Confidentialité

The controller responsible for data processing on this website is the person named above, Sharon Di Salvo, who operates ŌPUNTIA Gatherings (registered trade name: Opuntia Events) as a sole proprietorship (Einzelunternehmen). No Data Protection Officer has been appointed; none is currently required at this scale.

This website and the database behind it run on a single server rented from Hetzner Online GmbH (Hetzner), a German company, in a data centre in Nuremberg, Germany. To deliver a page, the server necessarily processes technical connection data sent by your browser, such as your IP address, browser and device information, the page requested, the referring page and the time. This data is used only to answer that request and is not stored: the site keeps no access log, so no record of your visit, your IP address or the pages you view is written to disk. The web server and the application record only operational messages (for example that the application has started or that a security certificate was renewed), which contain no IP address or other information about visitors. If an access log is ever switched on, this section will be updated first and will state how long it is kept.

This processing is necessary for the technical operation of the site and rests on legitimate interest (Art. 6(1)(f) GDPR) in a secure, functioning website. Hetzner acts only on the controller's instructions and has no independent use for the data. Hosting this site involves no transfer outside the EU at all: the server and the database are both in Germany. Until 11 September 2026 the site was hosted by Vercel Inc., a company based in the United States, and an earlier version of this policy described that arrangement; moving to a German server removed that transfer.

This site uses the Cormorant Garamond and Jost typefaces via Next.js's built-in font optimisation, which downloads the font files at build time and serves them from this site's own domain. Your browser never requests anything from Google's font servers, and no connection data or IP address is shared with Google for this purpose.

This site sets one cookie: `opuntia_locale`, which remembers your chosen language for up to one year. It contains only a language code, is read solely by this website, and is not used for tracking or advertising.

This cookie is strictly necessary for a function you actively request (keeping the site in your chosen language) and is therefore set without requiring consent, under Art. 6(1)(f) GDPR and § 25(2) No. 2 TDDDG. You can delete it at any time through your browser settings; the site will simply ask again for your language preference.

No analytics, marketing or tracking technology of any kind is used on this site: no Google Analytics, Meta Pixel, Plausible or comparable service, and no advertising cookies or pixels. Your visit is not followed from page to page, you are not profiled, and nothing you do here is recorded unless you choose to submit a form. If that changes in the future, this section will be updated first and consent obtained wherever required before any such technology is activated.

One exception is named here rather than left implied: when you do submit a form, the record of that submission notes which page you sent it from and, if you reached the site through a link carrying campaign parameters, those parameters and the referring address. That is stored with your submission, and it is not used to follow you anywhere. See "What the database stores".

Every form on this site works the same way: your submission is sent by email, through ŌPUNTIA's own mailbox at Apple iCloud+ (Apple Distribution International Ltd., Ireland), directly to the project mailbox (hello@opuntiagatherings.com), and is also stored in this project's own database, described in the next section. Both have to succeed before a form tells you it worked, so a submission cannot quietly go missing.

After the contact form, Stay Close, Shape a Future Gathering and the Priority List (when you join, and again if you answer the optional follow-up questions) we also send you one confirmation email, in the language you used. It is sent through Lumitra Mail (see “Emails from ŌPUNTIA and unsubscribing”), which keeps your email address as a contact subscribed to no topic, and a copy of the confirmation. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in confirming that your submission arrived. The confirmation is not part of the submission itself: if it cannot be sent, your submission still counts.

The fields below are the only personal data each form collects. Every form also carries two hidden anti-spam fields (a decoy field and a timestamp) that contain no information about you — see "Spam protection".

The database runs on the same server as this website, in Germany, and is reachable only from that server over a private network: it has no public address and accepts no connections from the internet. It is read through an administration area that is not publicly reachable and requires a personal login with two-factor authentication; the only people with access are the controller and a technical service provider acting on the controller's instructions (see "Technical service provider").

