1. Introduction
Welcome to Letz Buzz ("we," "our," or "us"). We are committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our platform to discover and participate in local events in Luxembourg.
This policy complies with the General Data Protection Regulation (EU) 2016/679 (GDPR) and Luxembourg's national data protection laws. It should be read alongside our Terms of Service.
2. Data Controller
The data controller responsible for your personal data is:
3. Information We Collect
3.1 Information You Provide
- Account Information: Email address, full name, nickname, profile preferences
- Profile Data: Avatar color, bio, interests, notification preferences
- Event Data: Events you create, attend, or show interest in
- Communication Data: Messages, reviews, and other content you post
- Collection Data: Event collections you create
3.2 Information Collected Automatically
- Usage Data: Pages viewed, events browsed, interactions with features
- Device Information: Browser type, device type, IP address
- Cookies: Session cookies and authentication tokens (see Section 11)
- Activity Logs: Event participation, review submissions, points earned
4. Legal Basis for Processing
Under GDPR Article 6, we process your personal data based on the following legal grounds:
- Consent (Art. 6(1)(a)): You have given clear consent for specific processing, such as receiving event notifications and participating in our pilot programme. You may withdraw consent at any time.
- Contract Performance (Art. 6(1)(b)): Processing is necessary to deliver the Letz Buzz service, including account management, event creation, RSVPs, and chat functionality.
- Legitimate Interests (Art. 6(1)(f)): We process certain data to pursue the following legitimate interests, which we have balanced against your rights and interests:
- Platform security and fraud prevention: Detecting and blocking abusive accounts or content to protect the community.
- Service improvement: Analysing aggregated usage patterns to improve features and fix bugs.
- Content moderation: Reviewing flagged messages and user-submitted events to maintain a safe environment.
We have assessed that these interests are not overridden by your fundamental rights. You may object to processing based on legitimate interests at any time (see Section 8).
- Legal Obligation (Art. 6(1)(c)): Processing necessary to comply with applicable law, including responding to lawful requests from authorities.
5. How We Use Your Data
We use your personal data for the following purposes:
- To provide and maintain our service
- To manage your account and authentication
- To facilitate event creation and participation
- To enable communication between users
- To provide personalised event recommendations (see Section 13 on automated processing)
- To send notifications about events and activities (with your consent)
- To implement gamification features (points, badges, rewards)
- To analyse and improve our service
- To prevent fraud and ensure platform security
- To comply with legal obligations
6. Data Sharing and Sub-Processors
We do not sell your personal data. We may share your information in the following circumstances:
- With Other Users: Your profile information, events, and public messages are visible to other users based on your privacy settings.
- Infrastructure & Platform Provider (Base44): Our platform is hosted on Base44, which provides database storage, authentication, and backend infrastructure. Base44 processes personal data on our behalf as a data processor under appropriate data processing agreements.
- AI Features: We use AI language models to power features such as content moderation, event recommendations, personalised suggestions, and chat summaries. These AI services may process message content, event data, and user preferences. We only use reputable AI providers operating under data processing agreements. No personal data is used to train external AI models without your explicit consent.
- Legal Requirements: We may disclose data when required by law or to protect our rights and those of our users.
- Business Transfers: In case of merger or acquisition, your data may be transferred. We will notify you in advance.
To request an up-to-date list of our sub-processors, contact us at contactletzbuzz@gmail.com.
7. Data Retention Periods
In accordance with the GDPR's storage limitation principle (Article 5(1)(e)), we retain your personal data only for as long as necessary for each specific purpose. The following retention periods apply:
| Data Category | Retention Period | Basis |
|---|---|---|
| Account & profile data | For the lifetime of the account, then deleted within 30 days of closure | Contract performance |
| Chat messages | 6 months from the date of posting, then automatically deleted | Legitimate interests (community moderation) |
| Activity logs (page views, interactions) | 6 months from the date of activity | Legitimate interests (service improvement) |
| RSVP and event participation records | 6 months after the event date, after which data is anonymised for aggregated analytics | Legitimate interests (recommendations, analytics) |
| Event reviews | For the lifetime of the account. On account deletion, review text is anonymised (author attribution removed) within 30 days; the review content may remain visible as community content | Contract performance (community content) |
| Gamification data (points, badges) | For the lifetime of the account, then deleted within 30 days of closure | Contract performance |
| Moderation & flagged content records | 6 months after resolution, or until the conclusion of any related legal proceedings plus 1 year (capped at the applicable Luxembourg limitation period) | Legal obligation / legitimate interests |
| Pilot programme consent records | 3 years after consent is given (for accountability purposes) | Legal obligation (Art. 7(1) GDPR) |
When you delete your account, all personal data is deleted or irreversibly anonymised within 30 days, except where we are required to retain it to comply with a legal obligation or to establish, exercise, or defend legal claims.
