Privacy policy for website operators based on GDPR specifications

We are delighted you are visiting our website and thank you for your interest in our company and our Service. Data protection and data security are very important to us with regard to the use of our Services. We would therefore like to take this opportunity to inform you about the personal data we collect and what we use this data for. We will use your personally identifiable information for a number of reasons, for example, to contact you by mail, phone or online regarding our services and events and for marketing, advertising and sale efforts. We may disclose personally identifiable information to trusted affiliates, independent contractors and business partners who will use the information for the purposes outlined before. We may disclose aggregate, anonymous data to investors and potential partners. Finally, we may transfer information collected from you in connection with a sale of our business. As far as any data are transferred to third parties outside the EU we will care for equivalent security measures. Please note that information submitted to us via the internet can at no time be fully secured. You may withdraw your permission to use your personal data at any time by giving us notice at info@cloudfest.com.

We kindly ask you to routinely read this privacy policy as changes to legislation or our internal corporate processes can necessitate an adaptation of its content. You can call up, save and print out this privacy policy at any time under "Privacy Policy".

1. Controller

The data controller responsible for processing your personal data in connection with the use of the portal is:

WHD Event GmbH
Breite Straße 147 -151
50766 Köln
info@cloudfest.com

Data Protection Officer
Dr. Karsten Kinast, LL.M.
KINAST Rechtsanwaltsgesellschaft mbH
Nordstraße 17a
50733 Köln
whd@kinast.eu

2. Purpose of data processing

We provide you with access to our portal and to the content and functions available on it.

The provision of certain personal data is required to use the portal. The provision of this data is not based on consent but constitutes the contractual agreed consideration for access to and use of the portal, as well as for attending our events free of charge.

Without the provision of the required data, we cannot grant you access to our portal. You are free, exclusively on site, to purchase event tickets by paying the specified admission price and to attend the event without making use of the benefits of our portal.

3. Categories of personal data processed

As part of your registration and use of the portal, we process the following categories of personal data in particular:

• email address,
• Service sector in which your company operates,
• Country/region,
• Company size,
• Usage and interaction data relating to the event and the portal (e.g., participation in sessions, interaction with exhibitor stands and content, use of digital services, and analyses derived from this for lead qualifications),
• Data from cookies and similar technologies.

4. Specific data processing activities

We process your personal data for the following purposes:

a) Provision of the portal

To set up and manage your user account, and to provide the portal's functions and content. Access to the portal is granted not in return for a monetary payment, but in return for the provision of certain personal data. The provision of this data is an essential part of the user agreement and constitutes the agreed consideration for the use of the portal. Consent to data processing is not sought for this purpose, as data processing is necessary for the performance of the contract.

The legal basis for the processing of your personal data for the provision of the portal is Article 6(1)(b) and (f) GDPR. On the one hand, following registration, we grant you access to our event and our portal. On the other hand, we also have a legitimate interest (Article 6(1)(f) GDPR) in processing your data to generate leads to fulfil the purpose of our platform.

Your data will be stored for as long as the contract between you and us remains in force; beyond that, the data will only be stored for as long as statutory retention periods apply.

User accounts are marked as inactive two years after the last login and deleted after a further period of 90 days without any further activity, provided that no statutory retention obligations prevent this.

b) Provision of contractually agreed services

We process your personal data to fulfil the terms of the user agreement, to grant access to the services offered, and to authorize access to our events.

The legal basis for data processing is Article 6(1)(b) GDPR. The processing is necessary to fulfil the user agreement via the portal. The provision of certain personal data constitutes the contractually agreed consideration for access to the portal.

Your data will be stored for as long as the contract between you and us remains in force; beyond that, the data will only be stored for as long as statutory retention periods apply.

c) Live events and conferences

We organize many live conferences throughout the year (collectively, 'events'). When you register for one of our events, we access the information in your user account to provide you with information and services relating to the event, including, but not limited to, the following personal data:

• Title
• First name
• Surname
• Occupation
• Mobile number
• Company
• (Billing) address
• E-Mail address

You also agree that photos may be taken at our events, including those taken by our exhibitors or other third parties. Your event badge will also display the company on whose behalf you are attending the event.

If you are speaking at one of our events, we will collect information about you, including your name, your employer, your contact details and your photograph. In certain cases, we may also record and store a recording of your voice and your image.

When you attend our conferences, you will be given a beacon which records your location data at specific points. The use of these beacons serves, on the one hand, to ensure your safety during our events and thus to comply with legal obligations; it is therefore based on Article 6(1)(c) GDPR.

The processing of the aforementioned personal data also serves to fulfil a contract between you and WHD Event GmbH or to conduct (pre-)contractual activities in accordance with Article 6(1)(b) GDPR, for the benefit of all event participants.

Furthermore, the use of location data helps to analyze the interests of our visitors to make our events more attractive and to provide exhibitors with information about visitor behavior. This processing of your personal data is based on our legitimate interest in accordance with Article 6(1)(f) GDPR.

