Skip to content
DEENTickets (ticket shop)

Legal

Privacy policy

Information on the processing of personal data in accordance with the GDPR for the German Legal Tech Summit conference and exhibition on 3 December 2026 in Hannover.

English version

This English version is provided for convenience. In case of any discrepancy, the German version is legally binding. Read the German version

Contents · 25 sections

of German Legal Tech Summit GmbH · As of 4 November 2026

§ 1 Controller and scope

  1. The controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data in connection with the German Legal Tech Summit conference and exhibition on 3 December 2026 in Hannover and the related digital and organisational services is:
    German Legal Tech Summit GmbH
    Hans-Böckler-Allee 26
    30173 Hannover
    Germany

    Phone: +49 (0)511 547 47 49 46
    Email: info@germanlegaltechhub.com
    Website: www.germanlegaltechsummit.com
    – hereinafter referred to as the “Organiser” or “German Legal Tech Summit GmbH”.
  2. This privacy policy applies to the processing of personal data of exhibitors, sponsors, visitors, participants, speakers, stand staff, employees and other persons involved in the event or communicating with the Organiser.
  3. It applies in particular to the processing of personal data
    1. during sign-up and registration for the event,
    2. in the running and organisation of the conference and exhibition,
    3. in connection with exhibitor and sponsor contracts,
    4. in the issuing and use of personalised participant and exhibitor badges,
    5. in communication with participants, exhibitors, sponsors and speakers,
    6. in connection with digital or virtual event components,
    7. in the taking of photographs and film and audio recordings,
    8. in the use of the Organiser’s website, and
    9. to safeguard the statutory, contractual and legitimate interests of the Organiser.
  4. The Organiser processes personal data exclusively within the framework of the applicable data protection provisions, in particular the GDPR, the German Federal Data Protection Act (Bundesdatenschutzgesetz, BDSG) and – where applicable – the German Telecommunications and Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG).

§ 2 Categories of personal data

  1. In the course of preparing, running and following up the event, the following categories of personal data in particular may be processed:
    1. master data, in particular first name and surname,
    2. contact data, in particular email address, telephone number and postal address,
    3. professional data, in particular company, role, position and field of activity,
    4. registration and event data, in particular sign-up, ticket, attendance, admission and badge data,
    5. contract and billing data of exhibitors and sponsors,
    6. communication data from email, telephone and other communication with the Organiser,
    7. technical data arising from the use of digital event services,
    8. data on consents and their withdrawal,
    9. photographs and film and audio recordings, insofar as such recordings are made in the course of the event,
    10. where applicable, further data that the data subject voluntarily provides to the Organiser.
  2. The provision of personal data is generally voluntary. Where certain data are required for the conclusion or performance of a contract, for registration, for admission to the event or for the provision of a requested service, failure to provide them may mean that the service concerned cannot be provided, or cannot be provided in full.

§ 3 Purposes and legal bases of processing

  1. The Organiser processes personal data in particular for the following purposes:
    1. to prepare, organise and run the conference and exhibition,
    2. to process sign-ups and registrations,
    3. to issue personalised participant and exhibitor badges,
    4. to organise admission and access authorisations,
    5. to perform and administer contracts with exhibitors, sponsors and other contractual partners,
    6. to communicate with participants, exhibitors, sponsors, speakers and service providers,
    7. to provide booked services and digital event components,
    8. for invoicing and payment processing,
    9. to ensure security and the proper running of the event,
    10. to comply with statutory retention, documentation and other obligations,
    11. to establish, exercise or defend legal claims,
    12. to provide information about the event and – where legally permissible – about future events,
    13. for public relations and reporting on the event, and
    14. for the technical and organisational development of the event and the digital services.
  2. Where processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract, it is based on Art. 6(1)(b) GDPR. This applies in particular to registration for the event, the performance of exhibitor and sponsor contracts and the provision of booked services. The Terms and Conditions expressly provide for the processing of personal data for the performance of the contract.
  3. Where the Organiser is required to process personal data by virtue of a legal obligation, processing is based on Art. 6(1)(c) GDPR.
  4. Where processing is necessary for the purposes of the legitimate interests pursued by the Organiser or by a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, processing is based on Art. 6(1)(f) GDPR. Legitimate interests may include, in particular, the efficient organisation of the event, communication with participants and business partners, public relations, documentation of the event, IT security and the establishment, exercise and defence of legal claims.
  5. Where the Organiser processes personal data on the basis of consent, this is done on the basis of Art. 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

