Privacy Policy

1. Controller

The party responsible for processing personal data on this website is:

German Legal Tech Hub GmbH
Hans-Böckler-Allee 26
30173 Hannover
Germany

Phone: 0511 547 47 49 46
E-mail: info@germanlegaltechhub.com

For the purchase of tickets for the German Legal Tech Summit, the contracting party and data controller is German Legal Tech Summit GmbH, Hans-Böckler-Allee 26, 30173 Hannover (Section 10).

2. Overview

Personal data is any data that can be used to identify you personally. We process data you provide to us directly – for example, in a form, when making a booking or placing an order – as well as technical data generated automatically when you visit the website. We do not use cookies or any third-party analytics or advertising services on this website. We measure how our pages are used with our own cookie-free method (Section 6).

3. Hosting and access logs

This website is hosted on a server operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Hetzner processes data solely on our behalf (Art. 28 GDPR).

When you access a page, your browser technically transmits data to the server: IP address, date and time, the address accessed, the amount of data transferred, status code, referring website, and browser and operating system. The server records this information in an access log in order to deliver the website, identify errors and defend against attacks. The log is limited in scope and is continuously overwritten; no evaluation relating to individual persons takes place. The legal basis is our legitimate interest in the secure and reliable provision of the website (Art. 6(1)(f) GDPR).

The connection is fully encrypted via TLS throughout.

4. No cookies, local storage in the browser

This website does not set cookies. We only store in your browser's storage what you trigger yourself and what is necessary for the function you have requested:

• Your choice of display (light, dark or automatic) when you change it using the switch above (stored permanently in your browser until you select “automatic” or clear the website data),
• your entries in the ticket shop for the duration of the browser session, so that they are retained if payment is interrupted, as well as the billing address for the text of the confirmation page.

This information never leaves your device. The legal basis is § 25(2) No. 2 TDDDG (strictly necessary for the service you have requested).

5. Documents, images and dates

Fonts, images and logos are served from our own server; no data is transmitted to third parties when they load. The current dates shown in the calendar and on the event pages are loaded directly by your browser from our management system (Hub OS), whose database is hosted by Supabase Inc. on servers in Frankfurt am Main (EU). For technical reasons, your IP address is transmitted to this server in the process; no personal data about you is requested or stored. The legal basis is Art. 6(1)(f) GDPR (current dates without having to reload the page).

6. Visitor statistics and heatmap without cookies

To understand which content is being used and to improve the website, we analyse usage with our own in-house process. No cookies are set and no information is stored on your device. No tracking takes place in the “My Hub” member area.

• Visit statistics: We record the page visited (without parameters) and its title, the time of the visit, how long the page remained visible, the referring website (its domain only), campaign parameters (UTM) where applicable, device type, browser and operating system (in general terms only), screen width, browser language, and clicks on links to other websites (their address only, without parameters). The IP address is used to determine the approximate location (country; for Germany, Austria and Switzerland, also region and city). The IP address itself is not stored: to distinguish between visits, a non-reversible checksum is generated from the IP address and browser identifier together with a random value that changes daily. The random value is deleted after one day; after that, the checksum can no longer be linked to any individual or IP address. Visitors cannot be recognised across multiple days. To determine location, we use the “IP to City Lite” database from DB-IP (db-ip.com, licensed under CC BY 4.0) within our own system; no data is transmitted to DB-IP.
• Heatmap: To see which areas of a page attract interest, we also anonymously record where on a page is clicked, where the cursor moves (only when using a mouse) and how far users scroll. We only store the page visited (without parameters), the device type (computer or smartphone, based on screen width), the relevant element on the page with its approximate position, and the scroll depth reached — and only as daily totals. Form field entries are not recorded, nor are IP addresses, browser identifiers or visitor IDs; it is not possible to link this data to individual visits or persons. The script for this is loaded by your browser from our server hub.germanlegaltechhub.com (Hetzner Online GmbH, Germany); for technical reasons, your IP address is transmitted to this server in the process, but it is not used for the heatmap.

The data is processed in our management system (Hub OS) on servers operated by our processor Supabase in Frankfurt am Main (EU) and is not passed on to third parties. The legal basis is our legitimate interest in the needs-based design and improvement of our website (Art. 6(1)(f) GDPR). You may object to this measurement at any time (Section 14).

