Privacy Information pursuant to Art. 12 et seq. GDPR
This single privacy notice applies to all areas in which you may come into contact with us.
In this way, we want to make it as easy as possible for you to obtain information about our data processing in one single place.
You can quickly jump to the information on the respective data protection-relevant situations by clicking on the respective heading in the outline.
Data protection is a high priority for us. We are committed to complying with the statutory data protection requirements and aim to provide maximum transparency in doing so.
I. APPLICABLE TO ALL DATA PROCESSING
II. DATA PROCESSING – FIRST CONTACT WITH US
III. DATA PROCESSING – WEBSITE WWW.BITSANDPRETZELS.COM
IV. DATA PROCESSING – BITS & PRETZELS APP
V. DATA PROCESSING – BITS & PRETZELS EVENT
VI. DATA PROCESSING – SOCIAL MEDIA
VII. VALIDITY AND CHANGES TO THE PRIVACY POLICY
I. Applicable to all data processing
2. Name and address of the controller
Startup Events GmbH
Am Kartoffelgarten 14
81671 Munich
Germany
Website: www.bitsandpretzels.com
Email: privacy@bitsandpretzels.com
2. Name and address of the data protection officer
SiDIT GmbH, www.sidit.de, email: info@sidit.de
3. Explanation of terms
We have designed our privacy policy in accordance with the principles of clarity and transparency. Should there nevertheless be any uncertainties regarding the use of various terms, the corresponding definitions can be viewed here.
4. Legal bases for data processing
We only process your personal data (e.g. name, email address, IP address) if there is a legal basis for doing so.
a) Processing of personal data under the GDPR
Under the General Data Protection Regulation, the following legal bases pursuant to Art. 6 GDPR are particularly relevant:
- Art. 6 para. 1 sentence 1 lit. a GDPR: The data subject has given consent to the processing of his or her personal data for one or more specific purposes.
- Art. 6 para. 1 sentence 1 lit. b GDPR: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract which are carried out at the request of the data subject.
- Art. 6 para. 1 sentence 1 lit. c GDPR: Processing is necessary for compliance with a legal obligation to which the controller is subject.
- Art. 6 para. 1 sentence 1 lit. d GDPR: Processing is necessary in order to protect the vital interests of the data subject or of another natural person.
- Art. 6 para. 1 sentence 1 lit. e GDPR: processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
- Art. 6 para. 1 sentence 1 lit. f GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
At the relevant points in this privacy notice, we always point out to you once again the legal basis on which your personal data is processed.
b) Consent of the holders of parental responsibility pursuant to Art. 8 para. 1 sentence 2 alt. 2 GDPR
A holder of parental responsibility must consent to all data processing within the scope of this website for which the consent of a minor who has not yet reached the age of 16 is required.
Information on the individual data processing operations, their purposes and the categories of data concerned for which the consent of the data subject is required can be found in this privacy notice.
You can withdraw your consent at any time by sending the declaration of withdrawal in text form to the contact details of the controller. Processing carried out until the withdrawal remains lawful.
5. Disclosure of personal data
The disclosure of personal data also constitutes data processing.
The protection of your personal data is very important to us. For this reason, we are particularly careful when it comes to disclosing your data to third parties.
Disclosure to third parties therefore only takes place if there is a legal basis for the processing. In particular, we disclose personal data to persons or companies that act for us as processors pursuant to Art. 28 GDPR. A processor is anyone who processes personal data on our behalf, in particular service providers who are subject to our instructions and control.
In accordance with the requirements of the GDPR, we conclude a contract with each of our processors in order to oblige them to comply with data protection regulations and thus to ensure comprehensive protection for your data.
6. Storage period and deletion of your data
Your personal data will be deleted by us
- insofar as it is no longer necessary for the purposes for which it was collected or otherwise processed, and
- insofar as the processing is not necessary for exercising the right of freedom of expression and information, for compliance with a legal obligation, for reasons of public interest or for the establishment, exercise or defence of legal claims.
7. Your rights as a data subject
You have the following rights:
a) Access
Pursuant to Art. 15 GDPR, you have the right to request information about your personal data processed by us. This right of access includes information about
- the purposes of processing
- the categories of personal data
- the recipients or categories of recipients to whom your data have been or will be disclosed
- the planned storage period or at least the criteria for determining the storage period
- the existence of a right to rectification, erasure, restriction of processing or objection
- the existence of a right to lodge a complaint with a supervisory authority
- the origin of your personal data, if it was not collected by us
- the existence of automated decision-making including profiling and, where applicable, meaningful information about its details
b) Rectification
Pursuant to Art. 16 GDPR, you have the right to the immediate rectification of inaccurate or completion of incomplete personal data stored by us.
c) Erasure
Pursuant to Art. 17 GDPR, you have the right to request the immediate erasure of your personal data stored by us, unless further processing is necessary for one of the following reasons:
- the personal data are still necessary for the purposes for which they were collected or otherwise processed
- for exercising the right of freedom of expression and information
for exercising the right of freedom of expression and information
- for compliance with a legal obligation which requires processing under the law of the European Union or of the Member States to which the controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
- for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing
- for the establishment, exercise or defence of legal claims
d) Restriction of processing
Pursuant to Art. 18 GDPR, you may request the restriction of the processing of your personal data for one of the following reasons:
- You contest the accuracy of your personal data.
- The processing is unlawful and you oppose the erasure of the personal data.
- We no longer need the personal data for the purposes of processing, but you require it for the establishment, exercise or defence of legal claims.
- You object to the processing pursuant to Art. 21 para. 1 GDPR.
e) Notification
If you have requested the rectification or erasure of your personal data or a restriction of processing pursuant to Art. 16, Art. 17 or Art. 18 GDPR, we will communicate this to all recipients to whom your personal data have been disclosed, unless this proves impossible or involves disproportionate effort. You may request that we inform you about these recipients.
f) Transmission
You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format.
You also have the right to request the transmission of these data to a third party, provided that the processing was carried out by automated means and is based on consent pursuant to Art. 6 para. 1 sentence 1 lit. a or Art. 9 para. 2 lit. a or on a contract pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR.
g) Withdrawal
Pursuant to Art. 7 para. 3 GDPR, you have the right to withdraw the consent you have given to us at any time. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until its withdrawal. In future, we may no longer continue the data processing that was based on your withdrawn consent.
h) Complaint
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR.
i) Objection
If your personal data are processed on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, insofar as there are grounds for doing so arising from your particular situation or the objection is directed against direct marketing. In the latter case, you have a general right to object, which we will implement without you having to specify a particular situation. If you wish to exercise your right of withdrawal or objection, an email to privay@bitsandpretzels.com is sufficient.
j) Automated individual decision-making, including profiling
You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision
1. is necessary for entering into, or the performance of, a contract between you and us
2. is permitted on the basis of legal provisions of the European Union or of the Member States to which we are subject, and these legal provisions lay down suitable measures to safeguard your rights and freedoms and your legitimate interests
3. is made with your explicit consent
However, these decisions may not be based on special categories of personal data pursuant to Art. 9 para. 1 GDPR, unless Art. 9 para. 2 lit. a or g GDPR applies and suitable measures have been taken to protect your rights and freedoms and your legitimate interests.
With regard to the cases referred to in i) and iii), we take suitable measures to safeguard your rights and freedoms and your legitimate interests, which include at least the right to obtain human intervention on our part, to express your own point of view and to contest the decision.
