Privacy Policy
Last updated: 13 September 2026
1. Controller
The Controller within the meaning of the General Data Protection Regulation (GDPR) is:
Soul Radar – Your Soul Event Finder
Tim-Niklas Kubach
Lugbank 6
96049 Bamberg
Germany
E-mail: info@soulradar.net
This Privacy Policy explains which Personal Data is processed when Soul Radar (soulradar.net) is used, for which purposes this is done and which rights data subjects have.
2. General information on data processing
Soul Radar is a platform for finding, publishing and managing Soul events and for connecting users, DJs and promoters.
Depending on how Soul Radar is used, the following data in particular may be processed: name or profile name, e-mail address, authentication and session data, voluntary profile details, profile pictures, event data, attendance and favourite data, follower/following relationships, messages, voluntarily provided location data as well as technical usage and log data.
Depending on the respective operation, processing is based in particular on Art. 6 (1) lit. b GDPR for the provision of the requested functions and on Art. 6 (1) lit. f GDPR to ensure secure and functional operation. Where processing is based on consent, Art. 6 (1) lit. a GDPR is the Legal Basis.
3. Hosting and Emergent
Soul Radar is operated via the Emergent platform.
The Processor is:
Emergent Labs Inc.
2380 Via Espada
Pleasanton, CA 94566
USA
E-mail: privacy@emergent.sh
Under the data processing agreement in place with Emergent, Soul Radar acts as Controller with regard to the data of its users and Emergent acts as Processor. The data processed by Emergent on our behalf expressly includes Personal Data in the databases and storage provided for the application.
Emergent uses Sub-processors to provide its services. These may include, in particular, providers of cloud hosting, object storage, e-mail delivery and authentication.
Processing by Emergent and its Sub-processors may take place in the EU, the USA and India.
Where data is transferred to a third country without an adequacy decision, the data processing agreement provides in particular for the Standard Contractual Clauses (SCCs) of the European Commission pursuant to Art. 46 GDPR as the transfer mechanism.
Emergent undertakes not to use Personal Data of customers for training, retraining or fine-tuning AI models and to contractually prohibit this for the AI Sub-processors it uses.
4. Technical access and log data
When Soul Radar is accessed, technically necessary data is processed. This may include in particular the IP address, time and type of access, requested resources, browser and device information as well as error and diagnostic data.
This processing serves to deliver the website, to ensure secure and stable operation and to detect and prevent abuse and technical malfunctions.
The Legal Basis is Art. 6 (1) lit. f GDPR. Our Legitimate Interest lies in the secure and functional operation of Soul Radar.
Precise location coordinates of the Near Me function are not logged in clear text in the access logs controlled by Soul Radar.
Certain platform-level service and log data is processed by Emergent as an independent controller for its own purposes under its data processing agreement, in particular for operation and security as well as fraud and abuse prevention.
For individual infrastructure, ingress and system logs maintained by Emergent at platform level, Soul Radar has no specific deletion periods available. These logs are processed in accordance with the platform operator's specifications and deleted as soon as they are no longer required for the respective purposes or existing retention obligations.
5. Registration and user account
Certain Soul Radar functions require a user account.
During registration, in particular the name, e-mail address, authentication data and the profile and account settings chosen by the user are processed.
Passwords are not stored in clear text but protected using a cryptographic hashing procedure (bcrypt).
Processing is carried out to set up and provide the user account on the basis of Art. 6 (1) lit. b GDPR.
Soul Radar is intended for registered users aged 16 and over. During registration, users must confirm that they have reached the minimum age of 16. This also applies when an account is first created via Google Login. No date of birth is collected for this purpose.
6. Google Login
As an alternative to regular registration, a user account can be created via Google or the login can be performed via Google.
In this case, Soul Radar receives in particular the name, e-mail address, profile picture URL and the information that authentication was successful. As of the current technical status, Soul Radar does not store any Google access or refresh tokens.
In connection with Google authentication, Personal Data may be transferred to Google and to the USA.
Use of Google Login is voluntary. Regular login is available as an alternative. The Legal Basis for processing by Soul Radar is Art. 6 (1) lit. b GDPR.
7. Public profiles
Soul Radar profiles can generally be accessed publicly, even without logging in.
