Source: https://www.offensivecon.org/privacy-cfp.html
Timestamp: 2019-04-22 16:56:11+00:00

Document:
The protection of your personal data (hereafter “p.d.”) which are processed when using our website as well as during the registration for our conference is a huge and important concern for us. The term “personal data” includes all information which refer to identified or identifiable individuals.
Categories of data are e.g. your name, your address, your e-mail-address, but also data about your usage behavior on www.offensivecon.org.
That is represented by the CEO Lukas Hermann, ibid. You can also contact us via e-mail under office@bluefrostsecurity.de. Our homepage can be accessed via www.bluefrostsecurity.de.
For any questions and remarks regarding this privacy statement or for general inquiries regarding data protection please contact our data protection officer. You can contact him via e-mail under privacy@bluefrostsecurity.de or per mail by post with confidence to the attention of the data protection officer at the above address.
Insofar as we obtain the data subject’s consent for processing of personal data, Art. 6 (1) Clause 1 lit. a) GDPR as the legal basis.
In case of processing of personal data is necessary for the performance of a contract, the legal basis is Art. 6 (1) Clause 1 lit. b) GDPR. This also applies to processing operations that are necessary to carry out pre-contractual measures.
Insofar as processing of personal data is necessary for the compliance of a legal obligation our company is subject to, the legal basis is Art. 6 (1) Clause 1 lit. c) GDPR.
In the case that vital interests of the data subject or of another natural person require a processing of personal data, Art. 6 (1) Clause 1 lit. d) GDPR serves as the legal basis.
If processing is necessary to protect a legitimate interest of our company or of a third party and if the interests, fundamental rights, and fundamental freedoms of the data subject do not outweigh these legitimate interests, the legal basis for processing is Art. 6 (1) Clause 1 lit. f) GDPR.
The data processed by us will be deleted or its processing restricted in compliance with the statutory provisions, in particular in accordance with Articles 17 and 18 GDPR. Unless specifically stated in this privacy statement, we delete data stored by us as soon as it is no longer needed for its intended purpose. Beyond the time of continued use, data is only collected if it is required for other and legally permissible purposes or if the data must be retained due to statutory retention obligations. In these cases, processing is restricted, that means blocked, and not processed for other purposes.
The data is stored temporarily on our servers. This data is not stored together with other personal data except those stated above. The temporary storage of the IP address by the system is necessary to enable the website to be delivered to the user’s computer. For this purpose, the IP address of the user must be stored for the duration of the session. In addition, we create so-called log files. The log files are stored to ensure the security of our IT systems. The log files include all of the above data categories, whereby IP addresses are shortened for the purpose of anonymization. A personal evaluation of the data, in particular for marketing purposes, does not take place.
Processing of the above data is necessary for technical reasons to offer a website pursuant to Art. 6 (1) Clause 1 lit. b), lit. c), lit. f) GDPR in order to display our website correctly to you and to guarantee stability and security. In particular, log files are created to prove attacks on our systems. We delete non-anonymous server log files regularly after seven days, but not later than 30 days after your visit.
In some cases, we use external service providers, who are bound by our instructions to process your data. These were selected and commissioned carefully by us and are controlled regularly. The orders are based on data processing agreements pursuant to Article 28 GDPR. The processor does not process data independently for its own purposes. If you have any questions about our order processors, please do not hesitate to contact us.
For the operation and hosting of this website we make use of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, located within the EU, which processes all usage data, meta and communication data of visitors or customers of this website on our behalf and on the basis of our legitimate interests in an efficient and secure provision of this online offer in accordance with Article 6 (1) Clause 1 lit. f) GDPR.
When you register as a speaker for the conference, we will process the data you provide when submitting your talk in order to process the contract. For the purpose of registration we need your name, your e-mail-address, your address, company, country of residence and a brief biography. Furthermore, the date and time of the order as well as data transmitted by your browser (see above server log files) are processed automatically.
The legal basis for the processing of your personal data is Article 6 (1) Clause 1 lit. b) GDPR. The legal basis for voluntarily provided information is Article 6 (1) Clause 1 lit. a) GDPR. We are obliged to save your ordering data for a period of ten years because of commercial and fiscal regulations (German federal Handelsgesetzbuch, German federal Abgabenordnung). However, we will perform a restriction of the processing after the congress. The legal basis for that is Article 6 (1) Clause 1 lit. b), lit. c) GDPR.
