Privacy policy

This policy applies to the website fesity.de (also reachable via fesity.com and fesity.eu, which redirect to fesity.de). Our customer portal (app.fesity.de) has its own privacy notice, available there under “Privacy”. The German version (Datenschutzerklärung) is the binding one; this English version is provided for convenience.

1. Controller

SFX E-Commerce, owner Simon Festl
Junkersstr. 20
93055 Regensburg
Germany

Email for privacy requests: datenschutz@fesity.de
Phone: +49 171 2123136

We have not appointed a data protection officer because the legal requirements for doing so (Art. 37 GDPR, Section 38 BDSG) are not met.

2. Summary

• No cookies, no tracking: This website sets no cookies and uses no analytics, advertising or tracking tools.
• No third-party content: The typeface, images, scripts and spam protection are delivered from our own servers. We do not embed maps, videos, social media buttons or fonts from other providers.
• Forms only at your initiative: We only receive personal data if you register for an event, join a waiting list or write to us.

3. Legal bases

We process personal data on the basis of

• Art. 6(1)(a) GDPR (consent; you can withdraw it at any time with effect for the future, Art. 7(3) GDPR),
• Art. 6(1)(b) GDPR (contract or pre-contractual steps taken at your request),
• Art. 6(1)(c) GDPR (legal obligation, e.g. retention under commercial and tax law),
• Art. 6(1)(f) GDPR (legitimate interests, e.g. secure operation of the website and protection against abuse).

Storing information on your device and accessing it is additionally governed by Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act, see section 5).

4. Hosting and server logs

We run the website and the interface our forms send to on Google Cloud (services Cloud Run, Cloud SQL, Cloud Storage, Secret Manager and Cloud Logging) in the europe-west1 region in Belgium (EU). Our contractual partner is Google Cloud EMEA Limited, Dublin, Ireland. Google processes the data on our behalf (Art. 28 GDPR).

When you open a page, your browser transmits technically necessary data to the server: IP address, date and time, requested address, amount of data transferred, status code, browser identifier (user agent) and the previously visited page (referrer). We use this data only to deliver the website, find errors and fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation.

Google Cloud Logging stores the logs on our behalf for 30 days; after that they are deleted automatically. If we need individual entries to investigate a specific security incident, we keep them until the investigation is complete.

5. Storage in your browser (no cookies)

The website remembers some settings in your browser's storage (localStorage). They are only stored if you change the setting or close a notice yourself, stay on your device and are not transmitted to us.

The entries contain no identifier and remain stored until you clear the website storage in your browser. The legal basis is Section 25(2) no. 2 TDDDG (strictly necessary for the display you explicitly requested) and Art. 6(1)(f) GDPR. Because we only store what you choose yourself, we do not ask for separate consent and do not show a cookie banner.

We do not use analytics or marketing cookies. The website sets no cookies at all and loads no content from other providers' servers; it only calls our own interface at app.fesity.de (section 7).

6. Contact by email

If you write to us (e.g. to hallo@fesity.de or datenschutz@fesity.de), we process your email address, your name and the content of your message in order to answer your request.

The legal basis is Art. 6(1)(b) GDPR if your request concerns a contract or its preparation, otherwise Art. 6(1)(f) GDPR (our interest in answering requests). We delete messages once your matter has been dealt with, unless statutory retention obligations apply (six years for business letters, Section 257 HGB, Section 147 AO).

We manage our email with Google Workspace (contractual partner: Google Cloud EMEA Limited, Ireland) on the basis of a data processing agreement (Art. 28 GDPR).

7. Events

Showing dates: The “Events” page loads the current dates from our interface. No cookies or login data are transmitted.

Registration: If you register for an event, we process your name, company, email address, optionally your role in the company and (on the registration page in the customer portal) your phone number, the selected date, the language of the page, the time and version of your confirmation in the form, and the status of your registration (registered, waiting list, cancelled, attended).

Purpose: Organising the event: confirmation by email with a calendar entry and check-in code, personal link for cancelling, waiting list and moving up, reminder before the date, admission on site and information about changes or cancellation.

Legal basis: Art. 6(1)(b) GDPR (your participation following your registration).

Recipients: We store registrations on Google Cloud (section 4). We send the emails about your registration via Google Workspace (sender portal@fesity.de; section 11). We do not pass participant data to event platforms: even if we also announce a date on such a platform, registration runs through this website and our own system.

Retention: We delete your registration three months (90 days) after the end of the event.

8. Waiting list

On pages marked “Coming soon” and, as long as sign-up for the customer portal is not yet open, on the sign-up page of the customer portal (app.fesity.de/start) you can ask to be notified.

Data: name, company, email address, optionally your message, the page on which you signed up, the language and the time and version of your consent.

Purpose: We inform you by email when the service launches and can refer to your message.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time, e.g. by email to datenschutz@fesity.de. This does not affect the lawfulness of processing carried out before the withdrawal.

Retention: until we have informed you about the launch, for no longer than twelve months (365 days) after you signed up, or until you withdraw your consent.

9. Protection against spam and abuse

To prevent automated abuse of our forms, we use the open-source method ALTCHA. When you submit a form, your browser solves a small computing task that it receives from our server. No cookies are set and no data is transmitted to third parties. In addition, the forms contain a field that is invisible to humans and only filled in by automated programs.

To limit excessive requests from one connection, we briefly count requests per IP address. For this we do not store the IP address itself but a check value (hash) calculated from it, together with a counter and a timestamp, in our database. A counter is valid for ten minutes; we delete it after about one day.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is protecting our forms and systems against abuse.

10. Links to our customer portal

Buttons such as “Get started for free” take you to our customer portal. The link only contains the page you came from (e.g. home page or industry page) so that we can prepare your start accordingly. Processing in the customer portal is governed by the privacy information provided there.

11. Recipients and transfers to third countries

We only pass on personal data where this is necessary for the purposes described. Service providers act on our behalf on the basis of a contract under Art. 28 GDPR:

For Google Workspace we have set the data region to Europe: stored emails and files are kept in data centres in the EU. Transmission and individual processing steps (e.g. for delivery or support) may also take place outside the EU. Google belongs to the US group Alphabet. For Google Cloud, too, we cannot rule out that Google transfers data to the USA in individual cases or accesses it from there, e.g. for maintenance and support. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which an adequacy decision of the European Commission exists (Art. 45 GDPR). In addition, Google has agreed to the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR).

12. Retention at a glance

13. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR). Please write to datenschutz@fesity.de.

Right to object (Art. 21 GDPR): Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Where we process your data for direct marketing, you may object at any time without giving reasons.

Right to lodge a complaint (Art. 77 GDPR): You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You can also contact the supervisory authority of your place of residence or work.

14. Obligation to provide data, no automated decisions

You are not obliged to give us any data. For event registration and the waiting list we need the fields marked as required; without them, registration is not possible. All other information is voluntary.

We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

15. Security

The website is only accessible in encrypted form (HTTPS). Only authorised persons have access to stored registrations. We back up the database daily; automatic backups are overwritten after 14 days. Until then, deleted data may still be contained in a backup.

16. Changes

We update this policy when the website or the legal situation changes. The version published here applies.

Last updated: 17 October 2026