Da­ten­schutz­er­klä­rung

Last updated: October 2026

In this privacy policy, Be Brave gUG (haftungsbeschränkt) (“we”, “us” or “ChefTreff”) explains how we process your personal data. It covers three areas:

• Part A applies to our website https://chef-treff.de.
• Part B applies to our events, in particular the Future Leader Summit, and to our platform https://portal.chef-treff.de with its areas for talents, speakers, partners, volunteers and the hackathon.
• Part C contains the information that applies to all areas: service providers, transfers to third countries, retention periods and your rights.

We comply with the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications and Digital Services Data Protection Act (TDDDG).

In case of doubt, the German version of this privacy policy prevails.

Controller

Be Brave gUG (haftungsbeschränkt)
c/o Factory Hammerbrooklyn
Stadtdeich 2–4, 20097 Hamburg, Germany
Managing Director: Jan Henri Kalinowski
Email: info@chef-treff.de

Data Protection Officer

Konrad Gruner, reachable at datenschutz@chef-treff.de or at the postal address above, marked “Data Protection Officer”.

Part A · Website chef-treff.de

A1 · Providing the website and server logs

When you visit our website, our hosting provider automatically processes the following data:

• date and time of access;
• the page visited and the previously visited page (referrer);
• browser type and version, operating system;
• your IP address.

We need this data to deliver the website, keep it secure and fend off attacks. It is stored in server logs and deleted after 30 days at the latest, in individual cases later, until a suspected misuse has been resolved.

• Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Content is delivered via a worldwide server network. For transfers to the USA, see C2.
• Content management: We manage the texts and images of the website with Sanity (Sanity AS, Trondheimsveien 2K, 0560 Oslo, Norway, with its US company Sanity US Inc., San Francisco, USA). Speaker profiles and partner logos come from our platform (see B4 and B6).

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure and functioning website. Storing and reading technically necessary information on your device is based on Section 25(2) no. 2 TDDDG.

A2 · Cookies and consent management

We use cookies and similar technologies (e.g. pixels, local storage). We set technically necessary cookies without consent (Section 25(2) no. 2 TDDDG). All other cookies, i.e. statistics and marketing, are set only after you consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR). You can change or withdraw your choice at any time via the “Cookie settings” link in the website footer.

Consent management: our own solution on this website, without a third-party provider. We store your choice in a cookie in your browser.

• Data processed: your choice and the time of consent.
• Retention: The consent cookie is kept for 12 months.
• Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR (proof of consent).

A3 · Statistics and marketing (only with consent)

We load the following services only after you have agreed in the cookie banner. The legal basis is Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time with effect for the future.

Google Tag Manager. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

• Purpose: The Tag Manager manages the integration of the services listed below. It does not analyse data itself, but processes your IP address when loading.

Server-side tagging (Stape). Stape, Inc., 901 N Market St., Suite 100, Wilmington, DE 19801, USA.

• Purpose: We do not load the services listed in this section directly in your browser but via our own tagging server on a subdomain of chef-treff.de. It receives the data and forwards it to the respective services only if you have consented.
• Data: IP address, device and browser information, pages visited and events, as received by the respective services.
• Hosting: Stape operates the tagging server for us as a processor; the tagging server is located in the European Union.
• Third country: Stape, Inc. is based in the USA and is certified under the EU-US Data Privacy Framework (C2).

Google Analytics 4. Google Ireland Limited, address as above.

• Purpose: audience measurement.
• Data: shortened IP address, device and browser information, pages visited, interactions, approximate location.
• Retention: The data is deleted after 14 months; cookies are kept for up to 2 years.
• Third country: Data may be transferred to Google LLC, USA (C2).

Google Ads conversion tracking. Google Ireland Limited, address as above.

• Purpose: measuring the effectiveness of our ads on Google.
• Retention: cookies for up to 90 days.
• Third country: Data may be transferred to Google LLC, USA (C2).

Microsoft Clarity. Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland.

• Purpose: usage analysis with heatmaps and session recordings. Mouse movements, clicks and scrolling are recorded; entries in form fields are masked.
• Retention: cookies for up to 12 months.
• Third country: Data may be transferred to Microsoft Corporation, USA (C2).

Meta Pixel. Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

• Purpose: measuring the effectiveness of our ads on Facebook and Instagram, building audiences.
• Retention: cookies for up to 90 days.
• Joint controllership: We are jointly responsible with Meta for collecting the data and transferring it to Meta (Art. 26 GDPR). You can find the agreement at https://www.facebook.com/legal/controller_addendum.
• Third country: Data may be transferred to Meta Platforms, Inc., USA (C2).