§ 4 Sign-up and registration

  1. When signing up for the conference and exhibition, the personal data required to process the sign-up and to run the event are collected.
  2. These may include, in particular, first name and surname, company, role, email address, billing data, ticket or registration data and, where applicable, further voluntary information.
  3. In the case of exhibitors and sponsors, personal data of contact persons, of named stand staff and of other participants may also be processed.
  4. The Terms and Conditions expressly provide that stand staff must be named in advance via the designated registration system and that personalised exhibitor badges are not transferable.
  5. The Organiser sells tickets for the event in its own ticket shop on this website (§ 4a). Until 3 November 2026, the ticketing service used was Peppermint Digital GmbH, Boulevard der EU 8, 30539 Hannover; existing registrations have been transferred to our system (§ 4a para. 12).

§ 4a Buying tickets in the ticket shop

  1. Controller: The controller for the processing of personal data when buying tickets is German Legal Tech Summit GmbH (§ 1). The ticket shop is part of this website; orders are transmitted directly to the Organiser’s management system (Hub OS) and stored there. The Hub OS is operated by German Legal Tech Hub GmbH (the Organiser’s parent company) as a processor under Art. 28 GDPR on servers of Hetzner Online GmbH (Germany); the database is hosted by Supabase Inc. as a processor on servers in Frankfurt am Main (EU).
  2. Data of the person placing the order (buyer): When an order is placed, we process
    1. the type of buyer (company/law firm, authority/public body or private individual),
    2. salutation, first name and surname, optionally academic title,
    3. email address, optionally a different email address for the invoice, optionally telephone number,
    4. billing address (street, postcode, town/city, country),
    5. for companies and authorities: company name or authority/office, optionally VAT identification number, optionally purchase order number or file reference, for authorities optionally the Leitweg-ID (routing ID for e-invoices),
    6. order data: selected tickets, prices, discount code used, payment method, payment status, order number, time of the order, language, time and version of the accepted ticket terms,
    7. a checksum (hash value) of the IP address to prevent misuse (limiting the number of requests per connection); the IP address itself is not stored.
  3. Data of attendees: A person is named for each ticket (personalised ticket): salutation, first name and surname, optionally academic title, email address, optionally company, optionally telephone number and address. If the buyer provides data of other persons (e.g. colleagues), the buyer must inform them in advance about the disclosure and about this privacy policy. Attendees receive their ticket by email.
  4. Purposes: We process these data in order to
    1. accept, confirm and process the order (order confirmation, contract text, ticket terms),
    2. issue the tickets and send them to the attendees,
    3. check and redeem discount codes,
    4. process payment and issue invoices or e-invoices,
    5. check admission (para. 8),
    6. provide attendees with organisational information before and after the event (e.g. programme, travel, changes),
    7. process withdrawals, cancellations, name changes and refunds,
    8. comply with statutory retention obligations and establish or defend legal claims,
    9. prevent misuse of the ticket shop.
    For this purpose, buyers and attendees are created as contacts in the management system or assigned to an existing contact; the booking is recorded as participation in the event.
  5. Legal bases:
    • Art. 6(1)(b) GDPR for the order, ticket, payment, admission, organisational information and withdrawal/cancellation (contract with the buyer; for attendees who do not order themselves, additionally Art. 6(1)(f) GDPR – legitimate interest in performing the contract concluded by the buyer),
    • Art. 6(1)(c) GDPR for invoicing, e-invoicing and retention (§ 14 UStG, § 147 AO, § 257 HGB),
    • Art. 6(1)(f) GDPR for preventing misuse and fraud, for matching with existing contacts and for establishing and defending legal claims.
    Without the mandatory information (name, email address, billing address; name and email address for each ticket), we cannot accept the order. For orders subject to a charge, we also use the buyer’s email address to inform the buyer about similar events of the German Legal Tech Summit (§ 7(3) UWG, Art. 6(1)(f) GDPR). We point this out when the order is placed and in the order confirmation. The buyer can object to this at any time, e.g. via the unsubscribe link in every email or by email to info@germanlegaltechhub.com, without incurring any costs other than the transmission costs according to the basic rates. Otherwise, buyers and attendees receive advertising by email only with their consent (§ 10).
  6. Reminder for an uncompleted order: If you tick the optional box “If I do not complete the order, the German Legal Tech Summit may remind me once by e-mail” when ordering with card payment and the order is not completed, you will receive exactly one reminder by email to the address given, no earlier than 24 hours later, with a link back to the ticket shop. The legal basis is your consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). Without the tick there is no reminder; the order does not depend on it. You can withdraw your consent at any time with effect for the future, e.g. by email to info@germanlegaltechhub.com or by a short reply to the reminder. As proof, we store the time and wording of the consent with the order until the end of the regular limitation period (three years).
