Privacy Policy

Data controller

Website delivery and server logs

When this website is accessed, the server processes technically necessary connection data. This may include the IP address, time, requested resource, referrer, browser, operating system and response status. The hosting provider processes this data to deliver the website, maintain stability and prevent attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of this website. Log data is deleted when it is no longer required for these purposes, unless statutory retention duties apply.

General enquiries

The contact form processes your name, email address and message. It also contains an invisible “website” field that normally remains empty and helps identify automated spam.

Processing is limited to reviewing and answering your enquiry. Depending on its content, the legal basis is Art. 6(1)(b) GDPR for pre-contractual steps or Art. 6(1)(f) GDPR based on our legitimate interest in handling business enquiries.

After server-side validation, the enquiry is delivered by email through Resend to contact@38tribe.com. It is deleted once the enquiry has been completed and no statutory retention obligation applies.

Booking enquiries

A booking enquiry processes the selected artist, event or club name, event type, country, city, venue, date, promoter or company, name, email address, optional phone number and an optional message. The form also includes an empty “website” field for spam prevention.

Processing is necessary to handle your enquiry and take pre-contractual steps under Art. 6(1)(b) GDPR. After server-side validation, the system generates a reference number and delivers the enquiry through Resend to ayse@38tribe.com and sofien@38tribe.com. Data is deleted when the enquiry has been completed and no statutory retention obligation applies.

IP-based rate limiting

To protect the contact and booking endpoints from misuse, an IP address derived from the request header is processed as part of a process-local key. Each form permits no more than five requests within 60 seconds. Counters and expiry times exist only in the memory of the relevant server instance; no persistent database is used.

Expired entries are removed when a protected endpoint is next called and no later than the end of the server process. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the security and availability of the forms.

Locally delivered fonts

The font files used by this website are delivered by our own web server together with the application. Visiting the website therefore does not establish a connection to Google Fonts or another external font provider.

Cookies, local storage and analytics

The current application code sets no cookies, uses neither Local Storage nor Session Storage, and includes no analytics, advertising or tracking services. A consent banner is therefore not currently required for this website.

Instagram, SoundCloud and Spotify

Artist profiles may contain ordinary external links to Instagram, SoundCloud and Spotify. No social-media plugins, players or feeds are embedded. A connection to the respective provider is made only when you actively follow such a link; from that point the external provider processes data under its own responsibility and privacy terms.

Recipients and international transfers

Personal data is received only by parties that require it to operate the website or handle an enquiry. This includes the technical hosting provider, the named 38.TRIBE recipients and the transactional email provider Resend (Plus Five Five, Inc., USA) acting as a processor.

Resend states that email metadata, addresses and message content are stored in the United States. The transfer is governed by a data processing agreement including the EU Standard Contractual Clauses; Resend also states that it participates in the EU–US Data Privacy Framework. External social-media providers are contacted only after an active click.

Data subject rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing, data portability and objection. Where processing is based on consent, you may withdraw that consent for the future. You also have the right to lodge a complaint with a data protection authority.

The competent authority is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2–4, 40213 Düsseldorf. Further information: www.ldi.nrw.de.

Automated decisions

The current application code does not use automated decision-making, including profiling.