Privacy Policy

The controller within the meaning of Article 4(7) GDPR is:

Treehouze GbR, Tom Kahlert, Henri Runge and Benjamin Mäder, Pappelallee 22, 10437 Berlin, Germany. Email: hello@treehouze.de. Further information can be found in our imprint.

Our website treehouze.de is provided via Lovable and Lovable Cloud. When you access our website, technically necessary access data may be processed. This may include in particular: IP address, date and time of access, pages and resources accessed, amount of data transferred, referrer URL, browser type and browser version, operating system, device information.

This processing is necessary to provide our website securely, reliably and technically correctly. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, functional and uninterrupted operation of our online offering and in detecting and preventing technical disruptions and misuse.

For our current setup, we use a hosting region within the European Union. Where Lovable uses additional technical subprocessors to provide the website, they are used as part of Lovable's infrastructure.

The domain name resolution (DNS) for treehouze.de is provided by Cloudflare. When the address of our website is looked up, the IP address of the requesting device is processed by Cloudflare for that purpose only. No website traffic passes through Cloudflare and no visitor profiles are created.

When you access our website, the hosting infrastructure may automatically create server log files. These may include in particular: IP address, date and time of access, page or resource accessed, referrer, browser information, operating system, technical connection and error data.

The processing takes place for the delivery of the website, technical troubleshooting and the detection and prevention of attacks and misuse. The legal basis is Article 6(1)(f) GDPR. The data is stored only for as long as necessary for technical operation, security and troubleshooting.

Our website allows venues, brands, event organisers, operators, collectives and other potential partners to contact us. We process the information you provide in the relevant form. This may include in particular: name, email address, name of the venue, company, brand or collective, city, type of offering or organisation, website or social media profile, information about what you would like to host through or together with Treehouze, content of your message, any additional information you provide voluntarily.

We use this data to review your enquiry, contact you and, where applicable, prepare a potential business relationship. Where your enquiry relates to the initiation of a cooperation or contract, processing is based on Article 6(1)(b) GDPR. For other enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in handling enquiries and establishing business relationships.

Form data is processed and stored through our Lovable infrastructure. We retain this data only for as long as necessary to handle the enquiry and any subsequent cooperation, unless statutory retention obligations apply.

You can join the Treehouze waitlist on our website. We currently process in particular: your name, your email address, your city, your selection regarding how you would like to use Treehouze.

We use this information to record your interest in Treehouze, keep you informed about the launch of Treehouze, new events, new cities, new formats and material developments relating to Treehouze, and to improve our offering based on demand. The legal basis for sending such updates is your consent pursuant to Article 6(1)(a) GDPR.

You can withdraw your consent at any time with effect for the future, for example by emailing hello@treehouze.de. After withdrawal, we will no longer use your email address for such updates and will delete your waitlist data unless another legal basis or statutory retention obligation applies.

All our signup forms use a double opt-in procedure. After you submit a form with the marketing consent box ticked, we send you a single confirmation email containing a one-time confirmation link. Your email address is only included in our updates once you have clicked that link. The link expires after seven days.

To document your consent, we store: whether you ticked the consent box, the time of submission, the time of confirmation and a one-time, hashed confirmation token. We do not store your IP address for this purpose. Records that are never confirmed are excluded from any communication and deleted in due course.

If we introduce a regular newsletter or an external email service provider, we will update this Privacy Policy accordingly.

We display our own events on our website. For event registration and RSVP functionality, we currently use the external service Partiful. If you click an RSVP, Join or similar button, you will be redirected to the Partiful platform.

As the event organiser, we may receive in particular the following data in connection with your event registration: name, email address, RSVP or registration status, information relating to the relevant event, answers to questions we ask in connection with the event. For individual events, we may for example ask about your favorite drink or other information relevant to event planning.

We use this data in particular for: planning the event, managing the guest list, communicating with participants, preparing and running the event, immediate follow-up after the event. Where processing is necessary to manage your participation in an event, it is based on Article 6(1)(b) GDPR. Where additional information is provided voluntarily, the legal basis depends on the specific purpose and may in particular be Article 6(1)(a) or Article 6(1)(f) GDPR.

Partiful's own processing of personal data is additionally governed by Partiful's privacy policy. Participant data that we store solely for event organisation purposes will be deleted after the event and the necessary follow-up period, unless statutory retention requirements or another legal basis apply.

For individual events, we may ask during registration via Partiful whether you agree to appear in photos or videos. You may be given the option to either consent or indicate that you do not want to be photographed or filmed.

Consent is voluntary. Refusing consent does not affect your ability to attend the event. If you give your consent, selected photo and video recordings may in particular be used for: documenting our events, our website, our social media channels, future event communication, press and public relations, general Treehouze communication and marketing. The legal basis in these cases is Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future. To do so, please contact hello@treehouze.de. The lawfulness of processing carried out before withdrawal remains unaffected.

If you do not provide consent, we will make reasonable organisational efforts not to deliberately photograph or film you or to publish such recordings. For recordings of larger groups or situations where individual persons are not the main focus, the legal assessment may differ depending on the specific context.