  7. Payment via Stripe: If you pay by card or another payment method offered via Stripe (e.g. Apple Pay, Google Pay), you are redirected to the payment page of Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe collects the payment data (e.g. card number, expiry date, security code) itself; the Organiser does not receive them. We transmit the order number, amount, ticket description and the buyer’s email address to Stripe. We receive the payment status, time, payment method and a payment identifier from Stripe. Stripe processes data to handle the payment and – as an independent controller – for fraud prevention, risk assessment and compliance with its own legal obligations (e.g. anti-money laundering); for this purpose Stripe may also collect device and connection data. A transfer to Stripe, Inc. in the USA is possible; it is based on the EU-U.S. Data Privacy Framework, in which Stripe participates, and on the EU Standard Contractual Clauses. Stripe’s privacy notice: stripe.com/en-de/privacy. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for fraud prevention.
  8. Purchase on account, invoice and e-invoice: Companies and authorities can order on account; no external payment service is used for this. For every order subject to a charge, the Organiser issues an invoice containing the information required under § 14(4) UStG (invoice recipient and address, VAT ID and purchase order number where applicable, names of the attendees in the description of services, discount code used). The invoice is created as an electronic invoice (ZUGFeRD/Factur-X), for authorities with a Leitweg-ID additionally in XRechnung format, and sent by email to the (billing) address provided. We reconcile payments on account with our bank statements. For orders totalling €0.00 (e.g. with a 100% code), no invoice is issued, but a booking confirmation. The legal basis is Art. 6(1)(b) and (c) GDPR.
  9. Ticket with QR code and admission control: Each ticket contains a QR code with a random ticket identifier; names or other data are not contained in the QR code. At admission, the QR code is read with the Organiser’s admission system and matched with the ticket; the fact that and the time when the ticket was redeemed are stored. Photo ID may be requested to check the personalisation (§ 6(3) of the ticket terms). The legal basis is Art. 6(1)(b) GDPR; admission control also serves the legitimate interest in safe event operations and in preventing ticket misuse (Art. 6(1)(f) GDPR).
  10. Sending emails: We send order confirmations, invoices, tickets, acknowledgements of withdrawals and organisational information from the mailbox info@germanlegaltechhub.com via Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; processor under Art. 28 GDPR). If this channel fails, we use Resend as a fallback (§ 10(6)). With both services, a transfer to the USA is possible; this is based on the EU-U.S. Data Privacy Framework, in which Microsoft and Resend participate, and on the EU Standard Contractual Clauses.
  11. Visitor app: Attendees can sign in to the Summit visitor app (germanlegaltechsummit.com/app) with the email address of their ticket; sign-in uses a code that we send to this email address. The app shows the attendee’s own ticket, the programme and meetings. Making a profile visible to exhibitors (“Visible to exhibitors”) is voluntary and only happens with separate consent, which can be withdrawn in the app at any time. The legal basis is Art. 6(1)(b) GDPR, and Art. 6(1)(a) GDPR for visibility to exhibitors.
  12. Exchanging contact details with exhibitors (lead scan): Exhibitors and partners can scan an attendee’s ticket at their stand with their exhibitor app. This only happens if the person shows their ticket for this purpose; when scanned, their consent is stored with its wording and time: “By showing my ticket and having it scanned at the stand of [exhibitor], I consent to [exhibitor] contacting me with my business contact details about the Summit and afterwards.” The exhibitor then receives the name, title, role, company, business email address and, where available, telephone number and LinkedIn profile. From the time of transmission, the exhibitor is itself responsible for further processing. Consent can be withdrawn at any time with effect for the future vis-à-vis the exhibitor and the Organiser. The legal basis is Art. 6(1)(a) GDPR. Without a scan, no attendee data are passed on to exhibitors (§ 14(4)).
  13. Transfer of existing Peppermint bookings: Until 3 November 2026, the Organiser used the ticketing service of Peppermint Digital GmbH, Boulevard der EU 8, 30539 Hannover, for ticket sales (processor). Existing registrations (name, email address, company, ticket type, code used, QR code of the ticket, booking and payment status) have been transferred to our system so that tickets already sent remain valid, ticket holders can use the visitor app and admission can take place without Peppermint. For these bookings, Peppermint’s payment receipt remains the record; no new invoice is issued. The legal basis is Art. 6(1)(b) GDPR.
  14. Withdrawal: Private individuals (consumers) can withdraw from their contract in accordance with the cancellation policy, including via the “Withdraw from contract” button on the website. For this purpose, we process the name, email address, order number, an optional note, the time of receipt and a checksum (hash value) of the IP address; the acknowledgement of receipt is sent by email to the address provided. The legal basis is Art. 6(1)(b) and (c) GDPR (§§ 355, 356a BGB).
  15. Storage period:
    • Invoices, cancellation invoices and accounting records, including the order data contained therein: eight years from the end of the calendar year in which they were created (§ 147(1) no. 4, (3) AO, § 14b(1) UStG); commercial and business letters (e.g. the order confirmation): six years (§ 147(1) nos. 2, 3 AO, § 257 HGB).
    • Ticket and attendee data not contained in accounting records (e.g. an attendee’s email address and admission record): until the event and its organisational follow-up have been completed, unless there is another legal basis (e.g. consent to the newsletter, participation in subsequent events).
    • Withdrawals and records of consent (lead scan): until the end of the regular limitation period (three years, § 195 BGB).
    • The checksum of the IP address: for as long as it is required to prevent misuse.
    Otherwise, § 16 applies.
  16. Your rights: The rights under § 18 (access, rectification, erasure, restriction, data portability, withdrawal of consent, objection) and the right to lodge a complaint under § 19 apply to the data from ticket purchases. A message to info@germanlegaltechhub.com is sufficient. Statutory retention obligations (para. 14) take precedence over erasure; in that case, the data are restricted until the retention period has expired.