Depending on voluntary details and usage, the following in particular may be visible there:
- profile name and profile picture
- voluntarily provided location
- DJ or organizer designation
- biography and other voluntary profile details
- favourite track and favourite event
- linked social media profiles
- upcoming and past events
- attendance, DJ and organizer history
- follower and following counts
Follower and following figures can be clicked, so that it is visible which profiles are behind them.
Users should therefore only provide information in their public profile that they wish to make publicly accessible.
Publicly accessible information can in principle also be captured by search engines, unless the respective page is technically excluded from indexing.
The Legal Basis for providing the profile and community functions chosen by the user is Art. 6 (1) lit. b GDPR.
8. “I'm Going” and event history
Logged-in users can use “I'm Going” to indicate that they intend to attend an event.
The number of confirmations may be displayed publicly. The specific list of attending users is only accessible to logged-in users.
A user's event history is derived from their “I'm Going” entries. After an event has ended, it may therefore appear as an attended event in the public profile.
If an “I'm Going” entry is withdrawn, the corresponding link is removed and the event is no longer included in the personal history on the basis of that entry.
The Legal Basis is Art. 6 (1) lit. b GDPR.
9. DJ and organizer attributions
Soul Radar can display at which events a user has been listed as DJ or promoter.
DJ attributions may either be linked to a Soul Radar profile or merely appear as a free-text DJ/artist name within an event.
Events that are entered editorially by Soul Radar itself are not attributed to the user account used for this purpose as personally organized events.
Names of DJs, artists and promoters may be retained as part of historical event information even after an event has ended.
Depending on the specific attribution, the Legal Basis is Art. 6 (1) lit. b or lit. f GDPR. The Legitimate Interest lies in particular in providing accurate event information and a traceable event archive.
10. Following and blocking
Logged-in users can follow other users, DJs and promoters and block users.
For this purpose, the corresponding relationships between user accounts are stored. Follower and following relationships may be visible to other users as part of the community functions. Blocks are not publicly visible.
When a user account is deleted, the associated follow and block relationships are removed.
The Legal Basis is Art. 6 (1) lit. b GDPR.
11. Saved events
Logged-in users can save events or mark them as favourites. For this purpose, the link between the user account and the respective event is stored.
When the user account is deleted, these personal associations are deleted.
The Legal Basis is Art. 6 (1) lit. b GDPR.
12. Events and event archive
Promoters can submit and manage events on Soul Radar. In doing so, in particular the event title, date and time, venue and address, description, genres, event type, admission and ticket information, external links, venue information, names of DJs and artists as well as flyers and other images may be processed.
Soul Radar may also record events editorially itself. Such recording does not mean that Soul Radar or the user who entered the data is the promoter of the event.
Published events may remain in the public event archive after they have ended. This serves to document past events and to support the history and community functions built upon them.
The Legal Basis for processing by promoters is in particular Art. 6 (1) lit. b GDPR. For the editorial provision and archiving of publicly advertised event information, we rely in particular on Art. 6 (1) lit. f GDPR. Our Legitimate Interest lies in operating an information and event archive for the Soul scene.
13. Images, flyers and file storage
Profile pictures, event flyers and other uploaded images are processed via the file storage provided for Soul Radar by Emergent.
Event images and flyers are publicly accessible in accordance with their function.
Users may only upload content which they are entitled to use and publish. If individuals believe that an image or other personal content has been published without authorization, they may contact info@soulradar.net.
When a user account is deleted, the associated profile picture is deleted from the file storage used by Soul Radar or made inaccessible for regular access. Event flyers are retained if the associated event remains in the archive.
14. Direct messages
Logged-in users can exchange direct messages via Soul Radar.
In doing so, in particular the sender, recipient, message content, timestamp and, where applicable, an event reference are processed.
If a user deletes a message from their view, it is hidden for that user. It may remain available to the other participant in the conversation.
If a sender's user account is deleted, messages already sent may be retained for the other participant so that their existing communication is not retroactively altered. In this case, the link to the deleted user account is removed. The sender is subsequently displayed as “Gelöschter Nutzer” or “Deleted user”. The profile picture, profile link, location and other profile data of the deleted account are no longer provided in this context.