II. Data processing – first contact with us
1. Processing of personal data and the nature and purpose of its use
a) We generally process the following personal data from you:
- Company name
- Salutation, first name, last name of the designated contact persons
- Position, job title
- Address (if different: billing address)
- a valid email address,
- Telephone number (landline and/or mobile)
- Fax number
- Date of birth
- Position in the company, job title
- Country of origin
- Bank details
- Schufa data
- Creditreform data
We assign you a customer number in our system.
b) For what purposes do we process your data (purpose of processing) and on what legal basis?
aa) For the performance of contractual obligations and/or the implementation of pre-contractual measures (Art. 6 para. 1 sentence 1 lit. b) GDPR)
We process your personal data for the performance of contractual obligations and/or the implementation of pre-contractual measures carried out on the basis of your request, i.e. in particular
- for the performance of the contract;
- for correspondence with you;
- for contacting you in the course of performing the contract;
- for invoicing;
- for handling warranty claims;
- for handling any liability claims and asserting any claims against you.
bb) On the basis of your consent (Art. 6 para. 1 sentence 1 lit. a) GDPR)
Insofar as you have given us consent to the processing of personal data, the respective consent is the legal basis for the processing specified therein. This applies in particular to:
- Collection and storage of further personal data
- Advertising approaches by telephone, by email, by messenger (e.g. Facebook Messenger, WhatsApp) or via social media
- Maintaining the customer account
You can withdraw consent at any time with effect for the future. We inform you that the withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until its withdrawal.
cc) Within the scope of the balancing of interests (Art. 6 para. 1 sentence 1 lit. f GDPR)
We may also use your data on the basis of a balancing of interests to safeguard our legitimate interests or those of third parties. This is done, for example, for the following purposes:
- Keeping an order history for our future services
- For customer advice and support and for sales
- General business management and further development of services and products
- Advertising, market and opinion research
- Anonymisation of personal data for use in the further development and quality management of our products/services
- Anonymisation of personal data for the use of the data for training machine learning (AI training)
Our interest in the respective processing results from the respective purposes and is otherwise of an economic nature. Where possible and appropriate, we process your data in pseudonymised or anonymised form.
dd) On the basis of statutory requirements (Art. 6 para. 1 sentence 1 lit. c) GDPR)
We are subject to various legal obligations, such as statutory commercial retention and documentation obligations (under the HGB, StGB or AO).
2. Disclosure of data to third parties and processors
The disclosure of personal data also constitutes processing. However, at this point we would like to inform you separately once again about the topic of disclosure to third parties. The protection of your personal data is very important to us. For this reason, we are particularly careful when it comes to disclosing your data to third parties.
Your personal data is generally transferred to third parties for the following purposes:
- Processors with whom we have concluded an agreement pursuant to Art. 28 GDPR
- Shipping (e.g. shipping service providers)
- Payment (e.g. payment service providers)
- Accounting (e.g. tax advisors)
- Legal disputes (e.g. lawyers)
- Communication platform (e.g. email, WhatsApp, Facebook, Instagram, LinkedIn, X, TikTok, other messenger services)
- Partners
- Authorities, where applicable
Data processing takes place exclusively in a Member State of the European Union or in another State party to the Agreement on the European Economic Area. Any transfer to a third country only takes place if the special requirements of Art. 44 et seq. GDPR are met.
III. Data processing – website www.bitsandpretzels.com
1. Processing of information pursuant to § 25 para. 1 TDDDG
We process information pursuant to § 25 para. 1 TDDDG by storing information on your terminal equipment or accessing information that is already stored on your terminal equipment. This may be both personal information and non-personal data, e.g. cookies, browser fingerprints, advertising IDs, MAC addresses and IMEI numbers. Terminal equipment is any equipment directly or indirectly connected to the interface of a public telecommunications network for sending, processing or receiving messages, § 2 para. 2 no. 6 TDDDG.
As a rule, we process this information on the basis of your consent, § 25 para. 1 TDDDG.
Insofar as an exception pursuant to § 25 para. 2 no. 1 and no. 2 TDDDG applies, we do not require consent. Such an exception applies if we access or store the information solely in order to transmit a message via a public telecommunications network, or if this is strictly necessary for us to be able to provide a telemedia service expressly requested by you. You can withdraw your consent at any time.
Processing carried out until the withdrawal remains lawful.
2. SSL or TLS encryption
For security reasons and to protect the transmission of confidential content, such as the requests you send to us as the website operator, this website uses SSL or TLS encryption.
You can recognise an encrypted connection by the fact that the address line of the browser changes from “http://” to “https://” and by the lock symbol in your browser line.
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.
3. Use of AI systems
In order to optimise our processes and improve your personalised visitor experience on our website, your personal data may be processed by artificial intelligence (AI) technologies. The AI is used in particular to:
- carry out data analyses,
- create forecasts,
- close security gaps,
- and make routine processes more efficient.
The AI used operates in accordance with the principles of the GDPR. Any decisions that have legal or similar effects on you are not made by the AI alone, but are supplemented by human intervention.
4. Cookies
We use cookies on our website. Cookies are small data packets that your browser creates automatically and that are stored on your terminal device when you visit our website. These cookies serve to store information in connection with the respective terminal device used.
When using cookies, a distinction is made between technically necessary cookies and “other” cookies. Technically necessary cookies exist where they are strictly necessary to provide an information society service expressly requested by you.
a) Technically necessary cookies
In order to make the use of our offering more pleasant for you, we use technically necessary cookies. These may in particular be so-called session cookies (e.g. language and font selection, shopping cart), consent cookies and cookies to ensure server stability and security.
The legal basis for setting these cookies results from § 25 para. 1 TDDDG and Art. 6 para. 1 sentence 1 lit. f) GDPR, our legitimate interest in the error-free operation of the website and our legitimate interest in providing you with our services in an optimised manner.
b) Other cookies
In addition, we use other cookies for statistical purposes, analysis, marketing and retargeting purposes.
We only use these cookies on the basis of your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR.
You can withdraw your consent to the use of cookies at any time. Processing carried out until the withdrawal remains lawful. To do so, you can either edit your consent settings on our website, deactivate the use of cookies in your browser settings (although this may also restrict the functionality of the online offering) or, in individual cases, set an opt-out for the respective service.
5. Consent banner / consent management
To obtain consent for the cookies we use, we use the consent banner service Usercentrics of the service provider Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. This service itself sets a so-called consent cookie in order to query and process the respective consent status. This consent cookie is technically necessary and is therefore used on the basis of our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, § 25 para. 1 TDDDG.
For the use of some services of the Google/Alphabet group, we use the so-called Google Consent Mode V2 in Advanced Mode. Details on this consent mode can be found on Google's page at https://developers.google.com/tag-platform/security/guides/consent?hl=de&consentmode=advanced and for the affected Google services.
The use of Consent Mode is technically necessary and is therefore carried out on the basis of § 25 para. 1 TDDDG and on the basis of our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
6. Services used on the website
a) Hosting of the website
Our website is hosted by Cloudflare Inc., 101 Townsend Street, San Francisco, CA 94107, USA. For this reason, all personal data collected on our website is stored on our host's servers, unless an external service of a third party is integrated. This may include in particular your name, IP address, email address and communication data. You will find out below, in the individual functions and services we explain, exactly which specific personal data is involved. Should we use an external service provider, this will be made clear in the description of the respective service or tool.
The host processes your data only on our instructions and insofar as this is necessary to provide the services on the website. The host does not process the data for its own purposes.
We have concluded a data processing agreement with the host.
b) When visiting the website
When you access our website, the browser used on your terminal device automatically sends information to the server of our website. This information is temporarily stored in a so-called log file.
The following information is collected without any action on your part and stored until it is automatically deleted:
- IP address of the requesting computer
- Date and time of access
- Name and URL of the file retrieved
- Website from which access is made (referrer URL)
- Browser used and, if applicable, the operating system of your computer and the name of your access provider
The aforementioned data are processed by us for the following purposes:
- Ensuring a smooth connection set-up of the website
- Ensuring convenient use of our website
- Evaluation of system security and stability
- Error analysis
- for further administrative purposes
Data that allow conclusions to be drawn about your person (e.g. your IP address) are deleted after 7 days at the latest. Should we store the data beyond this period, these data are pseudonymised so that they can no longer be attributed to you as a person.