For each submission it holds: your answers as you sent them, including free-text answers in full (only tidied: spaces at the start and end, invisible control characters and runs of more than one blank line are removed); the structured answers additionally in a normalised form (such as the regions or seasons you selected); which page of this site you submitted from; the referring address and any campaign parameters from the link you arrived through, where present; whether you ticked the consent box, with the time you did so and a version identifier for the wording you agreed to; the time of the submission; a note that the notification email was sent; and a copy of any confirmation email sent to you, with its language and whether it was delivered.

It does not hold your IP address. No visitor IP address is ever written to the database, for any form, and no cookie or identifier links your submission to your browsing.

Purpose: to keep an accurate record of what people have told us, and to understand in aggregate what kind of gathering there is genuine interest in. Legal basis: the same as for the form you submitted, named in its own section below. Retention: as set out for that form, and under "Retention and erasure".

The controller engages a technical service provider to operate the infrastructure (the server, the database and the application) and the sending of emails. Under the GDPR this provider is a processor (Art. 28), acting only on the controller's documented instructions and with no independent use for the data.

To do that work, the provider can access the personal data stored for your submissions, including the full content of emails sent to you, through the administration area described above (which requires a personal login with two-factor authentication, so every access is attributable to a specific person). A written data processing agreement (Art. 28(3) GDPR) binds the provider to confidentiality and to the security measures set out in this policy, and requires the return or deletion of the data when the engagement ends. The provider engages only the sub-processors named elsewhere in this policy (Hetzner for hosting, the email delivery providers, Cloudflare for the images used in emails and for the Turnstile check on the forms, and Sentry for error monitoring) and no others without notice to the controller. The same provider also operates the email service described in the next section.

Programme updates to the Priority List, messages to venues, experts and partners already in contact with us, letters written to one person, and the confirmation sent after the contact form, Stay Close, Shape a Future Gathering and the Priority List are sent through Lumitra Mail (mail.lumitra.co), an email service operated by the technical service provider described above, as a processor acting only on the controller's instructions under a written data processing agreement (Art. 28 GDPR). The service runs on a server of Hetzner in Germany, which holds the contacts, the messages and the copies of sent messages. Images used in messages are stored separately, in Cloudflare R2, the storage service of Cloudflare, Inc. (United States), in a bucket in its EU jurisdiction, so those files rest on servers in the European Union. What is stored there are the picture files themselves, ŌPUNTIA's own photographs of its gatherings and places, which may show people; nothing about you is stored with them. Your email program never loads them from Cloudflare: the email service fetches each picture itself and serves it from its own address. Your answers and your consent record stay in this project's own database: the controller decides who receives a message, and Priority List mailings go only to people who ticked the consent box. Of what you entered in the form, a confirmation receives only your first name and what chooses its opening sentence: the reason for contact you picked, or, for Stay Close, whether you told us about yourself (never what you wrote). A Priority List confirmation receives your first name (after the follow-up questions, the one you gave when joining) and, when you join, the name of the gathering, the link to its page and, where they are known, its dates and region; nothing else you entered.

For each person who is sent a message on one of the two topics below, the service stores: the email address; the first name; the gathering concerned; which of the two topics the person is subscribed to; and a copy of every message sent to them, with its subject, the time it was sent, the delivery provider's message reference and whether it was delivered. For a confirmation, it stores your email address, your first name as you gave it, the language of the confirmation and a copy of the message, with the same details, and the value that chose its opening sentence (the reason for contact, or yes or no for the note about yourself), or, for a Priority List confirmation, the name of the gathering you joined, the link to its page, and its dates and region where they are known. Your address is kept there as a contact subscribed to no topic, so a confirmation never signs you up for anything, and a form never changes the details of a contact the service already holds. If you unsubscribe, or a message cannot be delivered to your address, the service also records that, with the reason, the topic and the date. Messages are delivered through ŌPUNTIA's own mailbox at Apple iCloud+ (Apple Distribution International Ltd., Ireland), one message to one person at a time, so no recipient ever sees another's address.

