Privacy Policy — Coffee Festival Europe

Controller

The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Content Agency UG (haftungsbeschränkt), represented by Muhammed Danaci. Full contact details are in the imprint.

Principle

We process personal data only where it is necessary for a functioning website and for our services. As a rule, processing takes place only with your consent or where another legal basis under the GDPR applies. Nothing on this site measures your behaviour before you have agreed to it.

Hosting and server log files

When you open this website, our hosting provider automatically collects information your browser transmits: the page requested, date and time, the volume of data transferred, the referrer, browser type and operating system, and the IP address in shortened form. This data is technically necessary to deliver the site and to keep it stable and secure. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is secure operation. Log files are deleted after 30 days at the latest.

Getting in touch

If you write to us by e-mail, we process what you send in order to handle your enquiry and any follow-up questions. The legal basis is Art. 6 (1) (b) GDPR for contract-related enquiries, otherwise Art. 6 (1) (f) GDPR. We delete the data once the matter is closed and no statutory retention periods stand in the way.

Partner and exhibitor applications

The application form collects details about your company, your contact person, the format of participation you are after and, optionally, file attachments. We process this solely to assess and prepare a possible collaboration. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures). Your progress before submitting is stored only locally in your browser; it reaches us only when you send the form.

Uploaded files are not placed in any publicly reachable directory. They are held in access-restricted storage, cannot be retrieved through a guessable address and are not indexed by search engines. We keep application documents until the relevant festival edition has closed, and beyond that only for as long as commercial and tax law requires.

Address lookup in the form

In the application form you can switch on the address lookup. Only if you actively do so is a connection to Google established and your input passed to Google for completion. Without activation no such connection takes place and you simply type the address yourself. The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG.

For the newsletter we use the double opt-in procedure: after signing up you receive an e-mail in which you confirm the subscription. The legal basis is your consent under Art. 6 (1) (a) GDPR. You can unsubscribe at any time, for instance via the link at the bottom of every issue. Withdrawal does not affect the lawfulness of processing carried out beforehand.

Technically necessary storage — your language choice, your form progress and your cookie decision — lives in your browser's local storage and is exempt from consent under § 25 (2) TDDDG. Everything else, in particular statistics and marketing, is loaded only after your active agreement. Nothing is pre-selected, and declining is exactly as easy as agreeing. You can change your decision at any time via “Cookie settings” in the footer.

Google Analytics

If you have consented to the Statistics category, we use Google Analytics provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. IP anonymisation is active, so your address is truncated before it can be combined with anything. A transfer to the USA cannot be ruled out; it is based on the EU-US Data Privacy Framework or on standard contractual clauses. The legal basis is Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Without consent no analytics script is loaded.

Meta Pixel

If you have consented to the Marketing category, we use the Meta Pixel provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland, to measure the effect of our campaigns. The legal basis is Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG. Without consent no pixel is loaded.

Fonts and media

All typefaces, videos and images are served from our own server. Opening the page therefore creates no connection to an external font or video network.

Partner portal

The partner portal at crm.coffeefestival.eu is a separate, access-protected service. Processing there is governed by the privacy notice published inside the portal. Clicking the portal link simply opens a new page; no data is transmitted to the portal from this website in the process.

Recipients and processing on our behalf

We pass data on only where it is necessary to perform a contract, where we are legally obliged to, or where you have consented. Service providers that process data on our behalf — hosting or e-mail delivery, for instance — are bound by data processing agreements under Art. 28 GDPR.

Your rights

You have the right at any time to information about the data stored about you (Art. 15), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on a legitimate interest (Art. 21). You can withdraw consent you have given at any time with effect for the future. An informal e-mail to us is enough.

Right to lodge a complaint

Without prejudice to other remedies, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your residence, your place of work or the place of the alleged infringement.

No automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

Last updated · 2026-08