TikTok Pixel. TikTok Technology Limited, The Sorting Office, Ropemaker Place, Dublin 2, D02 HD23, Ireland, together with TikTok Information Technologies UK Limited, Kaleidoscope, 4 Lindsey Street, London EC1A 9HP, United Kingdom.

• Purpose: measuring the effectiveness of our ads on TikTok.
• Joint controllership: We are jointly responsible with TikTok for collecting and transferring data via the pixel and for measurement and reporting (Art. 26 GDPR). You can find the agreement at https://ads.tiktok.com/i18n/official/policy/jurisdiction-specific-terms.
• Retention: cookies for up to 13 months.
• Third country: Data may be transferred to TikTok group companies outside the EU (C2).

A4 · Chat on the website

For questions on the website, we use the chat assistant Chatbase: Chatbase Inc., 2261 Market Street STE 85690, San Francisco, CA 94114, USA (processor).

• Data: your messages and, if you provide it, your email address.
• Legal basis: Art. 6(1)(f) GDPR (answering enquiries).
• Retention: 12 months.
• Please do not enter any sensitive data in the chat.

A5 · Embedded content and links to social networks

We load third-party content (e.g. videos or 3D tours) only when you click on it. Only then does the provider receive your IP address and browser information. We refer to our social media profiles with simple links only. Clicking them does not yet transfer any data to the network.

Podcast episodes. On the podcast page we show the latest episodes of our podcast. Our server fetches the list of episodes with title, cover and description from the podcast host and serves it without any connection between your browser and the host. Only when you play an episode does your browser load the audio file directly from Podigee: Podigee GmbH, Revaler Straße 28, 10245 Berlin, Germany (processor). Podigee then receives your IP address and browser information; no cookies are set. Legal basis: Art. 6(1)(f) GDPR (providing our podcast on the website).

A6 · Our social media presence

We run profiles on Instagram and Facebook (Meta Platforms Ireland Limited), LinkedIn (LinkedIn Ireland Unlimited Company), TikTok (TikTok Technology Limited) and YouTube (Google Ireland Limited).

• What the network processes: When you visit these profiles, the respective network processes your data according to its own privacy policy.
• Statistics: For page statistics (“Insights”) on Facebook and Instagram, we are jointly responsible with Meta (Art. 26 GDPR). The agreement: https://www.facebook.com/legal/terms/page_controller_addendum.
• What we process: We process messages and comments you send us there in order to reply.
• Legal basis: Art. 6(1)(f) GDPR (public relations and communication).

A7 · Contacting us

When you write to us by email or via a form, we process your details (name, email address, telephone number if provided and your message) to answer your enquiry.

• Legal basis: Art. 6(1)(b) GDPR if it concerns a contract or participation; otherwise Art. 6(1)(f) GDPR (answering enquiries).
• Retention: We delete the details once your enquiry has been dealt with, unless statutory retention obligations apply (e.g. for business letters, C3).

A8 · Newsletter

We send our newsletter only with your consent (Art. 6(1)(a) GDPR).

• Sign-up: You confirm it via a link in an email (double opt-in). We store the time and channel of sign-up as proof.
• Sending: via ActiveCampaign, LLC, 1 North Dearborn Street, Chicago, IL 60602, USA.
• Analysis: We analyse whether a newsletter was opened and which links were clicked in order to improve our content.
• Relevant invitations: With your consent, we assign you to target groups based on your details on the platform (e.g. interests, status, events attended) so that we only invite you to relevant events. Lists with names and email addresses are created only by our marketing team and administration, and only for people who have consented; every such export is logged. All other analyses are aggregated figures without names; we do not report small groups individually.
• Unsubscribing: You can unsubscribe at any time via the link in every newsletter or in your profile on the platform. The unsubscription then also applies on the platform.
• Block list: After you unsubscribe, we store your email address on a block list so that you do not receive any further advertising (Art. 6(1)(f) GDPR).

Part B · Events and platform portal.chef-treff.de

B1 · Account and login on the platform

You need an account to access the platform. Login works without a password: you receive a login link at your email address.

• Data: email address, name, your roles on the platform (e.g. talent, speaker, partner), login times.
• Technically necessary storage: The platform only sets a login cookie (session) and a cookie for the selected language. In your browser’s local storage, it keeps settings and the history of the wiki assistant until you close the tab (Section 25(2) no. 2 TDDDG). We do not use any statistics or marketing tools on the platform.
• Legal basis: Art. 6(1)(b) GDPR (terms of use).
• Retention: until you delete your profile or your role ends. You can delete your profile yourself at any time via “Delete profile”. We then block your email address from being created again (block list as a check value, not in plain text).

