Privacy and data protection

Privacy Notice

This Privacy Notice explains processing by Brockhaus Ventures UG (haftungsbeschränkt) i. G. and the boundary to processing performed for professional Workspace customers.

Version: 1.0
Last updated: 2026-08-28

Controller and privacy contact

Brockhaus Ventures UG (haftungsbeschränkt) i. G., operating the NOCTRA Intelligence product, is the controller for the activities identified below where it determines purposes and means.

NOCTRA IntelligenceBrockhaus Ventures UG (haftungsbeschränkt) i. G.Falgerstraße 748147 MünsterGermanyEmail the NOCTRA privacy contact: legal@noctraintelligence.com

NOCTRA controller processing

Public website and server logs

Purpose: Deliver the public site, maintain availability, diagnose faults and protect the Platform against misuse.
Data categories: IP and request metadata that may be available to the host, date and time, requested path, response and diagnostic data, browser or device metadata and sanitized application log categories.
Legal basis: Article 6(1)(f) GDPR — legitimate interests in secure, reliable and diagnosable operation. Article 6(1)(c) applies where a specific legal security duty requires processing.
Recipients / providers: Hosting and infrastructure providers where the request reaches their function; competent authorities where legally required.
Source: Automatically from the requesting device and the application or provider runtime.
Retention: For the period necessary to operate and diagnose the service, investigate availability or security events and meet applicable legal-defence needs; provider logs follow the configured provider retention controls.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Technical request data is necessary to deliver the requested page; optional analytics is separate.

Support and contact requests

Purpose: Persist, route and answer general contact-form submissions, business, support, ticket-recovery, privacy and security communications.
Data categories: Optional name, email, selected topic, message, Workspace or transaction references supplied by the sender, correspondence and open/resolved status. Ticket recovery additionally uses the buyer email and matching ticket records; rate limiting uses a pseudonymized HMAC-derived request signal rather than storing the raw IP address in the request record.
Legal basis: Article 6(1)(b) GDPR for pre-contractual or contractual requests involving the data subject; otherwise Article 6(1)(f) for business communication and support. Article 6(1)(c) applies to legally required privacy or security handling.
Recipients / providers: NOCTRA personnel handling the request and the relevant hosting, authentication or email provider where technically involved; legal advisers or authorities where necessary.
Source: Directly from the sender or an authorized Workspace contact.
Retention: Until the request is resolved, then for applicable legal retention or limitation periods where the correspondence is needed as contract, compliance or dispute evidence.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Generally voluntary; without necessary contact and request details NOCTRA may be unable to respond or verify authority.

Workspace access inquiries previously submitted through Google Forms

Purpose: Review workspace access inquiries from prospective professional organizers and respond to the request; send future updates only where separately requested.
Data categories: Name, email, optional phone, company or Event-series information, organizer role, Event location and schedule, attendance, current software, operational challenges, product interests, feedback willingness and optional update interest.
Legal basis: Article 6(1)(b) GDPR for the requested pre-contractual workspace access review; Article 6(1)(a) for optional future updates, which can be withdrawn at any time.
Recipients / providers: Google Forms / Google Workspace for the externally hosted form and NOCTRA personnel reviewing the application.
Source: Directly from the applicant in the actively opened external form. The form is linked rather than embedded, so the NOCTRA page does not load the form before the visitor opens it.
Retention: For workspace access review and follow-up, then only for applicable evidence or limitation needs. Optional update contact data remains until withdrawal or the update purpose ends.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Voluntary. Required form fields were necessary to review the workspace access inquiry; optional fields and update interest could be omitted.

Consent-gated Google Analytics 4

Purpose: Measure use of the public landing page and valid public Event pages. The configured event contract is limited to allowlisted public page events; checkout and purchase events, authenticated organizer and Workspace activity, Platform Admin and other protected product surfaces are excluded.
Data categories: Consent state, sanitized public-surface category and public locale, page and interaction events, pseudonymous analytics identifiers and ordinary request or device metadata. NOCTRA does not intentionally send names, email addresses, phone numbers, internal UUIDs, Event, Venue or Workspace names, Event keys or slugs, ticket, pass or reservation identifiers, financial or business metrics, raw query strings or protected URLs.
Legal basis: Article 6(1)(a) GDPR and consent for optional terminal-device access under applicable German law. Consent can be withdrawn through Cookie Settings without affecting processing before withdrawal.
Recipients / providers: Google Analytics where production configuration is valid and the visitor has accepted the current disclosure version. The Google contracting entity and role remain verification blockers.
Source: From the consenting visitor’s browser and limited public-page interactions.
Retention: GA4 event data and cookies follow the configured Analytics property, browser controls and Google’s applicable retention controls. The account-level setting must be confirmed before Production activation. Withdrawal disables further analytics emission and triggers attempted cleanup of NOCTRA Attribution Lite state and GA cookies.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Optional. Rejection or no decision prevents the Google tag from loading and does not limit core Platform or public-page use.

