Skip to content
Urban Comedy ClubStandUp Club Munich
TicketsDE · EN

Privacy policy

Last updated: 25.10.2026

1. What this is about

This privacy policy explains which types of personal data (data for short) we process, for what purposes and to what extent. It applies to all processing by us: on urbancomedy.de, in providing our services and on our social media profiles (together: our online services).

The terms used are meant to be gender-neutral.

2. Controller

Fritz Voggenreiter
Innere Wiener Straße 6
81667 Munich
Germany
Email: info@urbancomedy.de

For further details see our imprint.

3. Summary

4. Overview of processing

The following overview summarises which data we process, who is affected and why. Details are given in the sections below.

Types of data

Data subjects

Purposes

5. Legal bases

We process data on the basis of the GDPR. National data protection rules may also apply. Where a more specific legal basis applies in an individual case, we state it in the relevant section.

Storing information in your browser and reading it is additionally governed by Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act), see section 9.

6. Security

We take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk, taking into account the state of the art, costs, the nature, scope, context and purposes of processing, and the likelihood and severity of risks to the rights and freedoms of data subjects.

This includes in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access, input and disclosure, and by keeping data available and separated. We have procedures in place for exercising data subject rights, deleting data and responding to threats. We consider data protection by design and by default when selecting hardware, software and procedures.

Encryption (HTTPS): The website is only accessible via TLS encryption, which protects data transmitted between your browser and our website from unauthorised access. You can recognise this by "https" in the address bar.

7. Transfer of data

In the course of our processing, data may be transferred or disclosed to other bodies, companies or persons, e.g. IT service providers or providers of services and content embedded in the website. We comply with the legal requirements and conclude the contracts and agreements necessary to protect your data with the recipients, e.g. data processing agreements (Art. 28 GDPR).

Transfers to third countries: Some of the providers named also process data outside the EU and EEA, in particular in the USA. For the USA, the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework applies (Art. 45 GDPR) where the recipient is certified under it. Where that is not sufficient, we base the transfer on the European Commission's Standard Contractual Clauses (Art. 46 (2) (c) GDPR). The basis for each provider is given in the relevant section.

8. Providing the website (hosting via Cloudflare)

What happens: To show you the website, we process your IP address; without it, content and functions cannot be transmitted to your browser. Usage data is also generated, in particular date and time, the requested address, the previous page (referrer, if your browser sends it), the amount of data transferred, and your browser and operating system.

Who: The website is delivered via Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA). Cloudflare provides storage, computing power and a global server network (content delivery network) and protects the website against attacks and overload, processing connection data on our behalf. We have concluded a data processing agreement with Cloudflare (Art. 28 GDPR).

Log files: We do not store any server log files ourselves. Cloudflare processes connection data for delivery and security according to its own policies.

Purpose and legal basis: Delivering the website, user-friendliness, operating the technical infrastructure and security. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is offering the website reliably and securely.

Third country: Processing in the USA cannot be ruled out. Cloudflare is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

9. Cookies, browser storage and cookie settings

What we mean: By "cookies" we mean all techniques that store information in your browser or on your device or read it from there, including local storage. They serve, for example, the functioning, security and convenience of a website or the analysis of visitor flows.

When we ask: Under Section 25 (1) TDDDG this requires your prior consent. Without consent it is only permitted where storing or reading is strictly necessary to provide a service you have expressly requested (Section 25 (2) no. 2 TDDDG), e.g. to store your settings or ensure the functioning and security of the website. For the subsequent processing of personal data, the legal basis is your consent if given (Art. 6 (1) (a) GDPR); otherwise we rely on our legitimate interests (Art. 6 (1) (f) GDPR) as explained in this section and for the individual services.

Retention: We distinguish

Your cookie settings: On your first visit, a banner asks which categories you allow. We use it to obtain and store consents and to let you manage and withdraw them.

