Data Privacy Statement for cplace Digital Conference 2021

Revision: July 2021

1. General notes

The coronavirus pandemic has been a tough experience for all of us, changing our lives in nearly every conceivable respect. Here at collaboration Factory we have been affected by the pandemic in many ways, as well. One area where this is especially evident is the preparations for our annual project management conference. For obvious reasons, there cannot be a live event this year. The developments over the past several months have convinced us to hold this year's conference as a purely digital event – we call it “Digi Con”.

The fact that it will be a digital event makes this Data Privacy Statement a bit longer than you might have seen in previous years. However, be assured that we will strictly adhere to all legal requirements when it comes to the protection of your personal data.

Please be aware that this Data Privacy Statement exclusively applies to the processing of data in connection with your registration for, or your participation in cplace Digi Con 2021. In addition, for your visit of our website please also take note of the relevant Data Privacy Statement.

2. Data Controller

This Data Privacy Policy applies to the processing of data by us as a Data Controller pursuant to GDPR, Art. 4(7). Our contact details are as follows:

collaboration Factory AG
Arnulfstrasse 34
D-80335 Munich, Germany

Represented by: Dr. Rupert Stuffer (CEO)
Registry court, registration number: Munich, HRB 262367
Contact:

E-mail: info@collaboration-factory.de

ph.: +49 (0)89 809133 230
Fax: +49 (0)89 809133 239

3. Privacy Protection Officer

Marco Niederhausen
collaboration Factory AG
Arnulfstrasse 34
D-80335 Munich, Germany

privacy@collaboration-factory.de

4. Definitions

Unless specified otherwise in this Data Privacy Policy, whether explicitly or implicitly, the definitions provided in GDPR, Art. 4 shall apply to the terms used herein.

5. Processing of your personally identifiable data in connection with your registration for cplace Digi Con 2021 using the Web Form

When you register for cplace Digi Con 2021 using our Web Form, we will process the following personally identifiable data for you:

  • Customer master data such as name, address, place of residence
  • Contract and services information
  • Communication data relating to the establishment and continuation of a contractual relationship using electronic means of communication, such as e-mail address, telephone and mobile phone number etc.
  • Consent information regarding advertisements, use of our e-mail address or telephone number for advertising purposes
  • Anonymous or pseudonymized data for internal statistical analytics and marketing reports

We will process the above-specified information for purposes related to the conclusion and implementation of the contract. The purposes of processing the data will primarily depend on the relevant Terms and Conditions of Participation. The legal basis for this is GDPR, Art. 6(1)(b). We will delete the data as soon as they are no longer needed, provided there are no legal obligations requiring us to do otherwise. We will review the need to delete your data every six months.

6. While you participate in cplace Digi Con 2021

6.1 Processing of data on the cplace Digi Con 2021 event website

cplace Digi Con 2021 will be implemented using the event platform HyperCon. When you access this event website, we, respectively, the provider of hosting services contracted by us, will exclusively collect the personally identifiable data your browser transmits to our server. Specifically, these include: 

  • IP address 
  • Date and time of the request 
  • Time zone difference from Greenwich Mean Time (GMT) 
  • Content of request (specific page) 
  • Access status/HTTP status code 
  • Volume of data transmitted 
  • Website initiating the request 
  • Browser 
  • Operating system and its user interface 
  • Browser software language and version 
  • Information about your device 

We need these data for technical purposes to provide you with access to the event platform. The legal basis for this processing of your data is GDPR, Art. 6(1)(1)(f). These data are stored for the duration of no more than 14 days for security reasons (e.g. to support investigations of misuse or fraudulent activities), and will be deleted thereafter. Data which must be stored as evidence beyond that period are exempt from erasure pending final resolution of the case in question. 

To process the data as described above, we will retain the services of carefully selected providers who will process your data on our behalf of, and as instructed by us, and whom we subject to periodical checks. These data are processed on our behalf by Amazon Web Services EMEA S.à.r.l., Luxembourg (AWS), among others. Our utilization of the services of AWS entails transmission of data to Amazon Web Services Inc. in USA. We have agreed the EU standard contractual terms and conditions with AWS. The legal basis for this transmission of data is GDPR, Art. 46(2)(c). 

6.1.1 Usage analysis using Google Analytics

Our event page may use Google Analytics to help us improve future websites. When accessing the websites, you have the option to agree to the use of Google Analytics. You may also object to the use of Google analytics at any time, including retroactively. Provided that you give us your consent, we will analyze the way you use our website. For this purpose, we will process the following personally identifiable data received from you:

  • IP address
  • Date and time of the request
  • Time zone difference from Greenwich Mean Time (GMT)
  • Content of request (specific page)
  • Access status/HTTP status code
  • Volume of data transmitted
  • Website initiating the request
  • Browser
  • Information about your device
  • Operating system and its user interface
  • Browser software language and version
  • Screen and window resolution
  • Your approximate location
  • Information about the time you spent on our webpages
  • Information about your activities while using our website

We will therefore transmit the data listed above to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for analytical purposes. Google will analyze the data on our behalf to understand the way you have used our website. We need this information to ensure the stability and security of the website and continue to develop it to better serve the interests of users. The data collected in this process will not be merged with your other profile information but used for anonymized statistics to help us better understand our users and better adapt the website to their needs. As stated above, we will process these data exclusively on condition of your consent. The legal basis for this is GDPR, Art. 6(1)(1)(a).