The Legal Basis for the messaging function is Art. 6 (1) lit. b GDPR. The limited retention of messages already received after account deletion may be based on Art. 6 (1) lit. f GDPR. The Legitimate Interest lies in not retroactively distorting the communication history of the remaining conversation participant.
15. “Near Me” location function
Soul Radar offers a voluntary proximity search.
The device location is only accessed if the user actively invokes the function and grants location permission via the browser or device.
The current geographic coordinates are temporarily transmitted to the Soul Radar backend to determine events within the requested radius.
Precise device coordinates are not permanently stored in the Soul Radar database. Soul Radar does not create a location history. Transmitted longitude and latitude values are redacted in the access logs controlled by Soul Radar.
The Legal Basis is Art. 6 (1) lit. b GDPR, as processing is carried out exclusively to provide the proximity search actively requested by the user.
16. Location in the profile
Independently of “Near Me”, a user may voluntarily state a location in their profile.
This profile location is stored and may be displayed publicly. It must be distinguished from the precise location coordinates of the device.
The user can change or remove this information.
17. OpenStreetMap
For map display, Soul Radar uses map material from OpenStreetMap.
When the map view is loaded, map tiles are retrieved directly from the infrastructure of the OpenStreetMap Foundation. In this process, in particular the IP address, browser information and the requested map section are processed technically.
Provider:
OpenStreetMap Foundation
St John's Innovation Centre
Cowley Road
Cambridge
CB4 0WS
United Kingdom
The map data is processed to provide the map function requested by the user. The Legal Basis is Art. 6 (1) lit. b GDPR.
Privacy information: https://osmfoundation.org/wiki/Privacy_Policy
18. Nominatim geocoding
To convert place and address details into geographic coordinates, Soul Radar uses the Nominatim service provided by the OpenStreetMap Foundation.
The request is made via the Soul Radar backend. The user's IP address is therefore not transmitted directly from their browser to Nominatim as part of this request. The data processed is in particular the place or address to be geocoded.
Geocoding results may be cached internally to avoid repeated identical requests.
Nominatim Usage Policy: https://operations.osmfoundation.org/policies/nominatim/
19. E-mail delivery
Soul Radar sends function-related e-mails, in particular for e-mail verification, password reset and, where applicable, in connection with user, support and community functions.
E-mails are sent via the e-mail infrastructure provided by Emergent. According to Emergent's sub-processor documentation, Amazon Simple Email Service (Amazon SES) is used for this purpose, among others.
In this process, in particular the e-mail address, name, subject, message content and technical delivery information may be processed.
Emergent may use Sub-processors to provide its services and remains responsible for their data protection obligations under its DPA.
20. Support requests, reports and moderation
When users contact Soul Radar, submit support requests or report content or other users, the data required for processing is handled. This may include in particular contact details, user ID, message text, details of the content concerned and internal processing information.
Closed support cases, reports as well as audit and moderation information are generally retained for up to 365 days. Individual cases may be retained longer where this is necessary due to an ongoing abuse, security or legal matter.
When a user account is deleted, the user's real name is removed from any remaining audit or moderation information and the internal user ID is pseudonymized.
Depending on the operation, the Legal Basis is Art. 6 (1) lit. b or lit. f GDPR. Our Legitimate Interests lie in particular in handling requests, moderation, abuse prevention as well as the security and integrity of the platform.
21. Cookies and local browser storage
Soul Radar uses cookies and browser storage technologies to the extent that they are necessary for login, security, language, display or functions chosen by the user.
These include in particular the session cookie required for the logged-in session as well as local entries for authentication and settings such as language, display and view mode.
Where the storage of or access to information on the end device is strictly necessary to provide a digital service expressly requested by the user, this is done pursuant to § 25 (2) TDDDG without prior consent.
Soul Radar currently does not use any of its own non-essential analytics, advertising or tracking technologies. In particular, PostHog and its session recording are not used on soulradar.net.
Soul Radar does not use personalized advertising and does not create advertising profiles of its users.
22. Recipients of Personal Data
Personal Data is only disclosed where this is necessary to provide Soul Radar, where a legal obligation exists or where another Legal Basis applies.