B2 · Applying as a talent or student

When you apply for the Summit or a format, we process:

• contact details;
• information about your studies or job, interests and motivation;
• how you heard about us;
• your CV and photo, if you choose to provide them.

You can apply from the age of 16. We select the participants. The decision is made by people on our team; there is no automated decision within the meaning of Art. 22 GDPR.

• Legal basis: Art. 6(1)(b) GDPR (application and participation).
• Retention: 12 months after the respective edition, unless you delete your profile earlier.

B3 · Sharing with partner companies for formats

We run some formats together with partner companies: company tours, masterclasses, side events and interview tables. For these formats, the partner helps decide who takes part. If you apply for one of them, we share your application only with the partner company of that format:

• name, email address (for contact regarding this format) and your LinkedIn address, if provided;
• the profile details you have released for sharing (e.g. field of study, graduation year, skills, interests, career goals);
• your answers to the questions of this application and its status (received, accepted, waiting list, declined).

We do not share information on diet or health, CV files, date of birth, telephone number or information about other applications.

• Purpose: selecting participants and contacting you about this format. The partner may not use the data for other purposes, in particular not for advertising or its own talent pools, without asking you again.
• Legal basis: Art. 6(1)(b) GDPR. Sharing is part of the format you apply for, because the partner helps make the selection; we point this out on the application page and in our terms of participation.
• Duration: The partner has access until four weeks after the Summit and deletes downloaded data no later than three months after the Summit.
• Withdrawing: If you withdraw your application under “My applications”, the partner no longer sees it.
• The partner company processes the data as an independent controller for running the format.

B4 · Speakers

To support our speakers, we process:

• profile, short bio, photo, session details;
• travel, hotel and shuttle data, travel expenses and bank details for reimbursement;
• technical requirements for the appearance and presentations;
• responses to invitations to side events.

Recipients:

• our speaker team;
• the booked hotel (name, dates of stay);
• the shuttle company (name, times, locations);
• our stage technicians: they receive a copy of your presentation in a Google Drive folder per stage and day. The copy is deleted as soon as the presentation is removed or your session is cancelled;
• our accounting and bank (travel expense receipts, see C1).

Website and event app: We publish your speaker profile on our website and in the event app, i.e. name, position, organisation, short bio, links, portrait and your sessions. We only do this if you have agreed to the publication and the use of your photo and our team has approved the profile. If you withdraw, cancel or delete your profile, we automatically remove it from the website. For the website, we cut out your portrait (background removed) and set a uniform crop. To do this, we send the photo to Photoroom SAS, Paris, France (processor); our team checks every result before publication.

Dietary information: Intolerances and dietary preferences may be health data (Art. 9 GDPR).

• Voluntary and purpose: Providing this information is voluntary; we only use it for catering.
• Legal basis: your explicit consent (Art. 9(2)(a) GDPR).
• Deletion: automatically 30 days after the end of the Summit.

Contacts you add: If you add an assistant or agency as a contact, we process their name and business contact details for coordination. Please inform the person about this.

Schedule: If your published programme slot changes and for the calendar invitation, you receive emails with title, time and stage.

Legal basis: Art. 6(1)(b) GDPR (speaker agreement); for the website profile and photo Art. 6(1)(a) GDPR.

Retention: until the end of the edition; travel expenses and receipts according to tax and commercial retention periods (C3).

B5 · Companions of speakers

If a speaker registers you as a companion for the Summit, or our speaker team adds you at their request, we store your first and last name and your email address. We do not receive this information from you but from the person registering you; we ask them to inform you.

We use this information exclusively to:

• issue your ticket;
• organise admission and, where applicable, access to the speaker lounge;
• trigger the sending of the ticket by our ticketing provider vivenu.

Legal basis: Art. 6(1)(b) GDPR (contract with the speaker about their participation) and Art. 6(1)(f) GDPR (organising the event and supporting our speakers).

Recipients: our speaker team, vivenu (processor) and, with your name only, the speaker lounge staff.

Retention: until three months after the end of the edition.

Your rights: At your request to datenschutz@chef-treff.de, we delete your details on the ticket and in the email log and cancel the ticket, even one already issued by vivenu.

