Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

2. Collection and Storage of Personal Data

When you use our application, we collect and process the following personal data:

• E-mail address: For authentication and account management
• Name / display name: For display within the application
• Sign-in data: Google OAuth token or a one-time sign-in link sent by e-mail („magic link“) for passwordless, secure sign-in. No passwords are stored.
• Session data: To maintain your sign-in
• Event data: Sessions, rooms and time slots that you create
• Votes: Pseudonymous expressions of interest in session proposals (where the feature is enabled). These are stored without reference to your name or account, but are linked to a randomly generated device identifier so that each device can vote only once (details in section 6).
• Feedback: Ratings and optional comments on sessions or on the event (where enabled). You may voluntarily submit comments anonymously or under your name.
• Notifications (optional): Your notification settings and – only if you enable push notifications on a device – the technical delivery address of your browser (push subscription, see section 5).

On-site and networking features

Organisers can enable individual on-site features for their events (all are disabled by default). Features usable without signing in work with the pseudonymous device identifier described in section 6 – no browser fingerprinting takes place, no device characteristics are read out. Where the respective feature is enabled, we process:

• Presence signal („I'm here“): A voluntary, day-specific „on site today“ signal per device identifier. It serves exclusively as a lower-bound counter („at least N are here“) and to unlock the on-site features – it is not attendance tracking and not access control. If you take part in the prize draw, the signal is linked to your account.
• Prize draw: Your voluntary participation flag on your account. When a draw takes place, the display name of the winning person is shown live on the on-site event display. Any terms of participation are set by the organiser.
• Room impulses (topic parking lot): Short text contributions on the ongoing session, pseudonymous per device identifier; automatically deleted after 24 hours.
• Resource notes (links, book recommendations, key takeaways): Short text contributions, pseudonymous per device identifier; they are retained as a public resource log of the respective session.
• Secret missions: The mission drawn per device and event day (pseudonymous), so that no repeat draw occurs.
• „Who's here“ display: Only with an account and your express consent (opt-in per event, Art. 6(1)(a) GDPR, revocable at any time): your display name and, where applicable, your profile picture become visible to other checked-in participants of that event, possibly also on the on-site event display. The display is day-specific and is not archived.
• Thank-yous (kudos / session thanks): Private messages of thanks to other participants or to session hosts. They are visible exclusively to the receiving person; what is stored is the text, the name of the giving person (for anonymous session thanks, the name optionally provided by that person) and the event reference.
• Notice board: Requests and offers with a name you provide yourself and, optionally, a hint on how to find you on site. Posts are visible to visitors of the event page while the event is running; posts marked as „done“ are displayed without a name, and all posts are automatically deleted at the end of the event.
• Table groups (break groups): The assignment of your device to a break group (pseudonymous, per break). Only group sizes are displayed publicly, no individuals.

Profile (optional)

If you create a profile, we additionally process the following voluntary information:

• Username and short description (bio): Voluntary profile details entered by you (user-generated content)
• Profile picture (avatar): An image uploaded voluntarily (JPEG, PNG or WebP), stored on our server
• Visibility: You decide yourself whether your profile is publicly accessible
• Proof of consent: Time and version of the accepted legal texts, a truncated (hashed) IP value and the browser identifier (user agent) as proof of consent pursuant to Art. 7 GDPR

3. Purpose of Data Processing

Your personal data is processed for the following purposes:

• Account management: Provision and administration of your user account (legal basis: performance of a contract, Art. 6(1)(b) GDPR)
• Event planning: Enabling session planning for your events (legal basis: performance of a contract, Art. 6(1)(b) GDPR)
• Voting & feedback: Capturing interest in session proposals as well as responses for improving sessions and the event (legal basis: provision of the feature you requested, Art. 6(1)(b) GDPR)
• Access control: Ensuring that only authorised users have access (legal basis: legitimate interest in the security of the application, Art. 6(1)(f) GDPR)
• Public profile: Display of your voluntary profile details and assignment of your sessions, if you make your profile public (legal basis: consent, Art. 6(1)(a) GDPR, revocable at any time — see section 12)
• On-site and networking features: Provision of the features described in section 2 that can be enabled per event (presence counter, prize draw, room contributions, thank-yous, notice board, table groups) (legal basis: provision of the feature you requested, Art. 6(1)(b) GDPR; the „Who's here“ display is based on your consent, Art. 6(1)(a) GDPR, revocable at any time)
• Protection against abuse: Prevention of repeat actions (e.g. one vote per device) and limitation of automated access via pseudonymous device identifiers and rate limits (legal basis: legitimate interest in an abuse-free platform, Art. 6(1)(f) GDPR)
• Moderation: Handling of reports and protection against unlawful or abusive content (legal basis: legal obligation and legitimate interest, Art. 6(1)(c) and (f) GDPR — see section 13)

4. Legal Bases at a Glance

The legal basis relevant to each purpose is stated directly with the purposes in section 3 as well as with the individual features (sections 2, 6, 7, 12 and 13). In summary, we base processing on:

• Art. 6(1)(b) GDPR (performance of a contract and provision of the features you requested)
• Art. 6(1)(f) GDPR (legitimate interest in security, protection against abuse and traceability — right to object, see section 9)
• Art. 6(1)(a) GDPR (consent, e.g. public profile, „Who's here“ display, functional cookies — revocable at any time)

For the storage of and access to information on your terminal equipment (cookies, local storage), sec. 25 of the German Digital Services Data Protection Act (TDDDG) applies in addition (see sections 6 and 7).

