Privacy Policy Concerning Events
Disclosure requirements pursuant to Art. 13 GDPR in relation to events
The following information is designed to provide an overview of our use of personally identifiable information (hereinafter “personal data” or “personal information”) relating to you at events of Bertelsmann and of your rights as a data subject.
1. Who is accountable for processing my personal data?
Bertelsmann SE & Co. KGaA
Carl-Bertelsmann-Straße 270
33335 Gütersloh, Germany
Email: info@bertelsmann.de
is accountable for the processing of your information described below. We process personal information in accordance with the provisions of the European General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
You can contact our data protection officer at the address indicated above by using the reference ‘For the attention of the Corporate Data Protection Department (ZCD)’ or by writing to: datenschutz@bertelsmann.de.
2. What information on me is stored?
We process the following categories of personal information:
- contact details, in particular first and last name, title as applicable, address, phone number, email address, as applicable
- details on the company or institution for which you work
- details on your professional position
- pictures or videos showing you at an event, as applicable
- date and place of birth, as applicable (e.g. for invitations to events that are subject to a security check by the German Federal Criminal Police Office (BKA))
As a general rule, we obtain this information directly from you. In some cases we receive personal details relating to you from the company or institution for which you work so that we can invite you to one of our events.
3. Why is my personal data being processed (designated processing purpose) and what is the legal basis for this?
We use your contact details (name, postal address, email address) to send you invitations to our events that dovetail with your interests, and to send you relevant information (e.g. event program) by mail or email in advance of an event. The legal basis for this follows from Art. 6 (1) clause 1 point f) GDPR, based on our legitimate interest in the appropriate communication of our company strategy and our business activities, which also include public events and the inclusion of journalists.
If you should no longer wish to receive any invitations to our events, you have the option of lodging an objection to the use of your information for this purpose by writing to: info@bertelmann.de. In this case, we would immediately discontinue sending you invitations to our events.
When you take part in an event organized by us, we process the information indicated in section 2 for the purpose of conducting the event and enabling you to take part in it. This also extends to including your name, details pertaining to your company or institution and your current professional position in a participant list that is provided to the others attending the event (including in electronic form), or providing your information (name, details on your company/institution), as applicable, to the moderators/hosts of the event for the purpose of conducting the event. We also use this information to send you relevant material (e.g. conference proceedings) after the event. We also share your information with cooperating organizations to the extent that this is required for conducting the event and enabling you to take part in it, e.g. external guest management. The legal basis for this processing of information follows from Art. 6 (1) clause 1 point b) GDPR.
If you are invited to an event that requires a security check to be conducted by the German Federal Criminal Police Office (BKA), the information provided by you in section 2 will be used to conduct the security check and disclosed to the BKA for this purpose. The legal basis for this processing of information follows from Art. 6 (1) clause 1 point b), c) and e) GDPR.
In addition, pictures and videos are routinely made at our events. Some of them are published on our website, on our social media channels, in the course of external and internal reporting or in Bertelsmann newsletters, together with your name, as applicable. In addition to the pictures and videos, metadata such as the time and location is automatically stored in digital cameras. The legal basis for making and storing photographs and video recordings follows from Art. 6 (1) clause 1 point f) GDPR, based on our legitimate interest in reporting on our events. The legal basis for publishing photographs and video recordings is founded upon section 22, 23 German Art Copyright Act (KUG).
Pursuant to Art. 21 (1) GDPR, you have the right, for reasons relating to your particular situation, to lodge an objection at any time to the making and storage of photographs and video recordings in which you appear with effect for the future by writing to info@bertelmann.de and setting out your objection.
We would expressly like to draw your attention to the fact that external reporters are present at our events who also make pictures and videos. However, since we have no control over the pictures and videos made by these external reporters and how this material is used by them, we are unable to make any binding statements as to the purpose and scope of the processing of your information by these external reporters.
4. Am I under an obligation to provide personal information?
You are not legally or contractually bound to provide personal information. If you take part in our events or would like to receive an invitation to them, you must provide your personal details. Without your details we are generally not able to send you invitations to our events or enable you to take part in them.
5. Who comes into possession of my personal information?
We share your personal information with the departments and positions indicated in section 3 for the purposes set out in section 3. We also contract service providers (contract data processors, e.g. delivery services) who are bound by our directives to mail or email invitations to you or for the purpose of guest management. Contract data processors are provided access to your information only to the extent and for the period necessary to provide the services contracted by us. Where these service providers process your personal information outside of the European Union, this may result in it being transmitted to a country which does not provide for the same standard of data protection as the European Union. In this case, we ensure that the service providers guarantee an equivalent level of data protection by contractually binding them or by other means. You can request a copy of these safeguards by contacting the addresses indicated in section 1 above.
6. How long is my personal information stored?
We store your contact details for the purpose of sending out invitations – until you should lodge an objection – for the purpose of catering to our legitimate mutual interest in communication and the provision of information. We will store any objection lodged by you for a period of three years for evidentiary purposes.
The other information collected for the purpose of conducting an event or running a security check is deleted immediately after the event.[GJZ1]
The pictures and videos of you which are stored along with their metadata on the basis of Art. 6 (1) clause 1 point f) GDPR remain stored until you legitimately lodge an objection pursuant to Art. 21 (1) GDPR against their storage, unless there are overriding legitimate reasons for processing them as provided for by Art. 21 (1) clause 2 GDPR.
In the event that contract data processors, who are bound by our directives, are given access to your information this is done only to the extent and for the period necessary to provide the services contracted by us. Bertelsmann ensures that relevant agreements on deleting data are complied with.
7. What rights do I have with regard to my personal information?
You have the right at any time to request access to your personal information that is currently on file with us. If this information is incorrect or not up to date, you have the right to request that it be corrected. You also have the right to have your personal information deleted and/or its processing restricted as provided for in Art. 17 and Art. 18 GDPR. Where our processing by automated means of information provided by you is based on your consent or is the subject of a contract with you, you have the right to request a copy of this data in a structured, commonly-used, machine-readable format (right to data portability). If you want to exercise any of your rights, you can address these issues to the contact indicated in section 1 above. For information on your right to lodge an objection, see section 3.
You also have the right to lodge a complaint with the competent data protection authority. The authority responsible for us is: LDI NRW (Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen), Kavalleriestr. 2-4, 40213 Düsseldorf. However, you also have the right to contact the competent data protection authority at your place of residence, who will refer your matter to the competent authority.
Date of this Privacy Policy: 25 May 2018