Our utilization of the services of Google analytics entails transmission of data by Google to its group companies and/or data processing subcontractors. For these purposes, the information specified above may be transmitted to, and stored on, a server of Google group companies and/or data processing contractors located in USA with the IP address anonymized. The functionality used by Google Analytics IP for anonymization replaces the last octet in IPv4 addresses, respectively, the last 80 bits of IPv6 addresses in computer memory by zeros. As a consequence, the user's exact IP address will not be stored.

We have agreed the EU standard contractual terms and conditions with Google. These may be accessed at any time at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005.... As an alternative you may request these documents from us using the contact information provided below.

6.2 Integrated tools

To allow cplace Digi Con 2021 to be held as a virtual conference, we will use several software tools designed for digital events.

6.2.1 Wonder

We use Wonder (formerly Yotribe) to enable our participants to share information and engage in digital networking. Wonder is a service offered by Yotribe GmbH, Kommandantenstrasse 77, D-10117 Berlin. We use this tool to create flexible video group rooms which you may join. This is how it works: In the software application, all participants are displayed on a large surface. Each participant may freely position themselves using their computer mouse. Once two or more participants have been placed closely to each other, a group video conference will be launched. This emulates a physical situation similar to a coffee break where you join a group of attendees at a bistro table in a foyer, but in a digital space.

In Wonder, the participants of the group video conference are given access to the video and audio content of the video conference.

Wonder is responsible for its own compliance with privacy protection laws. To read Wonder's privacy policy please go to https://www.wonder.me/privacy-policy.

The legal basis for the processing of personally identifiable data in connection with the integration of Wonder, and for the associated transmission of personally identifiable data to Yotribe GmbH is Art. 6(1)(1)(b). We will process and transmit your data to perform our contractual obligation to carry out cplace Digi Con 2021 as agreed with you.

You are under no obligation to participate. 

6.2.2 Vimeo

When carrying out cplace Digi Con 2021 will also use pre-produced videos. These videos will be uploaded to the collaboration Factory channel on Vimeo and then embedded into our event website. Vimeo (Vimeo LLC, 555 West 18th Street New York, NY 10011 USA) is responsible for complying with applicable privacy protection laws in connection with the use of the Vimeo platform. To read Vimeo's privacy policy please go to https://vimeo.com/privacy.

For the purposes specified above, Vimeo will, to the best of our knowledge, process the following personally identifiable data from you:

  • IP address
  • Date and time of the request
  • Time zone difference from Greenwich Mean Time (GMT)
  • Content of request (specific page)
  • Access status/HTTP status code
  • Volume of data transmitted
  • Website initiating the request
  • Browser
  • Operating system and its user interface
  • Browser software language and version
  • Information about interaction with the Vimeo plug-in
  • Device identifier of your equipment if applicable
  • Version of the Vimeo software used by us
  • Information about playbacks of the video to date
  • Information about the way the video has been playback (e.g. full screen)

The legal basis for the processing of personally identifiable data in connection with the use of Vimeo videos, and for the associated transmission of personally identifiable data to Vimeo Inc. is Art. 6(1)(1)(b). We will process and transmit your data to perform our contractual obligation to carry out cplace Digi Con 2021 as agreed with you.

Vimeo will inevitably receive the data specified above. Vimeo is a service rendered by a provider from USA. Furthermore, we cannot exclude that data may additionally be routed by Internet servers located outside the EU. In particular, this may be the case when you as a participant are located in a third country. This means that your personally identifiable data will likewise be processed in a third country. Agreement of the so-called EU standard contractual terms and conditions ensures an adequate level of privacy protection. The legal basis for this transmission of data is GDPR, Art. 46(2)(c). Furthermore, transmission of your data to USA is necessary for us to meet our contractual obligation to carry out cplace Digi Con 2021 as agreed with you. The legal basis for this is GDPR, Art. 49(1)(1)(b).

There is no obligation to access any videos. 

7. Email communication

E-Mails, die Sie an uns und wir an Sie übermitteln, verarbeiten wir mittels eines bei unserem Dienstleister (Microsoft Corporation, One Microsoft Way, Redmond, WA 98052-6399, USA) gehosteten E-Mail-Servers. Die Verarbeitung Ihrer personenbezogenen Daten geschieht um uns die E-Mail-Kommunikation mit Ihnen zu ermöglichen. Die Rechtsgrundlage dafür ist Art. 6 Abs. 1 lit. f DSGVO.

