Source: https://www.cong-o.de/index2.php?option=com_content&task=view&id=264&pop=1&page=0&Itemid=287
Timestamp: 2019-04-21 09:02:44+00:00

Document:
The information in this statement applies to the processing of personal data on our website and is intended to inform you of the purposes of the processing, the recipients, legal bases, storage time limits, and your rights. On principle, we process the personal data of our users only where this is necessary to maintain a functioning website and to provide our contents and services. Personal data are all data relating to you personally, such as your name, your address and your email address. “Data processing” means in particular the collecting, storing, use and transfer of your data.
Where we obtain the consent of the data subject for the processing of personal data, the legal basis is Art. 6 (1) a) of the EU General Data Protection Regulation (GDPR).
In processing personal data necessary for the performance of a contract to which the data subject is a party, Art. 6 (1) b) serves as the legal basis. This also applies when processing is necessary to take steps prior to entering into a contract.
Where the processing of personal data is necessary for compliance with a legal obligation to which our company is subject, Art. 6 (1) c) of the GDPR serves as the legal basis.
Where processing is necessary to protect the vital interests of the data subject or another natural person, the legal basis is Art. 6 (1) d) GDPR.
If processing is necessary to pursue the legitimate interests of our company or a third party and such interests are not overridden by the interests or fundamental rights and freedoms of the data subject, the basis of processing is Art. 6 (1) f) GDPR.
Personal data of the data subject are deleted or access to these data is blocked as soon as the reason for storage no longer applies. Storage may be made after the grounds for storage no longer apply if this is prescribed by law. Blocking or deletion of the data will also occur when a storage time limit prescribed by the above-mentioned norms expires unless there is a need to continue to store the data for conclusion or performance of a contract.
You will find further information on the legal bases of processing and the duration of storage regarding specific personal data in the respective sub-sections.
You will find information on your rights in Section III.
(8) the existence of automated decision-making including profiling pursuant to Art. 22 (1) and (4) GDPR and, at least in these cases, substantive information on the logic involved and the extent of and intended effects of such processing on the person concerned.
You have the right to request information as to whether the personal data relating to you will be transmitted to a third country or an international organisation. In this connection, you may request information on suitable guarantees in connection with the transfer pursuant to Art. 46 GDPR.
You have the right to rectification or completion if the personal data concerning you are inaccurate or incomplete. The rectification must be made without delay.
(4) you have objected to processing pursuant to Article 21(1) GDPR pending the verification whether our legitimate grounds override your grounds.
If processing has been restricted under the above-named conditions, you will be informed by the controller before the restriction of processing is lifted.
(6) the personal data concerning you have been collected in relation to the offer of information society services pursuant to Article 8(1) GDPR.
Where we have made the personal data public and are obliged pursuant to Article 17 (1) GDPR to erase the personal data, we shall take reasonable steps including technical measures, taking account of available technology and the cost of implementation, to inform controllers which are processing the personal data that you as the data subject have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.
If you have asserted the right to rectification, erasure or restriction of processing against us, we shall be obliged to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data concerning you have been disclosed, unless this proves impossible or involves disproportionate effort.
You have the right to be informed by us about those recipients.
In exercising this right, you also have the right to have the personal data concerning you transmitted directly from us to another controller, where technically feasible. The rights and freedoms of others may not be adversely affected.
The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.
You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.
We shall then no longer process the personal data concerning you unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defence of legal claims.
In the context of the use of information society services, and notwithstanding Directive 2002/58/EC, you have the option of exercising your right to object by automated means using technical specifications.
You have the right to revoke your declaration of consent under privacy law at any time. The lawfulness of the processing on the basis of your consent until revocation is not affected by the revocation.
However, these decisions may not be based on special categories of personal data referred to in Article 9(1) GDPR, unless point (a) or (g) of Article 9(2) GDPR applies and suitable measures to safeguard your rights and freedoms and legitimate interests are in place.
In the cases referred to in (1) and (3), we implement suitable measures to safeguard your rights and freedoms and legitimate interests, at least the right to obtain human intervention on the part of the controller, to express your point of view and to contest the decision.
Regardless of any other administrative or judicial remedies, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State in which you reside, have your place of work or where the alleged infringement occurred, if in your opinion the processing of the personal data concerning you infringes the GDPR.
The supervisory authority with which you lodge the complaint will inform you of the status and the results of the complaint, including the possibility of seeking judicial remedy pursuant to Article 78 GDPR.
These data are stored in our system’s logfiles.
The legal basis for collecting and storing the data is Article 6(1) f) GDPR.
The temporary storage of the IP address is necessary for displaying the website to you. For this, your IP address has to be stored for the duration of the visit. The remaining data are collected for technical reasons in order to ensure stability and security.
