Wullup Get the app

Deutsche Version

Legitimate Interest Assessment for Event Sourcing

Last Updated: 23.09.2026

Wullup takes publicly announced events from publicly accessible sources. Where personal data is involved, we rely on our legitimate interest under Art. 6(1)(f) GDPR. This page sets out how we balanced the interests involved. It complements the notice on Event Sources and AI Transparency, where you will find all details on sources, recipients and your rights.

This page is available in English and German. In case of discrepancies, the German version prevails.

Controller: Wullup GmbH, Im Vogelsang 14, 35452 Heuchelheim, Germany — [email protected]

The assessment follows the three steps set out by the Court of Justice of the European Union (judgment of 4 October 2024, C-621/22) and takes into account Opinion 28/2024 of the European Data Protection Board and the draft of its Guidelines 03/2026 on web scraping.

1. What This Is About

  • Purpose: people should find what's on in their city in one place — in the Wullup app and on wullup.com.
  • Sources: public websites of venues and organizers, public Instagram accounts, and portals whose operators have granted us a licence.
  • Who is affected: event details are only personal data when they relate to a natural person — for example a sole trader acting as organizer, artists and DJs named in a line-up, or people shown on a flyer.
  • Which data: the organizer's name (published as the host of the event), line-up names and the organizer's Instagram name (internal only, for categorisation and matching), the text of a post or page (for a limited time, as the basis for reading the event details), and flyer images (without permission only briefly in memory for text recognition).
  • No contact details: we automatically remove email addresses and phone numbers before any text is stored or analysed by AI.

2. Step 1: Our Legitimate Interest

We pursue three interests:

  • Informing the public: a city's cultural offering is scattered across many websites and accounts. Making it findable in one place serves freedom of information (Art. 11 of the EU Charter of Fundamental Rights).
  • Running our platform: Wullup is a business. Under the case law of the CJEU, a commercial interest can also be legitimate as long as it is lawful.
  • Reach for organizers: events are announced publicly precisely so that as many people as possible find them.

These interests are lawful, clearly defined and present.

3. Step 2: Necessity

  • Consent from everyone affected cannot realistically be obtained: the details come from public sources, and who is named in them is not known in advance. The European Data Protection Board also considers that consent is generally not a suitable legal basis here.
  • Organizers can manage their events themselves — in Wullup Backstage. That takes priority, but it does not cover the whole offering.
  • We only process what the purpose requires:
    • Without permission, we publish only factual details — title, date, time, venue, price — and neither description texts nor flyers.
    • We do not have AI write texts, and we do not use the content to train AI models.
    • We remove contact details before any storage or AI analysis.
    • We do not take third parties' comments.
    • We do not build profiles of people and offer no search for people.

4. Step 3: Balancing

4.1 Nature of the Data and Reasonable Expectations

  • Published by the organizer, to be found: the organizer made the details public themselves — with the aim of reaching an audience. Showing them to an audience matches the purpose of their publication.
  • Professional details: the data concerns professional or artistic activity, not private life.
  • Sensitive topics: where the topic of an event allows conclusions about political opinions, religious beliefs, sexual orientation, health or trade union membership, we publish it only under the name of the venue, without naming the source and without listing it in search engines. We then do not store the line-up, the Instagram name or the source's raw data.

4.2 Our Safeguards

Safeguard How it works
Opt-out signals are respected robots.txt (including Crawl-delay) before every request and on every redirect; text-and-data-mining reservations (TDMRep, corresponding headers and meta tags, Content-Usage) and written reservations in terms or imprint. These checks apply to pages and to images.
No circumvention of technical barriers No logging in, no solving of captchas. If a website answers with a bot or captcha check, we stop reading that website entirely.
Identifiable crawler Our crawler identifies itself as Wullup/1.0 (+https://wullup.com/bot); how to block it is explained on Our Crawler.
Transparency Information under Art. 14 GDPR at Event Sources; every event we take names and links its source.
Objection without giving reasons Via the opt-out form or by email. The block applies before any future retrieval; events already taken are removed — within 72 hours.
Considerate retrieval Websites roughly every three and a half days, with at least half a second between requests — longer if the website asks for it.
Short retention periods Post and page texts 30 days after the source stops carrying them; line-up, Instagram name and organizer name in our internal records 30 days after the event ends. Details are in the table at Event Sources, Section 4.5.
Rightholder's permission Where an organizer has submitted their own website in Backstage, given consent and proven that it belongs to them, we read it with their express permission. A block via robots.txt is still respected.

4.3 Impact on the People Concerned

The impact is minor: we only show what the organizer published themselves with the aim of spreading it. We do not link the details into profiles and make no decisions about people; there is no automated decision-making within the meaning of Art. 22 GDPR.

Remaining risks and how we address them:

  • Errors in automated reading: every event links its source and carries the note "details without guarantee". We correct errors when told at [email protected], and organizers can manage their details themselves in Backstage.
  • Service providers outside the EU: where data reaches the USA, we rely on the EU-U.S. Data Privacy Framework and, alternatively, on standard contractual clauses.

4.4 Result

Our legitimate interests outweigh the interests of the people concerned. Decisive factors are:

  • that the details were published by the organizer themselves to reach an audience,
  • the restriction to factual details,
  • consistent respect for technical and written opt-out signals,
  • objection without giving reasons, which also prevents future sourcing, and
  • the short retention periods.

5. Your Rights

You can object to the processing at any time (Art. 21 GDPR) — most easily via the opt-out form. You also have the right of access, rectification, erasure and restriction of processing, and the right to lodge a complaint with a data protection supervisory authority. Details are at Event Sources, Section 4.6.

We review this assessment whenever something material changes in how we source events, and otherwise annually.