1. Data Controller and Data Protection Officer
The data controller within the meaning of the General Data Protection Regulation (GDPR) is:
Innovationsgesellschaft Technische Universität Braunschweig mbH
Management: Manuela Breuer, Moritz Tetzlaff
Wilhelmsgarten 3
38100 Braunschweig
0531 209 700 01
info@itubs.de
You can contact our Data Protection Officer at:
Kämmer Consulting GmbH
Phone number: 0531/702249-0
Email address: dsb-team@kaemmer-consulting.de
2. General Information on Data Processing
We process personal data only to the extent necessary to provide our website, to handle inquiries, to take precontractual measures, to conclude and fulfill contracts, to book and manage events, to process payments, to issue invoices, to fulfill legal obligations, or based on consent.
The specific data processed in each case depends on which features and services you use. Providing certain personal data may be required to submit an inquiry, make a reservation, complete a payment, or participate in an event. Without this data, we may not be able to process the relevant inquiry, reservation, or participation.
Personal data will only be disclosed to third parties if there is a legal basis for doing so, if it is necessary for the performance of a contract, if we are legally obligated to do so, if you have given your consent, or if we have a legitimate interest in doing so and your interests or fundamental rights do not override that interest.
Automated decision-making, including profiling as defined in Article 22 of the GDPR, does not take place.
3. Website Access and Server Log Files
When you visit our website, our web server or our hosting provider, STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, automatically processes information transmitted by your browser. This may include, in particular: IP address, date and time of access, page accessed, amount of data transferred, referrer URL, browser type and version, operating system used, and the requesting provider.
Data is processed for the purpose of providing the website from a technical standpoint, ensuring system security, preventing misuse, and analyzing errors. The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and stable operation of our website.
We have entered into a data processing agreement with STRATO GmbH in accordance with Article 28 of the GDPR. In this context, STRATO processes personal data exclusively on our behalf and in accordance with our instructions.
Server log files are stored only as long as necessary for the purposes stated and are subsequently deleted or anonymized, unless longer retention is required to investigate security incidents.
4. Making Contact
If you contact us via the contact form, email, or phone, we will process the data you provide in order to handle your inquiry. This may include, in particular, your name, email address, phone number, company, subject line, message content, and the time you contacted us.
The legal basis is Article 6(1)(b) of the GDPR if your inquiry is related to a contract or precontractual measures. In all other cases, the legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in processing and documenting your inquiry. If you have given your explicit consent, the legal basis is Article 6(1)(a) of the GDPR.
The data will be deleted as soon as your request has been fully processed and there are no legal retention requirements or legitimate interests in continuing to store it.
5. Event Registration, Payment Processing, Co-Organizers, and Learning Platforms
If you book a training session, continuing education program, course, workshop, seminar, conference, meeting, or other event through our website, we will process the information you provide during the booking process.
These may include, in particular:
- First and Last Name
- E-mail address
- Phone number, if provided
- Company / Organization, if specified
- Billing Address and Billing Information
- Discrepancies in Participant Information for Group Bookings
- booked event
- Reservation Number, Order Number, and Payment Status
- Billing and Payment Information
- Organizational Communications Regarding the Booked Event
We process this data to accept your reservation, review and confirm your registration, process your payment, issue invoices, communicate with you regarding the event, and organize and carry out the event you have booked.
The legal basis is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the implementation of precontractual measures or for the performance of a contract. To the extent that we are legally required to retain certain documents—in particular, documents related to commercial and tax law—processing is based on Article 6(1)(c) of the GDPR. In individual cases, processing may also be based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR, in particular for internal organizational purposes, for documenting accounting processes, to prevent misuse, and to assert or defend legal claims.
We organize many of our events in collaboration with various co-organizers. These may include, in particular, institutes, departments, or collaboration partners of the Technical University of Braunschweig, as well as other project or event partners. The co-organizers involved in each event are listed on the respective event page and during the registration process.
To the extent necessary for ticket sales, registration, and the conduct of the event, we process personal data jointly with the respective co-organizer as joint controllers within the meaning of Article 26 of the GDPR. This applies in particular to data such as name, email address, organization, event booked, booking status, payment status, and organizational details regarding participation.
The purpose of joint processing is, in particular, to process registrations, manage participants, match payments with registrations, create participant lists, provide access information, conduct the event, and handle post-event organizational tasks.
Responsibilities regarding data protection are defined between us and the respective co-organizers. You may generally exercise your data protection rights with iTUBS or with the respective co-organizer named.
For events provided or conducted through the Lernfabrik or the Technical University of Braunschweig’s learning platform, we transmit the necessary data to the Technical University of Braunschweig or the Lernfabrik. This may include, in particular, first and last name, email address, the event booked, number of participants, booking status, and payment status. When booking an event in which the Lernfabrik is listed as a co-organizer or partner, you also accept the Lernfabrik’s Privacy Policy.