CategoryPurposeWithout consent
Strictly necessaryStores your choice in the banneralways on, cannot be deselected
AnalyticsAudience measurement with Google Analytics (section 13)off
MarketingAd performance and audiences for advertising with Google and Meta (section 14)off
External mediaYouTube videos, Google map, embedded ticket shops (sections 16 and 17)off, individual items can be loaded by click

Cookie for your choice: So that we do not ask again on every page and can prove your consent, we store your decision in the cookie cc_cookie. It contains the selected categories, the time of your decision, the banner version and a randomly generated identifier for this decision. The identifier contains no information about you, and we do not combine it with other data. The cookie is also set if you reject everything, as we would otherwise ask you again. It expires after 182 days, after which we ask again.

The legal basis for storing it is Section 25 (2) no. 2 TDDDG. We base the subsequent processing on Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR (proof of consent) and Art. 6 (1) (f) GDPR (legitimate interest in respecting your choice).

Changing or withdrawing consent: You can change your choice at any time via "Cookie settings" at the bottom of every page. Withdrawal applies to the future. Where technically possible, we remove cookies of deselected categories. You can also delete or block cookies or object to processing in your browser's privacy settings.

10. Fonts

We use font files so that the website is legible and displayed consistently. All fonts, including those from the Google Fonts library, are served from our own server or via Cloudflare (section 8). No fonts are loaded from Google or other providers, and no data is sent to Google in the process.

11. Contact by email and messenger

If you contact us, e.g. by email or via social media, we process your details to the extent necessary to answer your enquiry and any requested action. This usually includes your name, contact details, the content of your message and related meta and communication data (e.g. time). We only use this data to communicate with you.

The legal basis is Art. 6 (1) (b) GDPR where a contract or a pre-contractual request is concerned, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries and organising our processes). We delete the data in accordance with section 18, usually once the enquiry has been dealt with and no retention obligations apply.

Email receipt for urbancomedy.de is provided by Resend (section 12).

Communication via messenger

We also use messengers for communication. Please note the following information on how they work, encryption, the use of metadata and your options to object.

You can also reach us in other ways, e.g. by email. Please use the contact options we have given you or those listed on our website.

Encryption and metadata: If a messenger is end-to-end encrypted, only you and we can read the content of messages and attachments, not the messenger provider. The provider may, however, process metadata, e.g. that and when you communicate with us, and details of your device and connection. Which data it processes is governed by its privacy policy.

12. Newsletter

Principle: We only send newsletters and other promotional emails with your consent. The newsletter informs you about our shows, dates, promotions and news from the club. The content described at sign-up is decisive for your consent.

Sign-up: For the newsletter we only need your email address. We also store the language of the page on which you sign up, so that you receive the newsletter in that language.

Double opt-in and log: After signing up you receive an email with a confirmation link. We only add you to the list once you click it. We log the process to be able to prove a proper sign-up: we store the time of sign-up and confirmation, the form you used, the language and the version of the consent text.

Protection against abuse: To prevent automated abuse we use an invisible check field and limit the number of sign-ups within a short time.

Legal basis: For sending, your consent (Art. 6 (1) (a) GDPR). We store the sign-up log on the basis of Art. 6 (1) (c) in conjunction with Art. 7 (1) GDPR and Art. 6 (1) (f) GDPR (legitimate interest in being able to prove a proper process). We use an email service provider on the basis of our legitimate interest in efficient and secure sending (Art. 6 (1) (f) GDPR).

Email service: For sign-up and sending we use Resend (Plus Five Five, Inc., USA), which processes the data on our behalf under a data processing agreement (Art. 28 GDPR). According to Resend, processing takes place mainly in the USA. Resend is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR) and has also agreed to the European Commission's Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

Unsubscribing: You can unsubscribe at any time, i.e. withdraw your consent or object to further receipt. There is an unsubscribe link at the end of every issue. You can also write to us via the contact details above, preferably by email.

Retention: We keep your email address for as long as you receive the newsletter. After you unsubscribe, we may keep the address for up to three years on the basis of our legitimate interests to be able to prove an earlier consent; we then only process it to defend against possible claims. You can request earlier deletion at any time if you also confirm that you had previously consented. Where we must permanently respect an objection, we reserve the right to keep the address in a block list solely for that purpose.

13. Audience measurement (analytics, only with consent)

What it is about: Audience measurement shows us how visitors use our website, e.g. when the website or individual content is used most, where visitors come from and which areas we should improve. For this, usage sessions may be combined into pseudonymous profiles and information may be stored in and read from your browser. This covers in particular pages visited and elements used there, technical details such as browser and operating system, and times of use. We do not store plain data such as names or email addresses; neither we nor the provider know your actual identity, only the details stored in the profile.

