GDPR Notice

This notice explains how Mao Nid Noi processes personal data under the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the UK GDPR and the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection. It applies to you if you use maonidnoi.com from the European Economic Area, the United Kingdom or Switzerland, and it supplements our Privacy Policy, which describes in plain terms what we collect and why.

The data controller

Mao Nid Noi is the controller of the personal data processed through maonidnoi.com. This means we decide why and how your data is processed and we are responsible for protecting it.

• Email: [email protected]
• Contact form: maonidnoi.com/contact

Given the size and nature of our processing, we are not required to appoint a Data Protection Officer. All privacy requests are handled by the contact above.

Key definitions

• Personal data means any information relating to an identified or identifiable living person, such as a name, email address, IP address or location.
• Processing means anything done with personal data, including collecting, storing, using, sharing and deleting it.
• Controller means the organisation that decides why and how personal data is processed. Processor means an organisation that processes personal data on the controller's behalf.
• Data subject means you, the person the data is about.

Principles we follow

In line with Article 5 GDPR, we make sure that personal data is:

• processed lawfully, fairly and transparently;
• collected only for specified, explicit and legitimate purposes and not used in ways incompatible with them;
• adequate, relevant and limited to what is necessary (data minimisation);
• accurate and, where necessary, kept up to date;
• kept in an identifiable form for no longer than necessary (storage limitation);
• protected by appropriate technical and organisational security measures (integrity and confidentiality).

We are responsible for, and able to demonstrate, compliance with these principles (accountability).

What we process, why, and on what legal basis

Under Article 6 GDPR, every processing activity needs a legal basis. The sections below set out ours.

Running your account

Data: name, email address, hashed password, optional profile details (username, display name, bio, location, avatar). Purpose: creating and managing your account, signing you in, saving favourites and collections. Legal basis: performance of a contract with you (Article 6(1)(b)). Retention: until you delete your account.

Publishing your contributions

Data: reviews, ratings, tips, photos, questions and answers, check-ins, crowd reports, submitted places and suggestions, shown with your display name. Purpose: publishing community content about venues. Legal basis: performance of a contract (Article 6(1)(b)) and our legitimate interest in providing accurate, community-driven venue information (Article 6(1)(f)). Retention: while the content is published; on account deletion, contributions are deleted or anonymised.

Reservations

Data: the booking details you enter. Purpose: sending your request to the venue and showing you its status. Legal basis: taking steps at your request before entering into a contract, and performance of a contract (Article 6(1)(b)). Recipients: the venue you book with, which becomes an independent controller of the booking. Retention: up to 24 months after the reservation date.

Location and safety features

Data: your device location and the trusted contacts you add. Purpose: showing nearby venues and, if you switch it on, sharing your live location with people you choose. Legal basis: your consent (Article 6(1)(a)), given through your browser's location permission and by starting a share. Retention: nearby searches are not stored; live shares are deleted when they end or expire, and contacts until you remove them.

Contact form and emails

Data: name, email address and message. Purpose: answering your enquiry. Legal basis: our legitimate interest in responding to people who contact us (Article 6(1)(f)), or steps before a contract where your enquiry concerns one. Retention: up to 24 months.

Security and server logs

Data: IP address, user agent, requested URLs, timestamps and error details. Purpose: keeping the website available and secure, detecting abuse and fixing faults. Legal basis: our legitimate interest in operating a secure service (Article 6(1)(f)). Retention: up to 90 days, longer only while investigating a specific incident.

Essential cookies

Data: session identifier, security token, your remembered city and your cookie choice. Purpose: making the website work. Legal basis: these cookies are strictly necessary, so no consent is required under Article 5(3) of the ePrivacy Directive; the processing itself rests on our legitimate interest (Article 6(1)(f)).

Analytics

Data: page views, referrers, browser, device type and approximate country. Purpose: understanding how the guide is used so we can improve it. Legal basis: our self-hosted, cookieless analytics does not store your IP address or identify you, and relies on our legitimate interest (Article 6(1)(f)). Any analytics that uses cookies, such as Google Analytics, runs only with your consent (Article 6(1)(a)), given by choosing "Accept all" in the cookie notice.

Legal obligations and claims

We may process and keep data where needed to comply with a legal obligation (Article 6(1)(c)) or to establish, exercise or defend legal claims (Article 6(1)(f) and Article 17(3)(e)).

