Privacy Policy

MZK Media Ltd.

Lordou Vyronos 61-63

6023 Larnaca, Cyprus

Company number: HE 483959

VAT: CY60275907F

Email: hello@cytec.app

Web: www.cytec.app

We process our users' personal data only to the extent necessary to provide a functional website and our content and services. Legal bases are in particular Art. 6 (1) (a) (consent), (b) (contract performance), (c) (legal obligation) and (f) (legitimate interest) GDPR.

When you access our website, your browser automatically transmits information to our server and stores it temporarily in log files: IP address, date and time, requested page, referrer URL, browser and operating system. Legal basis: Art. 6 (1) (f) GDPR (stability and security). Retention: max. 30 days.

When you register and buy tickets, we process: first and last name, email, phone (optional), date of birth, city/country and order and ticket data. We use this data to fulfil the contract and run the event (e.g. door check). Legal basis: Art. 6 (1) (b) GDPR. Retention according to commercial and tax law (up to 10 years).

For guest purchases we only process data needed for the order (name, email, optionally phone). Legal basis: Art. 6 (1) (b) GDPR.

Payments are processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin, Ireland. Payment and transaction data is sent directly to Stripe; we ourselves do not store full payment-method data. Legal basis: Art. 6 (1) (b) GDPR. Details: stripe.com/privacy. If you choose PayPal, payment is handled by PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. We send PayPal the order items and amount; PayPal sends us the payer's name and email address. Details: paypal.com/legalhub/privacy-full.

You can optionally sign in with your Google account (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Google then sends us your name, email address and, if set, profile picture; we never receive your Google password. Legal basis: Art. 6 (1) (b) GDPR. Sign-in with email and password remains available at any time.

If you ask to be notified about an event, we first send a confirmation email (double opt-in). Only after you confirm do we notify you once when tickets are available. We process your email address, the event and the sign-up and confirmation time. Legal basis: Art. 6 (1) (a) GDPR; you can withdraw at any time by writing to hello@cytec.app.

RaveBuddy is voluntary and you switch it on per event yourself — either on the RaveBuddy page via "Join" or via the optional, unchecked-by-default checkbox at ticket checkout. Other attendees of that event who also join then see your display name or first name, profile picture and short bio. After a mutual like (match), bar staff see the first and last names of both people to redeem the free shot. Legal basis: Art. 6 (1) (a) GDPR. You can leave at any time; existing matches are kept.

We use a double opt-in for our newsletter. Data processed: email, sign-up and confirmation time. Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time via the unsubscribe link in each email or by writing to hello@cytec.app.

When you contact us, we process the data provided (name, email, message) to handle your request. Legal basis: Art. 6 (1) (b) or (f) GDPR. Stored until the request is fully handled, at most until you withdraw consent.

For partner applications and payouts we process master, contact and billing data. Legal basis: Art. 6 (1) (b) GDPR and tax obligations.

Database, authentication and file storage are provided by Supabase Inc. (servers in Frankfurt am Main, EU). The website is delivered and operated via Cloudflare, Inc. Transactional email and newsletter delivery uses Resend (Resend, Inc.). Reach measurement (only after consent, see section 14) uses Metricool (Metricool SL, Spain, EU). Data processing agreements pursuant to Art. 28 GDPR are in place with all providers. Our team uses DeepL (DeepL SE, Cologne, Germany, EU) to translate editorial content (news, events, newsletter); only the editorial texts are sent, never visitor or customer data. Fonts are served from our own server; no connection to Google Fonts is made when you visit the site.

We use technically required cookies and localStorage to store session, language and checkout information (language: 12 months). If you arrive via a partner link, the partner code is stored locally in your browser for 30 days so a ticket purchase can be credited to that partner. Legal basis: Art. 6 (1) (f) GDPR. No tracking or marketing cookies are set without explicit consent.

Web analytics (Google Analytics 4): Only with your explicit consent do we use Google Analytics 4, a web analytics service by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). It sets cookies and processes usage data (e.g. pages viewed, device, approximate location) to measure and improve how our site is used. We send only the page path without query parameters; Google Signals and ad personalisation features are disabled. A transfer to Google in the USA cannot be ruled out (basis: EU-US Data Privacy Framework or standard contractual clauses). Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). You can withdraw your consent at any time with future effect via the “Cookie settings” link in the footer.

Reach pixel (Metricool): Only with your explicit consent do we load a counting pixel by Metricool (Metricool SL, Spain) to measure our website’s reach. A 1×1 pixel image is requested; the request carries only our account identifier and a non-personal technical counter — not the page path you visited and no data you entered. As with any internet request, your IP address and browser details are transmitted. The pixel is not loaded on member or internal areas. Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). You can withdraw your consent at any time with future effect via the “Cookie settings” link in the footer.

Marketing (Meta Pixel and Conversions API): Only with your explicit consent (category “Marketing”) do we use the Meta Pixel and the Conversions API of Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, D04 X2K5, Ireland). This lets us measure whether people visit our website and buy tickets after seeing our ads on Instagram or Facebook, and helps us show more relevant ads. Cookies (e.g. _fbp) are set and usage data (pages viewed, device and browser details, IP address) is transmitted to Meta. If you buy a ticket with consent given, we additionally transmit from our server order data (ticket type, amount, order reference) as well as — each in encrypted (hashed) form — your email address, if provided your phone number, your first and last name, postal code and country (where available), if you have an account your date of birth, and a pseudonymous identifier — your account id if you have an account, otherwise a random identifier stored in your browser solely with your marketing consent and with no direct personal reference (not set without consent; a withdrawal removes it) — so Meta can attribute the purchase to a Meta account. For the collection and transmission we are jointly responsible with Meta (Art. 26 GDPR); Meta is solely responsible for any further processing. A transfer to Meta Platforms Inc. in the USA cannot be ruled out (basis: EU-US Data Privacy Framework or standard contractual clauses). The pixel is not used on member, checkout or internal areas. Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent). You can withdraw your consent at any time with future effect via “Cookie settings” in the footer. More information: facebook.com/privacy/policy.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), objection (Art. 21) and to withdraw consent (Art. 7 (3) GDPR). Please send requests to hello@cytec.app.

You also have the right to lodge a complaint with a data protection authority, in particular the Office of the Commissioner for Personal Data Protection (Cyprus).

We use TLS encryption and technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss and unauthorised access.

This privacy policy is updated when our services or legal requirements change. Last updated: October 2026.