We use the pretalx ticket tool for registration. That is a service of pretalx / rixx.de Softwareentwicklung (Tobias Kunze) Dammstraße 18, 70806 Kornwestheim, which also stores the CFP submission system on its own servers. Entered data as well as your IP address and other automatically processed data are transferred to pretalx upon registration. We have concluded a data processing agreement with the service provider. In particular, this agreement guarantees that the transmission of your data is secure. The service provider does not process your personal data for its own purposes.
We would be pleased to give you the opportunity to contact us. If you contact us regarding the issue of data protection as well as any other matters, we will process the data provided by you so that we can take care of your request and respond to it. The processing of your data within the scope of contacting us via e-mail, telephone or via social media depending on the content of the enquiry for purely informational enquiries on the basis of your (presumed) consent pursuant to Article 6 (1) Clause 1 lit. a) GDPR or pursuant to Article 6 (1) Clause 1 lit. b) GDPR, as far as the contacts are in connection with contractual performance obligations. The information provided by users on the basis of Article 6 (1) Clause 1 lit. b) GDPR can be stored in a customer relationship management system ("CRM System").
We will delete your contact requests within a few days after processing. If you contact us by e-mail for informational purposes, you can object to the storage of your personal data at any time. In such a case, the conversation cannot be continued. Furthermore, you have the right to object to the storage of your personal data in a CRM system.
We will delete your contact inquiries from our active systems immediately after final processing, unless legal permissions or storage obligations permit or require further storage. For example, if you apply to us by e-mail, we will store your application data for a period of six months from the end of the application process.
When you visit offensivecon.org, the website also stores so-called cookies on your computer. Cookies are small text files that within the scope of your visit of our website are transmitted from our web server to your browser and are stored by your browser on your computer for later retrieval. You can determine by the settings in your browser, whether cookies can be set and retrieved. You can completely deactivate the storage of cookies in your browser, limit it to certain websites or configure your browser so that it automatically informs you as soon as a cookie is to be set and asks you for feedback.
In particular, we use session cookies. They store a so-called session ID, with which different requests of your browser can be assigned to a certain session. This allows your computer to be recognized when you return to our website, which offers significant added value for the registration function for our conference, for example. The session cookies are deleted when the expiry time of one week has been reached.
You can configure your browser settings according to your wishes and refuse the acceptance of third party cookies or all cookies, for example. The legal basis for the use of third party cookies as well as other offers from third parties is our legitimate interest (in the analysis, optimization and economic operation of the online service) pursuant to Article 6 (1) Clause 1 lit. f) GDPR, unless otherwise stated. You can object to the processing on the basis of our legitimate interests at any time.
Please consider the following notes on third-party cookies listed below.
We integrate the videos of the platform "YouTube" of the provider Google LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. If you visit one of our pages equipped with a YouTube plugin, a connection to the YouTube servers is established. The YouTube server is informed of which of our pages you have visited, stating your IP address.
If you are logged into your YouTube account, you allow YouTube to associate your surfing behavior directly with your personal profile. You may be able to prevent this by logging out of your YouTube account.
To protect your personal data, we have deliberately decided against implementing plug-ins from social network operators, with the exception of the integrated YouTube videos. Links to portals that you will find on our website are merely static links. Information is only transmitted to the service providers when you click on the button. If you are a member of one of the linked portals, the portal providers may link our profile and your visit to our website to your profile there. The following portals are linked by us. Further information can be found under the links listed below.
The LinkedIn and Google+ buttons implemented on our pages are static links. Information is only transmitted to the service providers when you click on the button. Further information is available at: https://www.linkedin.com/legal/privacy-policy?trk=%7Berror-page%7D-privacy-policy or https://policies.google.com/privacy?hl=en.
We maintain presences in social media in order to communicate with customers and prospective customers there and to keep them informed. When utilizing the relevant social media network, the terms and conditions of the respective social media network operators apply.
We apply technical and organizational security measures to protect our website and other systems against loss, destruction, access and change. Your data will only be transmitted encrypted via a secure and specifically hardened TLS connection.
Whether a single page of our website is transmitted in encrypted form is indicated by the closed key or lock symbol in the lower or upper status bar of your browser.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6