Our legitimate interests

Where we rely on legitimate interests, we have balanced them against your rights and freedoms. Our interests are running a reliable, secure and useful nightlife guide, keeping community content accurate and free of abuse, and responding to enquiries. You can object to this processing at any time (see "Your rights" below).

Special categories of data

We do not ask for special category data such as health, religion, sexual orientation or political opinions. Please do not include such information in reviews, tips or messages. If you do, it will be processed only to publish or answer what you chose to submit, on the basis that you have manifestly made it public (Article 9(2)(e)) or with your explicit consent (Article 9(2)(a)).

Cookies and consent

When you first visit, we ask you to choose between "Accept all" and "Essential only". We do not set any non-essential cookies until you choose, and you can change your mind at any time with the "Cookie settings" link in the footer. Refusing non-essential cookies does not limit your use of the guide. The full list of cookies is in our Privacy Policy.

Who receives your data

We use carefully selected processors who act only on our instructions under a data processing agreement meeting Article 28 GDPR:

• Hosting: our servers are hosted by Hetzner Online GmbH in Germany.
• Email delivery: our email provider sends service emails such as password resets and contact form replies.
• Website resources: OpenFreeMap (map tiles), Bunny Fonts (web fonts) and cdnjs (icons) receive your IP address and browser details when your browser loads these files.
• Analytics: our cookieless analytics is self-hosted; if Google Analytics is enabled, Google Ireland Limited processes analytics data after you consent.

Other recipients are venues (for reservations you make), other users (for content you publish), and public authorities or courts where the law requires it. We never sell personal data.

International transfers

We store data in the European Union. If a processor transfers data outside the EEA, UK or Switzerland, we make sure it is protected by an adequacy decision (for example the EU-US Data Privacy Framework for certified companies) or by the European Commission's Standard Contractual Clauses, with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.

How long we keep data

We keep personal data only as long as needed for the purposes above, as described in each section. When it is no longer needed, we delete or anonymise it. Copies held in backups are removed as those backups are replaced.

Your rights

Under Articles 15 to 22 GDPR you have the right to:

• Access (Article 15): get confirmation of whether we process your data and a copy of it, with information about how it is processed.
• Rectification (Article 16): have inaccurate data corrected and incomplete data completed. Most profile details can be edited in your account settings.
• Erasure (Article 17): have your data deleted, for example when it is no longer needed or you withdraw consent. You can delete your account yourself from your profile.
• Restriction (Article 18): ask us to limit processing while, for example, the accuracy of data or an objection is being checked.
• Data portability (Article 20): receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another controller where technically feasible.
• Objection (Article 21): object at any time to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds or need the data for legal claims.
• Withdraw consent (Article 7(3)): withdraw any consent at any time, for example through "Cookie settings" or your browser's location permission. This does not affect processing that took place before.
• Not be subject to automated decisions (Article 22): we do not make decisions with legal or similarly significant effects based solely on automated processing.

How to exercise your rights

Email [email protected] from the address linked to your account, or use our contact form, and tell us which right you want to exercise. We may ask you to confirm your identity before acting on a request.

We respond within one month of receiving your request. If a request is complex or we receive many requests, we may extend this by up to two further months and will tell you why. Exercising your rights is free, unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse it and explain why.

Right to complain

If you think we have not handled your data properly, please contact us first so we can try to put it right. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where the issue occurred. In the UK, this is the Information Commissioner's Office (ico.org.uk); in Switzerland, the Federal Data Protection and Information Commissioner (edoeb.admin.ch). A list of EU authorities is available from the European Data Protection Board (edpb.europa.eu).

Is providing data required?

You can browse the guide without giving us any personal data beyond what your browser sends automatically. An email address and password are needed to create an account, and some features (such as reviews, favourites and reservations) need an account. Everything else is optional.

Security measures

Under Article 32 GDPR, we protect personal data with measures appropriate to the risk, including:

• encrypted HTTPS connections for all traffic;
• one-way password hashing and protection against automated login attempts;
• access to production systems limited to authorised staff using key-based authentication;
• regular software updates and dependency security checks;

Personal data breaches

If a breach is likely to put your rights at risk, we will notify the competent supervisory authority within 72 hours of becoming aware of it (Article 33), and tell you without undue delay where the risk is high (Article 34).

Children

The guide is for adults aged 18 or over, or the legal drinking age where you live if higher. We do not knowingly process data of children. If you believe a child has created an account, contact us and we will delete it.

Changes to this notice

We review this notice regularly and update it when our processing changes. The date at the top shows when it was last updated. For significant changes we will inform registered users by email or a notice on the website.