This information is transmitted, in particular, so that registration codes can be generated, access information can be provided, participants can be activated on the learning platform, and the event can be organized and carried out. Subsequent registration and use of the learning platform take place via the platform provided by Lernfabrik. Additional privacy notices, terms of use, or event terms and conditions may apply there, which will be made available to you during the registration process on the learning platform.
The legal basis for data processing and data transfer in connection with co-organizers and learning platforms is Article 6(1)(b) of the GDPR, to the extent that the processing is necessary for the conduct of the booked event. To the extent that processing is necessary for the organizational coordination, documentation, or follow-up of the event, it is additionally based on Article 6(1)(f) of the GDPR. Our legitimate interest and the legitimate interest of the respective co-organizers lie in the proper planning, execution, and follow-up of the event.
We store booking, billing, and payment data for the duration of the contract and beyond, in accordance with the statutory retention periods under commercial and tax law. We delete other organizational data as soon as it is no longer required for the execution and follow-up of the event and there are no legal retention obligations or legitimate interests in further storage.
6. Payment Service Providers
We use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland) to process payments. In doing so, the data required for the payment is transmitted to the payment service provider. This may include, in particular, your name, billing information, payment amount, transaction number, email address, payment method, and transaction-related data.
The legal basis is Article 6(1)(b) of the GDPR, to the extent that the processing is necessary for payment processing and the performance of a contract. To the extent that we are legally required to document payments, the processing is based on Article 6(1)(c) of the GDPR.
For more information about Stripe’s data processing practices, please see Stripe’s Privacy Policy (https://stripe.com/de/privacy)
7. Recipients of Personal Data
Personal data will be disclosed only to the extent necessary to fulfill the stated purposes or where there is a legal basis for doing so. Recipients of personal data may include, in particular:
- Co-organizers and collaborating partners, in particular institutes, departments, or project partners of the Technical University of Braunschweig, as well as other event partners, to the extent necessary for registration, participant management, booking assignment, provision of access credentials, or the conduct of the event
- Braunschweig University of Technology or Lernfabrik, to the extent necessary for generating registration codes, activating the learning platform, and conducting the course
- Payment service providers, in particular Stripe, to the extent necessary for payment processing
- IT and hosting service providers, to the extent that they provide or maintain the website, booking systems, or other technical infrastructure
- Tax advisory services, accounting firms, banks, and other entities, to the extent necessary for invoicing, payment processing, or compliance with legal obligations
- Government agencies or courts, to the extent that we are legally required to disclose information or where such disclosure is necessary to enforce or defend against claims
To the extent that service providers process personal data on our behalf, we enter into the necessary data protection agreements with them, in particular data processing agreements pursuant to Article 28 of the GDPR.
8. Cookies and Consent Management
Our website uses cookies and similar technologies. Cookies are small text files that are stored on your device. Some cookies are technically necessary to operate the website, enable basic functions, provide security features, or save your privacy settings.
The use of technically necessary cookies is based on Section 25(2) of the TDDDG. The associated processing of personal data is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in ensuring the technically secure and functional operation of our website.
We use cookies and similar technologies that are not technically necessary—particularly for analytics, statistics, marketing, or convenience purposes—only if you have given your prior consent. The legal basis for this is Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect.
We use the consent management tool “Real Cookie Banner” to manage consent. For details on how “Real Cookie Banner” works, please visit https://devowl.io/de/rcb/datenverarbeitung/. Information regarding your consents and privacy settings is processed in order to document them and take them into account during future visits. The legal basis is Article 6(1)(c) of the GDPR, insofar as we are fulfilling statutory record-keeping obligations, as well as Article 6(1)(f) of the GDPR based on our legitimate interest in the legally compliant management of consent.
To adjust, view or revoke your privacy settings, please use the following links:
9. Google Analytics
Provided you have given your consent, we use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to analyze how our website is used in order to improve our offerings and statistically evaluate the reach of our content.
In particular, this may involve the processing of information such as pages visited, time spent on the site, click behavior, technical information about the browser and device, approximate location information, and truncated IP addresses.
The legal basis for the use of Google Analytics is your consent in accordance with Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR. You may revoke your consent at any time with future effect via our cookie settings.
Google may also transfer data to Google LLC in the United States. Google LLC is currently certified under the EU-U.S. Data Privacy Framework. To the extent that the data transfer is covered by this framework, the transfer is based on the relevant adequacy decision by the European Commission.
We have entered into the necessary data protection agreements with Google and use Google Analytics only in accordance with the privacy settings we have selected.
10. Social Media Links
On our website, we provide links to our company pages on Instagram and LinkedIn. These are simply links. Simply visiting our website does not establish a direct connection to the servers of Instagram, Meta, or LinkedIn. A connection to the respective platform is established only when you actively click on the corresponding link.
Instagram is provided by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. LinkedIn is provided by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland.