The legal basis for the data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the purposes of data collection listed above. Under no circumstances do we use the collected data for the purpose of drawing conclusions about your person.
c) Shop system vivenu & payment processing via Stripe
To offer and process our goods/services (in particular ticket sales and dispatch), we use the shop system vivenu. The provider is vivenu GmbH, Völklinger Straße 33, 40221 Düsseldorf, Germany (hereinafter: “vivenu”).
The data you provide in the ordering or purchasing process (in particular master and contact data such as name, address, email address as well as order and payment data) are processed by our shop provider on our behalf as part of the operation of the shop system. In addition, further cookies may be set by the shop system.
Payment processing also takes place via vivenu. For the technical processing of payments, vivenu uses the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) as a sub-processor. Via Stripe, payment by credit card (Visa, Mastercard, American Express) and by PayPal is available. In this context, the data required for payment processing are processed, in particular your name, your address and email address, your payment data, the invoice amount as well as order-related and technical data (e.g. IP address). The processing serves to carry out the payment you have chosen, to confirm your identity, to prevent fraud and to fulfil legal obligations (in particular strong customer authentication under the EU Payment Services Directive PSD2).
If you choose PayPal as the payment method, the data required for payment processing are additionally transmitted to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. PayPal processes these data as an independent controller in accordance with its own privacy policy (available at https://www.paypal.com/de/webapps/mpp/ua/privacy-full).
In the course of payment processing via Stripe, personal data may also be transferred to affiliated companies, in particular Stripe, Inc. in the USA. This transfer is based on the standard contractual clauses of the EU Commission (Art. 46 para. 2 lit. c GDPR); in addition, Stripe, Inc. is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).
The legal basis for the processing of your order and payment data is Art. 6 para. 1 lit. b GDPR (performance of a contract or implementation of pre-contractual measures). Insofar as the processing serves fraud prevention and the prevention of misuse, it is based on legitimate interests pursuant to Art. 6 para. 1 lit. f GDPR. Insofar as statutory and regulatory obligations are fulfilled (in particular PSD2 and anti-money laundering requirements), the processing takes place on the basis of Art. 6 para. 1 lit. c GDPR. Insofar as cookies that are not technically necessary are set by the shop system, this is done on the basis of your consent pursuant to § 25 para. 1 TDDDG in conjunction with Art. 6 para. 1 lit. a GDPR.
As vivenu GmbH processes the data on our behalf and subject to our instructions, we have concluded a data processing agreement with the provider pursuant to Art. 28 GDPR. This also covers the use of Stripe as a sub-processor.
Further information on data protection at vivenu GmbH can be found at https://www.vivenu.com/dataprivacy, and on data protection at Stripe at https://stripe.com/de/privacy.
d) Content Delivery Network (CDN) – Cloudflare
On our website, we use a so-called content delivery network (“CDN”) as well as the web firewall for defending against DDoS attacks of the technology service provider Cloudflare Inc., 101 Townsend St. San Francisco, CA 94107, USA (hereinafter: “Cloudflare”).
For this purpose, Cloudflare may process IP addresses, information regarding the routing of data traffic and the system configuration, and other information about traffic destined for or originating from websites.
For the CDN, the transfer of information between the browser and our server is technically routed via Cloudflare's network, so that we can optimise the loading speeds of our website. The web firewall is intended to prevent fraudulent transactions, unauthorised access to the services and other illegal activities.
The processing takes place pursuant to Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interest in the secure and efficient provision, as well as the improvement of the stability and functionality, of our website.
We have concluded the standard contractual clauses (in the Data Processing Addendum) with Cloudflare.
Further information can be found in Cloudflare's privacy policy at: https://www.cloudflare.com/privacypolicy/
e) Conclusion of contract
In the course of establishing the contractual relationship, only the personal data strictly required for the performance of the contract are processed pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR.
Insofar as you provide additional voluntary information, this is only processed on the basis of the consent you have given pursuant to Art. 6 para. 1 sentence 1 lit a GDPR. We use this voluntary information to offer a customer-friendly service and to continuously improve it.
f) Newsletter
Content of the newsletter and registration data
The sending of our newsletter, as well as the performance of statistical surveys and analyses and the logging of the registration process, only takes place if you order it from us and have given your corresponding consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR, § 25 para. 1 TDDDG.
The contents of the newsletter are specifically described upon registration for the newsletter. Providing your email address is sufficient to register for the newsletter. If you provide further voluntary information (e.g. your name and/or your gender), this will be used exclusively to personalise the newsletter addressed to you.
Double opt-in and logging
For security reasons, so that no one can register using other people's email addresses, we use the so-called double opt-in procedure for registration for our newsletter. After registering for our newsletter, you will therefore first receive an email asking you to confirm your registration. The registration only becomes effective once it has been confirmed.
Furthermore, your registration for the newsletter is logged. Logging includes the storage of the time of registration and confirmation, the data you have provided and your IP address. If you make changes to your data, these changes are also logged.
Withdrawal
If you no longer wish to receive our newsletter, you can withdraw your consent at any time with effect for the future. To do so, you can click on the link to unsubscribe from the newsletter at the end of each newsletter or send us an email to the following email address: privacy@bitsandpretzels.com
The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until its withdrawal.
Use of HubSpot
Registration takes place with the help of the newsletter service HubSpot, which is offered by HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany.
The email addresses of our interested parties, as well as their other data described in these notes, are stored on HubSpot's servers in Europe, although it cannot be ruled out that access from the USA may occasionally take place in support cases or by subcontractors.
HubSpot uses this information to send and evaluate the participation links on our behalf. Furthermore, according to its own information, HubSpot may use these data to optimise or improve its own services, e.g. for the technical optimisation of the sending and presentation of the invitation, or for economic purposes in order to determine which countries the recipients come from. However, HubSpot does not use the data of our interested parties to write to them itself or to pass them on to third parties.
We have concluded a data processing agreement with HubSpot. HubSpot does not acquire any right to pass on your data.
You can find HubSpot's privacy policy at:
https://legal.hubspot.com/de/privacy-policy
g) Contact form
We provide you with a form on our website so that you have the opportunity to contact us at any time. To use the contact form, it is necessary to provide a name for a personal salutation and a valid email address for contacting you, so that we know who the request comes from and can also process it.
If you send us requests via the contact form, your details from the request form, including the contact details you have provided there as well as your IP address, are processed pursuant to Art. 6 para. 1 sentence 1 lit. b and f GDPR for the implementation of pre-contractual measures taken at your request or for the pursuit of our legitimate interest, namely the exercise of our business activities.
The requests and the associated data are deleted no later than 3 months after receipt, unless they are required for a further contractual relationship.
h) Google Tag Manager
We use Google Tag Manager on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google). Google Tag Manager is an administration and management tool in which other tracking and/or statistics tools can be centrally managed and deployed.
When you visit our website, Google Tag Manager collects and processes your IP address, which may also be transferred to the USA. However, Google Tag Manager itself does not create a user profile or any analyses.
Google Tag Manager is used on the basis of your consent pursuant to Art. 6 para. 1 sentence lit. a GDPR.
We have concluded a data processing agreement with Google.
You can find Google's privacy policy here: https://www.google.com/policies/privacy/?hl=de
i) Google reCAPTCHA
On our websites, for our contact form, we use the service reCAPTCHA of the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google), in order to be able to distinguish between input by a human and automated, abusive, machine processing.
In the course of using reCAPTCHA, the following data are processed:
- Your IP address
- Device and browser information
- Interaction data (e.g. mouse movements and clicks). In addition, cookies or other technologies may be used.
A transfer of the personal data to Google LLC in the USA is possible. Google LLC is certified under the EU-U.S. Data Privacy Framework. Where necessary, transfers are additionally safeguarded by standard contractual clauses.
