Deutsch · English

Privacy notice – TimeframeBooking e.U.

1. Who is responsible?

TimeframeBooking e.U., owner Stefan Sommer, Eichenweg 23, 2464 Göttlesbrunn, Austria
Email: email address (visible with JavaScript) · Phone: +4369917235926
Company register: 440129z, Landesgericht Korneuburg
For any data protection question, contact us at this email address or by post.

2. What does this notice cover?

It covers:

• our website timeframebooking.com,
• our booking platform at app.timeframebooking.com with the links we send you (advance form, organisation form, signing a contract online, unsubscribe),
• the artist area for our artists,
• your business contact details, which we use to plan concerts and tours, and the request emails we send you.

Our own bookers receive a separate notice.

3. Visiting our website

When you open a page, our server (easyname, Vienna) processes your IP address, the page requested, the time and technical details of your browser so that it can send you the page. We keep no access log. If a technical error occurs, the app stores an error message for up to 90 days. In individual cases it may contain details about you, for example an email or IP address.
We use no analytics or advertising services and set no cookies on the website. When a page opens, we load no content from other providers; fonts and images are served from our own server.
The legal basis is our legitimate interest in offering a secure, working website (Art. 6(1)(f) GDPR).
Links to Instagram, Facebook, YouTube, Spotify, Bandsintown or ticket shops are plain links. Only when you click one do you leave our website; the provider's privacy policy then applies.

4. Contacting us by email or phone

Our website shows our email addresses and phone numbers; there is no contact form. “Request a date” and “Book this artist” open your own email program.
If you write to us or call us, we process your name, your contact details and your message in order to reply and to prepare a booking. Emails are kept in our bookers' mailboxes at ALL-INKL.COM and imported into our booking platform.
The legal basis is taking steps towards a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f)). For how long we keep the data, see section 13.

5. Links we send you (forms)

• Advance form: your details on how a show runs (schedule, contacts on the day, accommodation, travel) and the name and email of the person filling it in. Purpose: running the agreed show. The artists playing this show also see these details.
• Organisation form: your organisation's master data (name, address, invoicing details, website) and the business contact details of your contact persons. Purpose: up-to-date data for enquiries, contracts and invoices. Fields that were empty so far are taken over straight away. Changes to existing details, invoicing details and contact persons only apply once a booker has checked them. The artists playing at your venue also see the invoice recipient and billing address.
• Unsubscribe: your email address, so that we no longer contact you (suppression list).

The legal basis is the contract for the show (Art. 6(1)(b) GDPR). If you fill in the form on behalf of a company, it is our legitimate interest in running the show and the invoicing with that company (Art. 6(1)(f)).

Security check: before a link opens, we ask for your email address and match it against our contact details or the recipients of the link. For the organisation form we also send a code to that address. A technically necessary cookie then unlocks exactly this link (section 14). A short calculation in your browser stops automated submissions; it only talks to our own server. We count your IP address for at most 2 days to limit excessive requests. We keep failed attempts (address entered, IP address, time) for 90 days and delete codes after 2 days. The legal basis is our legitimate interest in protecting the data in the forms from unauthorised access and attacks (Art. 6(1)(f) GDPR).

6. Signing contracts online

If you sign a contract online via our link, we store your name, your position, the email address you entered, the time, your IP address, your browser's identifier, an optional hand-drawn signature and the fingerprint (SHA-256) of the signed file. We also record access to the contract link (each passed email check and each download of the PDF, with time, email address entered and IP address), details of the email we used to send the link (sending mailbox, recipients, time), and whether your IP address matches a sign-in of one of our bookers, so that a signature from our side would stand out. All this is recorded on an audit sheet as proof that the contract was concluded. After signing, we send the signed contract and the audit sheet to the email address you entered. The other recipients of the email with which we sent the contract receive the contract with the name and time of signing, without IP address or browser, so that a signature by someone else would be noticed. The legal basis is the contract (Art. 6(1)(b) GDPR) if you are a party to it yourself. If you sign on behalf of a company, it is our legitimate interest in being able to prove that the contract was concluded and to detect signatures by others (Art. 6(1)(f) GDPR). We keep the data for 7 years from the end of the year in which the contract was performed or cancelled (based on the retention period in § 132 of the Austrian Federal Fiscal Code, BAO), and longer only while a dispute about the contract is ongoing. After you enter your email address, a technically necessary cookie unlocks the contract link; it contains the email address you entered and lasts 30 days. The band whose performance the contract covers receives the signed contract with your name and the time of signing, without IP address or browser. The same applies to bands who sign their agency contract in the artist area. There, instead of the position, we store the place entered as well as the login address and the login session of the band account. All members with access see the name, time and place of all signatures and whether two signatures came from the same login session. Only we see the IP address, browser and session.

