Last updated: October 2026. This is a translation for convenience. In case of doubt, the German version prevails.
1. Controller
Martin Schirmer, Weinsbergstraße 116, 50823 Cologne, Germany
Email: martin@mann-liebt-mann.de
A data protection officer is not required by law and has not been appointed.
2. Overview
Gaytlas (“The Gay Atlas”) is a travel guide to queer places and events. You can use the website without an account. We only process personal data where this is necessary for operation, security and the features you use, or where you have given consent.
Particularly sensitive data: Using a queer website may allow conclusions to be drawn about sexual orientation (a special category under Art. 9 GDPR). We therefore do not analyse your browsing behaviour on a personal basis, do not use advertising trackers and do not pass on user data to third parties for advertising purposes.
3. Legal bases
- Art. 6(1)(a) GDPR and § 25(1) TDDDG – consent (e.g. optional cookies, external content)
- Art. 6(1)(b) GDPR – contract or pre-contractual requests (e.g. listing requests from organisers)
- Art. 6(1)(c) GDPR – legal obligations (e.g. retention)
- Art. 6(1)(f) GDPR and § 25(2) TDDDG – legitimate interest in secure, stable and fast operation
- Art. 9(2)(a) GDPR – explicit consent, if you voluntarily send us sensitive information
4. Hosting and server log files
The website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, on servers in the EU; a data processing agreement (Art. 28 GDPR) is in place with Hostinger. Hostinger also provides a content delivery network. When you access the site, technically necessary access data is processed: IP address, date and time, page accessed, referrer, browser and operating system. The purpose is delivery, stability and defence against attacks (Art. 6(1)(f) GDPR). Log files are deleted after 30 days at the latest unless they are needed to investigate a security incident.
5. Security, cache and backups
- Wordfence (Defiant Inc., USA) checks access requests for attacks; IP addresses and access data are processed for this purpose. To update its attack signatures, Wordfence may transmit IP addresses of suspicious requests to Defiant (Art. 6(1)(f) GDPR; third-country transfer on the basis of EU standard contractual clauses).
- LiteSpeed Cache stores pages temporarily so they load faster; personal data is not analysed in the process.
- UpdraftPlus creates backups of the website database. These may contain form data; they are stored securely and overwritten regularly.
6. Cookies and consent management
We use technically necessary cookies, e.g. for your chosen language (Polylang) and to store your cookie choice. Optional cookies and external content are only loaded after you consent. We manage consent with the Complianz plugin, which runs on our server. You can change or withdraw your choice at any time via the “Cookie settings” link. Details can be found in our Cookie Policy.
7. Maps (OpenStreetMap)
We use OpenStreetMap for maps. Map tiles are only loaded once you click on the map. Your IP address is then transmitted to the tile server of the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom). An EU Commission adequacy decision exists for the United Kingdom. The legal basis is your consent by loading the map (Art. 6(1)(a) GDPR). We do not use Google Maps.
8. Fonts and icons
Fonts (Google Fonts) and icons (Font Awesome) are loaded locally from our server. No connection is made to Google or Font Awesome servers.
9. Contact and forms
If you contact us by email or via a form, or submit an event, venue or hotel, we process your details (e.g. name, email address, content of your message, listing details) to handle your request and to review and publish the listing. Forms are stored on our server using Fluent Forms. The legal basis is Art. 6(1)(b) GDPR or (f) (general enquiries). We only publish organisers’ contact details where they are intended for the listing. We delete requests once they have been dealt with and no retention obligation applies.
10. Event calendar
The calendar (The Events Calendar) runs on our server. Using “Add to calendar” you can transfer an event to Google Calendar or Outlook; you are only redirected to the respective provider once you click this link, and its privacy policy then applies.
11. Newsletter
For our newsletter we use Hostinger Reach, a service of our host Hostinger (address see section 4; data processing under Art. 28 GDPR). A script is loaded from Hostinger’s servers for this purpose. We only send the newsletter after you have signed up and confirmed (double opt-in, Art. 6(1)(a) GDPR) and store your email address as well as the time and IP address of sign-up and confirmation as proof. We only analyse open and click rates if you have agreed to this. You can unsubscribe at any time via the link in every issue.
12. Affiliate and external links
Some links to hotels, tours or tickets are advertising or affiliate links and are labelled as such. Only when you click such a link does the partner (e.g. Booking.com) learn that you came from Gaytlas, and it may set cookies for this purpose. The partner’s privacy policy then applies. Partners do not set any cookies on Gaytlas itself.
13. Social media
We are present on social networks (e.g. Instagram, TikTok, Facebook). We do not embed any plugins; links to our profiles are simple links. When you visit our profiles, the operators process your data according to their own terms; for page statistics (Insights) we are jointly responsible with Meta Platforms Ireland Ltd. (Art. 26 GDPR).
14. Recipients and third countries
Data is only received by the service providers named above within the scope of their tasks. Transfers to countries outside the EU only take place if there is an adequacy decision (e.g. EU-US Data Privacy Framework) or EU standard contractual clauses.
15. Storage period
We only store data for as long as necessary for the respective purpose or as required by law (e.g. 6 or 10 years for business records under the German Commercial Code and Fiscal Code).
16. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent with effect for the future (Art. 7(3)). Right to object: You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21 GDPR). An informal email to us is sufficient.
You can also lodge a complaint with a data protection supervisory authority, e.g. the authority responsible for us: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.
17. Changes
We update this policy when our services or the legal situation change. The version published here applies.