We have concluded a data processing agreement with Google.
Further information on Google's privacy policies can be found at: https://policies.google.com/privacy?hl=de
Through the integration of reCAPTCHA, Google Fonts are also dynamically loaded by Google, without this being actively determined by the website operator or visitor. These web fonts are integrated via a server call, usually to a Google server in the USA. As a result, the following may be transmitted to the server and stored by Google:
- Name and version of the browser used
- Website from which the request was triggered (referrer URL)
- Operating system of your computer
- Screen resolution of your computer
- IP address of the requesting computer
- Language settings of the browser or of the operating system used by the user
Google reCAPTCHA is used on the basis of your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You can withdraw your consent at any time.
More detailed information can be found in Google's privacy notices, which you can access here:
www.google.com/policies/privacy/
j) hCaptcha
On this website, we use hCaptcha, a CAPTCHA service to protect our forms and input fields from automated access, spam and abusive use by bots.
hCaptcha is a service of Intuition Machines, Inc. (IMI), 1065 SW 8th St #704, Miami, FL 33130, USA.
When hCaptcha is loaded on our website, IMI collects and processes technical data required to distinguish human users from automated access. This includes in particular the IP address, information about the browser and operating system used, and interaction data (e.g. mouse and touch movements during the CAPTCHA check). In addition, hCaptcha sets a technical cookie (hmt_id) with a lifetime of up to 30 days, which is used exclusively for statistical purposes in connection with the provision of the service and to support accessibility functions. The processing serves exclusively the purpose of ensuring the security and integrity of our website and preventing abusive automated requests.
The data processing takes place exclusively on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG. You can withdraw your consent at any time with effect for the future by adjusting your cookie settings via our consent management tool.
A data processing agreement has been concluded with IMI, which is incorporated into hCaptcha's general terms of use and includes the standard contractual clauses of the EU Commission.
Further information on data protection at hCaptcha can be found at: https://www.hcaptcha.com/privacy
7. Analysis and tracking tools used on the website
We use the analysis and tracking tools listed below on our website. These serve to ensure the continuous optimisation of our website and to design it in line with requirements.
We use these tools on the basis of the consent you have given pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You can withdraw your consent at any time by changing the cookie settings. Processing carried out until the withdrawal remains lawful.
The respective data processing purposes and data categories can be found in the corresponding tools. We point out that we have no influence on whether and to what extent the service providers carry out further data processing.
a) Google Consent Mode v2 – Advanced Mode
For the use of some services of the Google/Alphabet group, we use the so-called Google Consent Mode v2 in Advanced Mode.
Even if you do not give consent via our cookie banner, your client still sends ping information with IP address, timestamp, user agent and referrer URL to Google. The IP address is anonymised on Google's servers. These data are used for conversion modelling in order to optimise ads despite missing consent or technical restrictions and to improve automatic bidding settings.
Details on this consent mode can be found on Google's page at https://developers.google.com/tag-platform/security/guides/consent?hl=de&consentmode=advanced.
Your personal data is processed on the basis of our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
b) Google Analytics
We use Google Analytics on our website, a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”).
In this context, Google Analytics uses cookies. The information generated by the cookie about your use of this website, such as
- Name and version of the browser used
- Operating system of your computer
- Website from which access is made (referrer URL)
- IP address of the requesting computer
- Time of the server request
is usually transferred to a Google server in the USA and stored there.
Your IP address is automatically anonymised by Google before it is recorded via EU domains and servers. Your IP address is therefore not logged or stored.
On our behalf, Google will use this information to evaluate your use of our website, to compile reports on website activities and to provide us with further services related to website use and internet use. The IP address transmitted by your browser within the scope of Google Analytics is not merged with other Google data.
We have concluded a data processing agreement with Google.
Please click here for an overview of data protection at Google: https://support.google.com/analytics/answer/6004245
c) Google Remarketing
We use the remarketing function of Google Analytics to direct advertising campaigns (including Google AdWords campaigns) at the visitors of our website. In this process, based on your previous visits to our website, relevant advertisements are presented to you when you visit other websites in the Google Display Network.
The DoubleClick cookie enables Google, ourselves and other third-party providers to display targeted advertising that corresponds to the interests determined on the basis of your previous visits to our website and/or other websites. This advertising may be displayed on Google websites and/or websites of other operators of the Google advertising network. We also use the Google Analytics advertising functions to analyse the effectiveness of our own advertising campaigns.
If you have agreed in your Google account that your web and app browsing history is linked by Google to your Google account and that information from your Google account is used to personalise ads, Google uses data from you together with Google Analytics data to create target group lists for cross-device remarketing. For this purpose, Google Analytics first collects, for you as a user on our website, Google-authenticated IDs that are linked to your Google account. Google Analytics then temporarily links these IDs with Google Analytics data in order to optimise our target groups.
We have concluded a data processing agreement with Google.
Please click here for an overview of data protection at Google: https://support.google.com/analytics/answer/6004245
d) Google Ads Conversion Tracking
On our website, we use Google Ads, an online advertising programme of the provider Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”). Conversion tracking is also used in this context. With this tool, Google Ads sets a cookie on your terminal device if you reach our website via a Google ad.
The cookie does not serve the purpose of personal traceability. If you as a user visit our website and the cookie is still active, it becomes recognisable to us together with Google that you clicked on the corresponding ad and were redirected to our site. Each Google Ads customer is assigned a different cookie. Cookies can therefore not be tracked via the websites of Ads customers.
The data obtained via conversion cookies are used to create conversion statistics for Ads customers. As customers of Google Ads, we thereby learn the total number of users who responded to our ad and were then directed to a website provided with a conversion tracking tag. This allows us to recognise the success of individual advertising measures. In this process, we do not receive any information with which we could personally identify you as a user.
When Google Ads is used, your browser automatically establishes a direct connection with Google's server and, if you have a Google account and are logged into it, can assign the visit to your account. If you do not have a Google account, Google assigns you its own identifier. We have no influence on what further data Google collects and stores.
We have implemented Google's “enhanced conversions” function on our website. With this function, data collected by ourselves, such as email address, name, address or telephone number, are captured in conversion tracking tags. These are then sent to Google in hashed form, where they are used to match them against our existing customers who have Google accounts. More detailed information on this function can be found at https://ads.google.com/intl/de_de/home/privacy/solutions/enhanced-conversions-for-web/
We have concluded a data processing agreement with Google.
Further details on Google's privacy policy can be found at http://www.google.de/policies/privacy/.
e) HubSpot
We work with HubSpot's CRM software, through which we can manage our customer data and conduct online marketing. The provider is HubSpot Germany GmbH, Am Postbahnhof 17, 10243 Berlin, Germany. For this purpose, landing pages, among other things, are analysed and reports are created. So-called “web beacons” and cookies are used in this process. In this context, the following personal data may be processed:
- IP address,
- geographical location,
- type of browser,
- duration of the visit,
- pages accessed,
- visitor sources via UTM parameters.
As a rule, the IP address is processed on HubSpot's European servers and only stored in shortened form. Only in exceptional cases is the IP address transferred to a HubSpot server in the USA and shortened there.
We use the collected information to continuously optimise and improve our website and to make it more user-friendly for you. In addition, we use this information to analyse which of our company's services are of interest to customers, users and newsletter subscribers in order to contact them for advertising purposes.
We have concluded a data processing agreement with HubSpot. HubSpot does not acquire any right to pass on your data.
You can find HubSpot's privacy policy at https://legal.hubspot.com/de/privacy-policy.
f) Contact forms and enquiries via HubSpot
To manage contact forms and to process enquiries, we use the service HubSpot, a service of the provider HubSpot Germany GmbH, Kopernikusstraße 1, 85737 Unterföhring, Germany (hereinafter: “HubSpot”).