7. Contact form, enquiries and registrations

If you write to us via the contact form, enquire about or book a membership, or register for an appointment, we transmit your details (e.g. name, e-mail address, organisation, query, chosen appointment or package) in encrypted form to our administration system (Hub OS). There, we create a record for you and – where provided – for your organisation in connection with your enquiry. This serves to process your enquiry, clarify any follow-up questions, and enable traceable communication with you.

We operate our own administration system. It runs on servers located in Germany (Hetzner Online GmbH); the database is hosted within the EU (Supabase, Frankfurt am Main). The service providers we use process data solely on our behalf, based on data processing agreements (Art. 28 GDPR). We do not share your data with third parties without your consent.

The legal basis is Art. 6(1)(b) GDPR, insofar as your enquiry relates to a contract or pre-contractual measures (such as membership or participation in events), and otherwise Art. 6(1)(f) GDPR (legitimate interest in processing enquiries and maintaining business contacts). Your details remain stored until your enquiry has been fully processed and there is no further reason for retention, or until you object or request deletion. Statutory retention obligations – for example, if a contract arises from the enquiry – remain unaffected.

To protect against automated submissions, our forms contain a field that is invisible to humans; any input entered into this field is discarded.

8. Membership and payment

To process a membership, we handle the details from your booking (organisation, contact person, named individuals, billing address, chosen package, payment method) within Hub OS. Named individuals receive an invitation to the “My Hub” member area. If you choose SEPA direct debit or credit card, you’ll receive a link to the payment page of Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details directly with Stripe; we do not store any card or bank details, only a customer and payment identifier from Stripe to check the payment status. Stripe’s privacy notice: stripe.com/de/privacy. The legal basis is Art. 6(1)(b) GDPR, and for invoices and their retention, Art. 6(1)(c) GDPR.

9. Newsletter

For the newsletter, we need your e-mail address; first and last name are optional. We use the double opt-in procedure: after signing up, you’ll receive an e-mail with a confirmation link, and registration is only complete once you’ve clicked it. We store the time of sign-up and confirmation in order to be able to demonstrate consent. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe from the newsletter at any time via the unsubscribe link in any e-mail or by writing to info@germanlegaltechhub.com.

Dispatch is handled by Resend, Inc. (USA) as a data processor (resend.com/legal/privacy-policy). Our newsletters contain a small tracking pixel and links routed through our own domain. This allows us to see whether and when a newsletter was opened and which links were clicked; we use this to improve our newsletters. This, too, is based on your consent to receive the newsletter and ends upon unsubscribing. We block undeliverable addresses and unsubscribed recipients from further newsletters.

10. Ticket purchases for the German Legal Tech Summit

You can buy tickets for the German Legal Tech Summit in the ticket shop on this website. It's the same ticket shop as on germanlegaltechsummit.com.

