Privacy policy

Version: September 2026. The German version is the binding one.

1. Controller

Nicolás di Rago, Griselda & Nicolás Tango Mariendorfer Weg 53, 12051 Berlin, Germany Email: info@griseldanicolastango.com

No data protection officer needs to be appointed under § 38 BDSG, as fewer than 20 people are regularly involved in the automated processing of personal data.

2. In short

• This website sets no cookies. We count visits with analytics software on our own server, without cookies and without sharing data with third parties.
• Data only arises when you submit a form, buy a pass, or start a video by clicking it.
• Fonts are stored on our own server. No connection to Google Fonts is made.
• The server is located in Germany.

3. Hosting and server log files

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. When you open a page, the server processes technically necessary data: IP address, date and time, page requested, data volume, browser type and operating system. These are written to log files that are overwritten automatically once they reach a fixed size (five files of 20 MB each). They are not merged with other data.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is the secure and stable operation of the website. A data processing agreement under Art. 28 GDPR is in place with Hetzner.

4. Cookies, local storage and visit statistics

The public website sets no cookies. Your choice of light or dark design is kept in your browser's local storage and never leaves your device.

A login cookie is set only in the administration area used by our staff. Visitors are not affected.

Visit statistics (Umami). We measure how the website is used with Umami, open-source software that runs on our own server in Germany. Umami sets no cookies and does not access your device's storage. For each page view it records the page visited, the referring page, browser, operating system, device type, screen size, language and the country or region derived from the IP address. The IP address itself is processed only briefly to determine the country and is not stored. Views by the same person are grouped by a daily value built from the IP address, the browser identifier and a random value that changes every day; after 24 hours no attribution is possible. We also count clicks on individual buttons, without personal data. There is no cross-site tracking, and no data is passed to third parties. The legal basis is our legitimate interest in evaluating and improving our offer (Art. 6 (1) (f) GDPR). You may object to this processing at any time (Art. 21 GDPR, see section 15).

5. Contact form

Through the contact form we collect your name, email address, your message and the language you chose. The data is stored on our server and forwarded by email to our mailbox so that we can answer you.

Retention: six months after receipt, then automatic deletion.

Legal basis: Art. 6 (1) (b) GDPR (steps prior to or performance of a contract) and Art. 6 (1) (f) GDPR (answering general enquiries).

6. Tango Meeting Spain enquiries and registrations

For information requests we collect name, email address and your question. For registrations we additionally collect phone number, country or tango school of origin, number of people, name of your dance partner, the packages you selected and an optional message. No payment data is collected through the website; deposits are paid by bank transfer.

Retention: information requests six months after receipt, registrations twelve months after the end of the respective event.

Legal basis: Art. 6 (1) (b) GDPR.

7. Form protection (Cloudflare Turnstile)

Our forms are protected against automated submissions by Cloudflare Turnstile. When a page with a form loads, your browser loads a script from Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare processes technical characteristics of your browser and your IP address to tell humans from bots. The content of your form is not sent to Cloudflare; our server only checks a token issued by Cloudflare.

Cloudflare is certified under the EU-US Data Privacy Framework; the EU Commission's standard contractual clauses (Implementing Decision (EU) 2021/914) apply in addition. A data processing agreement is in place with Cloudflare.

Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is protecting the forms from spam and abuse.

8. Email delivery (Brevo)

Confirmations, invoices and form notifications are sent through Brevo, a service of Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France. Brevo receives the recipient address and the content of the respective email. Processing takes place in the EU. A data processing agreement is in place with Brevo.

Legal basis: Art. 6 (1) (b) and (f) GDPR.

9. Our mailbox

Emails to info@griseldanicolastango.com are currently forwarded to a mailbox at Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, where they are read and answered. Google processes the emails as part of its mailbox service; transfers to third countries are covered by the EU-US Data Privacy Framework and the EU Commission's standard contractual clauses (Implementing Decision (EU) 2021/914).

Legal basis: Art. 6 (1) (b) and (f) GDPR.

10. Buying lesson passes online (Stripe)

When you buy a pass online, payment takes place on a checkout page hosted by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. Stripe collects your payment details (card, PayPal or SEPA direct debit) and your billing address directly. Payment details never reach our server.

We store your name, email address, billing address, the pass you bought, the amount, the payment reference and the invoice. Your confirmation that the service may start immediately (see the withdrawal policy) is stored as evidence.

Retention: invoices and the related order data are kept for ten years under § 147 AO and § 14b UStG. All other personal data is deleted or anonymised on request or once the pass has expired.

Legal basis: Art. 6 (1) (b) GDPR (contract) and Art. 6 (1) (c) GDPR (tax retention duty). A data processing agreement is in place with Stripe.

11. Videos (YouTube)

Videos are embedded via youtube-nocookie.com. When the page loads, only a preview image from our own server is shown. Only when you click the video does your browser connect to YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. From that moment YouTube processes your IP address and browser details. Without a click, no data flows to YouTube.

Legal basis: Art. 6 (1) (a) GDPR. Clicking the video is your consent for the current page view.

12. Backups

The database, images and invoices are backed up every night, encrypted, to a storage system (Storage Box) of Hetzner Online GmbH in Germany. 14 daily and 8 weekly backups are kept; older ones are deleted automatically. A deletion in the live system therefore also takes effect in the backups after about two months at the latest.

Legal basis: Art. 6 (1) (f) GDPR and Art. 32 GDPR.

13. Data security

All connections to this website are encrypted with TLS (HTTPS). Login credentials for the administration area are stored only as hashes. The server sits behind a firewall that opens only the web and maintenance ports, and receives security updates automatically. Backups are encrypted (section 12). Only the people who need personal data for teaching, administration or accounting have access to it.

14. Recipients and processors

We share personal data only with the service providers named in this policy: Hetzner Online GmbH (hosting and backups), Cloudflare, Inc. (form protection), Sendinblue SAS / Brevo (email delivery), Stripe Payments Europe, Ltd. (payment processing) and Google Ireland Limited (mailbox, videos after click). No data is shared for advertising purposes.

15. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). You may withdraw any consent at any time with effect for the future. After an objection we stop processing the data concerned unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.

An email to info@griseldanicolastango.com is enough to exercise your rights. We answer without undue delay and at the latest within one month of receiving your request (Art. 12 (3) GDPR). Erasure requests are carried out in one step across all systems; invoice data subject to statutory retention is anonymised, not deleted.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, mailbox@datenschutz-berlin.de.

16. Changes

We update this policy when the website or the law changes. The version published here applies.