Legal basis: Your consent in the "Analytics" category (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which you can withdraw at any time via "Cookie settings".

Retention: Unless stated otherwise, cookies of these services may remain on your device for up to two years.

Google Tag Manager: We manage the measurement services in this and the next section centrally via Google Tag Manager, a tool for embedding small pieces of code (tags) on the website. The Tag Manager itself does not create user profiles, does not store cookies with profiles and does not analyse anything. It passes your cookie settings to Google's services via "Consent Mode". When the Tag Manager loads, your IP address is transmitted to Google for technical reasons. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data processing terms: business.safety.google/adsprocessorterms.

Google Analytics 4: Google Analytics measures usage based on a pseudonymous identifier that contains no names or email addresses. This allows visits to be assigned to a device to see which content was viewed within one or several visits, whether visitors return and how they interact with the website, e.g. whether they click ticket buttons or confirm a newsletter sign-up. The time and duration, the referring source and technical features of device and browser are also stored. Cookies are set for this. According to Google, Google Analytics does not store individual IP addresses for users in the EU; Google only derives a rough location (city, region, country, continent) from the IP address on EU servers and then deletes the IP address immediately. We have set the retention of analytics data to 14 months. The provider is Google Ireland Limited (address above). Data processing terms: business.safety.google/adsprocessorterms. Privacy information: business.safety.google/privacy. You can also object via Google's browser add-on and the settings for personalised ads.

Third country: Google may also process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

14. Online marketing (only with consent)

What it is about: We advertise our shows on other websites and platforms and measure whether this advertising works. For this, the advertising providers create pseudonymous user profiles and store them in cookies or by similar means. These may include content viewed, websites visited, networks used and technical details such as browser, operating system and times of use. These cookies may later be read on other websites using the same advertising method and supplemented with further data by the provider. We do not store plain data such as names or email addresses.

If you are a member of a social network whose advertising methods we use, the network may link the profiles to your account. This is governed by the agreements you have made with the network, e.g. when registering.

We generally only receive aggregated reports on the success of our ads. Conversion tracking shows us which ads led to a desired action, e.g. a click on a ticket button; we only use this to evaluate our advertising. Audience building (remarketing, custom audiences) allows us to show ads to visitors of our website later.

Legal basis: Your consent in the "Marketing" category (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which you can withdraw at any time via "Cookie settings".

Retention: Unless stated otherwise, the cookies may remain stored for up to two years.

Objection: In addition to the cookie settings and the providers' own options, you can switch off personalised advertising centrally: in Europe via youronlinechoices.eu, across regions via optout.aboutads.info.

Google Ads: We place ads in Google's advertising network (e.g. in search results, videos and on websites) so that they are seen by people likely to be interested in our shows. We also measure conversions, i.e. whether someone, for example, clicks a ticket button after seeing an ad; we receive no information about individuals. We also use remarketing to show ads to visitors of our website later. The provider is Google Ireland Limited (address in section 13). Google Ads is subject to the controller-to-controller terms with Standard Contractual Clauses: business.safety.google/adscontrollerterms. Privacy information: business.safety.google/privacy.

Meta Pixel: We use the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, to measure the success of our ads on Facebook and Instagram and to build advertising audiences. If you are logged in to Facebook or Instagram, Meta may link the visit to your account. We and Meta are joint controllers for collecting and transmitting the data to Meta (Art. 26 GDPR); see the controller addendum. Meta is solely responsible for any further processing, see Meta's privacy policy.

Third country: Google and Meta may also process data in the USA. Google LLC and Meta Platforms, Inc. are certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

15. Our social media profiles

We have profiles on Instagram, Facebook, YouTube and TikTok, where we process data to communicate with users and provide information about us. On the website we only link to these profiles. No plugins are embedded, and data only goes to the provider when you click a link.

