This is a translation. In case of discrepancies, the German version prevails.

Joint Controllership with Organizers

This page summarises the essence of the joint controllership arrangement in version 3.0 that before concludes with each organizer under Art. 26(2) GDPR. It is addressed to guests of the evenings. The organizer responsible for your evening is shown with its legal name and contact details on the door page of the evening that you open via the QR code, before you enter any data. You can also ask before for these details at any time later.

1. What this is about

before and the organizer are jointly responsible for the check-in, the guest list and entry via before at an evening. This covers your name, the evening you checked in to and the check-in time. If you registered for an evening in before in advance, your name is on its guest list before you check in. The organizer sets up the evening in before and offers the check-in at its door; before provides the technology and decides how it works. The organizer and its team have no access to photos, wishes or chats and do not participate in their own evening's photo exchange.

2. Who is solely responsible for what

• before alone: your account, the photo exchange, wishes, chats, the afterparty email, notifications on your device, blocking and reporting, and the security of the service.
• The organizer alone: everything it does itself outside before, for example ticket sales, its own registration lists, admission and house rules on site and its own advertising.

The organizer sees the check-ins and the guest list of its evening with name and check-in time. It never sees photos, wishes or chats; the organizer and its team do not take part in the photo exchange of their own evening. Reports are handled only by before. In the review the organizer only sees totals; for small groups we withhold figures.

3. Who takes on which task

• before runs the technology and ensures its security, concludes the contracts with the service providers, provides the privacy policy, obtains consent where it is needed, answers requests from guests, carries out erasure and rectification in the system, informs the organizer of justified erasure requests concerning its evening and reports personal data breaches to the supervisory authority and the persons concerned where required.
• The organizer provides its legal name and a contact option for the door page and keeps them up to date, uses the guest list only for managing its evening, not for advertising or profiling, does not pass it on to third parties, does not pass on access credentials, obliges its staff to confidentiality, points to the privacy policy at its door and forwards requests from guests that reach it to before without delay.
• Copies held by the organizer: If the organizer takes details from the guest list into its own records, it may only do so insofar as it needs them for managing the evening. It deletes such copies as soon as this purpose has been fulfilled and also when before informs it of a guest's justified erasure request, for example because the guest has left the afterparty or deleted their account. before informs it of required rectifications, erasures and restrictions; it implements them in its copies without undue delay and confirms completion. If it exceptionally needs records for longer, for example because of its own statutory retention obligation, it alone is responsible for this storage and must itself state the purpose, legal basis and period.
• Data breaches: The organizer reports any personal data breach it notices to before without delay at contact@before.social. before assesses it and, where required, notifies the supervisory authority within 72 hours and informs the persons concerned.
• Both support each other so that requests are answered on time and inform each other of personal data breaches without delay.

4. Who informs you

before informs you about the processing: at the door with the reference to the privacy policy and on this page. The organizer's legal name and contact details are shown on the door page. The privacy policy and this summary remain accessible after the evening.

5. Whom you can contact

The quickest way is to contact before:

• Email: contact@before.social
• Contact form: before.social/contact

You can also contact the organizer. You can exercise your rights under the GDPR (for example access, rectification, erasure, objection, withdrawal of consent) against each of the joint controllers (Art. 26(3) GDPR). We then coordinate among ourselves; you do not have to worry about who does what. You can also lodge a complaint with a data protection supervisory authority (see the privacy policy, section 10).

6. Storage period

We delete the guest list with name and check-in time twelve months after the evening; the organizer sees it for that long. We delete your entry earlier if you leave the afterparty or delete your account; we delete an account without an email address automatically according to the periods in the privacy policy, section 8. Whatever you delete in before also disappears from the guest list that the organizer sees in before. Section 3 applies to copies held by the organizer.

7. The arrangement

Each organizer confirms the joint controllership arrangement before using before for an evening; each person in its team confirms it themselves. We keep a record of this confirmation together with the confirmed version. If the arrangement changes, organizers confirm the new version before continuing to use before. Version 3.0 replaces the earlier version 2.0; each organizer confirms it before its next evening. Organizers see the full wording in before; guests can request it from us. This page reflects the essence of the arrangement.

Last updated: 11 October 2026