Digital Services Act (DSA)

Last Updated: 25.09.2026

This page explains how Wullup applies Regulation (EU) 2022/2065 (Digital Services Act, DSA): whom to contact, how to report content, how we decide and how you can challenge our decisions.

1. Who We Are

Wullup GmbH, Im Vogelsang 14, 35452 Heuchelheim, Germany, operates the Wullup app for iOS and Android, the website wullup.com and the organizer web app Wullup Backstage (backstage.wullup.com). Users share posts, stamps, messages, profiles, events and crews there.

Under the DSA, Wullup is a hosting service and an online platform. Further company details are in our Imprint.

2. Contact Points

For authorities (Art. 11 DSA): Member State authorities, the European Commission and the European Board for Digital Services can reach us at [email protected].
For users (Art. 12 DSA): You can reach us directly and electronically at [email protected]. This contact point is not exclusively automated: a person reads and answers your message.

You can write to us in German or English. We do not need a legal representative in the EU (Art. 13 DSA) because we are established in Germany.

The easiest way to report content is the report form (Section 5).

3. Our Size and Which Rules Apply

Wullup GmbH currently qualifies as a micro or small enterprise within the meaning of Recommendation 2003/361/EC. This means:

The additional obligations for online platforms in Art. 20 to 28 DSA do not formally apply to us (Art. 19 DSA). The exception is Art. 24(3): on request, we provide the Digital Services Coordinator and the European Commission with the average number of monthly active recipients of our service in the EU. This number is far below the threshold of 45 million for very large online platforms (Art. 33 DSA).
We are not required to publish transparency reports (Art. 15(2) DSA).
The rules for all hosting services apply to us in full, in particular contact points (Art. 11 and 12), terms and conditions (Art. 14), notice and action (Art. 16), statements of reasons (Art. 17) and notification of suspected criminal offences (Art. 18).

Even so, we voluntarily offer an internal complaint system modelled on Art. 20 DSA (Section 7) and point you to certified out-of-court dispute settlement bodies (Section 8). Sections 11 to 13 describe, voluntarily, how we handle advertising, recommendations and the protection of minors.

4. How We Moderate Content

Our Terms of Service and Community Guidelines set out which content is not allowed and which measures we can take (Art. 14 DSA).

People decide: A person on our team reviews every report and makes every moderation decision. We use no automated means to decide on reports, and no account is warned, suspended or banned by automated means. Child-safety reports and reports where the reporter or the reported user is under 18 (by the date of birth on file) are handled first.
Automated check before saving: Before we save names, usernames and bios, profile and banner images, crew names, usernames, descriptions and images, stamp texts and custom stamps, they are checked by OpenAI's moderation API (OpenAI, USA). Flagged content is rejected and not saved. The message tells you that an automated check rejected it and that you can email [email protected] to have a person review it. If the check is unavailable, the content is saved unchecked. Other content, such as posts, chat messages and events, is not checked automatically.
Proportionate measures: Depending on the case, we give a warning, remove content, suspend an account (it stays suspended until we lift the suspension) or ban an account permanently (its email address goes on our block list and can no longer be used to register). Before we suspend or ban an account, we normally tell the user why and give them a chance to respond, unless immediate action is needed (e.g. for child sexual abuse material or threats) or the law prohibits it.

We do not monitor chats. Messages are encrypted at rest; this is not end-to-end encryption. If you report a chat message, the copy we keep for the review is also encrypted at rest.

5. Reporting Content (Art. 16 DSA)

You can report content that you believe is illegal or breaks our rules:

Report form: Report content. No account is needed. Every public event page on wullup.com links to it ("Report") with the event link filled in.
- Categories: illegal content; breaks the Community Guidelines; child sexual abuse material; copyright or trademark; something else.
- Details: the link to the content, or a description of exactly where it is; an explanation of why it is illegal or breaks our rules (for illegal content, name the law if you can, e.g. § 185 StGB); your name and email address; and your confirmation in good faith that the information and allegations in your report are accurate and complete. In the category "child sexual abuse material", name and email address are optional (Art. 16(2)(c) DSA).
- Receipt: After sending, you see an 8-character reference number on screen. If you gave your email address, a person on our team confirms receipt and tells you our decision by email from [email protected]. Without an email address, we cannot tell you the outcome.
In the app: Use "Report" on posts, profiles, chat messages, events and crews (not on your own events and crews). Reasons: spam or misleading content, harassment or bullying, hate speech, violence or threats, nudity or sexual content, false information, scam or fraud, copyright or trademark, illegal content, child safety, something else. Further details are optional. The app confirms that your report was sent, and we tell you our decision in the app. Stamps cannot be reported in the app: use the report form or email, or report the author's profile. If your app version does not offer an option, use the report form.
By email: to [email protected], with the same information. A person confirms receipt.

We decide on every report in a timely, diligent, non-arbitrary and objective manner, without automated means. We tell you our decision and how you can challenge it. We do not tell the person concerned who reported them.

Other routes: for copyright and trademark issues, see Copyright & Trademark Complaints. To have events from your website or under your name removed, use Opt Out of Event Sourcing. In an emergency, call 110 or 112.

6. Statement of Reasons (Art. 17 DSA)

If we warn a user, remove their content, or suspend or ban their account, we send them a statement of reasons. It arrives automatically in the app as a notice with a push notification, in German if the app is set to German, otherwise in English. If we have an email address, we also send it by email from [email protected]. A suspended or banned user also sees it on the "Account Blocked" screen. It states:

a reference number;
the measure and what it means (a suspension lasts until we lift it);
the content concerned (we never quote chat messages);
the facts and circumstances we relied on;
the ground: the legal provision, or the rule in our Terms of Service or Community Guidelines;
whether automated means were used;
the options for redress: our internal complaint system (Section 7), certified out-of-court dispute settlement bodies (Section 8) and the courts.