Consent-gated Attribution Lite

Purpose: Associate limited public acquisition context and allowlisted public interactions with signup and Workspace-creation milestones for aggregate campaign measurement.
Data categories: Canonical public landing-path category, referrer domain, sanitized UTM values, public tool identifier, allowlisted CTA identifier and timestamps. The state is stored in the browser and may be supplied as limited parameters only with accepted analytics consent.
Legal basis: Article 6(1)(a) GDPR and consent under section 25(1) TDDDG for optional terminal-device storage and access. Consent can be withdrawn through Cookie Settings.
Recipients / providers: Google Analytics only when GA4 is configured and the visitor has accepted the current analytics disclosure; otherwise the state remains in the browser.
Source: From the consenting visitor’s browser navigation and allowlisted public interactions.
Retention: At most 180 days from the first recorded touch. Stale state is discarded. Rejection or withdrawal clears the Attribution Lite browser state.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Optional. No Attribution Lite state is created or read for analytics unless the visitor has accepted analytics consent; rejection does not limit core services.

Accounts and authentication

Purpose: Create and secure accounts, authenticate users, maintain sessions, recover access and associate authorized users with Workspaces.
Data categories: Name, email, account and authentication identifiers, session and recovery state, membership, role, permission, invitation and access or revocation status.
Legal basis: Article 6(1)(b) GDPR where required to provide the requested account or contract to the data subject; Article 6(1)(f) for secure B2B administration of representatives and team members; Article 6(1)(c) for specific legal security duties.
Recipients / providers: Database, authentication, hosting and infrastructure providers used to deliver protected Platform access.
Source: Directly from the user, an inviting Workspace administrator and authentication systems.
Retention: For the account and Workspace relationship, then until deletion or restriction under applicable account, contract, security and legal-evidence requirements. Revoked access history may remain where needed for security evidence.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Required for protected Workspace access; without it the user cannot use authenticated Platform functions.

Platform Contract and contracting-party evidence

Purpose: Identify the professional customer, verify technical acceptance authority, form and evidence the Workspace Contract and administer the selected Plan.
Data categories: Workspace, user and membership identifiers; role snapshot; contracting-party name, business type, address, country, billing email and optional registration or VAT information; B2B and authority attestations; Terms and DPA versions and hashes; Plan and commercial snapshot; timestamps and evidence hash.
Legal basis: Article 6(1)(b) GDPR where the data subject is the contracting professional; otherwise Article 6(1)(f) for B2B contract formation and administration through authorized representatives. Article 6(1)(c) and Article 6(1)(f) apply to mandatory records and establishment, exercise or defence of legal claims.
Recipients / providers: Database, authentication, hosting and infrastructure providers for protected contract processing; advisers, auditors or authorities where lawfully required.
Source: From the accepting user, Workspace authority records and the immutable legal and commercial release records.
Retention: Historical acceptance evidence is append-only and retained for applicable contract, tax, audit, limitation and dispute periods. It is not erased merely because the accepting user later leaves the Workspace.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Required to conclude a Workspace Contract. Optional registration and VAT fields are required only where applicable or supplied.

Workspace administration and invitations

Purpose: Administer NOCTRA’s account relationship, invitation delivery, membership status and supportable authority boundaries independently of customer-controlled Event content.
Data categories: Business contact, invitation, role, membership, audit, activation and revocation data.
Legal basis: Article 6(1)(b) GDPR for the requested Platform relationship and Article 6(1)(f) for secure administration of business teams and authority.
Recipients / providers: Database, authentication, hosting and transactional-communication providers where an invitation or message is sent.
Source: From the invited user, the inviting Workspace and system-generated access records.
Retention: For the invitation and membership lifecycle, then as needed for account security, contract evidence and applicable limitation periods.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Required for the requested invitation or membership; no invitation or protected access can be administered without the necessary contact and authority data.

