Privacy Policy

Last updated: 18 August 2026

We are pleased that you use myCULTURE. Protecting your personal data is important to us. This Privacy Policy explains what personal data we process in connection with our website, digital services and mobile applications, why we process it, and what rights you have.

This Privacy Policy applies to the digital services operated by myCulture GmbH, including the myCULTURE website, myCULTURE web application and myCULTURE mobile applications, insofar as they refer to this Privacy Policy.

1. Controller

The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:

myCulture GmbH
Carlbergergasse 97/40
1230 Vienna
Austria

Email: hello@myculture.app

You can contact us at this address with any privacy-related question, access request or request to exercise your data protection rights.

2. Personal data we process

Depending on how you use myCULTURE, we may process the following categories of personal data:

contact details, including name and email address;
account and authentication information;
cities and other profile preferences selected by you;
saved content and preferences;
information about your interactions with content, events and recommendations;
searches and use of filters;
information about content you open, click, save or share;
information about your use of features such as adding something to a calendar;
information about visits or attendance that you report or confirm;
reviews and ratings you submit;
payment and transaction information relating to paid MEETs, where required to process the payment and comply with legal obligations;
technical information about the device, operating system, browser and use of our services;
IP address and other technical connection data;
session and pseudonymous identifiers;
location information or location context where permitted and necessary for location-related functionality;
information about your consent and privacy settings;
communications when you contact us;
information relating to emails and notifications where those features are used.

We generally collect only information that is necessary for the relevant purpose or otherwise permitted by law.

3. How we obtain your data

We obtain personal data in particular:

directly from you when you create an account, edit your profile, save content, submit reviews, attend events, make payments or communicate with us;
automatically when you use our digital services, where this is necessary for the relevant functionality or permitted on the basis of your consent;
through your use of our recommendation and personalization features;
from technical service providers processing data on our behalf;
where applicable, through payment or transaction processes to the extent necessary to provide a service you have requested.

4. Purposes and legal bases

We process personal data only where there is a legal basis for doing so.

4.1 Providing the service and managing your account

We process account information, authentication information, saved content, settings and other information necessary to provide myCULTURE, manage your account and perform functions requested by you.

Legal basis: Article 6(1)(b) GDPR, where processing is necessary for the performance of our contractual relationship with you.

4.2 Personalised content and recommendations

myCULTURE uses information about how you use the service to make the content and events shown to you more relevant.

This may include information about content you view, open, save, share or otherwise select; searches and filters you use; recommendations with which you interact; recommendations that you repeatedly do not select; and the city or location context relevant to you.

For logged-in users, this information may be associated with your account and used to create and continuously adapt a personal recommendation profile.

We may also use pseudonymous identifiers, session information, timestamps and information about the content presented to you.

Personalisation is used to make content and events within myCULTURE more relevant and to improve our service. It is not used to make decisions about your creditworthiness, employment, insurance, housing, access to public services or other matters producing legal or similarly significant effects.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is to provide a relevant, personalised cultural service and improve the quality of our recommendations and service.

We assess and balance this interest against the rights and freedoms of users, taking into account the nature of the data processed, users' reasonable expectations, the design of the personalisation system and the controls available to users.

4.3 Anonymous personalisation

For visitors who are not logged in, we may, where you have provided the required consent, store a pseudonymous identifier on your device and use it to record interactions for personalisation.

This identifier is used to maintain an anonymous or pseudonymous personalisation context. Such a personalisation context is generally deleted no later than 30 days after the last meaningful interaction. A meaningful interaction may extend this period.

In our case, the identifier is stored in your browser or device's local storage (localStorage) rather than as an HTTP cookie. The legal treatment of such technology does not, however, depend solely on whether it is technically a cookie.

Where consent is required for storing or accessing information on your device, we obtain that consent through our privacy/consent settings.

4.4 Service improvement and security

We process technical data, usage data and, where applicable, server log data to operate our services, identify errors, prevent misuse, investigate security incidents, and maintain the stability and security of our infrastructure.

Legal basis: Article 6(1)(f) GDPR. Our legitimate interest is to provide our services securely and reliably.