In connection with the use of HubSpot Forms, we use, after obtaining your consent, cookies and similar technologies of HubSpot in order to evaluate the use of our forms and web pages, to optimise our marketing activities and to recognise returning visitors. In this context, the following data in particular may be processed:
- IP address,
- timestamp,
- pages accessed,
- form submissions,
- device and browser information
- as well as a user identifier assigned by HubSpot.
To provide the services, HubSpot uses the group company HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA. It therefore cannot be ruled out that your data may be accessed from the USA in the course of the use of HubSpot.
The USA is a third country within the meaning of the GDPR. For HubSpot Inc., there is an adequacy decision of the European Commission based on the EU-US Data Privacy Framework (Art. 45 GDPR), provided that HubSpot, Inc. is certified accordingly. In addition, we conclude with HubSpot Inc. the standard contractual clauses adopted by the EU Commission and agree supplementary protective measures where necessary.
We have concluded a data processing agreement with HubSpot. HubSpot does not acquire any right to pass on your data.
g) Microsoft Clarity
We use the analysis service Microsoft Clarity of Microsoft Corporation, One Microsoft Way, Redmond, WA 98052 USA on our website.
In this process, usage- and user-related information (e.g. IP address, location, time or frequency of visits to our website) is transferred to a Microsoft server in the USA and stored there. We have activated the anonymisation function at Microsoft, so that your IP address is only processed in shortened form.
These data serve to evaluate your visit to our website and your usage behaviour, so that we can improve and optimise our services.
We have agreed the standard contractual clauses with Microsoft.
Further information on data protection at Microsoft can be found at https://privacy.microsoft.com/de-de/privacystatement.
h) Meta Conversion Pixel (Meta Pixel)
On our website, we use the Meta Conversion Pixel (“Meta Pixel”), an analysis and marketing tool of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: “Meta”). With the help of the Meta Pixel, Meta can track the behaviour of users after they have been redirected to our website via an ad placed with Meta. This enables us to record the effectiveness of our Meta ads for statistical and market research purposes (“conversion measurement”), to create or refine target groups for ads (“Custom Audiences”) and to serve ads based on interests. If you are logged into Meta services (e.g. Facebook, Instagram), Meta can assign the page visits to your profile there and evaluate them across devices.
The Meta Pixel enables the collection of so-called event data (e.g. “PageView”, “ViewContent”, “AddToCart”, “Purchase” including order value and currency), technical information from HTTP headers (including IP address, user agent, referrer URL), device and browser data, pixel ID and timestamps.
For certain processing of the so-called event data within the scope of the Meta Business Tools, we and Meta are joint controllers. The allocation of roles and responsibilities results from Meta's “Controller Addendum” (pursuant to Art. 26 GDPR; available at https://de-de.facebook.com/legal/controller_addendum) in conjunction with the “Business Tools Terms” (https://facebook.com/legal/technology_terms). According to these, we are in particular responsible for obtaining an effective legal basis (consent), the correct implementation of the pixel and the transparency information. Meta assumes, among other things, primary responsibility for fulfilling data subject rights with regard to the event data processed by Meta after transmission and for the security of Meta's systems. You can assert your rights (e.g. access, erasure) both against us and against Meta. A data processing agreement pursuant to Art. 28 GDPR is generally not concluded for the Meta Pixel. Instead, the aforementioned joint controllership agreement applies.
Otherwise, we refer to Meta's privacy information: https://www.facebook.com/about/privacy
i) Meta Conversion API
We use the Meta Conversions API (“CAPI”) of Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereinafter: “Meta”). In this process, event data are transmitted directly from our server to Meta in order to measure the effectiveness of our advertising measures, optimise campaigns and create target groups. The CAPI often works together with the Meta Pixel and reduces dependence on third-party cookies.
In the course of its use, the following data may be processed and transmitted to Meta:
- technical connection and device information (e.g. IP address, operating system, browser),
- online identifiers (cookie and click IDs, event ID),
- page and event data (e.g. URLs visited, campaign parameters).
The processing serves to measure the success of our ads, to optimise campaigns and ad placements, and to create or update target groups.
A transfer to the USA may take place.
Further information on data processing by Meta can be found in Meta's privacy policies at https://www.facebook.com/about/privacy.
j) LinkedIn Conversion Tracking
On our website, we use the conversion tracking function of LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (hereinafter: “LinkedIn”). This gives us the possibility of addressing you with targeted ads following a visit to our website. In addition, LinkedIn provides reporting that shows how successful the ads we place are and how users generally interact with our site. If you logged in via LinkedIn before visiting our site, this is recognised within the scope of conversion tracking, and you, as a visitor to our site, are associated with your LinkedIn account.
We have concluded a data processing agreement with LinkedIn.
Further information can be found in LinkedIn's privacy policy: https://www.linkedin.com/legal/privacy-policy?_l=de_DE
In addition, you have the option of opting out of interest-based advertising via LinkedIn. This is possible via the following link:
https://www.linkedin.com/psettings/enhanced-advertising
k) LinkedIn Analytics
We use LinkedIn Analytics on our website, a web analysis service of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland (hereinafter: “LinkedIn”).
In this context, LinkedIn Analytics uses cookies. The information generated by the cookie about your use of this website (e.g. login data, device information, IP addresses) is logged and possibly transferred to a LinkedIn server in the USA and stored there.
On our behalf, LinkedIn will use this information to evaluate your use of our website, to compile reports on website activities and to provide us with further services related to website use and internet use. The IP address transmitted by your browser within the scope of LinkedIn Analytics is not merged with other LinkedIn data.
We have concluded a data processing agreement with LinkedIn.
Please click here for an overview of data protection at LinkedIn:
https://www.linkedin.com/legal/privacy-policy
l) ABlyft (A/B testing)
On our website, we use ABlyft, a tool for carrying out A/B tests and optimising our online offering. With ABlyft, we test different variants of our website against each other in order to improve design, content and user-friendliness on the basis of actual usage behaviour.
The provider is Conversion Expert GmbH, Zeppelinring 52c, 24146 Kiel, Germany.
For this purpose, ABlyft collects information on usage behaviour on our website and sets cookies on your terminal device for this. According to the provider, no personally identifiable data is stored in the platform. The evaluation takes place exclusively in aggregated form, and neither IP addresses nor user IDs or comparable individual information are stored.
No data is transferred to a third country outside the EU/EEA. The provider, hosting and data storage are located entirely in Germany.
The legal basis for storing information on, and reading it from, your terminal device is your consent pursuant to § 25 para. 1 TDDDG. The associated processing of personal data takes place on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR. Your consent is voluntary and can be withdrawn at any time with effect for the future.
Further information on data protection can be found at: https://ablyft.com/en/privacy-notice
8. Image, audio and video embedding – YouTube
Within the scope of an iFrame and/or via a plug-in, we embed in our website videos from YouTube, which is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter: “Google”). In embedding the videos, we have activated YouTube's extended data protection mode.
If you play a YouTube video during your visit, a connection to YouTube's servers is established and the YouTube server is informed which of our pages you have visited. This enables YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your member account before visiting our website. In addition, YouTube sets various cookies when the service is started in order, according to its own information, to improve the services it offers and to prevent misuse.
Further information on the handling of user data and the cookies set can be found in YouTube's privacy policy at: https://www.google.de/intl/de/policies/privacy
Through the integration of YouTube, Google Fonts are also dynamically loaded by Google, without this being actively determined by the website operator or visitor. These web fonts are integrated via a server call, usually to a Google server in the USA. As a result, the following may be transmitted to the server and stored by Google:
- Name and version of the browser used
- Website from which the request was triggered (referrer URL)
- Operating system of your computer
- Screen resolution of your computer
- IP address of the requesting computer
- Language settings of the browser or of the operating system used by the user
The legal basis results from the consent you have given pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR. You can withdraw the consent you have given at any time by changing the cookie settings on our website.