1. Data controller: The controller responsible for processing personal data in connection with ticket purchases is German Legal Tech Summit GmbH, Hans-Böckler-Allee 26, 30173 Hannover, email info@germanlegaltechhub.com (organiser and contracting party). Orders are transmitted directly to the organiser's management system (Hub OS) and stored there. This website and the Hub OS are operated by German Legal Tech Hub GmbH as processor pursuant to Art. 28 GDPR on servers belonging to Hetzner Online GmbH (Germany); the database is hosted by Supabase Inc. as processor on servers in Frankfurt am Main (EU). The German Legal Tech Summit's privacy policy applies in addition, in particular for the visitor app and contact exchange with exhibitors.
2. Details of the person placing the order (purchaser): the type of purchaser (company/law firm, public authority/public institution or private individual); title, first and last name, optional academic title; e-mail address, optionally a different e-mail address for invoicing, optional phone number; billing address (street, postcode, city, country); for companies and public authorities, the company name or authority/department, optionally VAT identification number, optionally order number or reference number, for public authorities optionally the Leitweg-ID; order details (tickets selected, prices, discount code used, payment method, payment status, order number, time of order, language, time and version of the accepted ticket terms and conditions); a checksum (hash value) of the IP address to prevent misuse (limiting requests per connection) – the IP address itself is not stored.
3. Participant details: One named person is required per ticket (personalised ticket): title, first and last name, optional academic title, e-mail address, optional company, optional phone number and address. If the purchaser provides the details of other people (e.g. colleagues), they must first inform them about this disclosure and this privacy policy. Participants receive their ticket by e-mail.
4. Purposes: We process this data to accept, confirm and fulfil the order (order confirmation, contract text, ticket terms and conditions), to issue and send tickets, to verify and redeem discount codes, to process payment and issue invoices or e-invoices, to manage entry control, to provide organisational information to attendees before and after the event (e.g. programme, travel arrangements, changes), to handle withdrawals, cancellations, name changes and refunds, to comply with statutory retention obligations, to assert or defend legal claims, and to prevent misuse of the ticket shop. For these purposes, buyers and attendees are recorded as contacts in our administration system or matched to an existing contact; the booking is recorded as participation in the event.
5. Legal bases: Art. 6(1)(b) GDPR for order processing, tickets, payment, admission, organisational information and cancellation/withdrawal (contract with the purchaser; for attendees who do not place the order themselves, additionally Art. 6(1)(f) GDPR – legitimate interest in performing the contract concluded by the purchaser); Art. 6(1)(c) GDPR for invoicing, e-invoicing and record-keeping (§ 14 UStG, § 147 AO, § 257 HGB); Art. 6(1)(f) GDPR for preventing misuse and fraud, matching with existing contacts, and asserting or defending legal claims. Without the mandatory details (name, email address, billing address; for each ticket, name and email address), the order cannot be accepted. For paid orders, the organiser also uses the purchaser's email address to provide information about similar events run by the German Legal Tech Summit (§ 7(3) UWG, Art. 6(1)(f) GDPR). We draw attention to this when the order is placed and in the order confirmation. You may object to this at any time, for example via the unsubscribe link in every email or by emailing info@germanlegaltechhub.com, at no cost other than the transmission charges based on standard rates.
6. Reminder for incomplete orders: Anyone who, when placing an order by card payment, ticks the voluntary box “If I don’t complete my order, the German Legal Tech Summit may send me a single e-mail reminder” will, if the order is not completed, receive exactly one reminder e-mail at the address provided, no earlier than 24 hours later, containing a link back to the ticket shop. The legal basis is consent (Art. 6(1)(a) GDPR, § 7(2) no. 2 UWG). Without ticking the box, no reminder will be sent; this is independent of the order itself. Consent can be withdrawn at any time with effect for the future, e.g. by e-mailing info@germanlegaltechhub.com or by a brief reply to the reminder. For evidentiary purposes, we store the time and wording of the consent together with the order until the standard limitation period expires (three years).
7. Payment via Stripe: If you pay by card or another payment method offered via Stripe (e.g. Apple Pay, Google Pay), you will be redirected to the payment page of Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe collects the payment data there itself (e.g. card number, expiry date, security code); the organiser does not receive it. We transmit the order number, amount, ticket description and the buyer’s e-mail address to Stripe. We receive the payment status, time, payment method and a payment identifier from Stripe. Stripe processes data to process the payment and – as an independent controller – for fraud prevention, risk assessment and compliance with its own statutory obligations (e.g. anti-money laundering); for this purpose, Stripe may also collect device and connection data. Transfer to Stripe, Inc. in the USA is possible; this takes place on the basis of the EU-US Data Privacy Framework, to which Stripe has acceded, as well as the EU Standard Contractual Clauses. Stripe’s privacy notice: stripe.com/de/privacy. The legal basis is Art. 6(1)(b) GDPR, and for fraud prevention Art. 6(1)(f) GDPR.
8. Purchase on invoice, invoices and e-invoices: Companies and public authorities may order on invoice; no external payment service is used for this. For every paid order, the organiser issues an invoice containing the details required under § 14(4) UStG (invoice recipient and address, VAT ID number and order number where applicable, participants' names in the service description, any discount code used). The invoice is issued as an electronic invoice (ZUGFeRD/Factur-X), and for public authorities with a Leitweg-ID additionally in XRechnung format, and is sent by e-mail to the (billing) address provided. We reconcile incoming payments made on invoice with our account statements. For orders over €0.00 (e.g. using a 100% discount code), no invoice is issued; instead, a booking confirmation is provided. The legal basis is Art. 6(1)(b) and (c) GDPR.
9. Ticket with QR code and admission control: Each ticket contains a QR code with a randomly generated ticket identifier; no names or other data are contained in the QR code. At admission, the QR code is scanned and matched against the ticket; we record that and when the ticket was redeemed. Photo identification may be requested to verify personalisation. The legal basis is Art. 6(1)(b) GDPR; admission control also serves the legitimate interest in safe event operations and the prevention of ticket misuse (Art. 6(1)(f) GDPR).
10. Sending e-mails: We send order confirmations, invoices, tickets, acknowledgements of receipt of a withdrawal, and organisational information from the mailbox info@germanlegaltechhub.com via Microsoft 365 (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland; data processor pursuant to Art. 28 GDPR). If this route is unavailable, we use Resend as a fallback (see Section 9). Both services may transfer data to the USA; this is based on the EU-US Data Privacy Framework, to which Microsoft and Resend have both acceded, as well as the EU Standard Contractual Clauses.
11. Right of withdrawal: Private individuals (consumers) may withdraw from their contract in accordance with the withdrawal instructions, including via the “Withdraw from contract” button on the Right of withdrawal page. For this purpose, we process name, e-mail address, order number, an optional note, the time of receipt and a checksum (hash value) of the IP address; the confirmation of receipt is sent by e-mail to the address provided. The legal basis is Art. 6(1)(b) and (c) GDPR (§§ 355, 356a BGB).
12. Retention period: Invoices, cancellation invoices and booking records, including the order data they contain, for eight years from the end of the calendar year in which they were created (§ 147(1) no. 4, (3) AO, § 14b(1) UStG); commercial and business correspondence (e.g. the order confirmation) for six years (§ 147(1) nos. 2, 3 AO, § 257 HGB). Ticket and attendee data not contained in records (e.g. an attendee's email address and admission record) is kept until the event and its organisational follow-up have been concluded, unless another legal basis applies (e.g. consent to the newsletter, participation in future events). Withdrawals and proof of consent are kept until expiry of the standard limitation period (three years, § 195 BGB). The checksum of the IP address is kept for as long as necessary to prevent misuse.
13. Your rights: The rights set out in Section 14 apply to the data from ticket purchases, vis-à-vis German Legal Tech Summit GmbH. A notification to info@germanlegaltechhub.com is sufficient. Statutory retention obligations take precedence over deletion; the data will then be blocked until the retention period expires.

