Privacy Policy — FACE. Congress

1Overview and controller

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations, in particular the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

This privacy policy explains what personal data we collect on our website facecongress.com, how we use it and what rights you have.

The controller responsible for data processing on this website is:
FACE CONGRESS GmbH
Ayça Aral (sole Managing Director)
Agrippinaufer 8, 50678 Cologne, Germany
Email: info@facecongress.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Data protection contact: For all questions regarding data protection, please contact us at info@facecongress.com. We have not appointed a Data Protection Officer, as we are not legally required to do so.

2Your rights

You have the following rights at any time, free of charge:

Right of access (Art. 15 GDPR): to obtain confirmation as to whether we process your data and to receive a copy of that data.
Right to rectification (Art. 16 GDPR): to have inaccurate data corrected or incomplete data completed.
Right to erasure (Art. 17 GDPR): to have your data deleted, provided no legal retention obligations apply.
Right to restriction of processing (Art. 18 GDPR).
Right to data portability (Art. 20 GDPR): to receive your data in a structured, commonly used and machine-readable format.
Right to object (Art. 21 GDPR): to object to processing based on our legitimate interests, for reasons arising from your particular situation.
Right to withdraw consent (Art. 7 (3) GDPR): where processing is based on consent, you may withdraw it at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise any of these rights, please contact us at info@facecongress.com.

Right to lodge a complaint with a supervisory authority: Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2–4, 40213 Düsseldorf, Germany
https://www.ldi.nrw.de

You may also contact the supervisory authority in the EU member state of your habitual residence or place of the alleged infringement.

3General information on data processing

Access data / server log files

When you visit our website, the hosting provider automatically collects and stores information in so-called server log files, which your browser transmits automatically. This includes: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request, and the IP address.

This data is not merged with other data sources. The processing is carried out on the basis of Art. 6 (1) (f) GDPR. We have a legitimate interest in the technically error-free presentation and optimisation of our website and in the security of our IT systems, which requires the temporary logging of server log files.

Hosting

Our website is hosted by webgo GmbH, Heidenkampsweg 81, 20097 Hamburg, Germany. The personal data collected on this website is stored on the servers of webgo. We have concluded a data processing agreement (DPA) pursuant to Art. 28 GDPR with webgo to ensure data protection-compliant processing. The legal basis is our legitimate interest in the secure and efficient provision of our website (Art. 6 (1) (f) GDPR).

4Cookies and consent

Our website currently does not use its own tracking or analytics cookies. However, embedded third-party services (see section 6, in particular the Kajabi form embeds) may set cookies or use comparable technologies that are technically necessary to display and operate the embedded forms.

Where the storage of information on your device, or access to such information, is not strictly necessary for the operation of the website, this is only carried out with your consent pursuant to § 25 (1) of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6 (1) (a) GDPR. You may withdraw such consent at any time with effect for the future.

5Data collection on this website

Contacting us by email

If you contact us by email (for example via the address info@facecongress.com or an email link on this site), the information you provide — including your email address, name and the content of your message — will be stored by us for the purpose of processing your enquiry and in case of follow-up questions.

Legal basis: Where your enquiry relates to the initiation or performance of a contract, processing is based on Art. 6 (1) (b) GDPR. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR) and, where requested, on your consent (Art. 6 (1) (a) GDPR).

Retention: We retain this data until the purpose for storing it no longer applies (e.g. once your enquiry has been fully dealt with), unless statutory retention periods require longer storage.

Registration and event booking (Kajabi)

Registration and booking for our congress is intended to be handled via the Kajabi platform (see section 6). If you register or book through the embedded Kajabi forms, the data you enter (such as name, email address, and further registration details) is processed to carry out your registration and the contract for participation.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract or pre-contractual measures).

6Third-party services and data transfers

Kajabi (forms, registration and event platform)

Our website embeds forms and functionality provided through the Kajabi platform (embedded via the domain academy.face.cologne, technically operated by Kajabi). Provider: Kajabi, LLC, 17100 Laguna Canyon Road, Suite 100, Irvine, CA 92603, USA.

When a page containing a Kajabi embed is loaded, and in particular when you submit a form, personal data (such as your name, email address, form entries and technical connection data including your IP address) is transmitted to Kajabi and processed on its servers, which may be located in the United States.

Legal basis: For the operation of embedded forms and the initiation and performance of registrations, Art. 6 (1) (b) GDPR; where cookies or comparable technologies that are not strictly necessary are used, on the basis of your consent pursuant to § 25 (1) TDDDG and Art. 6 (1) (a) GDPR.

Stripe (payment processing)

Payments for registrations and bookings are intended to be processed via the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; for processing in the USA: Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA). Supported payment methods include credit card and Apple Pay.

When you make a payment, the payment and transaction data required to process it (such as name, payment details, amount and, where applicable, address data) is transmitted to and processed by Stripe. We do not receive or store your full card details ourselves; these are processed directly by Stripe as a PCI-DSS certified payment provider.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and our legitimate interest in offering efficient and secure payment methods (Art. 6 (1) (f) GDPR).

For more information, please see Stripe's privacy policy: https://stripe.com/privacy

Transfers to third countries (USA)

Some of the services named above (in particular Kajabi and, where processing takes place via its US entity, Stripe) may process personal data in the United States or transfer it there. The USA is a third country within the meaning of the GDPR that, in general, does not offer a level of data protection equivalent to that of the EU.

Where personal data is transferred to the USA, this is safeguarded either by the recipient's certification under the EU–US Data Privacy Framework (adequacy decision of the European Commission pursuant to Art. 45 GDPR) and/or by the EU Standard Contractual Clauses pursuant to Art. 46 (2) (c) GDPR, supplemented where necessary by additional protective measures. You can request a copy of these safeguards from us using the contact details above.

7Data security

We use appropriate technical and organisational measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential content. An encrypted connection can be recognised by the "https://" prefix and the lock symbol in your browser's address bar.

8Data minimisation and retention

We store personal data only for as long as is necessary to achieve the purposes stated here, or as required by statutory retention periods (in particular under commercial and tax law, which may require retention for up to ten years). Once the respective purpose ceases to apply and no retention obligations remain, the corresponding data is deleted routinely.

9Amendments to this privacy policy

We reserve the right to amend this privacy policy so that it always complies with current legal requirements, or in order to reflect changes to our services in the privacy policy — for example when introducing new services such as event registration and payment. The current version of this privacy policy applies to your renewed visit.