B6 · Partners and exhibitors

For our cooperation with partner companies, we process the data of their contact persons:

• name, business email address and telephone number, photo, role;
• contract documents, quotes and invoices;
• orders in the exhibitor shop;
• branding files, logo, details on booths and formats.

On the platform, partners see the names, photos and business contact details of their contact persons at ChefTreff.

People without their own account: To organise their appearance, partners can add people who do not have an account on the platform themselves: the booth team with shifts, the people running a format and participants in their meetings (e.g. interview tables). We store name, organisation and a short note without contact details. We process this information to organise the Summit (Art. 6(1)(f) GDPR; legitimate interest in a smooth event) and delete it no later than 30 days after the end of the event. The partner informs the people added.

Recipients: HubSpot (CRM) and sevdesk (quotes, invoices). We notify new bookings internally in a Slack channel (name of the organisation and the booking). The partner logo appears on the website and in the event app. We store print and branding files as a copy in Google Drive for our production team (Google Workspace, C1).

Legal basis: Art. 6(1)(b) GDPR (contract with the partner company) and Art. 6(1)(f) GDPR (communication with the contact persons).

Retention: for the duration of the business relationship, then according to statutory retention periods (C3).

B7 · Tickets, payment and admission

We sell tickets via vivenu GmbH, Völklinger Straße 33, 40221 Düsseldorf, Germany. Payments are processed by Global Event Technologies GmbH & Co KG, Neualmerstraße 37, 5400 Hallein, Austria.

• Data: name, email address, company and position (if provided), ticket category and ticket code. Only the payment provider processes payment data.
• Admission: At the entrance we scan the ticket code and store the day and time of entry.
• Legal basis: Art. 6(1)(b) GDPR (ticket contract); for admission also Art. 6(1)(f) GDPR (security and access control).
• Retention: invoice-relevant data for 10 years (Section 147 AO, Section 257 HGB). Admission data until three months after the end of the edition.

B8 · Event app (Swapcard)

For the programme, networking and exhibitor directory, we use the event app of SWAPCARD CORPORATION SAS, 17–21 Rue Saint Fiacre, 75002 Paris, France.

• Participants: We transfer your profile (name, email address, ticket group, organisation, position) to the app only with your consent (Art. 6(1)(a) GDPR). If you withdraw your consent or cancel your ticket, we remove your profile at the next synchronisation.
• Speakers and exhibitors: We transfer their public programme and company details on the basis of the respective agreement (Art. 6(1)(b) GDPR).
• In the app: What you do there (chat, scanning contacts, meetings) is processed by Swapcard on our behalf; we do not import any of it into our platform.
• Lead scanning: If an exhibitor scans your badge, they receive the profile data you have released in the app.
• Retention: until 12 months after the event.

B9 · Volunteers

To plan our volunteers’ assignments, we process:

• your profile;
• availability, areas of work and shifts;
• your crew pass.

Volunteers must be at least 18 years old on the first day of the event; we therefore ask for the date of birth.

• Legal basis: Art. 6(1)(b) GDPR (volunteer agreement).
• Retention: 12 months after the end of the edition, so that we can contact you again for the next edition.

B10 · Hackathon

For the hackathon, we process applications, skills, teams, submissions and ratings. The challenge partners see their team and its submission; the jury rates internally.

• Legal basis: Art. 6(1)(b) GDPR (terms of participation).
• Community: For exchange during the hackathon, we link to a Discord group. If you join, Discord’s privacy policy applies.

B11 · Initiatives Award and public voting

Application: When an initiative applies, we process the contact person (name, email address) and the texts and images of the application.

• Legal basis: consent or terms of participation.
• Deletion: We automatically delete the contact person’s details 14 months after the Summit.

Public voting: We do not store any IP address. To prevent multiple voting, we create an irreversible check value from the address (hash with a secret key) and store only this value.

• Legal basis: Art. 6(1)(f) GDPR (fair voting).

B12 · Community events (Luma)

Registrations for our community events run via Luma: Luma Labs, Inc., 548 Market St PMB 36143, San Francisco, CA 94104, USA. If you have registered but do not yet have a profile on our platform, we create a contact with your name, email address and event in order to invite you to further community events. This does not sign you up for a newsletter.

• Legal basis: Art. 6(1)(b) GDPR (your registration) and Art. 6(1)(f) GDPR (community management).
• Retention: 24 months after your last participation.
• Objection: at any time to datenschutz@chef-treff.de.

B13 · AI assistants on the platform

The platform offers assistants that answer questions about our wiki and help with titles or posts. Your input and the history of the current conversation are transmitted to Anthropic: Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland. Processing also takes place at the parent company Anthropic, PBC, USA (C2).

