1. Data protection at a glance
This policy describes which personal data we process when you visit our website, subscribe to our newsletter, buy a ticket or take part in the CXI Conference as an exhibitor, speaker or crew member – and which rights you have. Personal data means any information that can be used to identify you personally.
In short: the website itself collects only the technically necessary data (server logs) and uses no analytics or advertising services. We use external services in two places: the ticket shop (ticket.io) and embedded videos (Vimeo). To organise the conference, we process the data of exhibitors, speakers and crew in our own tools on a server in Germany.
2. Controller
The controller responsible for data processing on this website and for the organisation of the CXI Conference is:
Prof. Robert Paulmann
Bielefeld University of Applied Sciences and Arts (HSBI)
Faculty of Design
CXI Conference
Lampingstraße 3
33615 Bielefeld
Germany
Phone: +49 (0) 521 10670218
Email: info@cxi-konferenz.org
The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of the processing of personal data.
Data Protection Officer of Bielefeld University of Applied Sciences and Arts: by post via the university’s address, phone +49 521 106-7743, email datenschutzbeauftragte@hsbi.de
3. General information and your rights
Legal bases
We process personal data only where a legal basis permits it: for the performance of a contract or pre-contractual measures (Art. 6(1)(b) GDPR), on the basis of your consent (Art. 6(1)(a) GDPR), to comply with legal obligations (Art. 6(1)(c) GDPR) or on the basis of our legitimate interests (Art. 6(1)(f) GDPR). The basis that applies in each case is stated in the respective section.
Retention period
We store personal data only for as long as necessary for the respective purpose and delete it afterwards, unless statutory retention obligations require otherwise. Specific periods are stated in the individual sections.
Access, rectification, erasure, objection
You have the right to obtain information about your stored data and to rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR). You may object to processing based on legitimate interests on grounds relating to your particular situation (Art. 21 GDPR). You may withdraw any consent you have given at any time with effect for the future; the lawfulness of processing carried out until then remains unaffected. An informal email to info@cxi-konferenz.org is sufficient.
Right to lodge a complaint with a supervisory authority
You may lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.
SSL/TLS encryption
All CXI pages and tools are delivered over an encrypted connection (HTTPS). You can recognise this by »https://« in the address bar and the padlock symbol in your browser. Data you transmit to us cannot be read by third parties in transit.
No analytics or advertising services
We use no tracking, analytics or advertising services and create no usage profiles.
Objection to promotional emails
We hereby object to the use of the contact details published in our legal notice for sending unsolicited advertising and information material.
4. Hosting and processors
The website, the ticket shop embedded on our site, the exhibitor portal and our internal planning tool run on servers of jweiland.net GmbH, Echterdinger Straße 57, Gebäude 9, 70794 Filderstadt, Germany; the servers are located in Germany. The hosting provider processes data exclusively on our behalf and according to our instructions; a data processing agreement under Art. 28 GDPR is in place. We send our emails via the same provider. The legal basis is our legitimate interest in providing our services securely and reliably (Art. 6(1)(f) GDPR).
Server log files
When you access our pages, the server automatically stores information transmitted by your browser:
- IP address
- date and time of the request
- page accessed and amount of data transferred
- browser type and version
- operating system used
- previously visited page (referrer URL)
This data serves security and error analysis, is not merged with other data sources and is deleted automatically by the hosting provider after a short time. The legal basis is Art. 6(1)(f) GDPR.
5. Data collection on our website
Cookies
The website itself sets no cookies that recognise you or analyse your behaviour. Technically necessary cookies are set only by the embedded ticket shop (section 6), by the exhibitor portal for personal access (section 7) and by the Call for Cases form (section 9); they are stored on the basis of Art. 6(1)(f) GDPR. A chosen display mode (light/dark) is remembered locally by your browser and is not transmitted to us.
Contact by email
If you write to us by email, we process your details to handle your request and any follow-up questions (Art. 6(1)(b) or (f) GDPR). We delete them once the matter is settled and no statutory retention obligations apply.
Newsletter
With your consent (Art. 6(1)(a) GDPR), we inform you by email about the start of registration, the speakers and other news about the conference. For this purpose we store your email address as well as the date, time and IP address of your subscription and its confirmation, so that we can prove your consent. The subscription only takes effect when you click the link in our confirmation email (double opt-in). The newsletter runs on software on our own server; we do not pass your address on to third parties.
You can unsubscribe at any time via the link at the end of every newsletter or by emailing us. Your data will then be deleted from the mailing list.
Videos (Vimeo)
Recordings on the »Videos« page are embedded via the Vimeo service. The provider is Vimeo.com, Inc., 330 West 34th Street, New York, NY 10001, USA. When you open this page, your browser connects to Vimeo’s servers; Vimeo thereby learns your IP address and which page you visited. If you are logged in to Vimeo, Vimeo can assign the visit to your account; you can prevent this by logging out of Vimeo beforehand.
