The controller responsible for processing personal data on this website is Dancing Bear Productions, owner Georgos Gakis, Rolandstr. 63, 50677 Cologne, Germany. For privacy enquiries, contact info@dancingbear.de, phone +49 (221) 3762691.
This privacy policy explains which personal data is processed when you visit our website, send enquiries or use our account and AI Show functions.
We use the following services to provide the website and its functions:
Providing and securing the website is based on our legitimate interest in a reliable and secure online service under Article 6(1)(f) GDPR. Where services support an enquiry or account function you request, Article 6(1)(b) GDPR also applies.
Providers processing personal data on our instructions act as processors under Article 28 GDPR. This is distinct from processing for a provider's own purposes and the independent controllers described below. The linked provider documents explain the respective roles and terms.
A location selected for hosting, databases or individual server functions does not mean that all processing takes place there. Global delivery networks, subprocessors, support, security and log processing may involve other countries, including the USA. Depending on the provider and transfer, their documents describe the EU-US Data Privacy Framework for the relevant covered US entity, or Standard Contractual Clauses and supplementary safeguards. Statements about one US entity do not automatically apply to all affiliates. You can use the controller contact above to request information about the safeguards applicable to a particular transfer and a copy of the relevant safeguards.
Depending on the function used, we process names and optional company details, email addresses and telephone numbers, account and sign-in data, form and concept content, event details, and usage and technical connection data such as IP address, browser information, request time and requested content. Pseudonymous protection identifiers can still constitute personal data; they are not equivalent to anonymous data.
Matomo audience measurement is activated only after voluntary consent to “Statistics”. Without consent, the tracker is not loaded and no statistics requests are sent. The website, sign-in and short AI Show ideas remain available when consent is rejected.
For our website statistics, we use a self-hosted Matomo installation at Hetzner under our own domain analytics.georgos-gakis.com. After consent, Matomo processes visited pages and technical usage data. Your IP address is also technically transmitted to the Matomo installation. From the page URL, the tracker receives only the page path, excluding query parameters, fragments, account identifiers, email addresses and AI Show form input. Visitor cookies are limited to 30 days and session cookies to 30 minutes. Matomo remains disabled on account, password and email-confirmation pages.
Optional statistics cookies require consent under section 25(1) TDDDG; associated processing is based on consent under Article 6(1)(a) GDPR. Each category can be allowed separately, and consent can be withdrawn at any time through “Privacy settings” in the footer or on this page. Withdrawal prevents further statistics requests and removes accessible Matomo cookies. Processing performed before withdrawal remains unaffected.
Your choice is stored in the browser with a version, timestamp and expiry date for up to 180 days. A changed consent version or expiry requires a new choice. Essential storage for this choice and requested account sign-in is separate from optional permissions. The 180 days apply to the stored choice, not to statistics retained on the Matomo server. Those are governed by the analysis purpose and the installation's deletion periods.
Persistent storage of an AI Show draft on this device is a separate option that is off by default. The draft is stored in the browser only after consent. It expires after 30 days and is removed on the next read. Starting a new idea or withdrawing this option removes stored AI Show drafts. Consent is obtained under section 25(1) TDDDG.
An explicitly requested switch to sign-in can transfer the current draft using session storage for up to 30 minutes. This temporary transfer permits continuation of the requested function without persistent storage. It is consumed on return and removed when persistent draft storage is off. The essential HttpOnly session cookie “auth_token” supports sign-in, lasts for up to seven days and is removed on sign-out. Passwords and login tokens are never saved inside drafts or browser storage. Essential storage for explicitly requested functions is based on section 25(2) no. 2 TDDDG.
Guests may request three new short AI generations per calendar day (Europe/Berlin). To limit abuse and cost, a pseudonymous HMAC identifier is derived from the IP address and day using a secret key. Counter keys do not contain the plain IP address, change daily and expire at the end of the day. No additional browser cookie is set. Visitors sharing a network may share this allowance. The counter serves our legitimate interest in secure and economically sustainable operation of the requested function under Article 6(1)(f) GDPR and is checked independently of voluntary statistics consent.
When you create or refine a show idea with AI, your event details, selected preferences and free-text input are sent through our server to the OpenAI API. Refinements also include the existing concept. The data is used to provide the concept service you requested, based on Article 6(1)(b) GDPR. Technical abuse and cost prevention serve our legitimate interest in secure operation under Article 6(1)(f) GDPR. Please do not enter passwords, confidential personal information or special categories of personal data in the idea field. Statistics and persistent draft consent are not required for short generation.