5. Disclosure of Data

Your data is disclosed to third parties only in the following cases:

• Google OAuth: When using Google sign-in, authentication data is exchanged with Google. Google's privacy policy applies. Google is certified under the EU-US Data Privacy Framework (DPF); for related transfers to the USA there is an adequacy decision of the EU Commission (Art. 45 GDPR).
• Hosting provider: The data is stored on servers of our hosting provider, which acts on our behalf and is subject to corresponding data processing agreements.
• Push notifications: Only if you enable push notifications on a device is delivery carried out via the push service of your browser vendor (e.g. Google, Mozilla or Apple). The contents of the notifications are transmitted end-to-end encrypted in accordance with the Web Push standard; the push service may process technical metadata (such as the delivery address) also outside the EU. Which push service is used is determined by your browser; Google and Apple are certified under the EU-US Data Privacy Framework (DPF) (adequacy decision, Art. 45 GDPR). Push is optional and can be switched off per device at any time.

Beyond this, no disclosure to third countries outside the EU takes place.

6. Cookies

We use the following types of cookies:

Necessary cookies

A session cookie serves to maintain your sign-in and to manage the session. Even without signing in, your browser receives a randomly generated, pseudonymous device identifier via this cookie as soon as you actively use certain features (e.g. voting, submitting a topic request, posting a room contribution, on-site features). This identifier serves exclusively to prevent repeat actions (e.g. one vote per device) and to limit abuse (rate limits). No device characteristics are read out (no „browser fingerprinting“), no cross-site tracking is carried out and no advertising or usage profiles are created.

• Purpose: Authentication, session management, prevention of repeat actions and protection against abuse
• Storage period: Session-based (until sign-out or expiry, at most 7 days)
• Legal basis: Sec. 25(2) no. 2 TDDDG (strictly necessary for the feature you requested); processing pursuant to Art. 6(1)(b) and (f) GDPR

The language cookie is likewise necessary: if you actively choose a display language (e.g. via the language switcher or by opening the English language version), this cookie stores exactly this choice so that it is retained on subsequent visits. It is never set automatically based on your browser settings, contains no identifier and is not used for tracking (storage period: 12 months; legal basis: sec. 25(2) no. 2 TDDDG; processing pursuant to Art. 6(1)(b) GDPR).

Functional cookies

These store your host name for future session submissions. Your favourite sessions are also stored if functional cookies are enabled. These cookies are only set with your consent.

No analytics or tracking cookies: We do not use any third-party cookies and no external tracking (in particular no Google Analytics). The optional usage statistics for organisers (anonymous, aggregated view counts) are processed on the server side and do not set any additional cookies in your browser.

You can change your cookie settings at any time via the „Cookie Settings“ link in the footer.

7. Local Storage

The organiser tools (checklist, supply list) store your data exclusively in the local storage of your browser. No data is transmitted to our server in the process.

Your favourite sessions (preferred and alternative selection per time slot) are likewise stored in local storage, provided functional cookies are enabled. For users who are not signed in, this data remains exclusively on your device. For signed-in users, favourites are additionally stored with the account and synchronised across devices so that they are available on all devices. If you delete your account, the favourites data is deleted immediately and in full.

• Purpose: Storage of your checklist data (entries, progress, custom entries)
• Storage period: Until you clear your browser data or remove the data manually
• Legal basis: For the organiser tools, local storage is strictly necessary in order to provide the feature you expressly requested (sec. 25(2) no. 2 TDDDG; Art. 6(1)(b) GDPR). Your favourites are stored only with your consent via the functional cookies (sec. 25(1) TDDDG; Art. 6(1)(a) GDPR), which you can revoke at any time via the cookie settings

Note: As the data is only stored in your browser, it is lost if you clear your browser data, use a private window or change device. Use the export function to create a backup copy.

8. Storage Period

• Active accounts: For as long as you use the application
• Unconfirmed accounts: Registrations without e-mail confirmation are automatically deleted after 24 hours at the latest
• Sign-in links (magic links): Single-use and valid for a limited time; invalid after use or expiry
• Profile pictures: Until changed, deleted by you, or the account is deleted
• Reports / moderation data: For as long as required for handling and traceability
• Deleted accounts: Immediate deletion or anonymisation of all personal data. Sessions you submitted as well as feedback you gave (ratings and comments) are retained in anonymised form, separated from the account
• Public event content: The session plan of public events remains permanently publicly accessible after the event has ended – as documentation of the event. This concerns in particular session titles, session descriptions and the display names of session hosts provided at submission as part of the published programme. Your rights to erasure or anonymisation of personal data (Art. 17 GDPR, see sections 9 and 11) remain unaffected
• Session data: Until sign-out or after 7 days
• Favourites (signed-in users): Until manually deleted in the browser or the account is deleted
• Presence signals („I'm here“): Used on a day-specific basis; upon account deletion the account link is removed, the pseudonymous signals are deleted when the event is deleted
• Prize draw: Participation and draws until the account or the event is deleted
• Room impulses (topic parking lot): Automatically deleted after 24 hours
• Resource notes: Retained as a public resource log of the session (part of the event documentation, see „Public event content“)
• Notice board: Automatically deleted at the end of the event
• Thank-yous (kudos): Until deleted by the receiving person or upon deletion of that person's account; the name of the giving person is removed when their account is deleted
• Secret missions and table groups: Day-specific; deleted when the event is deleted

