Privacy Policy

Basic Information

Affected individuals

This Privacy Policy applies to all individuals who visit this website and to those who enter into a contract with the data controller (see below) regarding participation in the “Zukunftstag Mittelstand” event, regardless of whether such contracts involve a fee or not. All references to persons include all genders and the corresponding linguistic forms, in particular diverse, female, and male. Each reference to a person is to be understood with the suffix “(m/f/d).”

Person in Charge

The controller responsible for the processing described here is: Der Mittelstand. BVMW e.V., Alte Potsdamer Straße 5, 10785 Berlin, represented by the Chairman of the Federal Executive Board, former Senator Christoph Ahlhaus, Phone: +49 30 533206–0, Fax: +49 30 533206–50, Email: info@bvmw.de.
We have appointed a Data Protection Officer: Manuel Langeheinecke (digitalNORD GmbH, Kiel, Schleswig-Holstein). You can contact him as follows: By mail at our company address with the note “Data Protection Officer,” by email at dsb@dnord.de or online at https://dnord.de.

Rights

(1) Data subjects have the following rights with respect to the data stored about them: the right of access, the right to have inaccurate data corrected, the right to have data erased when there is no longer a basis for retention, the right to restrict processing, and the right to data portability. Furthermore, they have the right to lodge a complaint with the supervisory authority responsible for the data controller.

(2) To the extent that processing is based on the consent of the data subjects, the data subjects may withdraw their consent at any time with future effect; for example, by sending an informal message to one of the contact channels listed above (data controller).

(3) To the extent that the processing is based on the fulfillment of a legitimate interest—that is, on Article 6(1), first sentence, subparagraph (f) of the GDPR—data subjects may object to the processing at any time; for example, by sending an informal message to one of the contact channels listed above (data controller). If the objection is justified, the processing will be discontinued. If the legitimate interest relates to direct marketing, the objection is always justified.

Transfer to Countries Outside the European Union

(1) If personal data is transferred to entities outside the European Union, the controller must provide supplementary safeguards in accordance with Article 44 et seq. of the GDPR.

(2) If the controller refers to a so-called adequacy decision in the following privacy policy, this means that the recipient is located in a country, territory, or specific sector for which the European Commission has determined that it provides an adequate level of data protection. This guarantee is then provided under Article 45 of the GDPR.

(3) If the controller refers to the so-called EU Standard Contractual Clauses in the following privacy policy, this means that the recipient has contractually committed to complying with the EU data protection principles on the basis of the so-called EU Standard Contractual Clauses. This guarantee is then provided under Article 45 of the GDPR.

(4) If the controller refers to so-called binding internal data protection policies in the privacy policy below, this means that the competent supervisory authority has authorized the transfer. The guarantee then stems from Article 47 of the GDPR.

(5) If the controller states in the following privacy policy that the data subjects have expressly consented to the transfer to a country outside the European Union, this means that they consent to the transfer despite being aware of all associated risks. This guarantee is based on Article 49(1)(a) of the GDPR. In this context, we draw attention to the following risks: In the United States, the Republic of India, and the Russian Federation, there is no codified data protection law comparable to the GDPR. Government agencies in those countries have granted themselves extensive access to data, and the principle of proportionality regulated in the EU does not apply there. Furthermore, there is no effective legal protection for EU citizens in these countries.

(6) The above information is provided for precautionary purposes only. It applies only if and to the extent that reference is made to it in the privacy policy that follows.

Additional Information

(1) No automated decision-making, including profiling, takes place.

(2) A legal obligation to process data exists only to the extent that reference is made below to Article 6(1), first sentence, subparagraph (c) of the GDPR.

Data Processing

(1) The process of entering into the contract proceeds as follows: Data subjects register for the above-mentioned event via an online form. Either the data subjects initiate contact with the data controller, or vice versa. In doing so, the data controller processes all data that the data subjects voluntarily provide. This includes contact information (name, contact details such as email address, mailing address, and phone number) as well as communication data (inquiries, etc.). The data controller uses the contact information to confirm participation. The data controller stores this data. The purpose is to initiate or establish a contract. The legal basis is Article 6(1), first sentence, letter b of the GDPR.

(2) After the contract is concluded, the controller collects additional communication data (invitation, event information, ticket delivery) in order to fulfill the contract. The purpose is the performance of a contract. The legal basis is Article 6(1), first sentence, subparagraph (b) of the GDPR.

(3) Upon termination of the contract, customer data will be retained as follows:

1. Data relevant to the taxation of the data controller is generally retained for six years. Notwithstanding this, certain data is retained for ten years. The respective retention period begins in the year in which the document was created. The purpose is to comply with a legal retention obligation. The legal basis is Article 6(1), first sentence, letter c of the GDPR in conjunction with § 147 of the German Fiscal Code (AO).