There are two topics: “Programme updates” (the Priority List) and “Venue outreach” (venues, experts and partners already in contact with us). Every message carries a link to unsubscribe from its topic with one click, and your email program may offer the same through its own unsubscribe button. A confirmation belongs to neither topic: its link lets you unsubscribe from both, and once you have unsubscribed from both, no confirmation is sent to you. The same is true of a letter we write to one person by hand, such as a reply or a first enquiry to a venue (see “Venues found through research”): it belongs to neither topic, it signs you up for nothing, and the link at its foot lets you ask not to be written to again at all. Unsubscribing from one topic does not end the other unless you choose both on the page the link opens. You can also unsubscribe by replying to any message or by writing to hello@opuntiagatherings.com. An unsubscribe is checked immediately before every single message is sent, so it takes effect even for a message that was already queued.

The service does not track you: it does not record whether you opened a message or which links you followed. Images in messages contain no information about you, and every recipient receives the same picture at the same address. They are loaded either from the email service's own address or from this website (opuntiagatherings.com), which serves ŌPUNTIA's own brand images such as its sigil. When your email program shows an image from this website, it connects to this website's server, which processes the same technical connection data as for any visit (IP address, the name of your email program, the time) only to deliver the image, as described under “Hosting”; it is not stored, it is not linked to you or to the message, and it is not used to find out whether you opened it. Most email programs let you turn off loading images.

Legal basis: for Priority List mailings, the consent you gave when joining (Art. 6(1)(a) GDPR), which unsubscribing withdraws. For venue outreach, the basis named for the way you first contacted us (see “Contact form”). For a letter written to one person, the basis named for the way the contact began: “Contact form” if you wrote to us first, “Venues found through research” if we wrote to you first. For the confirmation after a form, legitimate interest in confirming that your submission arrived (Art. 6(1)(f) GDPR). Retention: copies of sent messages are kept until the controller deletes them or you ask for erasure; see “Retention and erasure”.

Fields: name, email address, reason for contact, subject, message, and (only if you choose to add them) organisation and website. Purpose: to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) or Art. 6(1)(f) GDPR (legitimate interest in responding to messages sent to us). Recipients: the controller above, by email via Apple iCloud+, this project's own database (see "What the database stores"), and Lumitra Mail for the confirmation sent to you (see "Forms on this site"). Retention: until your enquiry is resolved; see "Retention and erasure".

ŌPUNTIA looks for places that could host a gathering. If you run a venue that did not contact us first, this section tells you what we hold about it and why (Art. 14 GDPR). For a venue we find this way we keep: its name, its location, its website, the contact details it publishes for enquiries (an email address, and where published a telephone number, the name of a contact person and an Instagram account), and our own notes on whether it suits a gathering and on any contact we have had. Source: the venue's own website and public listings and profiles in which the venue presents itself. Nothing is bought, and nothing is taken from a source that is not public.

Purpose: to judge whether a venue suits a gathering and to send it one enquiry, as a prospective customer, at the address it publishes for enquiries, asking whether it would host one. Each enquiry is written to one venue by hand. It is never part of a mailing to a list, and a venue we found is not sent programme updates or advertising unless it asks for them. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in finding and approaching suitable venues, which a venue that publishes an address for enquiries can reasonably expect.

Recipients: the controller above; this project's own database (see “What the database stores”); and, once we write to you, Lumitra Mail, which sends the letter and keeps your address as a contact subscribed to no topic together with a copy of the letter (see “Emails from ŌPUNTIA and unsubscribing”). Your right to object (Art. 21 GDPR): you can tell us at any time, without giving a reason, not to write to you again, through the link at the foot of the letter, by replying to it, or at hello@opuntiagatherings.com. We then record only that your address is not to be written to, and erase the rest if you ask. Retention: for as long as the venue is being considered for a gathering, and at the latest until the project concludes or you object or ask for erasure; see “Retention and erasure”. Your other rights are set out under “Your rights”. Our first letter to you links to this policy.