11. Recipients and data processors

We only pass on personal data where necessary for the stated purposes, where there is a legal obligation to do so, or where you have given your consent. The following service providers process data on our behalf (Art. 28 GDPR):

• Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen – server for website and administration system (Germany),
• Supabase Inc. – database for the administration system (servers in Frankfurt am Main, EU),
• Resend, Inc. – sending of e-mails and newsletters,
• Microsoft Ireland Operations Limited – e-mail mailbox and dispatch of e-mails from the ticket shop.

Stripe Payments Europe, Ltd. processes payment data for memberships and ticket purchases (Sections 8 and 10), in some cases as an independent controller. When tickets are purchased, German Legal Tech Summit GmbH, as the contractual partner, receives the order data (Section 10).

12. Transfers to third countries

For certain service providers (Resend, Microsoft, Stripe), personal data may be transferred to the USA. This takes place on the basis of the European Commission’s adequacy decision on the EU-US Data Privacy Framework, to which these companies have acceded, supplemented by the EU Standard Contractual Clauses (Art. 45, 46 GDPR). The database of our administration system is hosted in Frankfurt am Main (EU).

13. Storage period

We store personal data only for as long as necessary for the relevant purpose, for as long as consent applies, or for as long as statutory retention obligations require. Under commercial and tax law, we retain invoices and booking records for eight years and commercial correspondence for six years, each counted from the end of the calendar year (§ 147 AO, § 257 HGB, § 14b UStG). The data is then deleted.

14. Your rights

You have the right to information about the data stored about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you may object at any time for reasons arising from your particular situation (Art. 21(1) GDPR). You may object at any time, without giving reasons, to the use of your data for direct marketing (Art. 21(2) GDPR).

For any queries, simply send a message to info@germanlegaltechhub.com. No automated decision-making, including profiling (Art. 22 GDPR), takes place.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the supervisory authority of the State of Lower Saxony: Der Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover.

16. Changes

We update this privacy policy whenever our website, our offering or the legal requirements change. The version published here at any given time applies.

Last updated: November 2026