A method for anonymisation by transmitting an event data set from at least one data supplying entity supplying the event data set to several data aggregating entities aggregating the event data set wherein the data set includes at least one identifier identifying at least one user of the data supplying entity and at least one attribute associated with the at least one identifier/user and including at least one of the group of type of event and/or the timestamp of an event and/or the location of an event, the method comprises the steps of: a. performing a non-reversible basic encryption of the at least one identifier using an encryption mechanism with a certain lifetime, b. iteratively performing an additional encryption of said basic encrypted identifier for n-times with n equal or greater than 2 resulting in an additional encrypted identifier, wherein the additional encryption comprises the steps of adding a random component to said encrypted identifier and encrypting the output using asymmetric encryption with a public key, wherein each iteration uses a random component with a lifetime shorter than the lifetime of the certain lifetime according to step a and than the lifetime of the previous iteration and a public key different to that of the previous iteration, c. transmitting the event data set characterised by the n-times additional encrypted identifier to a first data aggregating entity, and d. undoing at least one iteration of the additional encryption(s) at the first receiving data aggregating entity resulting in the n-1-times additional encrypted identifier wherein the first data aggregator derives at least of statistical index from a number of event data sets related to the same n-1-times additional encrypted identifier and collected within the lifetime of the random component set during the n-1 additional encyption e. the first data aggregator forwards said derived statistical indices-together with their related n-1-times additional encrypted identifier to at least one other data aggregating entity wherein the receiving at least one other data aggregating entity undoes at least one iteration of the n-1-times additional encrypted identifier resulting in the n-2-times additional encrypted identifier or the non-reversible basic encrypted identifier and stores the received statistical indices related to the same n-2-times additional encrypted identifier or the non-reversible basic encrypted identifier within the lifetime of the random component set during the undid iteration of the n-2 additional encypted identifier or the certain lifetime used during the non-reversible basic encryption. a. performing a non-reversible basic encryption of the at least one identifier using an encryption mechanism with a certain lifetime, b. iteratively performing an additional encryption of said basic encrypted identifier for n-times with n equal or greater than 2 resulting in an additional encrypted identifier, wherein the additional encryption comprises the steps of adding a random component to said encrypted identifier and encrypting the output using asymmetric encryption with a public key, wherein each iteration uses a random component with a lifetime shorter than the lifetime of the certain lifetime according to step a and than the lifetime of the previous iteration and a public key different to that of the previous iteration, c. transmitting the event data set characterised by the n-times additional encrypted identifier to a first data aggregating entity, and d. undoing at least one iteration of the additional encryption(s) at the first receiving data aggregating entity resulting in the n-1-times additional encrypted identifier wherein the first data aggregator derives at least of statistical index from a number of event data sets related to the same n-1-times additional encrypted identifier and collected within the lifetime of the random component set during the n-1 additional encyption e. the first data aggregator forwards said derived statistical indices-together with their related n-1-times additional encrypted identifier to at least one other data aggregating entity wherein the receiving at least one other data aggregating entity undoes at least one iteration of the n-1-times additional encrypted identifier resulting in the n-2-times additional encrypted identifier or the non-reversible basic encrypted identifier and stores the received statistical indices related to the same n-2-times additional encrypted identifier or the non-reversible basic encrypted identifier within the lifetime of the random component set during the undid iteration of the n-2 additional encypted identifier or the certain lifetime used during the non-reversible basic encryption.