Privacy policy

Overview

BLOCK.DJ (block.dj) is an online booking platform. Registered users – individuals or organisations, hereinafter “hosts” – publish booking pages on which guests can book appointments, event places or shifts. This privacy policy explains which personal data is processed, for what purpose, on what legal basis and for how long. Personal data is any information that can be used to identify you personally.

Controller

The controller responsible for data processing on this platform is:

G. Block
.
.
Deutschland
Email: support@block.dj

Hosts

When you book an appointment, the respective host receives your details in order to prepare and hold the appointment. If a host links their own legal notice and privacy information on their booking page, that information also applies to their processing. Questions about a specific appointment are best directed to the host.

Hosting and server log files

BLOCK.DJ is operated by the following provider, where all platform data is stored:

ALL-INKL.COM – Neue Medien Münnich
Hauptstraße 68, 02742 Friedersdorf, Deutschland

With every request, the server automatically stores access data (server log files): IP address, date and time, requested address, amount of data transferred, referring page, browser and operating system. This data serves the security and stability of operations (Art. 6 (1) (f) GDPR), is not combined with other data and is deleted automatically after a short time.

We have concluded a data processing agreement with the hosting provider pursuant to Art. 28 GDPR.

Privacy information of the hosting provider: https://all-inkl.com/datenschutzinformationen/

Encryption

All pages are transmitted exclusively via encrypted connections (HTTPS/TLS). Passwords are only stored as secure hashes; mail server credentials, two-factor keys and webhook secrets are stored encrypted in the database.

Cookies and local storage

BLOCK.DJ does not use cookies for advertising or analytics and does not include any tracking services. Only technically necessary storage is used:

• a session cookie for signed-in hosts (sign-in and protection against misuse); it expires after inactivity and is deleted when signing out,
• the cookie “meet_guest” when you sign in as a guest via an email link (guest portal, confirmation of your email address); it contains your confirmed address in signed form and expires after 7 days without use or when you sign out,
• a marker in your browser’s session storage so the page keeps its scroll position while you browse the calendar.

The legal basis is § 25 (2) no. 2 TDDDG, as this storage is strictly necessary for the service you request, as well as Art. 6 (1) (b) and (f) GDPR. No consent is required.

Booking appointments

When you book an appointment via a booking page, we process the details required for the booking:

• name and email address,
• the selected time, time zone and language,
• your answers to questions the host asks in the form (e.g. phone number or topic),
• the location or video conference link of the appointment,
• booking history (time, status, confirmation, rescheduling, cancellation).

The purpose is to arrange, confirm and hold the appointment, including confirmation, reminder and change emails with a calendar file (.ics). The legal basis is Art. 6 (1) (b) GDPR. If a host enters an appointment for you, the processing is based on their legitimate interest in organising their appointments (Art. 6 (1) (f) GDPR).

The recipient of your details is the host of the booking page; for organisations, also the members who hold or manage the appointment. Your details are not passed on to other third parties.

Unconfirmed bookings expire automatically. 18 months after the appointment, name, email address, answers and notes are anonymised automatically; data without personal reference is kept for statistics. Statutory retention obligations remain unaffected.

Shift planning

Hosts can invite people by email to sign up for shifts. We process the invitees’ name, email address and language as well as their answers (commitment, standby, decline) with time stamps. The purpose is planning the shifts (Art. 6 (1) (b) or (f) GDPR). The data is deleted together with the shift, at the latest 18 months after its last date.

Guest portal and email confirmation

Under “My appointments” you can manage your bookings without an account. On request we send a sign-in link to your email address; you also receive such a link if a booking page is restricted to certain email addresses. After you open it, we set the cookie “meet_guest” described above. To prevent misuse, we briefly store the IP address for forms and sign-ins in order to limit the number of requests. The legal basis is Art. 6 (1) (b) and (f) GDPR.

Sending emails

We send emails such as confirmations, reminders and invitations via the mail server of ALL-INKL.COM – Neue Medien Münnich. To be able to trace delivery problems, we store every email sent, including recipient, content and attachments, for 90 days and then delete it automatically (Art. 6 (1) (f) GDPR).

Hosts’ address book

Hosts have an address book that stores the name, email address and language of people who booked with them or received a booking link from them, possibly with a private note by the host. The address book serves to organise appointments (Art. 6 (1) (f) GDPR); entries not used for 18 months are deleted automatically.

Host accounts

For hosts we process account data (name, email address, password hash, settings, booking page details and images, optionally a two-factor key), a log of security-relevant events such as sign-ins with IP address, and usage statistics (sessions and active time per day). The purpose is to provide, secure and improve the platform (Art. 6 (1) (b) and (f) GDPR). The log and usage statistics are deleted after 18 months. Hosts can export their data as a ZIP file at any time under Profile → Security (Art. 20 GDPR) and delete their account there themselves; it is locked immediately and permanently deleted with all data after 14 days.

If hosts connect their calendars via an ICS link, the server fetches these calendars regularly and stores only the busy periods to prevent double bookings. Guests only see free times.

Visit statistics

We count how often a booking page is opened – as a plain total per day and page. No cookies are set and neither IP addresses nor any other characteristics that could identify you are stored.

Spam protection (Cloudflare Turnstile)

To protect individual forms against automated requests we use Cloudflare Turnstile by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the form loads, technical data from your browser (including IP address and browser characteristics) is transmitted to Cloudflare and analysed there to distinguish humans from bots. The legal basis is our legitimate interest in preventing misuse (Art. 6 (1) (f) GDPR). Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/

Video conferences

If an appointment takes place online, the host gives you a link to the service of their choice, such as BLOCK MEET, Zoom, Google Meet or Microsoft Teams. BLOCK.DJ does not transmit any data to that provider; its privacy terms only apply once you open the link.

Map links

For in-person appointments we show a link to route planning on Google Maps. Maps are not embedded; data only reaches Google when you click the link.

Transfers to third countries

Data is only transferred to countries outside the EU or EEA in connection with Cloudflare Turnstile (see above). Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is based on the European Commission’s adequacy decision (Art. 45 GDPR).

Your rights

You have the right at any time to

• access your stored data (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR) and
• withdraw any consent given with effect for the future (Art. 7 (3) GDPR).

Please contact the controller named above. You can also view your bookings yourself in the guest portal and – where the host allows it – reschedule or cancel them.

Right to object: Where processing is based on our legitimate interest (Art. 6 (1) (f) GDPR), you may object to it at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless compelling legitimate grounds prevail or the processing serves the establishment, exercise or defence of legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, place of work or the alleged infringement.

Required details and automated decisions

Name and email address are required for a booking; without them we cannot confirm the appointment. Further details are voluntary unless the host marks them as required.

There is no automated decision-making, including profiling (Art. 22 GDPR).