9. Your Rights

You have the following rights regarding your personal data:

• Access (Art. 15 GDPR): You can request information about the data we process
• Rectification (Art. 16 GDPR): You can request the correction of inaccurate data
• Erasure (Art. 17 GDPR): You can request the deletion of your data
• Restriction (Art. 18 GDPR): You can request the restriction of processing
• Data portability (Art. 20 GDPR): You can request a copy of your data in a structured format
• Objection (Art. 21 GDPR): You can object to the processing
• Complaint: You can lodge a complaint with a data protection supervisory authority

Notice of your right to object (Art. 21 GDPR): Insofar as we process personal data on the basis of a legitimate interest (Art. 6(1)(f) GDPR — for instance for protection against abuse or for the security of the application), you have the right to object at any time, on grounds relating to your particular situation, to such processing. We will then no longer process the data unless there are compelling legitimate grounds for the processing which override your interests, rights and freedoms. An informal objection suffices.

To exercise your rights, please contact us at: gerhard@wagler.media

10. Data Security

We use technical and organisational security measures to protect your data:

• Encryption: HTTPS/TLS for all data transmissions
• Access control: Role-based permissions for events
• Regular updates: Up-to-date software versions and security patches

11. Account Deletion and Data Export

If you have an account, you can delete it yourself at any time. To protect against accidental deletion, this is done in a two-step procedure (request and confirmation). Upon deletion, your personal data is deleted or anonymised; sessions you submitted as well as feedback you gave (ratings and comments) may be retained in anonymised form, separated from the account. The text of your comments is not altered in the process; if it contains personal information, please modify or delete it before deleting your account. If you are the sole responsible person („owner“) of an event, you must transfer this role beforehand.

To exercise your right to data portability (Art. 15/20 GDPR), you can request a structured data export of your personal data (profile and the content linked to your account) in machine-readable JSON format via your account; the export itself shows which data blocks it contains.

Alternatively, you can contact gerhard@wagler.media at any time.

12. User Profiles and User-Generated Content

Profiles are optional. If you create a profile, you can voluntarily provide a username, a short description (bio) and a profile picture and decide whether your profile is publicly accessible.

• Legal basis: This voluntary information is processed on the basis of your consent (Art. 6(1)(a) GDPR) and is revocable at any time by removing it or setting your profile to private.
• Public visibility: A public profile is accessible via the internet and may contain your display name, username, your bio, your profile picture and the publicly visible sessions assigned to you.
• Setting your profile to private: You can revoke your consent to the linking of your sessions with your profile at any time (Art. 7(3) GDPR) by setting your profile to private. For security reasons this is done – like account deletion – via an e-mail confirmation. In the process, all sessions assigned to you are permanently decoupled from your profile: they are then no longer linked via your profile and no longer editable via your account. The display name of the session host provided at submission remains publicly visible with the respective session, as it is part of the published programme. Subsequent changes to or removal of this name are then only possible via the event organisation or via support@barcamp.io. This decoupling is irreversible.
• Content filters: In free-text fields, links and potentially harmful code (HTML/SVG) are technically blocked. Profile pictures are checked for permitted image formats (JPEG, PNG, WebP).
• Labelling: User-generated content is presented as such; editorial review does not take place without specific cause.

13. Reports, Moderation and Complaints Procedure

A reporting function is available on user-generated content (e.g. bio, profile picture, session, topic requests, feedback as well as contributions from the on-site and networking features). When you report content, we process the reason given, an optional comment and technical accompanying data for protection against abuse.

• Handling: Reported content may be hidden as a precaution pending review and is reviewed promptly.
• Counter-notification: If content is deactivated or removed, we inform the person who posted it, stating the reason, and point out the possibility of objecting.
• Legal basis: Art. 6(1)(c) and (f) GDPR (legal obligation as well as legitimate interest in a legally compliant, abuse-free platform).

Details on rights and obligations relating to content are governed by the Terms of Use.

14. Consent and Versioning of the Legal Texts

When registering, you consent to the Terms of Use and this Privacy Policy in their respective applicable version. As proof (Art. 7 GDPR), for each document consented to we store its version status, the time, a truncated (hashed) IP value and the browser identifier. If we make material changes to these texts, we will ask you to consent again the next time you sign in.

15. Changes to This Privacy Policy

We reserve the right to adapt this Privacy Policy in order to align it with changed legal situations or with changes to our services. The current version is always available on this page.

16. Contact

If you have any questions about data protection, please contact:

E-mail: gerhard@wagler.media