4.5 Payments for paid MEETs

For paid MEETs, we process the information required to complete the payment. Payments are processed using Stripe.

We process or receive only the information required to complete and document the transaction. Payment information may be processed directly by Stripe.

Legal bases: Article 6(1)(b) GDPR for processing payments and providing the requested participation, and Article 6(1)(c) GDPR where statutory record-keeping or documentation obligations apply.

4.6 Reviews and attendance information

Users may submit reviews of events or places after indicating that they attended the relevant event or visited the relevant place.

Reviews may be publicly displayed. We generally display only the user's first name and the first letter or first character of their surname. Reviews are not displayed as a complete review history on the user's profile.

Information about reported or confirmed attendance may be used to provide the review function and support the reliability of reviews.

Legal bases: Article 6(1)(b) GDPR where processing is necessary for the feature requested by the user, and otherwise Article 6(1)(f) GDPR, in particular our legitimate interest in providing a reliable and trustworthy community feature.

If users voluntarily include personal or sensitive information in free-text reviews, that information may become part of the content they publish. We therefore ask users not to publish information in public reviews that they do not want to make public.

4.7 Cities and location context

myCULTURE may use location-related information to suggest content and events relevant to a particular city.

If you enable your browser or device's location functionality, the browser may process your location locally to enable location-based functionality. Your precise GPS coordinates are not transmitted to or stored by myCULTURE for this purpose.

You can also select a city yourself and save it to your profile. The selected city may be used to provide recommendations and relevant content.

Where external services process technical location information, we explain this in Section 12.

5. Personalisation and recommendation profiles

myCULTURE recommendations may be based on a combination of different signals, including:

content that has been shown to you;
content that you open or click;
content that you save or share;
searches you perform;
filters you use;
recommendations that you select or repeatedly do not select;
how you interact with content and recommendations;
the city or location context relevant to you;
information about visits, reviews and other features you use.

We may use this information to create a purpose-specific interest and recommendation profile. This profile is used to personalise your experience within myCULTURE.

We do not publish a detailed description of our technical algorithms, weighting systems or internal models. The methods used may change as our service develops.

No inference of sensitive personal characteristics

We do not use interactions with cultural content to determine sensitive personal characteristics of users.

In particular, viewing, searching for, saving or sharing content about particular groups, topics or artists does not mean that we assign the corresponding personal characteristic to the user.

For example, we do not infer that a person is LGBTQ+ merely because they interact with content relating to queer artists. Similarly, using a filter such as “wheelchair accessible” does not by itself mean that we infer that a user has a disability.

Categories such as Emerging Artists, Women Artists, Queer Artists, Black Artists, Indigenous Artists or Old Masters may describe artists, events or cultural content. They are not automatically treated as characteristics of users.

We do not intentionally collect or infer special-category personal data within the meaning of Article 9 GDPR for personalised recommendations.

No legally or similarly significant decisions

Our personalisation system is used to select and order cultural content. It is not used to make solely automated decisions that produce legal effects concerning you or similarly significantly affect you.

6. Associating an anonymous profile with an account

If you initially use myCULTURE anonymously and later create an account or log in, we may associate previously collected information about your personalisation interactions with your account, where legally permitted and compatible with the purpose for which the information was originally collected.

This allows us to continue personalising your experience without starting from an entirely new recommendation profile.

This association does not mean that we infer sensitive personal characteristics from the content you have viewed or interacted with.

7. Resetting your personalisation profile

Logged-in users can reset their personalisation or recommendation profile through the relevant functionality provided by myCULTURE.

A reset removes or resets the profile information used for personalisation. After a reset, myCULTURE may create a new personalisation profile based on subsequent interactions.

Resetting your recommendation profile is separate from deleting your entire account.

8. Cookies, local storage and similar technologies

We currently use no HTTP cookies for our digital services.

We do, however, use browser/device storage technologies, including:

localStorage for certain functions, including anonymous personalisation identifiers, login/session information, saved content, notification read status and drafts;
sessionStorage for a session identifier during a visit.

Technologies that are strictly necessary to provide a digital service expressly requested by you may be used without separate consent where the applicable legal requirements are met.