Your rights during retention periods
Your data subject rights — including the right to erasure (Art. 17) and the right to restriction of processing (Art. 18) — apply at any time, including during an active retention period. For example, you may request early deletion of your activity logs before the 6-month period expires. We will honour such requests unless we have an overriding legal obligation or legitimate ground to retain the data. Where we cannot fulfil an erasure request in full (e.g., moderation records subject to a legal hold), we will inform you and restrict processing of the relevant data instead.
8. Your Rights Under GDPR
You have the following rights regarding your personal data under Chapter III of the GDPR. We will respond to requests within 30 days.
- Right of Access (Art. 15): Request a copy of your personal data — use the "Download My Data" feature in your profile settings for an instant export.
- Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data via your profile settings.
- Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten") — you can delete your account directly in settings.
- Right to Restriction (Art. 18): Request that we restrict processing of your data in certain circumstances.
- Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable JSON format — available via "Download My Data" in settings.
- Right to Object (Art. 21): Object to processing based on legitimate interests or for direct marketing. We will cease processing unless we can demonstrate compelling legitimate grounds.
- Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time (e.g., unsubscribe from notifications) without affecting the lawfulness of prior processing.
- Rights related to automated decision-making (Art. 22): See Section 13.
- Right to Lodge a Complaint (Art. 77): File a complaint with the Luxembourg National Commission for Data Protection (CNPD) at cnpd.public.lu.
To exercise any of these rights, contact us at contactletzbuzz@gmail.com. We may need to verify your identity before processing your request.
9. Data Security
We implement appropriate technical and organisational measures (TOMs) to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit (HTTPS/TLS), secure authentication, role-based access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure.
10. Data Breach Notification
In the event of a personal data breach, we will notify the CNPD within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. If a breach is likely to result in a high risk to your rights and freedoms (for example, exposure of account credentials or sensitive personal data), we will also notify you directly without undue delay in accordance with Article 34 GDPR, describing the nature of the breach, the likely consequences, and the measures we have taken or propose to take.
If you believe you have discovered a security vulnerability or that your data may have been compromised, please contact us immediately at contactletzbuzz@gmail.com.
11. International Data Transfers
Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where our infrastructure or AI service providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place as required by Chapter V of the GDPR, such as Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914). You may request a copy of the applicable safeguards by contacting us.
12. Cookies and Tracking Technologies
We use cookies and similar technologies as described below. Under the ePrivacy Directive and Luxembourg's implementing legislation, we only place non-essential cookies with your prior consent.
| Cookie Name / Type | Purpose | Duration | Basis |
|---|---|---|---|
| Authentication token (session) | Keeps you logged in and authenticates requests to our servers | Session / 30 days | Strictly necessary |
| Language preference (localStorage) | Remembers your selected interface language | Persistent (until cleared) | Strictly necessary (functionality) |
| Country preference (localStorage) | Remembers your selected country for event filtering | Persistent (until cleared) | Strictly necessary (functionality) |
| Cookie consent record (localStorage) | Records your consent decision so we don't ask again | 12 months | Legal obligation (Art. 7(1) GDPR) |
| Pilot consent record (user profile) | Records your acceptance of pilot programme terms | Stored with your account | Legal obligation (Art. 7(1) GDPR) |
We do not use third-party advertising or tracking cookies. You can manage or clear cookies through your browser settings. Note that disabling session cookies will prevent you from logging in.
13. Automated Decision-Making and Profiling
We use automated processing to provide personalised features, including:
- Event Recommendations ("For You" feed): We analyse your interests, past RSVPs, categories browsed, and activity patterns to suggest events you may enjoy. This is done using algorithmic scoring and AI-assisted ranking. This processing does not produce legal or similarly significant effects — it only influences which events appear prominently in your feed.
- Content Moderation: AI tools may automatically flag chat messages or event submissions that appear to violate our community guidelines. Flagged content is reviewed by a human moderator before any action is taken. No account suspensions or bans are applied solely on the basis of automated decisions.
- Gamification Scoring: Points, levels, and badges are automatically calculated based on your platform activity (e.g., events attended, reviews written). The logic is transparent and described in your profile settings.
None of these automated processes result in decisions that produce legal effects or similarly significantly affect you within the meaning of Article 22 GDPR. You have the right to obtain human review of any decision that does significantly affect you, to express your point of view, and to contest the decision by contacting us at contactletzbuzz@gmail.com.
14. Children's Privacy
Our service is not intended for children under 16 years of age. Luxembourg has set the age of digital consent at 16 under Article 8 GDPR. We do not knowingly collect personal data from children under 16. If you believe we have collected data from a child, please contact us immediately at contactletzbuzz@gmail.com and we will delete it promptly.
15. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we will provide additional notice (e.g., via email or an in-app notification). We encourage you to review this policy periodically.
16. Contact Us
If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us:
Supervisory Authority — CNPD
If you are not satisfied with our response, you have the right to lodge a complaint with the Luxembourg National Commission for Data Protection (Commission nationale pour la protection des données — CNPD) at cnpd.public.lu.