2. If the processing of the data is based on consent, the data processed on the basis of that consent will be retained until the consent is revoked or until the purpose for which it is processed no longer applies. The purpose is specified in the respective consent form. The legal basis is Article 6(1), first sentence, letter a of the GDPR.

3. Data proving that consent was given is retained for three years, with this period beginning on December 31 of the calendar year in which either the consent is revoked or the data is deleted for other reasons. The purpose is to comply with a legal retention obligation. The legal basis is Article 6(1), first sentence, subparagraph (c) of the GDPR in conjunction with Article 7(1) of the GDPR. The three-year retention period is based on Section 31(2)(1) of the German Administrative Offenses Act (OWiG) in conjunction with Article 83 of the GDPR.

(4) In addition to paragraph 2, it is possible that video, photo, and/or audio recordings may be made during the event. These recordings will be published on the social media platforms Facebook, Instagram, LinkedIn, Xing, X (formerly Twitter), and YouTube; with the exception of Xing, a transfer of data to the United States cannot be ruled out. The legal basis is Article 6(1), first sentence, letter a of the GDPR, i.e., the consent of the data subjects. The processing is also not precluded by the fact that sensitive data as defined in Article 9(1) of the GDPR may also be processed. This is because the exception under Article 9(2)(a) of the GDPR applies here, as the consent also covers the processing of such data (e.g., health data resulting from wearing glasses).

(5) In addition to paragraph 2, the controller may contact data subjects for marketing purposes via email. To do so, the controller uses the data subject’s name and email address. The purpose is to send marketing communications to data subjects with whom the controller has a contractual relationship. The legal basis is Article 6(1), first sentence, letter f of the GDPR, whereby the legitimate interest arises from the aforementioned purpose in conjunction with Recital 47. Data subjects are informed that they may object to this processing at any time and without providing a reason, without incurring any costs other than the transmission costs according to the standard rates.

(6) In addition to paragraph 2, the controller may send promotional materials to data subjects by mail. To do so, the controller uses the data subject’s name and mailing address. The purpose is to send promotional materials to data subjects with whom the controller has a contractual relationship. The legal basis is Article 6(1), first sentence, subparagraph (f) of the GDPR, whereby the legitimate interest arises from the aforementioned purpose in conjunction with Recital 47. Data subjects are informed that they may object to this processing at any time and without providing a reason, without incurring any costs other than the transmission costs according to the standard rates.

(7) In addition to paragraph 2, the controller contacts data subjects for marketing purposes by telephone. To do so, the controller uses the data subject’s name and mailing address. The purpose is to contact data subjects with whom the controller has a contractual relationship for marketing purposes. The legal basis is Article 6(1), first sentence, letter a of the GDPR, i.e., consent. Data subjects are informed that they may withdraw their consent at any time and without providing a reason, without incurring any costs other than the transmission costs according to the standard rates. To do so, simply send an informal message via one of the contact channels listed above.

Data processors and third parties that receive data

The following third-party providers receive personal data:

Consent Management Tool: We use the “CookieFirst” service provided by Digital Data Solutions B.V. (Netherlands) to obtain and manage your consent to the storage of certain cookies in your browser. To this end, CookieFirst stores a technically necessary cookie that records your consent status. This processing is based on Article 6(1)(c) of the GDPR, as we are legally obligated to maintain records of the consents you have granted, as well as on the basis of Article 6(1)(f) of the GDPR, as we have a legitimate interest in obtaining consents in a manner that is both legally compliant and user-friendly.

If you actively consent to the setting of optional cookies, the processing is additionally based on your consent pursuant to Article 6(1)(a) of the GDPR. Further information can be found in CookieFirst’s privacy policy: https://cookiefirst.com/legal/privacy-policy.

Third-Party Providers: The social network “Facebook,” operated by Meta Platforms Ireland Limited (Ireland – EU), is used to publish video, audio, and photo recordings of the event. However, it cannot be ruled out that data may be transferred to or integrated with the parent company, Meta Platforms Inc. (U.S.). To the extent that the data controller and the provider of the social network or platform described here are jointly responsible, the agreement can be found here: https://www.facebook.com/legal/terms/page_controller_addendum. This page contains all information regarding the scope of application and the division of responsibilities. In all other cases, the social network or media provider has been commissioned in accordance with Article 28 of the GDPR. Further details on the manner of processing by this third-party provider are described here: https://www.facebook.com/business/gdpr. The use of this third-party provider is not precluded by the fact that data transfer to or integration with the parent company based in the U.S. cannot be ruled out. This is because the processing of personal data via this tool takes place only if the data subjects consent to the associated data transfer to the United States (see Article 49(1)(a) of the GDPR). This consent is given when registering for the event.