This also forms the basis of our legitimate interest in processing under Article 6(1) f) GDPR.
The data are deleted as soon as they are no longer required for the purpose for which they were collected. Data collected for the purpose of making the website available are deleted when each visit ends.
In the case of data stored in logfiles, this occurs at the latest within seven days. A longer storage period may occur. In this case, users’ IP addresses are deleted or altered so that it is no longer possible to identify the accessing client.
Collecting the data for making the website available and storing the data in logfiles is necessary for the operation of the internet page. Hence, the option of objecting is not available to the user.
The data contained in this QR code can be read with a special app. At the event, third parties may request you to allow the QR code to be scanned. If you do not wish third parties to collect these data from you, you should not accede to this request. The data can only be read if you hold your ticket directly in front of a scanning device. Disclosure of your data to third parties is not a condition of participating in the event.
Responsibility for data collection and processing lies with the respective third party. That third party’s data protection provisions and privacy statement apply.
We work together with the company PaySquare to process payment transactions. To process the transaction, you will be directed to PaySquare’s website and will then be requested to enter your payment data including personal data. Data collection and processing is done by PaySquare. Please take note of PaySquare’s information on data processing and privacy statement.
In the frame of the registration process you will be asked to consent to the processing of these data.
The legal basis for the data processing where you have given consent is Article 6(1)a) GDPR. If registration is necessary for the performance of a contract to which you are a party or to take steps prior to entering into the contract, processing is also based on Article 6(1)b) GDPR.
It is only possible to register for events via our website by providing the above-named data which is always required. The data provided in the context of your registration are therefore necessary for performance of a contract with you or to take steps prior to entering into a contract. Registration is also necessary for the provision of certain contents and services on our website in the form of the management of billing and delivery addresses. We may also use the collected data to contact the registered user about the event that he/she has booked.
The data are stored for three years from the end of the year in which the registration was made.
The data are necessary for performance of a contract or to take steps prior to entering into a contract. Hence, early deletion of the data is only possible if not barred by contractual or legal obligations.
We transmit some personal data we have received in the context of registration to service providers who work with us in processing the contracts we have entered into with you. These providers are our tax advisors, the printer that produces the entry tickets and in some cases companies and individuals that are responsible for the on-site running of the event.
In the frame of the registration process your consent to the processing of the data will be requested and reference will be made to this privacy statement.
The legal basis for the data processing is Article 6(1)a GDPR.
We collect and store your email address in order to send you the newsletter.
The collected data are stored as long as you subscribe to the newsletter.
You can revoke your consent at any time with future effect. This can also be done by cancelling your subscription.
The legal basis for processing personal data by using cookies is Article 6(1)f) GDPR.
The user data created by technical cookies will not be used to create legal profiles.
Cookies that are technically necessary are usually deleted when the browser is closed and the session ends. You can also delete cookies that have already been stored at any time.
Cookies are saved on your device which transmits them to us. Hence, by changing the settings in your browser, you can deactivate or restrict the transmission of cookies. If cookies for our website are deactivated it may no longer be possible for you to make full use of all the website’s functions.
We use the collected data to answer and process your requests. You are not required to provide us with your personal data. However, in that case, we will not be able to answer your request.
If you send us your data in the context of taking steps prior to entering into a contract, for example, when you request us to send an offer or you have a query regarding our products, the legal basis is Article 6(1)b) GDPR. In all other cases, the legal basis is Article 6(1)f) GDPR.
We process the personal data from the entry field only to deal with your contact request. If a contact request is made by email, this also provides us with the necessary legitimate interest in processing the data.
Other personal data processed when the contact form is sent serve to prevent misuse of the contact form and to ensure the security of our IT systems.
Your data are deleted when the circumstances show that your request or the relevant matter has been finally dealt with.
Personal data collected in addition when the request is sent are deleted after seven days.
Collection of the data is necessary to deal with the request sent via the contact form. Hence, the user does not have the option of objection.
On our website you can subscribe to a newsletter. To do this, you must enter your email address in the form provided for this on the website.
When you complete the form to subscribe to the newsletter, a record is created. In this record, changes you subsequently make to your subscription request are stored. The above data are stored again every time you make a change.
A record is also created of the messages we send you. We store information on which newsletters were sent to you and whether any have been returned.
When you make your subscription request we seek your consent to the processing of these data and refer to this privacy statement.
The legal basis for processing the data is Article 6(1)a) GDPR.
We collect and store the email address so that we can send you the newsletter.
The collected data will be stored as long as your subscription to the newsletter runs.
You may revoke your consent with future effect at any time. You can also do this by cancelling your subscription.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 22
 Art. 46