7. Complaints About Our Decisions

You can challenge our moderation decisions free of charge, including our decision on a report you made:

Suspension or ban of your account: in the app, on the "Account Blocked" screen via "Submit Appeal", or by email to [email protected].
All other decisions: by email to [email protected]. Please say which decision you mean (e.g. the reference number or the content) and why you think it is wrong.

You can complain for at least six months after we informed you of the decision. A person decides on your complaint, not an automated system. If your complaint shows that our decision was wrong, we reverse it. We tell you the result and the reasons: for an account block in the app with a push notification, otherwise by email. Our decision on your complaint is not final: out-of-court dispute settlement and the courts remain open to you.

8. Out-of-Court Dispute Settlement, Courts and the Digital Services Coordinator

Out-of-court dispute settlement (Art. 21 DSA): You can turn to a dispute settlement body certified by a Digital Services Coordinator. The Bundesnetzagentur has certified, among others, User Rights GmbH (Berlin, https://user-rights.org) and Platform Control (KLN information services UG, Gräfelfing, https://platform-control.com). The full EU list is at https://digital-strategy.ec.europa.eu/en/policies/dsa-out-court-dispute-settlement. Each body decides which platforms and topics it accepts. Using one is voluntary and does not affect your right to go to court.
Courts: You can go to court at any time.
Complaint to the Digital Services Coordinator (Art. 53 DSA): If you think we are breaching the DSA, you can lodge a complaint with the Digital Services Coordinator of the Member State where you are located or established. In Germany, this is the Bundesnetzagentur (Koordinierungsstelle für digitale Dienste), Tulpenfeld 4, 53113 Bonn.

9. Threats to Life or Safety (Art. 18 DSA)

If we become aware of information that gives rise to a suspicion that a criminal offence involving a threat to the life or safety of a person has taken place, is taking place or is likely to take place, including the sexual abuse of children, we promptly inform the law-enforcement or judicial authorities of the Member State concerned and provide all relevant information we have. In Germany, we report to the Bundeskriminalamt (BKA), the central office for such reports (§ 13 DDG). If we cannot identify the Member State concerned with reasonable certainty, we inform the BKA or Europol, or both (Art. 18(2) DSA).

If someone is in immediate danger, please call 110 (police) or 112 (emergency services) yourself.

10. Orders and Requests From Authorities

Courts and authorities can send the following to [email protected], in German or English: orders to act against illegal content (Art. 9 DSA), orders to provide information about individual users (Art. 10 DSA), and other requests from law-enforcement authorities. Please send them from an official address and state the legal basis.

We check whether each order or request is legally valid and complete.
We tell the issuing authority without undue delay whether and when we gave effect to it.
We inform the user concerned about the order and how we responded, at the latest when we give effect to it, or at the later time the authority sets in its order (Art. 9(5) and 10(5) DSA).
We disclose user data only where a legal provision permits or requires it, for example the German Code of Criminal Procedure (StPO) or the Telecommunications Digital Services Data Protection Act (TDDDG), and the request meets that provision's requirements.

11. Advertising

Art. 26 DSA does not formally apply to us (Section 3). This is what we do:

Organizers can pay to promote their events via Wullup Backstage. Every promotion is reviewed before it is delivered.
Promotions appear only in the app: in the Discover and Following feeds and at the top of the Events tab. They are labelled "Sponsored" and show the account hosting the event. wullup.com shows no promotions.
Promotions are shown only to users aged 18 or over (by the date of birth on file). Users without a date of birth and visitors without an account see none.
Main parameters: Organizers can target a promotion by city, age range (from 18) and gender. Among the promotions that match you, we prefer events in the city in your profile, events whose host you follow, and events that people you follow are going to. We also consider how often users in your city and age group have clicked on the promotion. We count at most three impressions of the same promotion per day for you.
We do not use special categories of personal data (Art. 9 GDPR), such as health, religion or sexual orientation, to target advertising.

12. Feed and Recommendations

Art. 27 DSA does not formally apply to us (Section 3). This is how it works:

Feed: The home feed has two areas: Crew (All, one tab per crew, and Following) and Discover (All, Music, Events). Every tab shows content in chronological order, newest first. Discover also shows public posts from people you don't follow and upcoming public events in the city in your profile. We do not rank the feed by engagement or with machine learning.
Inserted cards: The feed also contains labelled promotions (Section 11) and cards such as your daily stats and Weekly Drops.
Weekly Drops (new releases) are based on the artists you pinned and, if you connected Spotify or Apple Music, your top artists there. If that yields too few songs, we add new chart releases in your country. The card is created once a week; changes take effect the following week.
Artist Radar (concerts by your artists) is based on the artists you pinned, the artists in your posts from the last 90 days and your streaming top artists. It finds concerts within about 80 km of your approximate location, or in your country if you share no location. Pinning or unpinning artists changes the result.
Suggested people are based on shared crews, mutual contacts and active users with many followers.

For connected streaming accounts, see our Privacy Policy.

13. Protection of Minors

Art. 28 DSA does not formally apply to us (Section 3). This is what we do:

The minimum age is 16. The date of birth is self-declared and checked on our server; under 16 is rejected, and the app locks the device for 7 days after an under-16 entry. The age is not verified.
Users aged 16–17 have a private profile by default. They can switch to public in Edit Profile.
Direct messages between an adult (18+) and a minor (under 18, or no date of birth on file) are possible only if they follow each other.
Promotions are shown only to users aged 18 or over (Section 11). Wullup AI is available only from 18.
Child-safety reports and reports involving users under 18 are handled first.

Details are in our Child Safety Standards.

14. Related Documents

This document is available in German and English. The German version is legally binding; the English version is a courtesy translation.