Third-Party Providers: The social network “Instagram,” operated by Meta Platforms Ireland Limited (Ireland – EU), is used to publish video, audio, and photo recordings of the event. However, it cannot be ruled out that data may be transferred to or integrated with the parent company, Meta Platforms Inc. (U.S.). To the extent that the data controller and the provider of the social network or platform described here are jointly responsible, the agreement can be found here: https://www.facebook.com/legal/terms/page_controller_addendum. This document contains all information regarding the scope of application and the division of responsibilities. In all other cases, the provider of the social network or platform has been commissioned in accordance with Article 28 of the GDPR. Further details regarding the manner of processing by this third-party provider are described here: https://help.instagram.com/519522125107875. The use of this third-party provider is not precluded by the fact that data transfer to or integration with the parent company based in the United States cannot be ruled out. This is because the processing of personal data via this tool takes place only if the data subjects consent to the associated data transfer to the United States (see Article 49(1)(a) of the GDPR). This consent is given when registering for the event.

Third-Party Providers: The social network “LinkedIn,” operated by LinkedIn Ireland Unlimited Company (Ireland – EU), is used to publish video, audio, and photo recordings of the event. However, it cannot be ruled out that data may be transferred to or integrated with the parent company, LinkedIn Corporation (U.S.). Further details on how this third-party provider processes data are described here: https://www.linkedin.com/legal/privacy- policy?trk=hb_ft_priv.. The use of this third-party provider is not precluded by the fact that data transfer to or involvement of the parent company, which is based in the U.S., cannot be ruled out. This is because the processing of personal data via this tool takes place only if the data subjects consent to the associated data transfer to the U.S. (see Article 49(1)(a) of the GDPR). This consent is given when registering for the event.

Third-Party Providers: We use the “LinkedIn Insight Tag” from LinkedIn Ireland Unlimited Company on our website. This tag allows us to collect information about how our website is used, specifically which pages you have visited and what actions you have taken. This data is used to better target our advertising efforts on LinkedIn and to obtain statistical analyses of campaign effectiveness .
If consent has been obtained (e.g., via a consent tool), processing is based exclusively on Article 6(1)(a) of the GDPR.
The data collected is anonymous to us but personal to LinkedIn and, according to LinkedIn, is used to display relevant content and improve the user experience on LinkedIn. For more information, please see LinkedIn’s Privacy Policy: https://www.linkedin.com/legal/privacy-policy.
You can object to the processing at any time. LinkedIn members can do so via their account settings. Non-members can disable cookies via the LinkedIn opt-out page: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out.

Third-Party Provider: The social network “Xing,” operated by New Work SE (Germany – EU), will be used to publish video, audio, and photo recordings of the event. Further details on how this third-party provider processes data are described here: https://privacy.xing.com/de.

Third-Party Providers: The social network “X” operated by X Corp. will be used to publish video, audio, and photo recordings of the event. However, it cannot be ruled out that data may be transferred to or integrated with the parent company, X Holdings Corp. (USA). Further details on how this third-party provider processes data are described here: https://x.com/de/privacy. The use of this third-party provider is not precluded by the fact that a data transfer to or the involvement of the parent company, which is based in the U.S., cannot be ruled out.  This is because the processing of personal data via this tool takes place only if the data subjects consent to the associated data transfer to the U.S. (see Article 49(1)(a) of the GDPR). This consent is given when registering for the event.

Third-Party Providers: Our website uses plugins from the video portal Vimeo. The provider is Vimeo Inc., 555 West 18th Street, New York, New York 10011, USA. When you visit one of our pages that includes a Vimeo plugin, a connection is established to Vimeo’s servers. In the process, the Vimeo server is informed which of our pages you have visited. In addition, Vimeo obtains your IP address. This applies even if you are not logged in to Vimeo or do not have a Vimeo account. The information collected by Vimeo is transmitted to the Vimeo server in the U.S. If you are logged into your Vimeo account, you allow Vimeo to directly associate your browsing behavior with your personal profile. You can prevent this by logging out of your Vimeo account. For more information on how user data is handled, please see the Vimeo Privacy Policy at: https://vimeo.com/privacy.
Please note that, due to the Cloud Act, U.S. intelligence agencies may gain access to personal data that is inevitably exchanged when this tool is integrated, as a result of the Internet .
To the extent required by law, we have obtained your consent for the processing of your data described above in accordance with Art. 6(1) (a) of the GDPR. You may revoke your consent at any time with future effect. To exercise your right to revoke consent, deactivate this service in the “Cookie Consent Tool” provided on the website.

