Privacy Policy

The controller responsible for the processing of your personal data is:

CLC - Creative Lunch Club IT GmbH
Jungstraße 8/36
1020 Vienna
Austria
FN 644473f, Handelsgericht Wien
Represented by Klaus Heller
Email: hallo@creativelunchclub.com

We have not appointed a data protection officer, as we are not required to do so.

You provide directly

• Name and email address when you sign up
• City and postal code, used for matching
• Creative profession, website and social media channels
• Phone number, if you choose to add one
• Profile picture, if you upload one
• Reviews and feedback you submit
• Communication history if you contact us

Generated when you use the service

• Account and subscription data, including plan, status, matching history and credits
• Meetup bookings, attendance and, where applicable, food payments
• Billing records and invoices
• Technical data from server logs, such as IP address, pages visited, timestamps and browser type

From other sources

• Payment and subscription status from Stripe and PayPal
• If you joined before August 2026, your account data was migrated from our previous platform, where you had provided it to us directly

We do not store card details. These are handled by our payment providers.

• Providing the service, including matching, account and subscription management, meetup bookings and hosting (legal basis: contract performance, Art. 6(1)(b) GDPR)
• Payment processing and invoicing (legal basis: contract performance, Art. 6(1)(b) GDPR)
• Service communication, including match notifications, onboarding emails, meetup information and receipts (legal basis: contract performance, Art. 6(1)(b) GDPR)
• Statutory retention of invoices and financial records (legal basis: legal obligation, Art. 6(1)(c) GDPR, in particular § 132 BAO)
• Security, fraud prevention and aggregate analytics (legal basis: legitimate interest, Art. 6(1)(f) GDPR)
• Publishing your review, profile picture or host profile on our public pages (legal basis: consent, Art. 6(1)(a) GDPR, which you can withdraw at any time)
• Photos taken at meetups, where we publish them (legal basis: consent, Art. 6(1)(a) GDPR)

Your matches. When you are matched, your two matches receive your name, email address, creative profession, website and social media channels. Your postal code and phone number are only shared if you have not switched this off in your member area. You receive the same information about them.

Meetup hosts. If you book a meetup, the host sees your name and, where relevant to running the meetup, your email address and booking details.

Publicly visible. Reviews you submit, your profile picture and, if you host meetups, your host profile may be visible to anyone on our website. You choose whether to provide these and can ask us to remove them at any time.

We use the following service providers, each bound by a data processing agreement:

• Supabase for database and file storage, hosted in the EU
• Vercel for hosting our website and application
• Stripe and PayPal for payment processing, including payouts to meetup hosts via Stripe Connect
• EasyBill for invoice generation
• Postmark for transactional email
• Google for our support and onboarding mailbox

We do not sell your personal data.

We may disclose data where we are legally required to, for example to tax or law enforcement authorities.

Some of our providers are based in the United States or process data there. Where that happens, transfers are safeguarded by the European Commission's Standard Contractual Clauses and, where applicable, the provider's certification under the EU-US Data Privacy Framework. You can request a copy of the relevant safeguards from us.

• Account and profile data: for the duration of your membership, then up to 3 years after cancellation, to handle any claims arising from the contract
• Invoices and billing records: 7 years, as required by § 132 BAO
• Server logs: up to 30 days, unless retained longer to investigate a security incident
• Support correspondence: up to 3 years
• Reviews and public content: until you withdraw consent or ask for removal

Where deletion is not possible because of a statutory retention period, we restrict processing instead.

Under the GDPR you have the right to:

• Access a copy of the data we hold about you
• Rectification of inaccurate data
• Erasure of your data, subject to statutory retention requirements
• Restriction of processing
• Portability of data you provided, in a machine-readable format
• Object to processing based on legitimate interests
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal

To exercise any of these, contact us at hallo@creativelunchclub.com. We respond within one month. Where a request is complex, we may extend this by up to two further months and will tell you if we do.

You can also lodge a complaint with a supervisory authority. In Austria this is:

Österreichische Datenschutzbehörde
Barichgasse 40-42
1030 Vienna
dsb@dsb.gv.at

We use only technically necessary cookies, required for authentication and session management. We do not use advertising or tracking cookies, and therefore do not ask for cookie consent.

Our matching runs automatically, based on your city, postal code and account status. It does not produce legal effects for you or similarly significantly affect you within the meaning of Art. 22 GDPR. No profiling for advertising takes place.

We may update this policy from time to time. We will notify you of significant changes by email. The current version is always available on this page.