Notes: The networks may also process data outside the EU, which may pose risks for you, e.g. because your rights may be harder to enforce. The networks generally also use data for market research and advertising: your behaviour and interests may be used to create profiles to show you matching ads inside and outside the networks, usually by storing cookies on your device. If you are a member and logged in, profiles may also be stored across devices. Details and opt-out options can be found in the privacy policies of the networks.

Requests for access and other rights are most effective when made directly to the provider, as only the provider has access to the data and can act directly. If you still need help, please contact us.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in communication and public relations).

16. YouTube videos and Google map (external media)

Principle: We embed content loaded from other providers' servers, e.g. videos and maps. The provider always processes your IP address, as it could not send the content to your browser without it. Providers may also use invisible graphics (pixel tags) for statistics or marketing and store information in cookies, e.g. on browser, operating system, referring page and time of visit, and combine it with information from other sources.

On our website: Until you start a video or click the map, or allow "External media" in the cookie settings, we only show a preview image or placeholder from our own server, and no connection to the provider is made.

YouTube: We embed YouTube videos via the domain youtube-nocookie.com in "privacy-enhanced mode". According to Google, until a video is started this mode only stores information in cookies or similar that YouTube needs to deliver, control and optimise playback, including your IP address and details of your browser and device. Once a video is played, YouTube may additionally process information to analyse usage behaviour, store it in your user profile and personalise content and ads. The cookies may remain stored for up to two years. With your consent, videos may start automatically with the sound off. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Privacy information, about privacy-enhanced mode

Google Maps: On the location page we can show a Google Maps map. In particular your IP address and location data may be processed. If you are logged in to Google, Google may link the visit to your account. The provider is Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland. Privacy information

Legal basis: Your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), given either in the cookie settings or by clicking the individual video or map. Consent given in the cookie settings can be withdrawn there at any time.

Third country: Google may also process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

17. Tickets and embedded ticket shops

We do not currently sell tickets ourselves. Tickets are sold via EVENTIM.Light, a service of CTS EVENTIM AG & Co. KGaA. Your contractual partner is the organiser named in the ticket shop.

Ticket button: When you click a ticket button, the provider's ticket shop opens in a new tab. What happens to your data there is governed by the privacy notices of the provider and the organiser.

Embedded ticket shop: On some show pages we can embed the shop directly. It only loads when you click it or allow "External media". Your browser then connects to the provider's servers, which receive at least your IP address and may store or read information in your browser (see the principle in section 16). The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG). Orders in the embedded shop are subject to the terms and privacy notices of the provider and the organiser.

18. Retention and deletion

We delete data in accordance with the law as soon as you withdraw consent or no other legal basis exists, i.e. when the purpose no longer applies or we no longer need the data. Exceptions apply where legal obligations or special interests require longer retention, in particular data we must keep for commercial or tax reasons and data we need to enforce legal claims or protect the rights of others.

For individual processing operations we give specific periods in the sections above. Where several periods apply to the same data, the longest applies. Data we no longer keep for its original purpose but only because of a retention obligation is processed solely for that reason.

Start of periods: Where a period is at least one year and does not expressly start on a specific date, it starts at the end of the calendar year in which the triggering event occurred. For ongoing contractual relationships, the triggering event is the end of the contract.

19. Your rights

You have the right to

Right to object (Art. 21 GDPR): Where we process data on the basis of Art. 6 (1) (f) GDPR, you may object at any time on grounds relating to your particular situation. We will then stop processing unless we can demonstrate compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing at any time without giving reasons.

An email to info@urbancomedy.de is sufficient for all requests.

Complaints: You may lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular in the member state of your residence, place of work or place of the alleged infringement. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Postfach 1349, 91504 Ansbach, Germany, www.lda.bayern.de.

20. Obligation to provide data, no automated decisions

You are not obliged to provide us with data. Without an email address, however, we cannot send you the newsletter. No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

21. Changes

We update this policy as soon as changes to our processing require it, so please check the current version regularly. If a change requires action on your part, e.g. giving consent, or an individual notification is necessary, we will inform you.

Addresses and contact details of companies and organisations in this policy may change over time. Please check them before contacting them.

22. Definitions

Where terms are defined by law (in particular Art. 4 GDPR), those definitions apply. The following explanations are intended to aid understanding.

The German version of this privacy policy is legally binding.