• What we send: no name, no identifier and no email address.
• What we store: Only your browser keeps the conversation history until you close the tab. We only store how often an account uses the assistant (protection against misuse, 1 hour) and the wiki questions asked, without personal reference, in order to improve the wiki.
• Legal basis: Art. 6(1)(f) GDPR (a helpful platform).
• Note: Please do not enter any sensitive data. Anthropic deletes inputs and outputs after 30 days and does not use them to train its models.

B14 · Photo and video recordings at events

At our events, we take photos and videos or have them taken, among others by Penno Agency, Jonas Penno, Warnstedtstraße 59d, 22525 Hamburg, Germany. We use them for:

• documentation and reporting;
• our website and social media channels;
• advertising future events;
• informing our partners.

Legal basis: Art. 6(1)(f) GDPR in conjunction with Sections 22 and 23 of the German Art Copyright Act (KUG). Our legitimate interest is documenting and promoting our events. We point out the recordings in our terms of participation and on site.

Objection: You can object to the publication of recordings in which you are recognisably the focus, on grounds relating to your particular situation (datenschutz@chef-treff.de). We will then remove these recordings from our own channels. Speakers consent separately to the use of their recordings (B4).

Retention: 5 years from the recording.

Your own posts: If you publish content with our hashtag or tag us, we may share it using the network’s functions (e.g. repost). Beyond that, we only use your content with your permission.

B15 · Platform emails

We send transactional emails via Resend: Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. These include login links, confirmations, reminders, invitations and change notifications.

• Email log: We store recipient, template, time and status to prove delivery.
• Legal basis: Art. 6(1)(b) GDPR; for the log Art. 6(1)(f) GDPR (proof).
• Retention: 6 months.

B16 · Security and logs of the platform

We log changes made by our team on the platform: who changed what and when. We also log synchronisations with our service providers. This serves security and proof.

• Legal basis: Art. 6(1)(f) GDPR.
• Retention: If you delete your profile, the logs only refer to an anonymous identifier.

B17 · Feedback without login

After our events, you can give feedback via a link without logging in. We only store your answers and the date, no name, no email address and no IP address.

• Protection against misuse: To prevent mass submissions, we count requests per day and connection. For this, we create an irreversible check value from your IP address (shortened for IPv6) with a secret addition and the date; we do not store the IP address itself. The counter is kept separate from your answers.
• Legal basis: Art. 6(1)(f) GDPR (improving our events, protecting the page).
• Retention: answers for 3 years; we delete the counter after two days.
• If you give feedback while logged in, you can voluntarily provide your name; B1 then applies.

B18 · Online meetings

For briefings with speakers, meetings with partners and other appointments, we use Zoom (Zoom Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA) and Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

• Data: name, email address, time and duration of the meeting, technical connection data (IP address, device) and, if you switch them on, video and audio as well as chat messages.
• Recordings: We only record meetings after prior notice and with your consent.
• Legal basis: Art. 6(1)(b) GDPR if the meeting concerns a contract or your participation; otherwise Art. 6(1)(f) GDPR (efficient communication).
• Third country: Data may be transferred to the USA (C2).

B19 · Messenger groups

For coordination, for example with volunteers on event days, we invite people to WhatsApp groups. The provider is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

• Voluntary: Joining is voluntary. You also receive all important information by email or on the platform.
• Data: In the group, the other members see your telephone number, profile name and profile picture. WhatsApp processes what you write there according to its own privacy policy.
• Legal basis: your consent by joining (Art. 6(1)(a) GDPR). You can leave the group at any time.
• Retention: We close the groups no later than three months after the end of the event.
• Third country: Data may be transferred to WhatsApp LLC and Meta Platforms, Inc., USA (C2).

B20 · Applying for a job at ChefTreff (jobs and internships)

If you apply to us for a position or an internship, we process the documents and details you send us, such as contact details, CV, references and cover letter, as well as our notes from interviews.

• Purpose: deciding on establishing an employment relationship.
• Legal basis: Art. 6(1)(b) GDPR (pre-contractual steps) in conjunction with Section 26 BDSG.
• Recipients: only the people on our team involved in the selection.
• Retention: If no employment results, we delete your documents six months after the rejection, unless you consent to longer storage for future positions. If you are hired, we add the documents to your personnel file.