Payments, ticketing and mixed roles

Purpose: Support SaaS subscription billing, hosted ticket checkout, Stripe Connect organizer payment accounts, payment and full-order refund handling, transaction security and NOCTRA’s own legal or commercial obligations. The organizer is generally the ticket seller and controller for the buyer relationship; NOCTRA processes customer-controlled buyer data under the DPA where applicable. Stripe may process data as processor, independent controller or in another role depending on the payment activity and its terms.
Data categories: Workspace subscription and billing references; organizer payment-account, seller, business and tax data; buyer name, email and billing data; reservation, order, ticket, pass, transfer, payment, full-order refund, chargeback, invoice and correction references, status and amounts. Card-entry data is handled on Stripe-hosted surfaces rather than stored directly by the NOCTRA application.
Legal basis: For NOCTRA-controlled portions: Article 6(1)(b) GDPR where necessary for the relevant contract, Article 6(1)(f) for secure B2B payment and transaction administration, and Article 6(1)(c) for mandatory financial or compliance records. Customer-controlled portions follow the organizer’s legal basis and instructions.
Recipients / providers: Stripe, the relevant organizer or ticket seller, and database, hosting and transactional-communication providers; authorities, banks or advisers where legally necessary.
Source: From the buyer, organizer, Workspace configuration, Stripe and system-generated transaction records.
Retention: Operational data for the subscription or transaction lifecycle; completed financial, refund and dispute evidence for applicable statutory, limitation and defence periods. Each category follows its purpose and applicable retention criterion rather than one universal period.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Required for the selected paid ticket and payment flow. Without required buyer and payment data, a paid ticket purchase cannot be completed. Free tickets and Guestlist flows are distinct.

Financial, tax, contract and audit evidence

Purpose: Create and preserve legally required invoices, corrections, refunds, responsibility attestations, contract versions, audit trails and dispute evidence.
Data categories: Party and contact identity, transaction and tax context, invoice and correction data, acceptance and version records, timestamps, actor attribution, immutable hashes and dispute records.
Legal basis: Article 6(1)(c) GDPR for applicable accounting, tax and compliance duties; Article 6(1)(f) for reliable audit evidence and establishment, exercise or defence of legal claims.
Recipients / providers: Database and hosting providers; the relevant contracting party or ticket seller; tax, audit, legal and public authorities where lawfully required.
Source: From contracting parties, users, transaction providers and immutable application evidence paths.
Retention: For the applicable statutory retention and limitation periods. Retained evidence is segregated from ordinary active product use where the operational relationship has ended. No single period is asserted for all categories.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Some data is legally or contractually required. If required identity, tax or transaction evidence is not provided, NOCTRA may be unable to conclude or perform the relevant transaction or satisfy legal duties.

Security, fraud and abuse prevention

Purpose: Protect accounts, Workspaces, reservations, refunds, ticket access and infrastructure; investigate suspicious or failed operations and enforce security boundaries.
Data categories: Authentication and authorization events, access and revocation status, technical request data, scoped transaction references, rate-limit counters and pseudonymized HMAC-derived abuse signals.
Legal basis: Article 6(1)(f) GDPR — legitimate interests in protecting users, customers, transactions and systems; Article 6(1)(c) where specific security or fraud-prevention duties apply.
Recipients / providers: Database, hosting, security and rate-limit providers, and Stripe where relevant to the affected payment flow; authorized personnel, advisers or authorities where necessary.
Source: Automatically from application, authentication, request and provider events; from reports submitted by users or customers.
Retention: For as long as needed to prevent, investigate and evidence the relevant security or abuse event and for applicable legal-defence periods; provider-specific periods require verification.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Generated as necessary for secure use. Refusing necessary security processing can make the affected function unavailable.

Privacy requests and legal defence

Purpose: Verify and answer rights requests, document compliance, communicate with authorities and establish, exercise or defend legal claims.
Data categories: Identity and contact data, request and verification details, affected records, correspondence, decision and fulfilment evidence, authority or legal correspondence.
Legal basis: Article 6(1)(c) GDPR for GDPR request and authority obligations; Article 6(1)(f) for proportionate identity verification, compliance evidence and legal claims.
Recipients / providers: NOCTRA personnel, the relevant Workspace controller where the request concerns customer-controlled data, service providers needed to retrieve records, advisers, courts and competent authorities.
Source: From the requesting person, the relevant organizer or Workspace, NOCTRA systems and competent authorities.
Retention: For request handling and then for applicable accountability, limitation and legal-defence periods.
International transfers: Where a recipient processes personal data outside the EEA or access from a third country occurs, NOCTRA relies on an adequacy decision or another safeguard permitted by Chapter V GDPR where required. The concrete account-level transfer and contract facts are reviewed for the service used; no universal region or mechanism is asserted.
Required or optional: Information necessary to identify the relevant records and verify identity may be required; excessive verification data is not requested as a default.