More detailed information can be found in Google's privacy notices, which you can access here: www.google.com/policies/privacy/
IV. Data processing – Bits & Pretzels app
1. Processing of information pursuant to § 25 para. 1 TDDDG
We process information pursuant to § 25 para. 1 TDDDG by storing information on your terminal equipment or accessing information that is already stored on your terminal equipment. This may be both personal information and non-personal data, e.g. cookies, browser fingerprints, advertising IDs, MAC addresses and IMEI numbers. Terminal equipment is any equipment directly or indirectly connected to the interface of a public telecommunications network for sending, processing or receiving messages, § 2 para. 2 no. 6 TDDDG.
As a rule, we process this information on the basis of your consent, § 25 para. 1 TDDDG.
Insofar as an exception pursuant to § 25 para. 2 no. 1 and no. 2 TDDDG applies, we do not require consent. Such an exception applies if we access or store the information solely in order to transmit a message via a public telecommunications network, or if this is strictly necessary for us to be able to provide a telemedia service expressly requested by you. You can withdraw your consent at any time.
Processing carried out until the withdrawal remains lawful.
2. SSL encryption
For security reasons and to protect the transmission of confidential content, such as the requests you send to us as the app operator, our app uses SSL encryption.
If SSL encryption is activated, the data you transmit to us cannot be read by third parties.
3. Backend & hosting
The Bits & Pretzels app is based on the platform of the provider Brella Ltd, Siltasaarenkatu 10, 00530 Helsinki, Finland. The platform is a proprietary development of Brella and is operated by Brella.
All data collected via the app are stored in the backend of the Brella platform. Hosting takes place on the infrastructure of Hetzner Online GmbH, with data centres in Germany and Finland. Both locations are within the European Union. To this extent, no transfer of these data to a third country takes place.
The legal basis for operation and hosting is the performance of a contract pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR as well as our legitimate interest in the secure and stable operation of the app pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
We have concluded a data processing agreement with Brella pursuant to Art. 28 GDPR. Brella is certified according to ISO/IEC 27001.
More detailed information on data protection can be found at https://www.brella.io/privacy-notice.
4. Services used in the app
a) When downloading the app
When the mobile app is downloaded, the required information is transferred to the App Store or Play Store, in particular:
- User name
- Email address
- Customer number of your account
- Time of download
- Payment information
- the individual device identification number.
We have no influence on this data collection and are not responsible for it. We only process the data insofar as this is necessary for downloading the mobile app to your mobile terminal device.
b) Use of the app
When you use the mobile app, we collect the personal data described below in order to enable convenient use of the functions. If you wish to use our mobile app, we collect the following data, which are technically necessary for us in order to offer you the functions of our mobile app and to ensure stability and security:
- IP address
- Date and time of the request
- Time zone difference to Greenwich Mean Time (GMT)
- Access status/HTTP status code
- Amount of data transferred in each case
- Operating system and its interface
- App version
- Device/operating system information
- Name of the mobile terminal device
- Email address
The legal basis for the data processing is Art. 6 para. 1 sentence 1 lit. f GDPR. Our legitimate interest follows from the purposes of data collection listed above. Under no circumstances do we use the collected data for the purpose of drawing conclusions about your person.
The aforementioned data are processed in the backend of the Brella platform (see section “Backend & hosting”).
c) Registration & profile creation
On the basis of the information you provided when booking your ticket on the website www.bitsandpretzels.com, a user profile is created for you when the QR code of your ticket is scanned. You can adjust, change or delete the information in your profile at any time. The information in your profile is generally visible to other users.
As part of the registration, we collect and process in particular your name, your email address, your job title, the industry and address of your company, and a password of your choice. In addition, you can provide voluntary information (e.g. your LinkedIn URL, a profile picture, the approximate number of employees in your company, the approximate turnover of your company, professional fields of work and interest).
To upload a profile picture, you can either take a picture with the camera of your mobile device or use a picture from your photo gallery. If you wish to take a picture with your camera, it is necessary to grant the app access to this function. If you wish to use a picture from your photo gallery, it is necessary for this purpose that you grant the app access to it.
We collect these data for the performance of the contract pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR and on the basis of our legitimate interest in the further identification of users in order to enable effective networking, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. Insofar as voluntary information is processed, we process it on the basis of your voluntary consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until its withdrawal.
This information may already be pre-filled, in whole or in part, with data known to us from the ticket purchase on the website. Technically, this is implemented by the service vivenu, which is used as the shop system and payment service provider on our website www.bitsandpretzels.com. The provider of the vivenu service is vivenu GmbH, Kesselstraße 3, 40221 Düsseldorf, Germany. We have concluded a data processing agreement with it.
Further information on data protection at vivenu GmbH can be found at: https://vivenu.com/de/dataprivacy
The aforementioned data are processed in the backend of the Brella platform (see section “Backend & hosting”) and, with the exception of the password, are visible to all users of the app.
d) Push notifications
Under “Menu > Settings > Notifications”, you can set whether you wish to receive news via push notification, even if you are not currently actively using our app or the device is in sleep mode.
You can subsequently switch this function on or off at any time. The push notifications are delivered with the help of servers provided by the manufacturers of the operating systems. The mobile devices must therefore be registered with these servers, which requires the transmission of a UUID (iOS) or the device ID assigned to the device (Android).
The legal basis here results from Art. 6 para. 1 sentence 1 lit. b) GDPR for the provision of our services on the basis of the request you have made, as well as from our legitimate interest in a functioning app, Art. 6 para. 1 sentence 1 lit. f) GDPR.
e) Matchmaking
We want to support you as best we can in finding, among the overwhelming number of interesting participants and activities, conversation partners and activities that individually match your interests, and in making networking as efficient as possible. We therefore evaluate your profile information and interests as well as your event activities with the support of AI and, on this basis, suggest suitable participants and activities to you.
The matchmaking is a proprietary development of Brella and runs exclusively on Brella's servers. It combines a rule-based (deterministic) ranking with a machine learning recommendation model. It is not generative AI or a so-called large language model (LLM). No data are transmitted to third-party AI providers for matchmaking purposes.
The legal basis for this is our legitimate interest in enabling efficient networking, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR. This automated data processing is of a purely supporting nature and does not produce any legal effect within the meaning of Art. 22 GDPR.
The aforementioned data are processed in the backend of the Brella platform (see section “Backend & hosting”).
f) Networking & chat
Via the “Networking” tab, you have the possibility to search for other users, view their profiles, bookmark them, contact them and chat with them. In addition, there is the possibility of arranging a meeting with other participants for a personal conversation. In this process, the information you share in the chat as well as the date and time of the messages and requests are transmitted to the respective other users.
We do not, of course, view the messages exchanged between users.
The legal basis for the data processing is the performance of the contract pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR as well as our legitimate interest in enabling effective networking pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
The in-app chat is provided and operated by Brella on its own platform. No third-party chat service provider is involved. The content transmitted in the chat is processed in the backend of the Brella platform (see section “Backend & hosting”)
g) Calls / video calls
In addition, it is possible to make a call with persons with whom you have arranged a meeting. In this process, your audio and video transmission as well as the technical data required to establish the connection (e.g. IP address, time and duration of the connection) are processed.
Technically, the service “Whereby” of the provider Whereby AS, Gate 1 no. 107, 6700 Måløy, Norway is used for this.
The legal basis for conducting the video call is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR, which you give by starting or joining the call, as well as the performance of the contract pursuant to Art. 6 para. 1 sentence 1 lit. b GDPR. You can withdraw your consent at any time with effect for the future.
Whereby is used by Brella as a sub-processor. The processing is covered by the processing chain (Art. 28 GDPR).
More detailed information on data protection at Whereby can be found at https://whereby.com/information/tos/privacy-policy/.
h) Scanning QR codes and having them scanned
In the app, under “QR Code > My Code”, we provide you with an individual QR code, which you can have scanned by participants and our employees. The time of the scan is also stored in this process.