§ 5 Payment and billing data

  1. Where payments are to be made for participation or for exhibitor or sponsorship services, the Organiser processes the contract, invoice and payment data required for this purpose.
  2. This may include, in particular, name, company, address, billing address, invoice amount, payment status and other information required for invoicing.
  3. Where external payment service providers are used, the data required for this purpose are transmitted to the respective payment service provider. Payment service provider: Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Details of payment via Stripe when buying tickets: § 4a para. 6.
  4. Statutory retention obligations remain unaffected.

§ 6 Management of participants, exhibitors and sponsorship

  1. In order to run the conference and exhibition properly, the Organiser processes personal data of participants, exhibitors, sponsors, speakers and stand staff.
  2. This includes, in particular, assigning persons to companies, exhibition stands, sponsorship packages, talks, programme items and other event services.
  3. Processing is carried out in particular to organise the event, for access control, for communication and to fulfil contractual obligations.
  4. Where exhibitors or sponsors transmit personal data of employees or other persons to the Organiser, the respective contractual partner must ensure that the necessary data protection requirements are met and that the data subjects have been properly informed.

§ 7 Digital and virtual event components

  1. Where the event includes additional digital services, personal data may be processed when these services are used. This may include, in particular:
    1. registration and access data,
    2. login data,
    3. technical connection data,
    4. usage and interaction data,
    5. data on participation in digital programme items,
    6. where applicable, communication and networking data.
  2. The Terms and Conditions expressly provide for additional digital services such as online presences, virtual exhibition stands, streaming slots and access to networking platforms.
  3. The specific data processing operations depend on the technical platforms and service providers used in each case.
  4. Where consent is required for certain functions, it will be obtained before the processing concerned begins.