Processing controlled by a Workspace customer

A professional Workspace customer generally determines the purposes and means for its Event, Venue, Guestlist, Door, Campaign, ticket purchaser, attendee, reservation, ticket, refund and customer-report processing. For those instructed activities, NOCTRA generally acts as processor under the DPA rather than as independent controller.

People whose data relates to a customer-controlled Event or buyer relationship should normally contact the identified organizer or ticket seller. NOCTRA will route a request concerning customer-controlled data to the relevant controller and will assist that controller as required by the DPA. NOCTRA remains responsible for the separate controller activities identified in this Notice.

Customer-controlled processing can include organizer and seller records, public Event, Venue and Organizer pages and media, ticket purchasers and attendees, Guestlist, Door and access events, Offline Door data held locally on an enabled device, Campaign records, operational and commercial actuals, and generated Event or periodic reports. Transactional email providers may deliver customer-directed invitations, tickets and confirmations on NOCTRA’s behalf.

Cookies and browser storage

The current browser state supports public language and cookie preferences, authentication, recovery, secure callback binding, requested functional features and ticket-transfer replay protection. Optional analytics storage is separate and consent-gated.

noctra_public_locale

Purpose: Remember an explicit English or German choice across public pages and buyer flows.
Technical necessity: Required for the stated core flow
Approximate lifetime: Up to approximately one year; replaced when another supported language is selected.
Relationship: First-party, HTTP-only NOCTRA cookie; it does not change an organizer account or Workspace locale.
Analytics or marketing: Not used for analytics or marketing

noctra_public_analytics_consent

Purpose: Remember whether a public visitor accepted or rejected optional analytics cookies and the disclosure-policy version for that choice. Rejected and undecided states do not load the Google tag.
Technical necessity: Used only to remember the visitor’s choice; if absent, optional analytics cookies remain undecided and disabled.
Approximate lifetime: Up to approximately six months; replaced when the visitor changes the choice.
Relationship: First-party NOCTRA preference cookie readable by public-site code; independent from public language and organizer or Workspace locale. Acceptance from an older disclosure version returns to undecided when a materially changed policy becomes active; rejection remains fail-closed.
Analytics or marketing: Stores only the Cookie Banner preference. It does not itself send an analytics request.

Google Analytics cookies (_ga and _ga_<container-id>)

Purpose: Distinguish browsers and preserve session state for the limited public-surface measurement described above after valid consent.
Technical necessity: Optional; used only after acceptance under the current GA4 disclosure version and valid production configuration.
Approximate lifetime: Controlled by the configured Analytics property, Google and the browser. NOCTRA attempts to expire matching cookies when analytics is rejected or withdrawn.
Relationship: First-party Google Analytics cookies, separate from the NOCTRA language and consent-preference cookies. They are created only after the production and consent gates pass.
Analytics or marketing: Consent-gated public analytics only; not advertising or marketing profiling.

Supabase Auth and PKCE cookies

Purpose: Maintain authentication sessions and complete PKCE sign-in or recovery exchanges.
Technical necessity: Required for the stated core flow
Approximate lifetime: Session and provider configuration dependent; no single lifetime is fixed in application code.
Relationship: First-party cookies managed through the Supabase authentication SDK.
Analytics or marketing: Not used for analytics or marketing

noctra-password-recovery

Purpose: Bind a password-recovery callback to the protected reset-password flow.
Technical necessity: Required for the stated core flow
Approximate lifetime: Up to approximately 10 minutes; cleared after completion or expiry.
Relationship: First-party, HTTP-only NOCTRA cookie.
Analytics or marketing: Not used for analytics or marketing

noctra_stripe_onboarding_workspace

Purpose: Bind a Stripe Connect onboarding callback to the Workspace that started it.
Technical necessity: Required for the stated core flow
Approximate lifetime: Up to approximately 30 minutes; expired by the return flow.
Relationship: First-party, HTTP-only NOCTRA cookie used around Stripe Connect.
Analytics or marketing: Not used for analytics or marketing

