Privacy Policy

MatchQuest GmbH, Friedrichstraße 123, 10117 Berlin, Germany. Email: hello@matchquest.com. Managing director: Grzegorz Forysiak.

Data protection officer: [add contact if appointed]. Until then, reach us about any data protection question at hello@matchquest.com.

• Guest profiles are not public. Only your group at an event and people you are mutually connected with see your details.
• Who you choose after an event stays private. Only mutual choices are shared.
• We don't sell data or use advertising trackers. Google Analytics only runs if you agree.
• You can export your data and delete your account in your privacy settings.

When you open MatchQuest, our hosting provider processes technically necessary data: IP address, date and time, the address requested, browser and operating system, and error messages. This is needed to deliver the site and keep it stable and secure (Art. 6 (1) (f) GDPR). Logs are deleted after 14 days at the latest, unless needed to investigate a security incident.

Hosting provider: [add provider and server location]. We have a data processing agreement with them under Art. 28 GDPR.

For an account we process your email address, a securely hashed password, your role (guest, host, venue partner) and when you accepted the terms. We email you to confirm your address and send booking and account information. The legal basis is the performance of the user contract (Art. 6 (1) (b) GDPR).

We send email through Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) as our processor.

During setup we ask for a display name, date of birth, gender, languages, neighbourhood, preferred table size and interests; optionally a photo, a short text, who you'd like to meet and what you're looking for. We use this to check whether you can join an event (for example age limit and audience), to form balanced groups and to introduce you to your group (Art. 6 (1) (b) GDPR).

Your date of birth and gender stay private. Your group sees your display name, photo, languages and interests; after a mutual choice, the connected person sees your profile.

An optional phone number can be confirmed by text message. For this we use Twilio (Twilio Ireland Limited, Dublin) as our processor, where text confirmation is switched on.

Who you'd like to meet, together with your gender, may reveal your sexual orientation. The same applies to booking women-only or men-only events. These details are optional. We process them only with your explicit consent (Art. 9 (2) (a) GDPR) and only to form groups and show suitable events.

You can withdraw your consent at any time with effect for the future by removing the detail in your settings or writing to us. Processing before the withdrawal remains lawful.

When you book an event we process booking data (event, ticket, price, status, time, acceptance of the terms and code of conduct, waitlist, cancellations and refunds). The legal basis is the contract (Art. 6 (1) (b) GDPR) and statutory retention duties (Art. 6 (1) (c) GDPR).

Payments are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe processes some payment data as an independent controller, in particular to prevent fraud and meet payment-law obligations. We never receive your card details. More information: https://stripe.com/privacy.

We give the host the data needed to run the event: your display name, check-in status and group.

At check-in your ticket QR code is scanned. During the event we process attendance, grouping, table changes, breaks and help requests. Groups are formed automatically from all guests' details and the host's settings; this has no legal or similarly significant effect (no decision within the meaning of Art. 22 GDPR). The legal basis is the contract (Art. 6 (1) (b) GDPR).

We do not use your device's location.

You can rate the event and answer questions about how it went. Hosts only see ratings in aggregate, not who answered what. Your choice of who you'd like to see again stays private; only mutual choices are shown to both people. Connected people can message each other. The legal basis is the contract (Art. 6 (1) (b) GDPR); for analysing aggregated ratings to improve events, our legitimate interest (Art. 6 (1) (f) GDPR).

When you report a person or content or block someone, we process the report, the accounts involved and related communication. This keeps all guests safe and meets our obligations under the Digital Services Act (Art. 6 (1) (c) and (f) GDPR). We may share reports with the host where needed for safety on site and, in serious cases, with law enforcement.

We tell you about bookings, changes and table changes by email and in the app. If you allow push notifications, your browser's push service (for example Google, Apple or Mozilla) stores an identifier for your device. You can switch push notifications off in your browser at any time (Art. 6 (1) (a) and (b) GDPR).

For hosts and venue partners we process business and contact details, event and space details, photos, booking requests, messages between them, and earnings and payout data. Payouts go through Stripe Connect. The legal basis is the contract (Art. 6 (1) (b) GDPR) and legal obligations (Art. 6 (1) (c) GDPR).

When you write to us through the contact form, by email or through the appeal form, we process your details to handle your request (Art. 6 (1) (b) or (f) GDPR).

If you sign up for our newsletter or a waitlist, we process your email address based on your consent (Art. 6 (1) (a) GDPR). You can unsubscribe at any time using the link in every email.

We only store information on your device where it is strictly necessary for a feature you asked for (§ 25 (2) no. 2 TDDDG) or with your consent (§ 25 (1) TDDDG).

Strictly necessary

• Session cookie (JSESSIONID): keeps you signed in; deleted when you sign out or the session ends.
• XSRF-TOKEN: protects forms against forgery; session length.
• mq_cookie_consent: stores your cookie choice for 12 months.
• Local storage (mq_alerts_muted, matchquest-host-device-id): remembers whether table-change sounds are muted and marks the host's check-in device.

Only with consent: Google Analytics

If you agree, we use Google Analytics 4 (Google Ireland Limited) to understand how MatchQuest is used. The cookies _ga and _ga_<ID> are stored for up to 2 years. For users in the EU, Google Analytics does not log or store IP addresses. The legal basis is your consent (§ 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can withdraw it at any time through “Cookie settings” in the footer.

Recipients of your data are the service providers named above (hosting, Google Workspace, Stripe, Twilio and, with consent, Google Analytics), hosts to the extent described, and authorities where we are legally required.

Google, Stripe and Twilio may also process data in the USA. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the providers are certified, and additionally on standard contractual clauses (Art. 45 and 46 GDPR).

• Account and profile: until you delete your account.
• Booking and payment data: as long as commercial and tax law requires (§ 257 HGB, § 147 AO): 8 years for accounting vouchers, 10 years for books and annual accounts.
• Data from during an event (attendance, groups, breaks, help requests): up to 12 months after the event, then only in aggregate.
• Messages: as long as the connection exists and neither side has deleted their account.
• Reports and moderation decisions: as long as needed for safety and possible legal disputes, usually up to 3 years.
• Server logs: 14 days.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7 (3)). You can export your data and delete your account in your privacy settings; otherwise write to hello@matchquest.com.

Right to object: where we process data based on legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can complain to a data protection supervisory authority, for example the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin.

Without an email address, password, date of birth and gender we cannot set up a guest account or admit you to events. Everything else is optional.

We update this policy when our processing or the law changes. The current version is always here.