In this way, we want to offer you an easy way to share your contact details with other participants for networking in the app. In addition, you can scan the QR codes of other participants yourself under “QR Code > Scan QR Code”. For this, it is necessary that you allow the app access to your camera. The legal basis is our legitimate interest in enabling effective networking, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
Your name badge is scanned by us at admission. In this process, your full name, the company name, your job title, your email address, the country you have specified and the time of the scan are processed. The legal basis is the performance of the contract (verification of eligibility to participate) pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR.
When you visit individual rooms and talks during the event, your name badge may also be scanned on the basis of your voluntary consent in order to transmit your personal data to the respective sponsor(s) and operators. Your data will be passed on to the sponsor(s) and operator of this stand or this stage for marketing and advertising purposes, in particular so that they can contact you afterwards. You will also be reminded once again of the voluntary nature of the scan at the respective entry points. By providing your name badge for scanning, you give your voluntary consent to this. The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR.
You can withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until its withdrawal.
The QR codes are scanned via the camera of your terminal device and processed within the Brella app. No third-party service provider is involved for this.
i) Table Captains bookings
Via the menu item “Oktoberfest”, you can sign up for Table Captains and then see which Table Captain you have signed up for and at which table a seat is reserved for you.
The legal basis for this data processing is the performance of the contract pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR as well as our legitimate interest in enabling effective networking for you by informing you about your allocated seat and making it easier for you to find it, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
The booking page for the Table Captain reservation is provided and operated by ourselves and is merely embedded in the app. The data entered via this booking page are not processed by Brella, but by us as the controller.
j) Use of the camera and/or the photo gallery
You have the possibility of taking a picture directly via the camera of your device or of using a picture from the photo gallery of your device. In particular, you can use this possibility when creating a profile, when scanning the QR code of your ticket and when uploading your company logo or header.
The legal basis for this data processing is our legitimate interest in offering you a convenient way to upload pictures to the app, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
You are only entitled to upload pictures that you are also entitled to use.
The aforementioned data are processed in the backend of the Brella platform (see section “Backend & hosting”).
k) Calendar
In the app, you can put together your personal event schedule by adding sessions, talks and meetings to your schedule. No independent AI evaluation of your scheduling takes place.
The legal basis for this data processing is our legitimate interest in enabling efficient networking, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
The aforementioned data are processed in the backend of the Brella platform (see section “Backend & hosting”).
l) Sync schedule to calendar function
Via the “Sync schedule to calendar” function, you can transfer the schedule you have created in the app to your own calendar application. The synchronisation is provided via the Brella platform. No third-party calendar service is involved. Your schedule is handed over to the calendar application you use on your terminal device.
The legal basis is our legitimate interest in providing convenient appointment management, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
m) Sharing your profile
In the app, under “Account > Share Profile” (top right), you have the possibility of sharing your profile outside the app as well. To do so, you must press the “Share profile card” button located there. In the context menu that then appears, you can decide in which way, or via which app, you wish to share the profile. In addition to sharing on social media platforms and messenger services, you can also share the post via SMS or email. For this, it is generally necessary for our app to access your contacts in order to enable your message to be sent to them.
The legal basis for this data processing is our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR in enabling effective networking for you.
Before sharing posts, please ensure that the recipients also agree to receive such messages.
5. Analysis and tracking tools used in the app
a) Error and performance monitoring (Sentry)
In order to detect and correct technical errors and to monitor the performance and stability of the app, we use the Sentry service. When an error occurs, diagnostic data are processed, in particular technical error messages (error reports), information on the terminal device and operating system used, app version, time of the error and IP address.
The provider is Functional Software, Inc. (Sentry). The processing serves exclusively for error analysis and to ensure the stability and security of the app.
The legal basis is our legitimate interest in an error-free, stable and secure app, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
Sentry is used by Brella as a sub-processor. Insofar as a transfer to a third country (USA) takes place in this context, this is safeguarded by the EU standard contractual clauses (Art. 46 para. 2 lit. c GDPR).
More detailed information on data protection at Sentry can be found at: https://sentry.io/privacy/.
b) Statistical evaluations
To improve our app and for the statistical evaluation of its use, we use the analysis service PostHog. In particular, we evaluate: the total number of participants or users, the interaction rate (“engagement rate”), the number of name badge scans (“attendable scans”) and the number of chat messages. These evaluations are carried out for statistical purposes.
The provider is PostHog, Inc, 2 261 Market Street #4008, San Francisco, CA 94114, USA. The evaluations serve to understand the use of the app and to continuously improve the app.
The legal basis is our legitimate interest in the further development of our services, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
PostHog is used by Brella as a sub-processor. Insofar as a transfer to a third country takes place, this is safeguarded by the EU standard contractual clauses.
More detailed information on data protection at PostHog can be found at: https://posthog.com/privacy.
V. Data processing – Bits & Pretzels event
1. Collection and storage of personal data and the nature and purpose of its use
Bits and Pretzels is a founder and networking event. Its main purpose is to connect entrepreneurs and companies in order to create economic value.
a) Ordering a ticket & use of vivenu
When ordering the ticket, the personal data strictly required for the performance of the contract are processed (name, email address, address, payment data). In addition, you can voluntarily provide further personal data (e.g. company name, tax identification number).
The legal basis here results from the performance of the contract on the basis of the request you have made, pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR. Insofar as you have provided voluntary information, the data processing is based on your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR.
For ticket ordering and the processing of payments via the website, we use the service provider vivenu GmbH, Kesselstraße 3, 40221 Düsseldorf, Germany.
We have concluded a data processing agreement with it.
Further information on data protection at vivenu GmbH can be found at: https://vivenu.com/de/dataprivacy
b) At the event
aa) Scanning of the name badge in the context of participation in the event
In the app, under “QR Code > My Code”, we provide you with an individual QR code, which you can have scanned by participants and our employees. The time of the scan is also stored in this process.
In this way, we want to offer you an easy way to share your contact details with other participants for networking in the app. In addition, you can scan the QR codes of other participants yourself under “QR Code > Scan QR Code”. For this, it is necessary that you allow the app access to your camera. The legal basis is our legitimate interest in enabling effective networking, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
Your name badge is scanned by us at admission. In this process, your full name, the company name, your job title, your email address, the country you have specified and the time of the scan are processed. The legal basis is the performance of the contract (verification of eligibility to participate) pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR.
When you visit individual rooms and talks during the event, your name badge may also be scanned on the basis of your voluntary consent in order to transmit your personal data to the respective sponsor(s) and operators. Your data will be passed on to the sponsors and operators of the stages and stands for marketing and advertising purposes so that they can contact you afterwards. You will also be reminded once again of the voluntary nature of the scan at the respective entry points. By providing your name badge for scanning, you give your voluntary consent to this. The legal basis is your consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR.
You can withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until its withdrawal.
bb) Disclosure of your name
Bits & Pretzels is a networking event. Its purpose is to get to know other people, investors and other networking partners. Accordingly, your name and your contact details are also made accessible to other participants. This takes place in particular via our website www.bitsandpretzels.com, our Bits & Pretzels app and in the context of the event itself.
The legal basis for the processing is the performance of the contract pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR as well as our legitimate interest in enabling effective networking for all participants, pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
cc) Photo and video recordings
Photo and video recordings are made by us during the event. These are in particular recordings for presenting, promoting and portraying the event. These recordings may be published both on the website and on social media portals. The recordings are made and published on the basis of our legitimate interest in public relations pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR.
If you do not agree with this, we kindly ask you to briefly inform our photographers of this in the specific situation.
Insofar as targeted individual or close-up shots are taken, these are based on your voluntary consent pursuant to Art. 6 para. 1 sentence 1 lit. a) GDPR. You can withdraw your consent at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of the consent until its withdrawal.
dd) Participation in the “Table Captain” event
In the course of the Bits & Pretzels event, a so-called “Table Captain” event also takes place, which is offered in order to enable more intensive networking.