Non-essential storage or access to information on your device, including anonymous personalisation, is used only after the required consent has been obtained.

You can change or withdraw your consent at any time through our privacy settings, with effect for the future. Withdrawal must be as easy as giving consent.

9. Matomo

We use Matomo to analyse use of our website and web application.

Matomo is self-hosted by us on Hetzner servers in Germany.

We currently use Matomo in a privacy-focused configuration:

no Matomo cookies;
no Matomo User IDs for logged-in users;
IP addresses are shortened by two bytes before storage;
no session recordings;
no heatmaps;
internal recommendation events are not analysed through Matomo;
Matomo is not currently used for mobile-app analytics.

Matomo is used primarily to obtain aggregated statistics about use of our web services and to improve their technical and content quality.

Events collected for our own recommendation engine are not sent to Matomo. They are processed solely through our own systems.

Where consent is required for the relevant Matomo processing, Matomo is activated only after the required consent has been obtained.

10. Emails and newsletters

We distinguish between service-related communications and voluntary promotional/newsletter communications.

Service-related communications

We may send emails that are necessary or directly related to your account or use of myCULTURE, such as:

account and security information;
notifications you have requested;
information relating to content or features you have saved;
organisational information relating to events you attend.

These communications are not voluntary promotional newsletters.

Newsletters and promotional communications

We generally require your separate consent to send a regular promotional or content newsletter, unless a statutory exception applies.

You can withdraw that consent at any time using the unsubscribe link in the newsletter or another mechanism we provide.

Where technically enabled and legally permitted, we may measure whether a newsletter was opened or a link within it was clicked in order to improve our communications.

We use Mautic, operated by us, as well as Resend for certain email deliveries.

11. Mobile applications

This Privacy Policy also applies to our mobile applications.

Depending on the functionality and technical implementation, mobile applications may:

access information required to provide the relevant functionality;
use the same myCULTURE account and personalisation systems as the web application;
process usage and interaction data for recommendations;
use device permissions where you grant them;
provide location-related functionality;
provide notifications if that feature is enabled;
use technical or analytics functionality where enabled in the relevant app.

We currently do not use push-notification services, crash-reporting SDKs, advertising/attribution SDKs or social-media SDKs in our mobile applications.

If we introduce such services in the future, we will use them in accordance with applicable data protection requirements and, where required, after providing the relevant information and obtaining consent.

12. Maps and OpenStreetMap

We use the open-source Leaflet library to display maps and OpenStreetMap for map data and map tiles.

Leaflet itself does not transmit personal data to a provider; the library runs in our website or application.

When map tiles are loaded, your browser may connect to servers operated by the OpenStreetMap Foundation. Technical connection data, in particular your IP address, may be transmitted to the relevant map server.

This is separate from the browser's location functionality. If you grant location permission, the location information is processed locally in the browser and is not transmitted to myCULTURE.

13. External ticketing websites and external websites

We may provide links to external websites, including websites where tickets for events can be purchased.

When you follow such a link, you leave the myCULTURE environment. Processing of personal data on the external website is governed by that provider's own privacy policy.

myCULTURE does not currently operate an external ticketing system and does not automatically receive all information about a purchase made on an external ticketing website merely because you click an external ticket link.

14. Payment service provider

For paid MEETs, we use Stripe to process payments.

Stripe processes the information required for payment in accordance with its own privacy and security terms and the contractual arrangements in place with myCULTURE.

Depending on the payment method, additional processing by payment service providers may be required.

Upon confirming the deletion, all personal data associated with the app account, including tickets, saved content, and user preferences, will be scheduled for deletion. Users will permanently lose access to their app profile once the deletion is completed.

After initiating the deletion, the account will be scheduled for removal for a period of up to seven (7) days. During this time, the deletion process can be reversed upon request. After this period, all data will be permanently and irreversibly deleted.

15. Service providers and recipients

We disclose personal data only where this is necessary for one of the purposes described in this Privacy Policy and legally permitted.

Our service providers and recipient categories include:

We may use additional processors where necessary to operate and develop myCULTURE. We select processors carefully and enter into data processing agreements under Article 28 GDPR where required.

16. International data transfers

We aim to process personal data within the European Economic Area wherever reasonably possible.