§ 8 Website, server log files and technical data

  1. When the Organiser’s website is accessed, technically necessary data may be processed that are required for the provision, security and stability of the website. These may include, in particular, the IP address, the date and time of access, the resources requested, the referrer URL, the browser type, the operating system and other technical information.
  2. Where necessary, processing is carried out for the technical provision and security of the website and to safeguard the Organiser’s legitimate interests in a secure and functional online service.
  3. Hosting: The website is operated on a server of Hetzner Online GmbH, Industriestraße 25, 91710 Gunzenhausen, Germany, in the Falkenstein data centre (Germany) (processing on behalf under Art. 28 GDPR). No form entries are stored on this server; forms and bookings are forwarded directly to the Organiser’s management system (§ 11).
  4. Where log data are no longer needed and there are no statutory retention obligations or legitimate grounds for longer storage, they are deleted or anonymised.
  5. In-house audience measurement without cookies: In order to understand which content on the website is used, the Organiser counts page views using its own method. No cookies are set, and no information is stored on or read from the end device beyond what is transmitted anyway when a page is accessed. The following are recorded: the page accessed (without parameters), the time, the length of stay, the referring website (its domain only), campaign parameters (utm) where applicable, the device type, the browser and operating system (as a general category), the screen width, the browser language and clicks on links to other websites. The approximate location (city or country) is determined from the IP address. The IP address itself is not stored: to distinguish visits, an irreversible checksum is generated from the IP address and the browser identifier together with a random value that changes daily. The random value is deleted after one day, after which the checksum can no longer be attributed to any person or IP address. Visitors are not recognised across several days. The data are processed in the system of German Legal Tech Hub GmbH (the Organiser’s parent company, processor under Art. 28 GDPR) on servers of the processor Supabase in Frankfurt am Main (EU) and are not passed on to third parties. The legal basis is the Organiser’s legitimate interest in designing its service in line with demand (Art. 6(1)(f) GDPR). The location is determined using the “IP to City Lite” database from DB-IP (db-ip.com, licence CC BY 4.0); no data are transmitted to DB-IP in the process.
  6. Heatmap without cookies: To identify which areas of a page are of interest to visitors, the Organiser additionally records anonymously where on a page visitors click, where the mouse pointer is moved (only when a mouse is used) and how far a page is scrolled. Only the page accessed (without parameters), the device type (computer or smartphone, based on screen width), the respective page element with the approximate position within it and the scroll depth reached are stored, and only as daily totals. Entries in form fields are not recorded, nor are the IP address, the browser identifier or any visitor identifier; no link to individual visits or persons is possible. No cookies are set and no information is stored on the end device. The script used for this is loaded from a server of German Legal Tech Hub GmbH (hub.germanlegaltechhub.com, Hetzner Online GmbH, Germany); for technical reasons the IP address is transmitted to this server in the process, but it is not used for the heatmap. Processing, storage location and legal basis are the same as in paragraph 5.

§ 9 Cookies and similar technologies

  1. The website sets no cookies and does not integrate any third-party analytics, advertising or marketing services. Audience measurement and the heatmap take place without cookies (§ 8(5) and (6)).
  2. The browser only stores settings that you make yourself (the browser’s local storage, “localStorage”): the chosen display (light, dark or automatic), the accessibility settings and your decision on external media in the privacy notice. These details remain on your device, are not transmitted to the Organiser and are strictly necessary for the service you have expressly requested (Section 25(2) no. 2 TDDDG). You can delete them at any time via your browser settings.
  3. External media are only loaded with your consent – either generally via the privacy notice (“External media”) or in individual cases by clicking on the respective content:
    1. Google Maps (“Plan your visit” page): the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the map is loaded, your IP address and browser information in particular are transmitted to Google.
    2. YouTube (videos such as the aftermovie): the provider is also Google Ireland Limited. Videos are loaded in privacy-enhanced mode (youtube-nocookie.com) and only after you click on the video.
    Data may be transferred to Google LLC in the USA; this takes place on the basis of the EU-U.S. Data Privacy Framework, in which Google participates. Further information: policies.google.com/privacy. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time with effect for the future via “Cookie settings” in the footer of the website.
  4. Fonts are loaded from the website’s own server; there is no connection to Google Fonts or other font providers.