Table Captains are well-known experts from the start-up ecosystem. They make themselves available as hosts of a table at the Oktoberfest, at which, as a rule, up to eight participants can sit. In the app, participants are given the opportunity to reserve a seat at a table that particularly interests them.
In this process, not only the respective Table Captain can be viewed, but also the other persons who have already registered for the respective table.
As a result of the registrations, your name and the company name you have provided are shared with the other guests at the table.
The table reservations are technically implemented via the HelloSpaces platform. The provider is Hello Spaces GmbH, Lauerstraße 19, 35578 Wetzlar, Germany. Hello Spaces GmbH is a subsidiary of efec AG, which is based at the same address.
We have concluded a data processing agreement with the provider.
More detailed information on data protection at HelloSpaces can be found at: https://efec.de/datenschutz
The legal basis for this data processing is the performance of the contract pursuant to Art. 6 para. 1 sentence 1 lit. b) GDPR as well as our legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f) GDPR in enabling effective networking for all participants.
VI. Data processing – social media
1. Meta (Facebook & Instagram)
In the following, we inform you about the data processing operations on our Meta profile on Facebook and Instagram.
a. Data processing by Meta
With regard to data processing by Meta Platforms Ireland Limited, in particular regarding the processing, disclosure, storage period and deletion of your data, we refer to its data policy at https://www.facebook.com/policy.
Insofar as there is joint controllership with Meta (see “Data processing for Page Insights”), Meta Platforms Ireland Limited is responsible for handling your data subject rights. You can contact Meta Platforms Ireland Limited via this form: https://help.meta.com/support/privacy/
If you contact us in a case of joint controllership, we will forward your request to Meta Platforms Ireland Limited in accordance with our agreement pursuant to Art. 26 GDPR.
b) Data processing during interactions with our account
We only receive personal data from you if you become active (e.g. if you like, post, share or comment on something, send us a direct message or carry out other interactions). This also includes cases where you use certain hashtags or where we share your posts.
When you interact with us, data processing by us generally takes place inevitably, as this enables us to see your account and personal data of yours thus become accessible to us, such as your user name, your profile picture or the date or time of the interaction.
Please do not communicate any special categories of personal data to us via the respective Meta platform, i.e. in particular no information about your health, your religious beliefs or your sex life.
We process these personal data exclusively for the purposes we pursue on our Meta company profile:
- Presentation and operation of our company page on Facebook or Instagram
- Answering your messages addressed to us privately
- Reactions to your publicly shared posts (e.g. articles, videos, pictures) in which you mention or link us
- Answering your comments on posts publicly addressed to us.
- Answering and processing the lead forms you have filled in
We do not create profiles of you or mix these personal data with other data we hold about you.
The data from interactions with our account are used by us to provide visitors to our Facebook page or our Instagram profile with relevant content and to enable you to use our company profiles and their functionalities. This constitutes a legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
Answering your direct messages and comments on posts is justified pursuant to Art. 6 para. 1 lit. b GDPR.
In individual cases, we may require your consent for the processing of your personal data pursuant to Art. 6 para. 1 lit. a GDPR, e.g. if a post we publish contains a picture or video of you. In that case, we will explain further details of this data processing to you in connection with obtaining your consent.
c) Data processing for Page Insights
We process statistics and insights compiled by Facebook and Instagram (so-called Page Insights), which provide us with information about how people interact with our posts, pages, videos and other content. For this purpose, we receive, among other things, information about the number of people or accounts that view, react to or comment on our posts, as well as aggregated demographic and other information that helps us learn about the interaction with our page or our account.
When we place ads, we receive reports about the types of people who see our ads and about the success of our ads. In this process, no information that makes a person personally identifiable is shared with us, unless that person has consented to such processing. To help us better understand our audience, Meta Platforms Ireland Limited provides us with, among other things, general demographic and interest-based information. We also receive information from Meta Platforms Ireland Limited that enables us to understand which of our ads led to a purchase being made or an action being taken.
The processing of these data serves the purpose of analysing our reach and adapting our content and ads to user interests. By evaluating these data, we can recognise how our content, our profile and our advertising are consumed. This enables us to create content suited to our target group and to place advertising in order to better market our company and our services.
This constitutes a legitimate interest pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
This processing of your personal data in the course of Page Insights takes place under joint controllership with Meta Platforms Ireland Limited.
For this purpose, we have concluded a joint controllership agreement with Meta Platforms Ireland Limited: https://www.facebook.com/legal/terms/page_controller_addendum.
The controller for Facebook and Instagram is:
Meta Platforms Ireland Limited
4 Grand Canal Square
Grand Canal Harbour
Dublin 2
Ireland
You can contact Meta Platforms Ireland Limited via the following form: https://www.facebook.com/help/contact/1650115808681298
You can reach the data protection officer of Meta Platforms Ireland Limited via the following form: https://www.facebook.com/help/support/privacy?classification=1039363987665155&country=Germany&state=
The complete data policy of Meta Platforms Ireland Limited can be accessed via the following link: https://www.facebook.com/policy.
d) Advertising on Facebook and Instagram
We place ads on Facebook and Instagram in order to present our content and offers in line with users' interests. In doing so, we use Meta's targeting functions, which are based on data that Meta processes about its users within the platforms (e.g. demographic characteristics, interests, location). For this purpose, we receive reports from Meta on the reach and success of our ads, which do not enable the direct identification of individual persons.
The processing is based on Art. 6 para. 1 lit. f GDPR (legitimate interest in effective advertising and corporate communication). Insofar as Meta processes its own user data for this purpose, this takes place under Meta's own responsibility.
Meta Platforms Ireland Limited is responsible for the delivery of the ads and the processing of user data within the Meta platforms. Our role is limited to the selection of target groups and the design of the ads.
Meta's privacy information: https://www.facebook.com/policy
You can make settings for personalised advertising in your Facebook and Instagram account or object to it: https://www.facebook.com/adpreferences/
e) Retargeting via website visits (Meta Business Tools)
On Facebook and Instagram, we address persons who have previously visited our website www.bitsandpretzels.com (“retargeting”). For this purpose, we use Meta Business Tools (e.g. Meta Pixel/Conversions API), which record website events (e.g. page views, product views, purchases) and transmit them to Meta in order to form target groups and to measure the success of our campaigns.
In particular, the following data may be affected:
- Event data (e.g. PageView, ViewContent, AddToCart, Purchase incl. order value/currency)
- technical information/online identifiers (e.g. IP address, device/browser information, cookie ID, pixel/event ID, timestamp)
The collection and transmission of the event data via our website takes place exclusively on the basis of your consent pursuant to Art. 6 para. 1 lit. a GDPR, which is given via our consent manager, and serves the delivery of personalised advertising (retargeting), reach measurement and campaign optimisation.
The delivery and evaluation of the ads on Facebook and Instagram take place on the basis of our legitimate interest (Art. 6 para. 1 lit. f GDPR). Insofar as data based on your consent are used for this purpose, the consent is decisive.
We and Meta Platforms Ireland Limited are joint controllers for the collection and transmission of the event data by means of Meta Business Tools (Art. 26 GDPR). Details: https://www.facebook.com/legal/controller_addendum
Meta is independently responsible for the subsequent processing for its own purposes. Meta's privacy information: https://www.facebook.com/policy
You can withdraw your consent at any time via the cookie settings on our website.
Further advertising settings on Facebook and Instagram can be found here: https://www.facebook.com/help/instagram/245100253430454?locale=de_DE and https://www.facebook.com/help/109378269482053/?helpref=uf_share
VII. Validity and changes to the privacy policy
Should we change the privacy notice, this will be indicated on the website.
This privacy notice was last updated on:
25.09.2026