The transfer to the USA is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, to which Vimeo has subscribed. The legal basis is our legitimate interest in presenting our recorded talks (Art. 6(1)(f) GDPR). Further information: https://vimeo.com/privacy.
Links to other websites
Our pages contain plain links to partners, hotels, transport providers and to profiles on LinkedIn and Instagram. Only when you click such a link do you reach the pages of the respective provider, who then processes data according to its own rules. We do not use social media plugins that transmit data as soon as our pages are opened.
6. Ticket shop (ticket.io)
For ticket sales we use the ticket shop of ticket i/O GmbH, Lichtstraße 43g, 50825 Cologne, Germany, which is embedded on our »Registration« page. When buying a ticket, you enter your data – name, email address, billing address where applicable, payment details – directly in the shop; payment is handled by the payment service providers offered there. ticket.io processes this data to handle your ticket purchase.
From the ticket shop we receive the names and email addresses of ticket holders, where applicable company or university and billing address, as well as details of any discount. We use this data for admission and badges, for invoicing and for settling the accounts of the event (Art. 6(1)(b) GDPR); for this purpose, invoice data is passed to the administration of Bielefeld University of Applied Sciences and Arts. We delete the list of participants after the conference, once admission and accounting are complete; we keep invoice documents for the statutory retention periods. Proof of eligibility for discounts that you send us by email is checked and then deleted. When you open the »Registration« page, the embedded shop sets technically necessary cookies. Details on processing by ticket.io: https://www.ticket.io/datenschutz.
7. Exhibitor portal
Through our exhibitor portal we organise the exhibition spaces of the conference: enquiry, confirmation, contract and invoice, stand set-up, logos for the website and programme booklet, as well as exhibitor passes and tickets for the stand team and its guests.
Which data
Company and billing address; name, role, email address and phone number of the contact person; details of package and stand; logo files; names and email addresses of the persons who receive an exhibitor pass or ticket. Access to the portal is via a personal link; for this, the portal sets a technically necessary cookie.
Purposes and legal basis
Initiation and performance of the exhibitor agreement (Art. 6(1)(b) GDPR). We also use the company and contact details of the contact person to approach them again for the next conference – on the basis of our legitimate interest in continuing the cooperation (Art. 6(1)(f) GDPR). You may object to this at any time.
Recipients
We transmit the names and email addresses of pass and ticket holders to the ticket shop (ticket i/O GmbH, section 6) for tickets and admission, and to the printing company commissioned to print the badges, which works on our behalf. Invoice data goes to the administration of Bielefeld University of Applied Sciences and Arts. There are no other recipients.
Retention period
We delete the names of pass and ticket holders and all details of the stand after the conference at the year-end closing. We delete the company and contact details of the contact person automatically three years after the last contact. Exhibitors deleted in the portal remain in a recycle bin for 30 days and are then removed permanently. Contract and invoice documents are kept by the university for the statutory retention periods.
8. Speakers and programme
For travel, hotel and programme we process our speakers’ contact details, travel details, hotel nights and details of the talk (Art. 6(1)(b) GDPR). Travel details go to our organising team, hotel nights to the hotel. With the speakers’ consent, we publish name, position, company, CV, project and company description, photo and talk title on the website, on social media and in the programme. We delete travel and contact details at the year-end closing; the programme and the content of the talks remain part of our documentation.
9. Call for Cases
Via the »Call for Cases« form you can suggest brand projects for the programme, also anonymously. We process company or brand, agency, link and your text as well as, if provided, your name and email address for queries (Art. 6(1)(f) GDPR; for voluntary details Art. 6(1)(a) GDPR). To protect against automated submissions, the form sets a technically necessary cookie for one day and stores the IP address only as a hash value. The suggestions go to our programme team and into our planning tool (section 4). We delete them after the conference for which they were made; projects included in the programme are handled according to section 8.
10. Crew
From the conference’s helpers we process contact details, details of their assignment (area, shirt size) and – for payment – tax identification number and bank details (Art. 6(1)(b) GDPR). Bank details and tax ID are stored encrypted in our planning tool and are accessible only to the management; for payment they go to the administration of Bielefeld University of Applied Sciences and Arts. We delete them after payment, the remaining details at the year-end closing.
11. Photos and video recordings at the conference
During the conference, photos and video recordings are made for documentation, the website, the programme booklet and our channels on LinkedIn and Instagram. Participants may be recognisable in them. The legal basis is our legitimate interest in reporting on the event (Art. 6(1)(f) GDPR in conjunction with Section 23 of the German Art Copyright Act, KUG). If you do not wish to be depicted, please tell the CXI photographer on site; we will take this into account when recording and publishing.
12. Changes to this policy
We update this policy when our services or the legal situation change. The version published here applies.
Last updated: 9 October 2026