§ 10 Newsletter and electronic advertising

  1. Where the Organiser offers a newsletter or comparable electronic information, personal data are processed in order to provide the respective communication service.
  2. Promotional contact by email takes place, where required, on the basis of consent or another applicable statutory legal basis.
  3. Consent may be withdrawn at any time with effect for the future. In particular, the unsubscribe option provided in each email may be used for this purpose.
  4. Sign-up for the newsletter uses the double opt-in procedure: after signing up, you will receive an email containing a confirmation link. You will only be added to the mailing list once you have confirmed. As proof of consent (Art. 7(1) GDPR), we store the email address, the time of sign-up and of confirmation, and the IP address used when signing up. The legal basis is Art. 6(1)(a) GDPR.
  5. The sign-up data are stored in our management system (Hub OS). The database is operated by Supabase Inc. as processor on servers in Frankfurt am Main (EU), supabase.com/privacy.
  6. To send the emails, we use Resend, a service of Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, resend.com/legal/privacy-policy. In the process, the email address and the content of the email are transferred to the USA. The transfer is based on the EU-U.S. Data Privacy Framework, in which Resend participates, and on the EU Standard Contractual Clauses.

§ 11 Communication with participants and business partners

  1. When the Organiser is contacted by email, telephone, contact form or any other means of communication, the personal data transmitted in the process are processed.
  2. Processing is carried out to handle and respond to the respective enquiry and – where necessary – to take steps prior to entering into a contract or to perform a contract.
  3. Communications may be stored to document business transactions and to comply with statutory retention obligations.
  4. Contact and enquiry forms: the details entered in the website’s forms (name, email address and – optionally – company, mobile number, topic and message) are transmitted to the Organiser’s management system (Hub OS), where they are stored and handled as an enquiry; the sender is created as a contact or matched to an existing contact. The IP address is not stored. Hub OS is operated by German Legal Tech Hub GmbH (the Organiser’s parent company) as processor under Art. 28 GDPR; the database is hosted by Supabase Inc. as processor on servers in Frankfurt am Main (EU). The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR (legitimate interest in responding to enquiries).
  5. Booking meetings with exhibitors: anyone who books a meeting with an exhibitor via the website provides their first and last name, email address and – optionally – company, telephone number and topic. The booking is stored in Hub OS and confirmed by email. Where a booking requires a ticket, a check is made as to whether a ticket exists for the email address provided. With your consent, the details are passed on to the chosen exhibitor so that the meeting can take place. The legal basis is Art. 6(1)(b) GDPR (booking) and Art. 6(1)(a) GDPR (disclosure to the exhibitor).

§ 12 Photographs, film and audio recordings

  1. Photographs and film and audio recordings may be made during the conference and exhibition.
  2. The purpose of the recordings is in particular to document and report on the event, as well as the Organiser’s public relations and the promotion of future events.
  3. The Terms and Conditions provide that recordings in which stands, company logos or staff of the contractual partner are recognisable may be used for reporting and for promoting future events in print and online media, provided that no overriding legitimate interests conflict with this.
  4. Where processing is based on the Organiser’s legitimate interests, the interests and fundamental rights of the data subjects are taken into account. Recordings are used for other purposes only where there is an appropriate legal basis for doing so.
  5. For recordings in which individual persons are the deliberate and individual focus, separate consent is obtained in advance where required.
  6. Persons who do not wish to be recorded may generally contact the event staff. However, at a public event it cannot be guaranteed in every case that recordings are avoided entirely.

§ 13 Speakers, presenters and presentations

  1. In the case of speakers and presenters, in addition to general participant data, professional information, roles, company affiliation, presentation topics and photographs and film and audio recordings in particular may be processed.
  2. Where talks are recorded, streamed live or subsequently made available online, this is done only where there is a legal basis for doing so.
  3. Where consent is required for the publication of a talk or of recordings, it will be obtained separately.
  4. English version of the website: the public texts of the website – for speakers, for example, their role, profile text and talk topic, but not contact details – are machine-translated for the English version. For this purpose, only these texts, which are published anyway, are transmitted to the AI service Claude of Anthropic PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA. The transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); under Anthropic’s contractual terms, the data are not used to train AI models. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in an event website in German and English).