Im Rahmen der E-Mail-Kommunikation erfolgt eine Übermittlung Ihrer o.g. Daten in die USA. Eine Verarbeitung der personenbezogenen Daten findet damit auch in einem Drittland statt. Ein angemessenes Datenschutzniveau ist durch den Abschluss der sog. EU-Standardvertragsklauseln garantiert. Die Rechtsgrundlage für den Datentransfer ist. 46 Abs. 2 lit. c DSGVO.

Wir löschen die Daten, sofern diese nicht mehr erforderlich sind oder – im Falle von gesetzlichen Aufbewahrungspflichten – schränken wir die Verarbeitung ein. Die Erforderlichkeit überprüfen wir alle zwölf Monate.

7.1 Communication by telephone

When you contact us by telephone, we will need your personally identifiable data (e.g. your name, telephone number, postal or email address) to answer your inquiry or respond to your request. Your personally identifiable data will be processed pursuant to GDPR, Art. 6(1)(1)(b).

We will delete these data as soon as they are no longer needed or – if so required under statutory retention provisions – we will restrict the processing of these data. We will review the need to store your data every 12 months.

8. Erasure of data

The data processed by us will be erased pursuant to GDPR, Art. 17, or the processing of the data will be restricted pursuant to GDPR, Art. 18.

Unless provided otherwise in this Data Privacy Statement, the data processed by us will be erased as soon as they are no longer needed for the purposes for which they were collected, provided that no statutory data retention obligations prohibit us from erasing them. We will review the need to delete your data every six months. In the event that your data are not erased because they are needed for other, legally permissible purposes, processing of the data will be restricted. This means that the data will be blocked and not used. This applies to any data that must be retained under commercial, tax or any other law.

According to German law, the statutory retention or storage period applicable to financial records, documents, inventory lists, annual reports, reports on the economic position of the company, the opening balance sheet and any work instructions and other corporate documents needed to explain the above, any commercial or business correspondence received or sent, all accounting records and any other documents relevant to taxation pursuant to the German Fiscal Code (AO), Section 147 (1), is 10 years. The statutory retention period applies to any personally identifiable data of Data Subjects that may be contained in the above-specified documents.

9. Rights of the Data Subject

You have the following rights:

  • The right to request information about your personally identifiable data processed by us pursuant to GDPR, Art. 15. In particular, you may request information about the purposes of such processing, the category of the personally identifiable data, the category of the data recipients to whom your data has been or will be disclosed, the planned duration of data storage, your rights of rectification, erasure, restriction of processing, and objection, the existence of the right to lodge a claim, the origin of your data not collected by us, and the existence of an automated decision-making process including profiling, as well as meaningful information about the details thereof;
  • The right to demand immediate rectification of incorrect data and the right to amend incomplete personally identifiable data stored by us pursuant to GDPR, Art. 16;
  • The right to erasure of your personally identifiable data stored by us pursuant to GDPR, Art. 17, unless processing the data is required to exercise the right of free expression of opinion or the right of information, to fulfill a legal obligation, for reasons of public interest or to assert, exercise or defend a legal claim;
  • The right to restrict the processing of your personally identifiable data pursuant to GDPR, Art. 18, provided you are contesting the correctness of the data, or provided that processing the data is unlawful but you do not wish the data to be deleted although we do not need your data anymore and you need the data to assert, exercise or defend legal claims or you have objected to the processing of your data pursuant to GDPR, Art. 21.
  • The right to obtain your personally identifiable data which you have provided to us in a structured, commonly used, machine-readable format, or to transmit your data to another data controller pursuant to GDPR, Art. 20;
  • The right to lodge a complaint with a supervisory authority pursuant to GDPR, Art. 77. You can typically exercise this right by contacting the supervisory authority in charge of your regular place of residence or employment or the supervisory authority in charge of our company's headquarters.

10. Withdrawing your consent

If we are processing your personally identifiable data on the basis of your consent given pursuant to GDPR, Art. 6(1)(a), you have the right to withdraw your consent pursuant to GDPR, Art. (7)(3) for the future. 

To exercise your right to withdraw your consent, you may notify us by sending an e-mail to info@collaboration-factory.de. As an alternative option, you may use the contact information provided in section 1 above.

11. Objection to data processing based on our legitimate interest

If we process your personally identifiable data on the basis of our legitimate interest according to GDPR Art. 6(1)(1)(f), it is your right to raise an objection to the processing of your personally identifiable data pursuant to GDPR, Art. 21 provided you do so on grounds arising from your particular situation, or your objection is directed against direct marketing. In the latter case you have a general right to object, which we will act upon without you having to make reference to a specific situation.

To exercise your right to object, you may notify us by sending an e-mail to datenschutz@collaboration-factory.de. As an alternative option, you may use the contact information provided in section 2 above.

cplace Newsletter

You want to be the first to know about exciting events, upcoming webinars, new features and other news about cplace? Stay up to date in the project management world with our newsletter!

Subscribe