13. Automated decisions
There are none. Every application is read and decided by a person. There is no profiling and no automated scoring.
14. Do you have to give us this data?
No. Giving it is voluntary. Without a name and an email address we cannot process an application, so in that sense they are necessary for taking part. The optional fields have no effect on whether your application is accepted, except where they help us judge a creator or brand enquiry.
15. Changes
We will update this notice if the site or the way we handle data changes. The current version always applies.
Version 1.0, last updated [date]. The consent wording shown in the form carries the version number that is recorded with every application, so we can always tell which text you were shown.