Our events may be subject to a fee. Event registration currently takes place via Partiful. Payment is made to a PayPal account provided by us. If you make a payment via PayPal, PayPal processes the personal data required to complete the transaction. This may include in particular: name, email address, payment amount, time of payment, transaction number, payment status, additional payment and account information required by PayPal to process the transaction.

We receive from PayPal the information required to match your payment to your registration, manage your booking and process your participation in the event. We do not process your PayPal login credentials. Processing required for payment and event booking is based on Article 6(1)(b) GDPR. Where we are required to retain payment, booking or invoice data under commercial or tax law, further processing is based on Article 6(1)(c) GDPR.

PayPal processes certain personal data under its own data protection responsibility. PayPal's privacy policy additionally applies to this processing.

According to our current technical setup, we do not use analytics, tracking, marketing or profiling services on our website. In particular, we currently do not use: Google Analytics, Meta Pixel, advertising tracking, social media tracking, comparable marketing or profiling services.

Where only technically necessary technologies are used, consent is generally not required. We therefore currently do not use a cookie banner for analytics or marketing purposes. If we introduce such technologies in the future, we will update this Privacy Policy and obtain consent before activation where required.

The fonts used on our website are served locally via our website infrastructure. Accordingly, loading our website does not establish a connection to Google Fonts or another external font provider. In particular, no IP address is transmitted to Google solely for the purpose of displaying fonts.

Our website contains links to external websites and social networks, for example Instagram. These are currently ordinary links only. We do not currently embed social media feeds, social media tracking pixels or comparable plugins directly into our website. Simply visiting our website therefore does not, solely because of such links, create a connection to the respective social network.

If you click an external link, you leave our website. Any subsequent processing of personal data is the responsibility of the respective external provider.

Our services and events are intended exclusively for adults. We do not specifically target children or adolescents and do not knowingly collect personal data from minors.

We only disclose personal data where this is necessary for the relevant purpose, where there is a legal basis for doing so, or where you have consented. Service providers currently relevant to our offering include in particular: Lovable / Lovable Cloud - hosting, technical provision, backend and storage of website and form data; Cloudflare - domain name system (DNS) resolution for treehouze.de; Partiful - event registration, guest management and collection of voluntary information or consent relating to events; PayPal - payment processing.

Where service providers process personal data solely on our behalf, they are engaged as processors pursuant to Article 28 GDPR where legally required. Where a service provider processes data under its own data protection responsibility, its own privacy information additionally applies.

We do not sell personal data. We do not disclose personal data to third parties for their own advertising purposes.

We prefer to process personal data within the European Union or the European Economic Area. However, individual providers we use may have their registered office outside the European Economic Area or may process personal data partly outside the EEA.

Where personal data is transferred to countries outside the European Economic Area, this will only take place in accordance with Articles 44 et seq. GDPR. This may in particular be based on: an adequacy decision of the European Commission, certification under a recognised data protection framework, Standard Contractual Clauses issued by the European Commission, other appropriate safeguards provided for by law.

We retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention obligations. For our current offering, the following generally applies:

Server log files: only for as long as necessary for operation, security and troubleshooting.

Contact and partner enquiries: until the enquiry has been fully handled and thereafter only where necessary for a continuing cooperation or legal obligations.

Waitlist and Treehouze updates: until you withdraw your consent or until the purpose of the waitlist or related communication no longer applies.

Event and Partiful data: generally until the event and the necessary follow-up have been completed.

Photo and video consent records: for as long as the consent is required for the relevant use or until consent is withdrawn, unless another legal basis applies.

Payment, booking and tax-relevant data: in accordance with the applicable statutory retention periods.

Depending on the relevant processing activity, we rely in particular on the following legal bases:

Article 6(1)(a) GDPR - Consent, for example for Treehouze updates and certain photo and video recordings.

Article 6(1)(b) GDPR - Contract or pre-contractual measures, for example for event bookings, payments and business partner enquiries.

Article 6(1)(c) GDPR - Legal obligation, for example for statutory retention obligations.

Article 6(1)(f) GDPR - Legitimate interests, for example for the secure operation of our website and the handling of general enquiries.

Subject to the applicable legal requirements, you have in particular the following rights: right of access under Article 15 GDPR, right to rectification under Article 16 GDPR, right to erasure under Article 17 GDPR, right to restriction of processing under Article 18 GDPR, right to data portability under Article 20 GDPR, right to object under Article 21 GDPR, right to withdraw consent under Article 7(3) GDPR.

Where processing is based on your consent, you may withdraw that consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected. To exercise your rights, simply contact hello@treehouze.de.

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right under Article 21 GDPR to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

Following such an objection, we will no longer process the relevant personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law. The supervisory authority particularly responsible for us is: Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, Germany. You may also contact another supervisory authority competent under Article 77 GDPR.

Our website is transmitted using HTTPS/TLS encryption. We take appropriate technical and organisational measures to protect personal data in particular against: unauthorised access, loss, manipulation, destruction, unlawful disclosure. Access to personal data is limited to persons and service providers who require it for the relevant purpose.

We currently do not carry out solely automated decision-making, including profiling, within the meaning of Article 22 GDPR that produces legal effects concerning an individual or similarly significantly affects them.

We may update this Privacy Policy if our offering, the services we use or the applicable legal framework changes. The current version will remain available at treehouze.de. Last updated: September 2026.