7. Artist area (artist sign-in)

Our artists sign in with one email address per band and their own password. We store the password only as a hash, never in plain text. They set up access via a link we send by email (valid for 72 hours, single use). “Forgot password” sends a new link to that address (valid for 30 minutes).
For each sign-in we store the browser, IP address and times. With “Stay signed in” it lasts 30 days; otherwise it ends after 12 hours without use. We delete it 90 days after it ends. We count failed attempts for 2 days. We keep sign-ins, failed attempts and password changes (with IP address and time) for one year to prevent misuse.
In the artist area, artists enter: band details (invoicing, bank details, origin), members, contact persons and emergency contact, dates and blocked dates, travellers (name, role) and vehicles with number plates per tour or show, photo and logo (without metadata such as the location) and feedback. They download signed contracts there; downloads are logged. We only adopt bank details after checking them; the artist area never shows stored bank and invoice details when entering them.
Sharing: travellers, vehicles with number plates and rooms go to the show's promoter where needed for the show. Billing address, VAT ID and, if agreed, bank details are part of the contract and so go to the promoter. After our approval we show photo, logo, short bio, genre, origin and links on our website.
The legal basis is our contract with the band (Art. 6(1)(b) GDPR). For band members and travellers who are not themselves parties to the contract, and for the security records, it is our legitimate interest in planning tours and protecting access (Art. 6(1)(f)).
We block former artists; we can delete their access, which ends the account and all sign-ins.

8. Contacts and requests (promoters, clubs, festivals, agencies)

We store business contact details of promoters, clubs, festivals and agencies: name, position, business email address and phone number, the organisation (name, address, website, type, genre) and the history of our cooperation (emails, requests, shows, whether you were interested or declined).
Where the data comes from: our previous cooperation, your emails to us, the organisation form completed by you or your organisation, and details you publish yourself for booking requests (for example on your website).
What for: we send you booking requests for our artists (sometimes to several contacts of your organisation together, and at most one reminder if there is no reply), plan tours and handle contracts, advancing and accounting. Our platform automatically links replies to the request and recognises declines so that we don't send a reminder; a booker checks any unsubscribe request in your reply. We do not track whether you open our emails or click links.
The legal basis is our legitimate interest in arranging concerts and tours, including direct marketing within the meaning of Recital 47 GDPR (Art. 6(1)(f) GDPR); for booked shows, the contract (Art. 6(1)(b)).
How long: see section 13. If you have objected, we only keep your email address on our suppression list so that we don't contact you again.

9. YOUR RIGHT TO OBJECT TO REQUESTS (DIRECT MARKETING)

You can object at any time, without giving reasons and free of charge, to us using your data for requests (Art. 21(2) GDPR). How: via the “Unsubscribe permanently” link in each of our request emails, by a short reply to a request email, or by emailing email address (visible with JavaScript). Via the link, your objection takes effect immediately; we act on a reply or email by the next working day at the latest. The link stops working 3 years after the request ends; after that, a reply or email is enough. After that we will send you no further requests; only your address stays on our suppression list. The “Unsubscribe here” link, by contrast, only ends the one request the email belongs to.
You can also object, on grounds relating to your particular situation, to any other processing based on our legitimate interest (Art. 6(1)(f) GDPR) (Art. 21(1) GDPR).