Fields: name, email, your preferred formats, learning interests, seasons and regions, and (optionally) dietary needs, accessibility needs, language preference and a free-text note. Purpose: to understand demand and contact you about gatherings that match your interests. Legal basis: consent (Art. 6(1)(a) GDPR), given by ticking the consent box before submitting. Recipients: the controller above, by email via Apple iCloud+, this project's own database (see "What the database stores"), and Lumitra Mail for the confirmation sent to you (see "Forms on this site"). Retention: until you withdraw consent or the underlying concept is no longer being developed; see "Retention and erasure".

Fields: first name, email, and, optionally, which of the 4 Ways to Gather interest you, what you would love to explore, and a free-text note about yourself (“Tell us a bit about yourself”). The note is entirely optional, is not needed to stay in touch, and what you write in it is never repeated in any email sent to you. Purpose: to keep you informed about what takes shape at ŌPUNTIA (new gatherings, places, experts and important developments) and to understand who you are and what draws you. Legal basis: consent (Art. 6(1)(a) GDPR), given by ticking the consent box before submitting. Recipients: the controller above, by email via Apple iCloud+, this project's own database (see "What the database stores"), and Lumitra Mail for the confirmation sent to you (see "Forms on this site"). Retention: until you withdraw consent; see "Retention and erasure".

If you submit the form again, a new note about yourself replaces the earlier one in your entry, and leaving the field blank keeps the earlier one. Each submission is also kept as you sent it (see "What the database stores").

Fields: name, email, country or city, likely number of guests, and — optionally — preferred room type, dietary needs, accessibility needs, language preference and a message. Joining the Priority List is a non-binding expression of interest — it does not reserve a place and does not create a booking, purchase or payment obligation.

Purpose: to gauge interest in a specific gathering that is taking shape, and to contact you if and when it moves forward. Legal basis: consent (Art. 6(1)(a) GDPR), given by two separate, unticked checkboxes (one acknowledging that joining is non-binding, one consenting to this processing), each linked to this policy. Recipients: the controller above, by email via Apple iCloud+, this project's own database (see "What the database stores"), and Lumitra Mail for the confirmations sent to you (see "Forms on this site"). Retention: until you withdraw consent or the gathering is confirmed, cancelled or no longer developed; see "Retention and erasure".

After joining, you may optionally answer a short follow-up questionnaire (what you're hoping to feel more of, what you're curious to learn or explore, how you like to travel, and free-text answers about what you'd rather a gathering not include or anything else you'd like us to know). Answering it is entirely optional, is not required to remain on the Priority List, and is covered by the same consent given when you joined — this data is used only to shape gatherings around what people are genuinely drawn to. Retention follows the same terms as your Priority List entry above.

Fields: name, email, number of guests, and — depending on the form — preferred room type, region, language preference and a message, plus an optional opt-in to be notified about future editions. Purpose: to contact you about the specific gathering or a future edition of it. Legal basis: consent (Art. 6(1)(a) GDPR). Recipients: the controller above, by email via Apple iCloud+, and this project's own database (see "What the database stores"). Retention: until you withdraw consent or the relevant gathering is resolved; see "Retention and erasure".

Field: email address only. Purpose: to notify you when the seasonal totes become available — nothing else. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request). Recipients: the controller above, by email via Apple iCloud+, and this project's own database (see "What the database stores"). Retention: until the totes are released or you ask to be removed; see "Retention and erasure".

Each form's section above names the point at which its purpose ends. Your data is erased when you withdraw consent, when you ask us to erase it, or when the project concludes, whichever comes first.

There is no automated deletion schedule, and it would be misleading to imply one: with the small number of people on these lists, erasure is done by hand on request. That normally happens within a few days and always within one month, as Art. 12(3) GDPR requires. Erasure covers every copy, the database record, the email, and the copies of messages and the contact entry kept in the email service, not one of them. One thing is deliberately kept after erasure: if you unsubscribed, the email service keeps your address with the topic and the date, and uses it for nothing except making sure no message reaches you again. Erasing that record would mean writing again to someone who asked us not to (legitimate interest in honouring your request not to be contacted, Art. 6(1)(f) GDPR). If you want to hear from us again, tell us and it is lifted.