§ 14 Recipients of personal data

  1. Personal data are generally transmitted to third parties only where there is a legal basis for doing so and the transmission is necessary for the respective purpose.
  2. Possible recipients or categories of recipients include in particular:
    1. technical service providers and hosting providers,
    2. email services (Microsoft 365, Resend; § 4a para. 9, § 10),
    3. payment service providers (Stripe; § 4a para. 6),
    4. IT and software service providers,
    5. service providers for event organisation and admission management,
    6. security and event service providers,
    7. service providers for photo, film and media production,
    8. communication and newsletter service providers,
    9. tax advisers, auditors and other professional advisers,
    10. lawyers and other service providers engaged to enforce rights,
    11. authorities and other public bodies, where there is a legal obligation to do so.
  3. Where service providers process personal data on behalf of the Organiser, the requirements of Art. 28 GDPR are observed.
  4. Personal data are passed on to exhibitors, sponsors or other participants only where there is an appropriate legal basis for doing so, in particular where consent has been given or where disclosure is necessary to provide a requested event service. Exhibitors receive data from ticket purchases only after a lead scan with consent (§ 4a para. 11).

§ 15 Transfers to third countries

  1. Personal data are transferred to countries outside the European Union or the European Economic Area only if the requirements of Art. 44 et seq. GDPR are met.
  2. Where data are transferred to a third country in connection with individual service providers, the relevant safeguards and legal bases are taken into account.
  3. This currently concerns Resend (sending emails, § 10), Stripe (payment in the ticket shop, § 4a para. 6), Microsoft 365 (emails from the ticket shop, § 4a para. 9), Anthropic (translation of public website texts, § 13) and – only with your consent – Google (map and videos, § 9). The Hub OS database (Supabase) is located in Frankfurt am Main (EU).

§ 16 Storage period and erasure

  1. Personal data are stored only for as long as is necessary for the respective purpose of processing.
  2. Once the respective purpose no longer applies, the data are erased unless statutory retention obligations or other legal bases require further storage.
  3. Data from contractual and billing relationships may be stored beyond the duration of the event, in particular because of retention obligations under commercial and tax law.
  4. Where personal data are required to establish, exercise or defend legal claims, they may be stored until the relevant limitation periods have expired.
  5. The following erasure periods apply in particular to individual categories of data:
    Registration data:
    Until the end of the event or until the registration has been finally processed. Data are stored beyond this only where statutory retention obligations, the establishment, exercise or defence of legal claims or another legal basis so require.
    Participant data:
    Generally until the end of the event and the subsequent organisational wind-up. Where the data are required to comply with statutory retention obligations or to establish, exercise or defend legal claims, they are stored beyond this for the relevant period.
    Invoice and accounting data:
    In accordance with retention obligations under commercial and tax law, in each case from the end of the calendar year: invoices and accounting records eight years, commercial and business letters six years, books and annual financial statements ten years (§ 147 AO, § 257 HGB, § 14b UStG). For data from ticket purchases, see § 4a para. 14.
    Photographs, film and audio recordings:
    Generally for as long as they are necessary for the stated purpose. Where processing is based on consent, the recordings are erased once consent has been withdrawn, unless there is another legal basis or there are legitimate grounds for further storage.
    Newsletter data:
    Until consent is withdrawn or the recipient unsubscribes from the newsletter. After unsubscribing, proof of the consent given and of its withdrawal may be stored for the duration of the relevant statutory limitation and retention periods.
    Server log data:
    Generally for a maximum of 7 days, unless longer storage is necessary in an individual case to maintain security, to investigate security incidents or to establish, exercise or defend legal claims.
    Records of consent:
    For as long as the consent may need to be evidenced, in particular until the relevant statutory limitation periods have expired.