Third-Party Provider: The video playback tool “YouTube” from Google Ireland Ltd. (Ireland — EU) is used to publish video, audio, and photo recordings of the event. The provider has been commissioned in accordance with Article 28 of the GDPR. However, it cannot be ruled out that data may be transferred to or integrated with the parent company, Google LLC (U.S.). The use of this third-party provider is not precluded by the fact that data transfer to or integration with the parent company, which is based in the U.S., cannot be ruled out. This is because the processing of personal data via this tool takes place only if the data subjects consent to the associated data transfer to the U.S. (see Article 49(1)(a) of the GDPR). This consent is given as part of the registration process for the event.

Third-Party Provider: An external photographer, who has been commissioned in accordance with Article 28 of the GDPR, is used to take photographs.

Third-Party Provider: An external videographer, who has been commissioned in accordance with Article 28 of the GDPR, is used to produce video recordings.

Third-Party Provider: An external audio service provider, which has been commissioned in accordance with Article 28 of the GDPR, is used to produce audio recordings.

Third-Party Providers: We use the CRM tool Salesforce for the purposes of registration management and event organization. The provider of this tool is Salesforce, Inc., which is represented in Germany by Salesforce.com Germany GmbH, Erika-Mann-Str. 63, 80636 Munich, Germany. For more information on data protection at this company, please visit: https://www.salesforce.com/gdpr/overview/. The provider has been commissioned in accordance with Article 28 of the GDPR. The fact that Salesforce, Inc. is headquartered outside the European Union does not preclude this engagement. This is because, in the event that data is processed outside the United States, we rely on Article 47 of the GDPR in conjunction with Salesforce’s Processor Binding Corporate Rules for the Processing of Personal Data, see https://www.salesforce.com/content/dam/web/en_us/www/documents/legal/misc/Salesforce-Processor-BCR.pdf.

Third-Party Providers: We use the “Salesforce” service provided by Salesforce, Inc. to make online forms available and process them. The data you enter is processed on Salesforce’s servers. Salesforce acts on our behalf as a data processor pursuant to Article 28 of the GDPR. The legal bases for the processing are your consent under Article 6(1)(a) of the GDPR, to the extent that you have provided it to us; Article 6(1)(b) of the GDPR, to the extent that it concerns the performance of a contract or the implementation of pre-contractual measures; and Article 6(1)( f GDPR, our legitimate interest in the efficient and secure processing of inquiries.
It cannot be ruled out that data may also be transferred to the United States. Salesforce is obligated under the EU Standard Contractual Clauses (Article 46 of the GDPR) to ensure an adequate level of data protection. Further information on this can be found in Salesforce’s Privacy Policy: https://www.salesforce.com/company/privacy/.

Third-party providers: We use the event management service “Doo” provided by doo GmbH (Germany — EU).

Third-Party Providers: We use Google Analytics in a server-side implementation. In this process, your usage data is first processed on our server and only then transmitted to Google in a truncated form. There is no direct transfer of personal data (such as your IP address) to Google. The purpose of this processing is to analyze user behavior in order to optimize our online offering. 

Third-Party Providers: In connection with the analysis of user behavior, the central management tool “Google Tag Manager” from Google Ireland Ltd. (Ireland — EU) is used; this company has been appointed as a processor pursuant to Article 28 of the GDPR. Further details on how this third-party provider processes data are described here:&https://marketingplatform.google.com/intl/de/about/tag-manager/. It should be added that this tool enables the controller to integrate various codes and services into this website in an organized and simplified manner. In doing so, this tool implements the tags or triggers the tags integrated through it. When a tag is triggered, the provider may also process personal data. It cannot be ruled out that the provider may also transfer the data to a server in a third country. However, the transfer of data to the United States—possibly in cooperation with Google LLC (U.S.)—does not preclude such processing.  This is because the processing of personal data takes place only if the data subjects consent to the associated data transfer to the United States (see Article 49(1)(a) of the GDPR).

Web Hosting: We use the Google Cloud Platform provided by Google Cloud EMEA Ltd. to deliver our online services. Data processing generally takes place on servers in Frankfurt am Main (Germany). Google acts as our data processor in this context pursuant to Article 28 of the GDPR. The legal basis is Article 6(1)(f) of the GDPR, our legitimate interest in a secure and scalable infrastructure, or Article 6(1)(b) of the GDPR, to the extent that processing is necessary for the performance of a contract.
It cannot be ruled out that, in the context of maintenance and administrative tasks, access may occur from the United States. In such cases, the data transfer is based on the EU Standard Contractual Clauses pursuant to Article 46 of the GDPR, which we have entered into with Google. For more information, please see Google’s Privacy Policy: https://policies.google.com/privacy.