Your data will be stored for as long as the contract between you and us remains in force; beyond that, the data will only be stored for as long as statutory retention periods apply.

d) Analysis and commercial use of the data provided

The data you provide will also be processed for the following purposes:

• Compiling user analyses and generating leads
• Market and usage research
• Developing and improving our products and services
• Provision of aggregated analyses

The legal basis for this data processing is our legitimate interest pursuant to Article 6(1)(f) GDPR. We have a business interest in analyzing user data in order to improve our services and products.

Your data will be stored for as long as we require it for the purposes set out above. Your data will then be deleted or anonymized in such a way that it is neither personal nor personally identifiable.

e) Data processing to ensure the security of our services

Where necessary, we process your data to safeguard our legitimate interests in accordance with Article 6(1)(f) GDPR, in particular for:

• ensuring IT security,
• preventing misuse,
• analysing and improving our services,
• and enforcing legal claims.

We store your data for as long as we need it for the purposes mentioned above.

f) Generating leads

We process your data to generate leads for users of our platform.

The legal basis for the processing of your personal data is our legitimate interest pursuant to Article 6(1)(f) GDPR.

Based on your registration details and your interactions during the event and on the portal (e.g. participation in sessions, use of digital content, interaction with exhibitor content), we automatically calculate a score which is used to assess your interest in and relevance to specific topics or exhibitors. On this basis, you will be assigned to specific categories. This categorization is used to display more relevant content to you and to enable participating exhibitors to assess which participants might be particularly relevant to their offer.

Your data will be stored for as long as is necessary for the purposes mentioned above. Your data will then be anonymized and rendered unrecognizable in such a way that no conclusions can be drawn about your identity. Once the personal reference has been removed, data protection regulations no longer apply.

5. Obligation to provide data

The provision of the data referred to in clause three is a contractual requirement.

If you do not provide the required data, we will be unable to grant you access to the portal or enable you to use it.

6. Recipients of the data

Your personal data may be disclosed to the following categories of recipients:

• IT service providers and hosting providers (including external service providers responsible for maintaining our servers), providers of CRM and marketing automation solutions,
• Providers of event and venue technology (including check-in systems, event apps, and location tracking at the venue),
• Providers of accounting and invoicing software,
• Public authorities and courts where there are corresponding legal obligations. Where service providers function as data processors, processing takes place based on a contract in accordance with Article 28 GDPR.

7. Transfer to Third Countries

Where personal data is transferred to countries outside the European Economic Area, this is conducted only in compliance with the legal requirements set out in Articles 44 ff. GDPR.

This may, in particular, be conducted on the basis of an adequacy decision by the European Commission or appropriate safeguards, such as standard contractual clauses.

8. Your rights

You have the following rights in accordance with the statutory requirements:

• Right of access (Art. 15 GDPR),
• Right to rectification (Art. 16 GDPR),
• Right to erasure (Art. 17 GDPR),
• Right to restriction of processing (Art. 18 GDPR),
• right to data portability (Article 20 GDPR),
• right to object to processing based on Article 6(1)(f) of the GDPR (Article 21 GDPR).

To exercise your rights, you may contact us using the contact details provided above.

9. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data. The competent authority is Data Protection Authority of North Rhine-Westphalia.

10. Automated decision-making

No decision-making based solely on automated processing, including profiling within the meaning of Article 22 GDPR, takes place, unless otherwise stated in this privacy notice.

11. Cookies

We use cookies and similar technologies on our website. Cookies are small text files that are stored on your device and contain certain information relating to various relevant data. They serve to enable, analyze or personalize your visit to our portal according to specified parameters.

Depending on the purpose of the processing of personal data, we distinguish between technically necessary cookies, analytics cookies and marketing cookies.

a) Technically necessary cookies

Technically necessary cookies are required to provide the portal's basic functions and to ensure its operation. These include, for example, cookies used to store language settings, login details during a session or security functions.

The legal basis for the use of technically necessary cookies is our legitimate interest in the technically flawless operation of the portal pursuant to Article 6(1)(f) GDPR, or, insofar as the respective processing is necessary for the performance of a contract or the implementation of pre-contractual measures, Article 6(1)(b) GDPR.

As far as Section 25 of the German Telemedia Act (TDDDG) applies to the storage of information on your device or access to such information, this is done based on the necessity to provide the tele media service you have expressly requested.

b) Analytic cookies

Analytics cookies help us to understand how users interact with our portal. They enable us to collect statistical information about the use of our website, such as page views, time spent on the site or the origin of visitors. We use the insights gained to optimize our offering, improve user-friendliness, and generate leads.

Analytics cookies are only set if you have previously given your explicit consent in accordance with Article 6(1)(a) GDPR and Section 25 TDDDG for the storage of information on your device or access to such information.

You may withdraw your consent at any time with future effect or adjust your cookie settings.

c) Marketing and tracking cookies

Marketing and tracking cookies are used to recognize users across different websites, to measure the effectiveness of advertising campaigns and to display interest-based content or advertising. In doing so, information about your usage behavior, your interests or your interactions with advertising content may also be processed.

Marketing and tracking cookies are only set if you have previously given your explicit consent in accordance with Article 6(1)(a) GDPR and Section 25 TDDDG for the storage of information on your device or access to such information.

Cookies