Privacy Policy

Last updated: 9 September 2026

1. Controller

Florian Nowotny
BESO Berlin – Bizarre Entertainment & Scare Operations
Platz der Vereinten Nationen 26
10249 Berlin
Germany

Email: beso(at)besoberlin.com

2. Hosting and server logs

This website is hosted by One.com Group AB, Carlsgatan 3, 211 20 Malmö, Sweden. When you access the website, technically necessary data may be processed, including your IP address, time of access, requested pages, referrer URL, browser and device information. Processing is based on Art. 6(1)(f) GDPR for the secure and reliable operation of the website.

3. Cookies and consent management

We use technically necessary cookies and, subject to your consent, optional cookies and similar technologies for analytics, external media and other functions. Technically necessary storage or access may be used under Section 25(2) TDDDG where required to provide a service expressly requested by you. Optional technologies are used on the basis of your consent pursuant to Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.

We use CookieYes to record and manage your choices. You can change or withdraw your consent at any time via the cookie settings on this website.

4. Google Site Kit, Google Analytics and Consent Mode

We use Google Site Kit to integrate and manage selected Google services. Site Kit itself does not mean that every Google service is active on every page. Where enabled and subject to your consent, we use Google Analytics, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics may process information about pages visited, interactions, session duration, approximate location, browser and device. User- and event-related data in Google Analytics is configured to be retained for 14 months. The legal basis is your consent under Art. 6(1)(a) GDPR and, where access to your device occurs, Section 25(1) TDDDG.

Google Consent Mode may be used to transmit consent signals to Google. Depending on the technical configuration, limited cookieless technical signals may be processed before consent. Non-essential Analytics cookies are only set after the relevant consent.

5. Jetpack, WordPress.com, Jetpack Stats and newsletter

This website uses functions provided by Jetpack and WordPress.com. For users in Europe, the provider is in particular Aut O’Mattic A8C Ireland Ltd.; individual functions may also involve Automattic Inc. in the United States.

We use Jetpack Stats for audience measurement. According to Jetpack, this may involve IP address, WordPress.com user ID and username for logged-in users, user agent, visited URL, referring URL, timestamp, browser language and country code. As the website operator, we receive aggregated statistics rather than direct access to individual visitor IP addresses. Jetpack states that statistics logs containing IP addresses may be retained for 28 days.

Where consent is legally required for audience measurement, processing is based on Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG. Where purely technical cookieless processing is permissible without consent, it is based on Art. 6(1)(f) GDPR for statistical evaluation and improvement of our website.

If you subscribe to post notifications or a newsletter, we process your email address and subscription status on the basis of your consent under Art. 6(1)(a) GDPR. You can unsubscribe at any time using the unsubscribe link in the email.

6. External media

Our website may embed content from YouTube, Instagram and TikTok. Such content is generally loaded only after you have consented to the relevant category or expressly activated the content. Your IP address, device and browser information, the page visited and information about your interaction may be transmitted to the relevant provider.

Providers include Google Ireland Limited for YouTube, Meta Platforms Ireland Limited for Instagram and TikTok Technology Limited for TikTok. The legal basis is your consent under Art. 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.

7. Nightmare Navigator and Open User Map

We use the Open User Map WordPress plugin for the Nightmare Navigator. The interactive map loads map tiles from external map services. Depending on the map style or data source currently selected, providers may include OpenStreetMap, CARTO, Esri or Mapbox. When the map is loaded, your IP address and other technically necessary connection data may be transmitted to the respective provider.

You may also submit suggestions for places or events via the Nightmare Navigator. We process the information you enter, including location and content data and any optional details, in order to review, moderate and, where appropriate, publish the submission. Please do not submit personal data of uninvolved third parties. Processing is based on Art. 6(1)(f) GDPR for operating and developing the map; where you expressly request contact, Art. 6(1)(b) GDPR may also apply.

8. Affiliate links and partner programmes

BESO Berlin uses clearly identified affiliate links. If you visit an offer through such a link and later make a purchase or booking, we may receive a commission. This generally does not increase the price for you.

We currently use partner programmes in particular through AWIN AG, Otto-Ostrowski-Straße 1A, 10249 Berlin, Germany, and ADCELL, operated by Firstlead GmbH, Rosenfelder Straße 15–16, 10315 Berlin, Germany.

When you click an affiliate link, a connection is established with the relevant affiliate network and/or destination provider. Data such as IP address, click time, referrer information, destination page and technical identifiers may be processed for attribution purposes. If non-essential cookies or similar technologies are used on our website for affiliate tracking, they are used only with the required consent.

9. Click measurement in BESO event elements

Some pages use our own BESO event elements with ticket or outbound buttons. Clicks may be counted to understand which events and offers are relevant to visitors and to improve our website. Where this measurement is performed locally without identifying individual visitors, it is based on Art. 6(1)(f) GDPR. If click data is additionally transmitted to Google Analytics/GA4, the provisions in the Google Analytics section apply and the required consent is respected.

10. Comments and contact

If you leave a comment, we process the data entered in the comment form, including your comment, name and email address, as well as technically necessary information such as IP address and browser information for moderation and abuse prevention. The legal basis is Art. 6(1)(f) GDPR.

If you contact us by email or another method, we process the information you provide to handle your request. Contract-related enquiries are processed under Art. 6(1)(b) GDPR; other enquiries are processed under Art. 6(1)(f) GDPR.

11. International transfers

When using services such as Google, Meta, TikTok, Automattic or certain map providers, personal data may be processed outside the European Union or European Economic Area. Transfers take place only under the requirements of Art. 44 et seq. GDPR, in particular on the basis of an adequacy decision or appropriate safeguards.

12. Your rights

Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing, data portability, objection to certain processing and withdrawal of consent with effect for the future. You may contact us using the email address above.

You also have the right to lodge a complaint with a data protection supervisory authority. For a controller based in Berlin, the competent authority is in particular the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany.

13. Updates

We update this Privacy Policy when the services used on this website, their configuration or the legal requirements change.