OpenAI processes the request as an external AI service provider; processing outside the EU, including in the USA, is possible. AI Show disables API response storage using “store: false”. This does not guarantee that the provider stores no data or immediately deletes all data. According to the OpenAI data controls, API data is not used for training by default. Abuse-monitoring logs may be retained for up to 30 days by default; legal obligations or security reasons may require longer retention. Special retention and regional processing options depend on account configuration and contractual eligibility. This does not guarantee processing exclusively in Europe. OpenAI data processing terms.
Separately from optional browser storage, generated concepts are temporarily cached in our server's memory so identical requests can be answered without another model call. Reuse is limited to 15 minutes. Expired entries are removed when that entry is requested again or displaced because cache capacity is limited; this validity period does not guarantee deletion at exactly 15 minutes. This cache is separate from browser drafts and OpenAI's retention. It supports the requested service and our legitimate interest in reducing waiting times, repeated transfers and costs under Article 6(1)(b) and (f) GDPR.
For a customer account, we process your name, email address and password, which is stored as a hash in the backend. After sign-in, we display your name to identify your account; if no name is available, we display your email address. You may optionally provide your company and a brief note about your work and how you found us. These voluntary details are used for personal review of the registration and handling your enquiry, not for statistics. Accounts become usable only after manual approval; email confirmation alone does not grant access. Account data is stored in the Strapi backend. Registration and requested account functions are based on Article 6(1)(b) GDPR.
For confirmation and password reset emails, we send the email address and necessary email content, including the required confirmation or reset links or tokens, to Resend (Plus Five Five, Inc., USA). The purpose is to provide the requested account function under Article 6(1)(b) GDPR and protect the account under Article 6(1)(f) GDPR. These are functional account emails.
A European sending region does not mean exclusively European storage at Resend: according to the Resend region information, account data, including email metadata, logs and API records, is stored in the USA regardless of the sending region. According to Resend's GDPR information, email content is also processed and stored in the USA. Further information appears in its privacy policy and data processing terms. To request account deletion or information about your details, use the controller contact above.
For contact or booking enquiries, we process your name, email address, subject and message, together with any telephone number, company details, event dates, requested showacts, preferences and technical event details you provide. Our server sends ordinary enquiries by email through an SMTP mail service to our relevant contact inbox. Enquiries assessed as suspicious are held for human review and sent through SMTP only after release. The mail service processes address, content and connection data necessary for sending and delivery.
While you type, contact and booking drafts are automatically saved in this browser's local storage. They may include your name, email address, telephone number, company, event date, subject, message, selected showacts, event details and preferences. Drafts are valid for up to two hours after the last change; expired entries are removed on the next read. Confirmed email sending, confirmed receipt for human review or resetting removes the corresponding stored draft. This function operates independently of optional AI Show draft storage and is not controlled by its permission. You can also remove stored drafts through the browser's website data settings.
Enquiries about a possible booking or contract are based on Article 6(1)(b) GDPR. Other enquiries are handled on the basis of our legitimate interest in answering incoming requests and organizing communication under Article 6(1)(f) GDPR. Acknowledging the privacy notice in the form does not replace this assessment according to the purpose of processing.
We protect the forms using self-hosted ALTCHA. Verification runs through our own infrastructure without integrating an external CAPTCHA service. The computational challenge is valid for no more than five minutes and protected against reuse. We also process technical request identifiers, timestamps and HMAC identifiers of the IP address, email address and enquiry content generated with a secret key. For these protection identifiers, Redis receives neither plain IP or email addresses nor plain message content. The identifiers are pseudonymous, not anonymous. Separately, suspicious enquiry content, including contact details and the prepared email, is stored encrypted in Redis as described below.
Protection data limits repeated requests and detects duplicate submissions. IP- and email-related delivery limits use 15-minute windows; additional global limits use hourly and daily windows up to 24 hours. Detection of duplicates already sent is limited to 30 minutes. Short-lived challenge and reservation data is limited to its respective validity period. Processing is based on our legitimate interest in preventing spam, automated abuse and uncontrolled email sending and keeping the forms available under Article 6(1)(f) GDPR.
