Privacy Policy

  1. The controller for the processing described here is LESPIRANT GmbH, Karlstraße 72, 40210 Düsseldorf, Germany, represented by its managing director Laurent Tran. Commercial register: Amtsgericht Düsseldorf, HRB 77926.
  2. For any privacy question or request, write to info@lespirant.com. We have not appointed a data protection officer because the law does not require one for a company of our size.
  3. This policy covers the EventCoster website and app (eventcoster.com) and the event widget that other websites can embed.
  1. You can plan trips without an account. Your guest trips are linked only to a random ID stored in your browser.
  2. We use Google Analytics only if you agree. You can change your choice at any time in Privacy settings.
  3. We do not sell your personal data and we do not use it for advertising.
  4. You can download or delete your data yourself in Privacy settings, as a registered user or as a guest.
  5. The details for each purpose are below: what we process, why, on which legal basis, who receives it and how long we keep it.

Each purpose is one block with these rows: Data, Source, Legal basis, Recipients, Transfers outside the EU, Retention. ("GDPR" = Regulation (EU) 2016/679; "TDDDG" = German Telecommunications Digital Services Data Protection Act.)

  1. We use these processors, bound by data processing agreements (Art. 28 GDPR):
    • Hetzner Online GmbH, Gunzenhausen, Germany: server hosting in Germany.
    • Supabase Inc., USA: database and sign-in service, hosted in an EU data centre.
    • Google Ireland Limited, Ireland: Google Analytics (only with consent) and Google Workspace (email).
    • Google (Gemini API) and Mistral AI (France): translation and checking of event information; no data about you as a user.
  2. Travel data providers that our server queries for prices (search details only, never your identity): Booking.com, Google Flights, Kiwi.com and Skyscanner data through RapidAPI, Travelpayouts, and an exchange-rate service. Services our administrators use to check event information receive event details only: DuckDuckGo (web search) and OpenStreetMap Nominatim (address lookup).
  3. Independent recipients your browser contacts directly: Google and LinkedIn when you sign in with them; the OpenStreetMap Foundation (maps); Booking.com (hotel photos); our partners when you click a partner link.
  4. Our source code and event data are stored with GitHub, Inc. (USA).
  5. We disclose data to authorities only where the law obliges us to.
  1. Supabase Inc., Google LLC and GitHub, Inc. are based in the USA. Where data is transferred to the USA, the transfer is based on the EU-US Data Privacy Framework (for certified companies) or on the EU standard contractual clauses in our agreements with them.
  2. The OpenStreetMap Foundation is in the United Kingdom, which the European Commission recognises as providing adequate protection.
  3. Partners you visit through a partner link, and Google or LinkedIn when you sign in with them, process data under their own policies, which describe their transfers.

Copies in our providers' backups are overwritten in their regular backup cycle.

  1. You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), and to receive it in a portable format (Art. 20).
  2. Right to object (Art. 21 GDPR): where we rely on our legitimate interests (Art. 6(1)(f)), you can object at any time for reasons arising from your particular situation. We then stop unless we have compelling legitimate grounds or need the data for legal claims.
  3. Withdrawing consent: you can withdraw your consent to Google Analytics at any time in Privacy settings. This does not affect the lawfulness of processing before the withdrawal.
  4. Do it yourself: in Privacy settings you can download your data and delete your account, or, as a guest, download and erase your guest data. You will see a receipt listing what was deleted and what we keep, and why.
  5. Or write to info@lespirant.com. We answer within one month (Art. 12(3) GDPR).
  6. Right to complain: you can complain to a supervisory authority, in particular in the EU country where you live or work, or to ours: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
  1. We honour Global Privacy Control (GPC). If your browser sends the GPC signal, we treat it as a refusal of analytics: Google Analytics is not loaded and cannot be switched on while the signal is present.
  2. We do not track you across other websites, so we do not react to "Do Not Track" signals beyond that: without your consent, no analytics run at all.
  1. No. We do not sell personal data and we do not share it for advertising.
  2. Partner links may earn us a commission. When you click one, your browser sends the partner the link (with your search and our partner ID) and your IP address, as with any website you open. We add nothing that identifies you.

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Our rankings of flights, hotels and events are explained on How we rank results.

EventCoster is intended for people aged 18 and over (our Terms of Service).

We protect your data with technical and organisational measures, for example: verified sign-in, access only to your own trips, no IP addresses, names or email addresses in our logs, analytics only with consent, and limited administrator access.

We update this policy when our processing changes. The version and the date it takes effect are shown at the top; the changelog below lists the changes.