Some service providers may nevertheless be located outside the EEA or process data in third countries.

In particular, Resend may process personal data in the United States. Resend states that it is certified under the EU-U.S. Data Privacy Framework. Where a transfer is based on an adequacy decision or other appropriate safeguard, we comply with the applicable legal requirements.

When OpenStreetMap is used, technical connection data may be transferred to infrastructure in the United Kingdom. The United Kingdom currently benefits from an adequacy decision under EU data protection law.

We do not conduct international transfers solely for advertising or retargeting purposes.

17. Retention periods

We retain personal data only for as long as necessary for the relevant purpose or as required by law.

In particular:

Anonymous personalization profiles: generally no more than 30 days after the last meaningful interaction.
Account data: while your account exists, unless a shorter period is appropriate for a particular category of data.
Personalization and interaction data of logged-in users: for as long as necessary for personalization, service provision and service improvement, subject to applicable deletion rights and legal obligations.
Reviews: for as long as required to provide the relevant functionality or until deleted, subject to legal obligations and legitimate interests.
Payment and accounting records: in accordance with statutory retention requirements. In Austria, certain accounting records, books and supporting documents generally have to be retained for seven years.
Technical security and server data: only for the period necessary for operation, security, troubleshooting and, where applicable, investigation of security incidents.
Newsletter data: until you withdraw consent or unsubscribe, except for limited retention that may be necessary to document a withdrawal or prevent unwanted re-subscription.

When personal data are no longer required for the original purpose, they are deleted or anonymized unless a statutory retention obligation or another lawful basis requires continued retention.

18. Deleting your account

You can delete your myCULTURE account through the relevant account functionality or contact us at hello@myculture.app.

When your account is deleted, we delete the personal data associated with the account unless statutory retention obligations, legal claims or another lawful basis requires continued retention.

This generally includes:

account data;
saved content;
preferences;
personalised recommendation profiles;
personal interaction data, unless there is a lawful reason to retain them;
drafts and other account-related content.

Payment, accounting or other records that must legally be retained may be excluded from immediate deletion. Such retained information will not be used for personalisation or marketing unless this is separately permitted by law.

19. Your rights

Under the GDPR, you have, in particular, the following rights:

Right of access to your personal data;
Right to rectification of inaccurate or incomplete data;
Right to erasure of your personal data;
Right to restriction of processing;
Right to data portability, where the statutory requirements are met;
Right to object to certain processing;
Right to withdraw consent with effect for the future;
Right not to be subject to solely automated decision-making producing legal or similarly significant effects, where Article 22 GDPR applies.

Where we process personal data on the basis of legitimate interests, you may object on grounds relating to your particular situation. You may always object to processing of personal data for direct marketing.

To exercise your rights, contact:

hello@myculture.app

Where necessary, we may request reasonable information to verify your identity before disclosing personal data.

20. Withdrawal of consent

Where we rely on consent as a legal basis, you may withdraw your consent at any time with effect for the future.

You can do so through our privacy settings or by contacting hello@myculture.app.

Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before the withdrawal.

21. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU/EEA country of your habitual residence, place of work or the place where you believe a data protection violation occurred.

As myCULTURE is established in Austria, the Austrian Data Protection Authority is particularly relevant:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde)
Barichgasse 40–42
1030 Vienna
Austria

Email: dsb@dsb.gv.at
Website: https://www.dsb.gv.at/

Where processing is cross-border, other European supervisory authorities may also be involved in accordance with the GDPR.

22. Data security

We implement appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised access and other unlawful processing.

These measures include appropriate access controls, permission management, encryption during transmission and measures designed to secure our infrastructure.

No system can guarantee absolute security.

23. Changes to this Privacy Policy

We may amend this Privacy Policy when our services, technologies, legal requirements or data-processing activities change.

The current version will be published through our digital services.

If a change introduces a material new processing activity, we will provide any additional information required and, where necessary, obtain a new consent.

24. Contact

For questions about privacy, your personal data or the exercise of your rights, please contact:

myCulture GmbH
Carlbergergasse 97/40
1230 Vienna
Austria

hello@myculture.app