Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

2. General information

We process personal data solely within the limits of applicable law (GDPR, German Federal Data Protection Act). Below we explain the nature, scope and purpose of processing in connection with your visit to this website.

3. Hosting

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When the website is accessed, the server automatically processes technically necessary data (server log files, see section 4).

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure and stable provision of the website).

A data processing agreement (DPA) pursuant to Art. 28 GDPR is in place with Vercel. Transfer to the USA: Vercel is certified under the EU-US Data Privacy Framework (DPF) and additionally relies on the EU Standard Contractual Clauses (SCC), providing appropriate safeguards for the transfer to a third country.

4. Server log files

With every access, the server automatically records information transmitted by your browser: IP address, date and time of access, the URL requested, the volume of data transferred, the referrer URL, browser type and version, and operating system. This data is technically required to deliver the website and ensure its stability and security. Legal basis: Art. 6 (1) (f) GDPR. This data is not merged with other data sources, and no individual person is identified.

5. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in the address bar and by the padlock symbol in your browser.

6. Fonts

We use the IBM Plex fonts (Sans, Sans Condensed, Mono). The fonts are served locally from our own server. No connection to third-party servers, in particular Google Fonts, is established, and no personal data (such as your IP address) is transmitted to third parties in this process.

7. Cookies

This website does not use any tracking or advertising cookies. We use only one technically necessary cookie (NEXT_LOCALE), which stores your language choice (DE/EN) when you switch languages. This cookie is required for the function you requested; consent is not required under Section 25 (2) TTDSG. We therefore do not use a cookie banner.

8. Social media

The website (e.g. in the footer) contains links to our profiles on Instagram and LinkedIn. These are simple links, not embedded social media plug-ins. No data is transferred to the respective providers until you actively click a link and open the relevant platform. The provider's own privacy terms then apply to any processing there.

9. Contact and application forms

You can reach us through the forms on this website (the application form on the homepage, and the waitlist and the speaker and partner form on the event pages). When you submit a form, we process the details you enter, depending on the form for example name, email address, company and role, website or social media profile, and information about your enquiry, in order to handle your request and get in touch with you.

The legal basis is Art. 6 (1) (b) GDPR where the processing serves to prepare or perform a contract, and otherwise Art. 6 (1) (f) GDPR (legitimate interest in handling your request). Your data is deleted as soon as it is no longer required for the stated purpose and no statutory retention obligations apply. For the event waitlist we store your email address only until the relevant event has taken place or until you ask us to remove you.

For the technical delivery and storage of your submission we use two processors that act solely on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Delivery by email is handled by Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA): when you submit a form, the data you entered is sent to us by email and, where applicable, a confirmation email is sent to you. Your submission is additionally stored for us in Google Sheets, operated by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), so that we can process and follow up on your request. This may involve a transfer of data to the USA; both providers are certified under the EU-US Data Privacy Framework and additionally rely on the EU Standard Contractual Clauses, providing appropriate safeguards for the transfer to a third country. To protect the forms against automated spam we use a technical honeypot field only; no personal data is transmitted to third-party spam services. Further information: Resend https://resend.com/legal/privacy-policy and Google https://policies.google.com/privacy.

10. Reach measurement (Plausible Analytics)

We use Plausible Analytics to measure reach and understand how this website is used, so we can improve it. Plausible is a privacy-friendly analytics tool that works without cookies and does not store any personal data. It does not set cookies, does not track you across websites or devices, and does not create user profiles.

Plausible collects only aggregated statistics, such as page views, outbound link clicks, file downloads and form submissions, the referring website, and the browser, operating system, device type and country of visitors. Your country is derived from your IP address, but the IP address itself is not stored: it is only used transiently to generate an anonymous, non-reversible identifier and is then immediately discarded.

The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. The data is processed and stored exclusively on servers within the European Union; no data is transferred to third countries. The legal basis is Art. 6 (1) (f) GDPR (our legitimate interest in the needs-based design and continuous improvement of our website). As no cookies are used and no personal data is stored, no consent is required. Further information: https://plausible.io/data-policy.

11. Event tickets

When you buy tickets for one of our events (for example, Architecture After Hours), we process the data needed to sell you the ticket, admit you to the venue and meet our legal obligations.

For each order we process the buyer's email address (received through the payment) and, for every attendee, their full name and email address, together with the order details (edition, number of tickets, price tier, amount, currency and time of purchase) and a ticket reference code. Payment card details are entered directly on Stripe's hosted checkout page and never reach us.

We use this data to sell and deliver the ticket, send confirmations and admit you to the event, on the basis of the performance of a contract (Art. 6 (1) (b) GDPR). To issue your building pass we pass the guest list (each attendee's name and email) to the venue operator, Bentley Systems International Ltd., 6th Floor, 1 Cumberland St, Fenian St, Dublin 2, D02 AX07, Ireland. This is likewise necessary to perform the contract (Art. 6 (1) (b) GDPR) and serves our legitimate interest in event security (Art. 6 (1) (f) GDPR); the recipient is located within the EU.

Payments are handled by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland, together with Stripe, Inc. (USA). Your card details are entered on Stripe's own hosted checkout and are not accessible to us. Any transfer to the USA is safeguarded by the EU-U.S. Data Privacy Framework and standard contractual clauses. Further information: https://stripe.com/privacy.

Order and attendee data is stored in our database, which is hosted by Supabase in the EU (Frankfurt, Germany). The provider is Supabase, Inc. (USA); a data processing agreement and standard contractual clauses cover any access from outside the EU.

Invoices and accounting records for ticket sales are kept to meet our legal obligations (Art. 6 (1) (c) GDPR in conjunction with Section 147 of the German Fiscal Code, AO), and we process order records to prevent fraud and document our sales (Art. 6 (1) (f) GDPR).

If you tick the optional box at checkout, we use the email address(es) on your order to send you marketing emails from Skala Social and our partners (news, offers and event updates), on the basis of your consent (Art. 6 (1) (a) GDPR). This list is kept in our own database. Before we share your data with any partner, we will name that partner in this privacy policy; at present we do not share this list with third parties. You can withdraw your consent at any time, with effect for the future, by emailing start@skala-social.de; the withdrawal does not affect the lawfulness of processing carried out before it.

Attendee names and email addresses are deleted around three months after the event, unless we are required to keep them for legal records. Invoices and accounting records are kept for ten years (Section 147 AO). Your email address and marketing consent are kept until you withdraw the consent. Tickets are non-refundable, which is shown to you before payment.

12. Your rights as a data subject

You have the following rights: access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). To exercise them, an informal message to start@skala-social.de is sufficient.

13. Right to object

Where processing is based on Art. 6 (1) (f) GDPR, you have the right to object at any time for reasons arising from your particular situation.

14. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Berlin Commissioner for Data Protection and Freedom of Information (BlnBDI),
Alt-Moabit 59-61, 10555 Berlin, Germany.

15. No automated decision-making

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

16. Validity and changes

This privacy policy is currently valid. As the website develops or legal requirements change, it may become necessary to update it. Last updated: July 2026.