B21 · Sources of data

Where we do not collect data from you directly, it comes from these sources:

• your employer or partner company (contact persons);
• speakers (companions, assistants);
• partners who add people without their own account (B6);
• Luma (community events);
• vivenu (ticket purchase);
• our CRM or previous events, i.e. existing contacts from previous years.

Part C · General information

C1 · Recipients and processors

We use service providers who process data on our behalf and according to our instructions (Art. 28 GDPR). We have concluded a data processing agreement with all of them.

• Supabase Pte. Ltd., Singapore: database, login and files of the platform; the servers are located in Frankfurt am Main, Germany.
• Vercel Inc., USA: hosting of website and platform.
• Sanity AS, Norway (with Sanity US Inc., USA): website content.
• Plus Five Five, Inc. (Resend), USA: platform emails.
• vivenu GmbH, Germany: ticketing.
• Global Event Technologies GmbH & Co KG, Austria: payment processing.
• SWAPCARD CORPORATION SAS, France: event app.
• HubSpot Germany GmbH (processing at HubSpot Ireland Limited, Ireland, and HubSpot, Inc., USA): CRM.
• sevdesk GmbH, Germany: quotes and invoices.
• ActiveCampaign, LLC, USA: newsletter.
• Google Ireland Limited (Google Workspace), Ireland: email, storage, online meetings, presentations for stage technicians.
• Zoom Communications, Inc., USA: online meetings.
• Slack Technologies Limited, Ireland: internal notifications.
• Anthropic Ireland, Limited, Ireland (processing also in the USA): AI assistants.
• Celonis, Inc. (Make), USA: automations.
• Luma Labs, Inc., USA: registration for community events.
• Chatbase Inc., USA: website chat.
• Photoroom SAS, France: cutting out speaker portraits for the website.
• Stape, Inc., USA: operation of the tagging server (server-side tagging, A3).
• Penno Agency, Germany: photo and video.

Other recipients acting as independent controllers:

• partner companies for formats (B3) and exhibitors when lead scanning (B8);
• hotels and the shuttle company (B4);
• our bank (Qonto SA, Paris) for payments and receipt intake for travel expenses, and our tax advisers;
• authorities, where we are legally obliged.

C2 · Transfers to third countries

Some service providers are based outside the EU/EEA or belong to US groups: Vercel, Stape, Resend, ActiveCampaign, Make (Celonis), Anthropic, Luma, Sanity, Zoom, Chatbase, Google, Meta (including WhatsApp), Microsoft, LinkedIn, TikTok, HubSpot and Discord, and, after you click on embedded content, Loom and Matterport. Supabase is based in Singapore; our platform data is stored on servers in Frankfurt am Main, Germany.

Basis for the transfer:

• the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), where the recipient is certified, or
• the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

Certified under the Data Privacy Framework (as of October 2026): Vercel, Stape, Resend, ActiveCampaign, Celonis (Make), Zoom, Google, Meta, WhatsApp, Microsoft, LinkedIn, HubSpot, Atlassian (Loom) and Discord. We base transfers to Supabase, Anthropic, Luma, Sanity, Chatbase and Matterport on standard contractual clauses. You can obtain a copy of the safeguards on request.

C3 · Retention periods

We store personal data only for as long as necessary for the respective purpose or as required by retention obligations. The periods for the individual processing activities are set out in the sections above.

Statutory retention periods:

• invoices and accounting records: 10 years (Section 147 AO, Section 257 HGB);
• commercial and business letters: 6 years.

We delete participant and contact data not subject to retention obligations 3 years after your last participation or activity.

C4 · Your rights

You have the right to:

• access the data we process (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure, unless a retention obligation applies (Art. 17 GDPR). On the platform you can delete your profile yourself;
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR). On the platform you can download your profile data yourself;
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR), e.g. in the cookie banner, in your profile on the platform or by email;
• lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 7th floor, 20459 Hamburg, Germany, mailbox@datenschutz.hamburg.de.

Right to object (Art. 21 GDPR)

If we process your data on the basis of a legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You can object to processing for direct marketing purposes at any time without giving reasons.

An informal objection to datenschutz@chef-treff.de is sufficient.

C5 · Obligation to provide data, automated decisions

You are not legally obliged to provide your data. Without the information marked as mandatory, however, we cannot offer you an account, an application, a ticket or participation.

We do not use automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

C6 · Data security

We transmit data in encrypted form (TLS). On the platform, only authorised people see the data relevant to their role (access rights per record). Changes made by the team are logged.

C7 · Changes to this privacy policy

We adapt this policy when our processing activities or the legal situation change. The version published here applies.