Every form uses two automated, invisible checks (a decoy field that only automated software fills in, and a minimum time-to-submit) to reject spam before it is sent. Both run entirely on this server, involve no third-party service and no additional personal data, and cannot identify you.

The contact form, Stay Close, Shape a Future Gathering and the Priority List are also protected by Cloudflare Turnstile, a check provided by Cloudflare, Inc. (United States) that tells people apart from automated software, usually without you noticing anything; now and then it asks you to tick a box. It is loaded from challenges.cloudflare.com only once you start filling in one of these forms, not when you merely open a page. According to Cloudflare's Turnstile privacy addendum (cloudflare.com/turnstile-privacy-policy), Turnstile collects your IP address, the TLS fingerprint and user agent of your browser, and the site key and address of the site the form is on. The result is a one-time code, which this server checks with Cloudflare when you submit; we send Cloudflare only that code, never what you entered in the form and not your IP address. According to Cloudflare, Turnstile does not use cookies to collect or store information, and this site does not switch on its optional clearance cookie.

Cloudflare processes these signals on our behalf to detect automated software, as a processor, and, as it states in that addendum, also as a controller in its own right to improve its bot detection. Because Cloudflare, Inc. is a United States company, this can involve processing outside the EU/EEA; Cloudflare publishes its safeguards for such transfers in its data processing documentation. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in protecting these forms from automated abuse, including the people whose addresses could otherwise be flooded with confirmation emails. If the check cannot load, for example because a content blocker stops it, the form says so and lets you try again; you can always write to us directly at the address under "Controller".

This site reports technical errors to Sentry (Functional Software, Inc., trading as Sentry) so that a page which breaks can be found and fixed. Reports go to Sentry's European data region, and are generated both on this server and, for errors that happen only in your browser, from your browser.

Every category of personal data the service is capable of collecting is switched off explicitly in this site's configuration: no user information, no cookies, no request or response headers, no request bodies, no URL query parameters, no database query contents, and no variable values from the code. What remains is the technical error itself: its type, where in the code it happened, and which page it happened on. Form submissions and administration credentials are never sent to Sentry.

Because a report from your browser is an ordinary internet request, Sentry necessarily sees the IP address it comes from; the configuration instructs it not to record that as part of the report. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in a working, secure website. Sentry's own privacy documentation is at sentry.io/privacy.

Hosting no longer involves any transfer outside the EU: since 11 September 2026 this site and its database run on a German server operated by a German company. Two providers used to operate this site are US-based companies: Functional Software, Inc. (Sentry, used only for technical error reports, configured to send no personal data and to store reports in its European region) and Cloudflare, Inc. (which stores the images used in emails, in its EU jurisdiction, as described below, and runs the Turnstile check on four of the forms, which can involve processing connection data outside the EU/EEA; see "Spam protection"). Using Sentry can involve processing connection data outside the EU/EEA. Sentry publishes its own safeguards for such transfers (including standard contractual clauses) in its privacy and data-processing documentation. Emails from the forms and from the email service, and the project mailbox itself, are handled by Apple iCloud+, provided in the EU by Apple Distribution International Ltd. (Ireland); Apple may process message data in the United States, under the EU-US Data Privacy Framework and standard contractual clauses. Images used in those emails are stored in Cloudflare R2 by Cloudflare, Inc. (United States), in a bucket in its EU jurisdiction, so the files themselves rest in the European Union; because the provider is a United States company, its safeguards for any access from outside the EU/EEA (standard contractual clauses) apply as well. Only the picture files are stored there, never a recipient's address or name.

You have the right to access (Art. 15 GDPR), rectify (Art. 16), erase (Art. 17), restrict the processing of (Art. 18), receive a portable copy of (Art. 20), and object to (Art. 21) your personal data. Where processing rests on consent, you may withdraw it at any time, with effect for the future, by emailing hello@opuntiagatherings.com or, for emails from us, through the unsubscribe link in any of them.

You also have the right to lodge a complaint with a data protection supervisory authority. As the operator is based in Berlin, the competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit, BlnBDI), datenschutz-berlin.de — or the supervisory authority in your own EU member state.