§ 17 Data security

  1. The Organiser takes appropriate technical and organisational measures to protect personal data against loss, destruction, alteration, unauthorised disclosure or unauthorised access.
  2. The scope and nature of the measures taken depend in particular on the state of the art, the scope and purposes of the processing and the respective risk to the rights and freedoms of natural persons.
  3. In the case of digital event components, one hundred per cent availability or absolute security of digital services cannot be guaranteed, despite appropriate technical and organisational measures.

§ 18 Rights of data subjects

  1. Subject to the statutory requirements, data subjects have in particular the following rights:
    a) Right of access
    Data subjects may request confirmation as to whether and which personal data concerning them are being processed, together with the further information provided for by law.
    b) Right to rectification
    Data subjects may request the rectification of inaccurate personal data and, where applicable, the completion of incomplete data.
    c) Right to erasure
    The erasure of personal data may be requested under the statutory conditions.
    d) Right to restriction of processing
    The restriction of processing may be requested under the statutory conditions.
    e) Right to data portability
    Where the statutory requirements are met, there is a right to receive personal data in a structured, commonly used and machine-readable format or to request that they be transmitted to another controller.
    f) Right to withdraw consent
    Consent may be withdrawn at any time with effect for the future. The lawfulness of processing based on consent before its withdrawal remains unaffected.
    g) Right to object
    Where processing is based on Art. 6(1)(e) or (f) GDPR, there is a right to object under the statutory conditions. Objection may be made at any time to the processing of personal data for direct marketing purposes.
  2. To exercise these rights, a message to the following address is generally sufficient:
    German Legal Tech Summit GmbH
    Hans-Böckler-Allee 26
    30173 Hannover
    Germany
    Email: info@germanlegaltechhub.com

§ 19 Right to lodge a complaint with a supervisory authority

  1. Without prejudice to any other administrative or judicial remedy, there is a right to lodge a complaint with a data protection supervisory authority.
  2. The complaint may be lodged in particular with the data protection supervisory authority responsible for the Organiser or with another competent supervisory authority.
  3. The supervisory authority responsible for the Organiser is:
    Der Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen – State Commissioner for Data Protection of Lower Saxony)
    Prinzenstraße 5
    30159 Hannover
    Germany
    Phone: 0511 120-4500
    Email: poststelle@lfd.niedersachsen.de
    Website: www.lfd.niedersachsen.de

§ 20 No automated decision-making

  1. As a rule, no automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place in connection with the event.
  2. Should automated decision-making processes be used in future, this privacy policy will be supplemented with the legally required information before or at the time of the processing concerned.

§ 21 Processing of personal data of exhibitors and sponsors

  1. For exhibitors and sponsors, the respective contractual agreements and the General Terms and Conditions of German Legal Tech Summit GmbH apply in addition.
  2. Personal data of contact persons, stand staff and other persons named by the contractual partner are processed in particular to perform the respective contractual relationship, to organise the event and for communication.
  3. The Terms and Conditions oblige contractual partners to comply with applicable data protection law.
  4. Where a contractual partner transmits personal data of its employees, agents or other persons to the Organiser, the contractual partner is responsible for the lawfulness of its own transmission and for providing the necessary information to the data subjects, insofar as required by law.

§ 22 External service providers and processing on behalf of the Organiser

  1. The Organiser may engage external service providers to run the conference and exhibition.
  2. Where these service providers process personal data on behalf of the Organiser, processing takes place on the basis of appropriate data protection agreements.
  3. The Organiser remains the controller under data protection law for the processing operations for which it is responsible.
  4. The specific service providers may come in particular from the fields of registration, ticketing, hosting, IT, payment processing, streaming, networking, newsletters, event organisation and photo, film and media production.

§ 23 Changes to this privacy policy

  1. The Organiser reserves the right to amend this privacy policy where this becomes necessary as a result of legal, technical or organisational changes.
  2. The version published at the time of use or of the collection of personal data applies in each case.
  3. In the event of material changes affecting the rights or interests of data subjects, the Organiser will provide separate information where required by law.

§ 24 Final provisions

  1. Should individual provisions of this privacy policy be or become invalid, the validity of the remaining provisions remains unaffected.
  2. The applicable statutory data protection provisions apply, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and – where applicable – the German Telecommunications and Digital Services Data Protection Act (TDDDG).

As of 4 November 2026