Privacy Policy

01 Who is responsible

The controller responsible for processing your personal data within the meaning of Art. 4(7) GDPR is:

We have not appointed a Data Protection Officer, as we are not legally required to do so under Sec. 38 BDSG. For any data protection matter, contact us at the address above.

02 What data we collect

a) When you visit the website

When you access our site, your browser automatically transmits technical data that we process to deliver the site securely and reliably: IP address, browser type and version, operating system, the referring page, date and time of access, and pages viewed. This is stored temporarily in server log files.

b) When you register or buy a ticket

To process your registration and issue your ticket, we collect your first and last name, email address, billing address, company name and job title (where provided), payment information processed via our payment provider, and any ticket-category eligibility information you supply.

c) When you apply as a speaker, partner or sponsor

We collect the contact and professional details you submit, including name, role, organisation, email, and any biographical or marketing material you provide for the event programme.

d) When you subscribe to our communications

We collect your name and email address, and record your consent and its timestamp.

03 Why we process it, and our legal basis

We process your data only where a legal basis under Art. 6 GDPR applies:

• To perform the contract (Art. 6(1)(b) GDPR): processing your ticket order, issuing your ticket and invoice, managing your attendance, and handling speaker or partner arrangements.
• To comply with legal obligations (Art. 6(1)(c) GDPR): retaining invoices and tax records as required under German commercial and tax law.
• For our legitimate interests (Art. 6(1)(f) GDPR): operating and securing the website, preventing fraud, and analysing usage in aggregated form. You may object to processing based on legitimate interests at any time.
• On the basis of your consent (Art. 6(1)(a) GDPR): sending marketing emails, and setting non-essential cookies. You may withdraw consent at any time with effect for the future.

04 Who we share data with

We use carefully selected service providers who act as processors on our behalf under data processing agreements pursuant to Art. 28 GDPR. They may only process your data on our instructions. These include:

• Ticketing and registration: our ticketing platform (Rhuna / doo), which processes registration and attendance data.
• Email and communications: Kit (formerly ConvertKit), which processes your name and email to send the communications you have consented to.
• Analytics: Google Ireland Limited (Google Analytics 4, deployed through Google Tag Manager), which processes usage data in pseudonymised or aggregated form. These tags load only if you accept performance cookies.
• Website hosting and audience measurement: Vercel Inc., which hosts this website and therefore receives every request to it, and which provides Vercel Web Analytics. That measurement is cookieless: no cookie is set and nothing is stored on or read from your device. Visit counts are derived from a hash of the request that is regenerated daily and cannot be traced back to you or linked across days.
• Payment processing: our payment provider, which handles payment data directly; we do not store full card numbers.

We may also disclose data to public authorities where we are legally obliged to do so.

05 International data transfers

Some of our processors may process data outside the European Economic Area. Where this occurs, we ensure an adequate level of protection through an EU adequacy decision or, failing that, through the European Commission's Standard Contractual Clauses pursuant to Art. 46 GDPR. You may request a copy of the relevant safeguards from us.

06 How long we keep your data

We keep personal data only as long as necessary for the purpose it was collected:

• Server log data: deleted or anonymised after a short period, typically 7 days.
• Registration and attendance data: for the duration of our relationship and afterwards as needed to handle queries.
• Invoices and tax-relevant records: for the statutory retention period of up to 10 years under German commercial and tax law (Sec. 257 HGB, Sec. 147 AO).
• Marketing data: until you withdraw consent or unsubscribe.

07 Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data where the legal conditions are met (Art. 17);
• Restrict processing in certain circumstances (Art. 18);
• Data portability: receive your data in a structured, machine-readable format (Art. 20);
• Object to processing based on legitimate interests or direct marketing (Art. 21);
• Withdraw consent at any time, without affecting prior lawful processing (Art. 7(3)).

To exercise any of these rights, contact us at team@xventures.de.

08 Is providing data mandatory

Providing the data needed to register, issue your ticket, and meet our legal obligations is necessary to enter into a contract with us. Without it, we cannot process your registration. Providing data for marketing is entirely voluntary.

09 Changes to this policy

We may update this policy to reflect changes in our practices or legal requirements. The current version is always available on this page, with the date of the last update shown above.