Ticket-transfer sessionStorage

Purpose: Hold a per-tab random nonce for transfer creation or recovery replay protection.
Technical necessity: Required for the stated core flow
Approximate lifetime: Current browser-tab session; the nonce can rotate during the flow.
Relationship: First-party browser session storage; no third-party script receives it.
Analytics or marketing: Not used for analytics or marketing

Functional local and session preferences

Purpose: Remember desktop-sidebar state, local Event Planning Checklist progress, temporary post-event state and organizer-interface dismissals or preferences requested by the user.
Technical necessity: Functional storage used only when the visitor or authorized user requests the corresponding feature
Approximate lifetime: Checklist and sidebar preferences remain until changed or browser storage is cleared; temporary operational state lasts for the relevant tab or browser session.
Relationship: First-party localStorage or sessionStorage. These values support the requested interface or tool and are not conditional on analytics consent.
Analytics or marketing: Not used for analytics or marketing

Offline Door IndexedDB and service-worker cache

Purpose: Hold an authorized Event access snapshot and the application resources needed for the explicitly enabled Offline Door workflow.
Technical necessity: Functional storage used only when the visitor or authorized user requests the corresponding feature
Approximate lifetime: For the enabled offline workflow until the local snapshot, site data or service-worker cache is replaced or cleared.
Relationship: First-party IndexedDB and service-worker/cache storage on the authorized Door device; independent from optional analytics consent.
Analytics or marketing: Not used for analytics or marketing

NOCTRA Attribution Lite localStorage

Purpose: Store limited public landing, referrer-domain, sanitized campaign and allowlisted interaction context for consented public acquisition measurement.
Technical necessity: Optional; used only after acceptance under the current GA4 disclosure version and valid production configuration.
Approximate lifetime: At most 180 days from the first recorded touch; stale state is discarded and rejection or withdrawal clears it.
Relationship: First-party localStorage. It is created and used only after current analytics consent and is cleared with analytics rejection or withdrawal.
Analytics or marketing: Consent-gated public analytics only; not advertising or marketing profiling.

Necessary cookies support the stated core functions. The Cookie Banner stores a versioned accepted or rejected preference and sends no analytics request itself. Optional GA4 loads only when production configuration is valid and the current policy is accepted. Rejection stops future application events and triggers best-effort removal of the configured GA cookies. Public language remains independent.

General retention and termination boundary

Retention follows the purpose and legal basis stated for each activity. Customer-processor data is returned or deleted after the Platform Contract ends in accordance with documented DPA instructions and the technically available process, subject to statutory retention. This does not erase NOCTRA-controller evidence that must remain for applicable financial, tax, contract, audit, security, limitation or dispute purposes. Retained evidence is restricted from ordinary active product use. No universal backup or provider-deletion period is promised.

Your data-protection rights

Access to personal data and the information required by Article 15 GDPR.
Rectification of inaccurate data under Article 16 GDPR.
Erasure under Article 17 GDPR where its requirements are met.
Restriction of processing under Article 18 GDPR.
Data portability under Article 20 GDPR where applicable.
Objection under Article 21 GDPR to processing based on legitimate interests, on grounds relating to the person’s particular situation; direct-marketing objections apply without that additional requirement.
Withdrawal of consent at any time for the future, without affecting the lawfulness of processing before withdrawal.
Complaint to a competent data-protection supervisory authority under Article 77 GDPR.

Email the NOCTRA privacy contact: legal@noctraintelligence.com

Complaint to a supervisory authority

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-WestfalenPostfach 20 04 44, 40102 Düsseldorf, Germany+49 (0)211 / 38424 - 0https://www.ldi.nrw.de/kontakt

You may complain to this authority or another competent supervisory authority. The authority name and contact above were verified against its official contact page on 13 August 2026.

Automated decision-making

NOCTRA does not use the controller processing described in this Notice to make decisions based solely on automated processing that produce legal effects or similarly significantly affect a person within Article 22 GDPR. Operational calculations, fraud signals and access checks do not by themselves establish such a decision. If that product fact changes, this Notice must be updated before the change is used.

Providers and processing terms

View the DPA View provider disclosure

Security reports

Suspected security issues affecting the NOCTRA Platform can be reported to the published security contact. No response time or outcome is promised by this notice.

Email a security report: legal@noctraintelligence.com

Back to NOCTRA