Possible recipients include in particular:
- Emergent Labs Inc. as Processor for hosting and platform operation,
- the Sub-processors used by Emergent for the specific functions in use, in particular infrastructure, storage and e-mail service providers,
- Google when Google Login is used,
- the OpenStreetMap Foundation when map and geocoding functions are used.
Emergent's general sub-processor list contains numerous providers for various Emergent products and functions. This does not mean that all companies listed there receive Personal Data of Soul Radar users.
23. International / Third-Country Data Transfers
In the course of operating Soul Radar, Personal Data may be processed outside the European Union or the European Economic Area.
The Emergent DPA names the USA, the EU and India as processing locations.
Where no adequacy decision of the European Commission exists for a third country, the agreement with Emergent provides in particular for the Standard Contractual Clauses (SCCs) of the European Commission pursuant to Art. 46 GDPR. For the relationship between Soul Radar as Controller and Emergent as Processor, the corresponding controller-to-processor module is generally intended to apply.
24. Account deletion and retention period
Users can delete their Soul Radar account themselves.
Upon account deletion, in particular the user account and profile data, active sessions and e-mail tokens, “I'm Going” associations, favourites, follow and block relationships, the organizer profile and open associations that are no longer required are deleted.
The profile picture is deleted from the file storage used by Soul Radar or subsequently made inaccessible for regular access.
Events that have already been published and archived are not automatically deleted when a user account is deleted. Instead, the link to the user account is removed. This applies in particular because historical event information forms part of the public event archive. Events entered editorially as Soul Radar remain attributed to Soul Radar.
Direct messages already sent may be retained for the respective conversation participant; the link to the deleted user account is removed and the sender is displayed as “Deleted user”.
Audit, moderation, support and report data may be retained in accordance with the periods stated in this Privacy Policy or for as long as a specific security or legal reason exists.
25. Backups
Backup copies of the production database are created by the infrastructure provided by Emergent.
According to the backup cycles currently documented for the infrastructure in use, deleted data may remain in backup copies for up to 12 months.
These backup copies serve resilience and recovery purposes and are not part of regular production access.
Emergent's DPA also provides that data in routine backups or archives may not be capable of immediate deletion. In this case, such data must be isolated, taken out of use and protected from further processing until it is deleted in the regular backup cycle.
26. Data security
Soul Radar employs technical and organizational measures to protect Personal Data against loss, manipulation and unauthorized access.
These include in particular encrypted data transmission via HTTPS/TLS, cryptographic password hashing, protected session cookies, access restrictions, CORS restrictions, rate limiting for security-relevant operations and protected management of credentials and secrets.
In its DPA, Emergent undertakes to implement appropriate technical and organizational measures pursuant to Art. 32 GDPR and states that it maintains ISO 27001 and SOC 2 Type II.
27. Rights of data subjects
Subject to the statutory requirements, data subjects have in particular the right of access pursuant to Art. 15 GDPR, rectification pursuant to Art. 16 GDPR, erasure pursuant to Art. 17 GDPR, restriction of processing pursuant to Art. 18 GDPR, data portability pursuant to Art. 20 GDPR and objection pursuant to Art. 21 GDPR.
Where processing is based on consent, this consent may be withdrawn at any time with effect for the future. The lawfulness of processing carried out until withdrawal remains unaffected.
To exercise these rights, a message to the following address is sufficient:
info@soulradar.net
28. Right to object
Where we process Personal Data on the basis of Art. 6 (1) lit. f GDPR, data subjects have the right under Art. 21 GDPR to object to the processing on grounds relating to their particular situation.
We will then no longer process the Personal Data concerned unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves the establishment, exercise or defence of legal claims.
29. Right to lodge a complaint
Pursuant to Art. 77 GDPR, data subjects have the right to lodge a complaint with a data protection supervisory authority.
The authority competent for the Controller is in particular:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Germany
The right to contact another supervisory authority competent under the GDPR remains unaffected.
30. Automated decision-making
Soul Radar currently does not use any solely automated decision-making, including profiling, within the meaning of Art. 22 GDPR that produces legal effects concerning users or similarly significantly affects them.
31. Changes to this Privacy Policy
We will amend this Privacy Policy if Soul Radar's functions, the service providers used or the legal or technical framework change.
The current version published on soulradar.net applies.