When you visit our company pages on Instagram or LinkedIn, personal data may be processed by the respective platform operators. This may include, in particular, your IP address, technical information, information about your usage behavior, and interactions with our page—such as likes, comments, or messages. We do not have complete control over this data processing by the platform operators.
We operate our company pages to provide information about our company, our offerings, and our events; to communicate with interested parties, customers, and business partners; and to manage our public relations efforts. When you interact with us on Instagram or LinkedIn, we process the information visible to us in order to respond to your inquiry or interaction.
We process data on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in public relations, corporate communications, and our public image.
In some cases, the platform operators provide us with statistical analyses of the use of our company pages, known as Page Insights. These statistics are generated based on personal data that Instagram or LinkedIn processes in connection with the use of the respective platform. To the extent that we receive such Insights, joint controllership pursuant to Article 26 of the GDPR may exist between us and the respective platform operator.
For more information on data processing, please refer to the privacy policies of the respective providers:
Instagram / Meta: https://privacycenter.instagram.com/policy/
LinkedIn: https://www.linkedin.com/legal/privacy-policy
LinkedIn Page Insights: https://legal.linkedin.com/pages-joint-controller-addendum
11. Credit Check
Our company regularly checks your creditworthiness when entering into contracts and, in certain cases where there is a legitimate interest, also for existing customers. To this end, we work with Creditreform Boniversum GmbH, Hammfelddamm 13, 41460 Neuss, from which we receive the necessary data. For this purpose, we transmit your name and contact information to Creditreform Boniversum GmbH. The information pursuant to Article 14 of the EU General Data Protection Regulation regarding the data processing carried out by Creditreform Boniversum GmbH can be found here: https://www.boniversum.de/eu-dsgvo/informationen-nach-eudsgvo-fuer-verbraucher/
12. Data Transfer to Third Countries
Personal data will only be transferred to countries outside the European Union or the European Economic Area if the legal requirements for such a transfer are met. This may be the case, in particular, if the European Commission has issued an adequacy decision for the third country in question, if appropriate safeguards within the meaning of Article 46 of the GDPR have been agreed upon, or if you have given your explicit consent.
To the extent that we use services from providers based in or affiliated with a group of companies in the United States, personal data may be transferred to the United States. Certain providers may be certified under the EU-U.S. Data Privacy Framework. In such cases, we base the transfer on the relevant adequacy decision by the European Commission, provided that the respective processing is covered by it.
13. Retention Period
We store personal data only for as long as is necessary for the respective processing purposes. To the extent that statutory retention requirements apply—in particular those under commercial or tax law—we store the relevant data for the duration of these requirements.
We delete data from inquiries as soon as the inquiry has been fully processed, provided there are no legal retention requirements or legitimate interests in continuing to store the data.
We store booking, contract, invoice, and payment data for the duration of the contract and thereafter in accordance with the statutory retention periods.
We store data processed on the basis of consent until you revoke your consent or the purpose of the processing no longer applies, provided there is no legal obligation or legitimate interest in continuing to store the data.
14. Your Rights
In accordance with the statutory requirements, you have the right to access the personal data we process pursuant to Article 15 of the GDPR, the right to rectification pursuant to Article 16 of the GDPR, the right to erasure pursuant to Article 17 of the GDPR, the right to restriction of processing under Article 18 of the GDPR, the right to data portability under Article 20 of the GDPR, and the right to object to certain processing activities under Article 21 of the GDPR.
To the extent that processing is based on your consent, you have the right to withdraw that consent at any time, effective for the future. The lawfulness of the processing up until the withdrawal remains unaffected.
To exercise your rights, you may contact us or our Data Protection Officer at any time.
15. Right to Object
If we process personal data on the basis of Article 6(1)(f) of the GDPR, you have the right to object to such processing at any time for reasons arising from your particular situation. We will then no longer process the personal data in question unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.
To the extent that personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of such data for the purpose of such marketing. In this case, the personal data will no longer be processed for these purposes.
16. Right to File a Complaint with a Supervisory Authority
You have the right to file a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates data protection laws. In particular, the supervisory authority with jurisdiction is the one in your usual place of residence, your place of work, or the location of the alleged violation.
The State Data Protection Commissioner of Lower Saxony is generally responsible for the iTUBS.
17. Security and SSL/TLS Encryption
We take appropriate technical and organizational measures to protect personal data from loss, destruction, tampering, and unauthorized access. For security reasons and to protect the transmission of confidential content, our website uses SSL or TLS encryption. You can recognize an encrypted connection by the fact that the browser’s address bar begins with “https://.”
Please note that data transmission over the Internet—particularly when communicating via email—may be subject to security vulnerabilities. It is not possible to completely protect data from access by third parties.
18. Updates to This Privacy Policy
We reserve the right to update this Privacy Policy if our data processing practices change or if legal requirements make it necessary. The current version published on our website is the one that applies.
As of: 08/2026