We also assess text patterns locally using a rule-based heuristic. Neither this assessment nor the computational challenge proves that a human submitted an enquiry. Suspicious enquiries, including the contact and booking details supplied, are stored encrypted in Redis for up to seven days for review by us, together with random request IDs, timestamps, assessment reasons and processing status. Email sending occurs only after human release. Upon release, the encrypted content is removed from the active queue; receipt and duplicate identifiers remain only until the original seven-day expiry. Without release, the enquiry expires after that period without being sent. Review serves our legitimate interest in secure availability and spam prevention under Article 6(1)(f) GDPR and, for contractual or booking enquiries, handling the requested enquiry under Article 6(1)(b) GDPR.
Retention of the actual enquiry depends on whether the matter is resolved and whether further communication, a contract, legal retention duties or the establishment or defence of claims require continued storage. The technical expiry of protection data is separate from this.
Vimeo players load only after your separate consent for embedded video. Connection data, including the IP address, browser information and, where supplied, the referring page, is transmitted to Vimeo.com, Inc., USA. For ordinary player embeds, Vimeo processes data as an independent controller. Processing outside the EU, including in the USA, is possible. Even a European storage location for a video file would not guarantee exclusively European processing of all metadata and logs. Vimeo privacy policy.
We use Do-Not-Track mode. It does not replace consent or guarantee that all cookies and data processing are excluded. Consent is obtained under section 25(1) TDDDG and Article 6(1)(a) GDPR and can be withdrawn through Privacy settings.
This is separate from video files delivered directly through our Linode/Akamai infrastructure. They are delivered without a Vimeo player or its consent step. Loading them involves processing data needed for delivery, such as IP address, request time and technical connection data. The legal basis is our legitimate interest in presenting our productions under Article 6(1)(f) GDPR.
We link to profiles on LinkedIn, Xing, Facebook and Instagram. A plain profile link connects to the respective network only when opened. Further processing on these platforms is governed by their privacy notices.
We also display Instagram news on our website. Our server retrieves feed data; some images and videos are loaded directly by the browser from Instagram/Meta servers. Loading this content can therefore transmit the IP address, browser and device information and, where supplied, the referring page to Meta before any profile link is clicked. This integration is not linked to a separate Instagram permission in our Privacy settings. Meta Platforms Ireland Limited is generally responsible for Instagram in the European Economic Area; processing outside the EU, including in the USA, is possible. Instagram/Meta privacy policy.
Displaying Instagram news serves our legitimate interest in showing current productions and insights into our work under Article 6(1)(f) GDPR. The respective platform operator is responsible for processing for its own purposes.
The contact section embeds an OpenStreetMap map. The browser loads the map frame lazily as the map area approaches the visible viewport. There is no separate consent step for it in our Privacy settings. Loading it transmits the IP address, browser information and, where supplied, the referring page to the OpenStreetMap Foundation, United Kingdom, and the CDN providers used to deliver the map. Processing in other countries is possible.
The OpenStreetMap Foundation processes this data as an independent controller, rather than as our processor. Displaying the map serves our legitimate interest in clearly showing our location and directions under Article 6(1)(f) GDPR. Further information: OpenStreetMap Foundation privacy policy and privacy information for map users.
Retention periods depend on the respective processing purpose, statutory retention obligations and any need to establish or defend legal claims. For account data, the relevant criteria are the duration of the requested account and any subsequent retention duties; for enquiries, resolution of the matter and any resulting contractual relationship. Technical logs are assessed against operational, troubleshooting and security needs. Backups follow their respective backup and overwrite cycles; deletion from the active system therefore does not necessarily mean simultaneous removal from every backup. These are retention and deletion criteria, not a promise that all data is automatically deleted after one uniform period.
The specific periods above for browser storage, protection identifiers and reuse of AI results apply only to the described purpose. Independent controllers' linked privacy notices also apply to their processing.
Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). You may object under Article 21 GDPR to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation.
You may withdraw consent at any time with effect for the future. Processing performed before withdrawal remains unaffected. Privacy settings are available for the optional website categories. For other privacy enquiries and to exercise your rights, use the controller contact above.
You also have the right to lodge a complaint with a data protection supervisory authority under Article 77 GDPR. Our competent authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia.
We use SSL/TLS encryption (HTTPS) to protect data during transmission.
Updated: 9 November 2026