10. Who receives the data?

Within TimeframeBooking e.U., only our bookers have access.
To run our services we use providers that process your data only on our behalf and on our instructions (processors, Art. 28 GDPR):

• easyname GmbH, Vienna (Austria): server and database of our booking platform and our website, backups.
• ALL-INKL.COM – Neue Medien Münnich, Friedersdorf (Germany): our bookers' email mailboxes, which we use to write to you. The encrypted copy of our backup is also kept there.

We store and build the platform's program code at GitHub (Microsoft); no data from the platform goes there.
Other recipients:

• Promoters and artists where a show requires it, e.g. schedule details to the artists involved, travellers and number plates to the promoter, the contract to both. For an online signature, the recipients of the contract email (section 6).
• The provider of an AI tool in the USA, which we use for the time being to maintain our platform and improve its suggestions. Details from the platform may reach it in the process, including replies to our requests. The provider processes them as an independent controller under its own terms, not to train its models. The legal basis is our legitimate interest in running the platform (Art. 6(1)(f) GDPR). We will name the provider on request.
• Authorities and courts where we are legally required to.

We never sell your data.

11. Transfers outside the EU

We only transfer data outside the EU/EEA where there is a basis under Art. 44 et seq. GDPR. This concerns:

• AI tool (section 10): the details go to the USA. We have not agreed standard contractual clauses for this.

12. Legal bases at a glance

The legal basis and legitimate interest for each processing are stated in the relevant section. In short: contract or steps towards a contract (Art. 6(1)(b) GDPR); statutory retention duties for invoices (Art. 6(1)(c)); our legitimate interest in cooperation in the live music industry, in requests for our artists, in proving contracts and in preventing misuse (Art. 6(1)(f)).

13. How long do we keep data?

• Website: no access log; error messages up to 90 days.
• Counter against excessive requests: at most 2 days. Codes: 2 days. Failed attempts on public links: 90 days. Security log: 1 year.
• Contacts and emails: as long as we work together or send you suitable requests. We review contacts with whom no cooperation develops 3 years after the last contact and then delete them; we likewise review emails about an organisation without a show 3 years after the last contact and then delete them.
• After an objection or unsubscribe: only the email address on the suppression list, so that we do not contact you again.
• Form submissions: Advance form 3 years after the show; organisation form 3 years after submission or, if a booker has checked it, 3 years after that check.
• Invoices: 7 years (§ 132 BAO). Contracts, online signatures and audit sheets: 7 years from the end of the year in which the contract was performed or cancelled; longer only in case of a dispute. We keep emails about shows, contracts and invoices for as long as we need them as proof of these transactions.
• Artist area: sign-ins 90 days after they end; the account until we delete it.
• Backups: we back up daily. Automatic backups are kept for up to about 12 months and then deleted. In addition, at most 10 manually created backups are kept until newer ones replace them, and a further backup is made before every update, which we keep for 30 days, and always at least the last three. An encrypted copy of the latest daily backup is kept outside the server at ALL-INKL (section 10). There is only this one copy, and it is replaced every night. Deleted data disappears from the backups within these periods.

14. Cookies and browser storage

The website sets no cookies. In the platform we use no cookies for advertising or statistics, only what is technically necessary; this needs no consent (§ 165(3) Austrian Telecommunications Act 2021).

• Unlocking a link after the security check: a separate cookie per link. Advance form 30 days, organisation form this visit only, contract link 30 days (containing the email address you entered).
• Artist area sign-in: 30 days with “Stay signed in”, otherwise until you close the browser. A booker's “view as band”: 60 minutes.
• Language chosen on a sign-in page: 1 year.
• In the artist calendar, your browser remembers the name last entered (browser storage) until you delete it there.
• If a form comes back with an error, your browser remembers your entries for 15 seconds so nothing is lost. Passwords and files are never remembered.

The security check against automated submissions runs briefly in your browser and only via our own server.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time for the future (Art. 7(3)). Write to us at email address (visible with JavaScript).

16. Complaints and further information

You can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, Austria, email address (visible with JavaScript), www.dsb.gv.at. If you live or work in another EU country, you can also contact the authority there.
You are not obliged to give us any data. Without the details in a form, however, we cannot prepare a show, a contract or an invoice. We do not make automated decisions within the meaning of Art. 22 GDPR.

Last updated: 31.10.2026