Privacy Policy

1. Data Protection at a Glance

The following information provides a simple overview of what happens to your personal data when you visit our website and register for our event. Personal data is any data with which you can be personally identified.

2. Data Controller

3. Data Collection on Our Website

Website Analytics

This website does not use cookies or analytics tools. We only collect standard server log data (IP addresses, browser type, referring/exit pages, and date/time stamps) which is automatically deleted after 7 days.

Google Fonts

This website uses Google Fonts (IBM Plex Sans and JetBrains Mono) for typography. When you visit our website, your browser downloads these fonts directly from Google servers. This connection may transmit your IP address to Google. Google's privacy policy applies to this data processing. You can learn more at https://policies.google.com/privacy.

Contact Forms

When you contact us via email or contact form, we store the information you provide (email address, name if provided, and message content) to process your inquiry. We delete this data once it is no longer necessary to store it or restrict processing if statutory retention obligations apply.

4. Event Registration Data

We process personal data in two stages:

4.1 Raffle Entry Data

For the initial raffle entry, we collect:

• First name and last name
• Email address for communication
• Ticket type (Practitioner, Academia-Student, Academia-Non-student)
• Gender identity (for diversity statistics)
• Accessibility needs indicator (to ensure venue accessibility)
• IP address and submission timestamp

This data is processed through Cloudflare services (see Section 5) and used for:

• Processing raffle entries and selecting participants
• Ensuring fair distribution (50% academia, 50% practitioners)
• Preventing duplicate entries
• Notifying selected participants
• Anonymous diversity statistics

4.2 Ticket Processing Data

If selected in the raffle, your ticket will be processed through pretix GmbH (https://pretix.eu). This includes:

• Name and contact information
• Email address (pre-filled from raffle)
• Accessibility needs (if applicable)
• Payment information for the 15€ refundable deposit

This data is used for:

• Processing ticket confirmations
• Managing the refundable deposit
• Check-in at the registration desk
• Sending event-related communications
• Managing the waitlist

5. Cloudflare Services

We use various Cloudflare services to process and store registration data:

Cloudflare Turnstile

We use Cloudflare Turnstile for CAPTCHA verification to prevent automated submissions and spam. Turnstile may collect information about your browser and interaction patterns to verify you're human. This processing is subject to Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

Cloudflare Workers

Registration form submissions are processed through Cloudflare Workers, which are serverless functions that handle data validation, spam prevention, and storage. Workers may process your data in any of Cloudflare's global data centers for optimal performance.

Cloudflare R2 Storage

Registration data is stored in Cloudflare R2, an object storage service. Your data is stored exclusively in EU data centers, ensuring compliance with GDPR data residency requirements. Data is encrypted at rest and in transit.

Data Location and Security

Registration data is permanently stored exclusively in EU data centers (via Cloudflare R2). Processing may occur in Cloudflare's global network for performance optimization. Cloudflare has signed a GDPR-compliant Data Processing Agreement (DPA) with us and maintains appropriate technical and organizational measures to protect your data.

Cloudflare is certified under standard contractual clauses for international data transfers, ensuring that any processing outside the EU maintains GDPR-level protection.

6. Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract fulfillment (Art. 6(1)(b) GDPR) for event registration
• Legitimate interests (Art. 6(1)(f) GDPR) for event organization
• Consent (Art. 6(1)(a) GDPR) for marketing communications

7. Data Recipients

Your data may be shared with:

• Cloudflare, Inc. for raffle data processing and storage (EU data centers)
• pretix GmbH for ticket processing (if selected in the raffle)
• Event volunteers for check-in purposes (limited access)
• Email service providers for event communications

8. Data Retention

We retain your personal data only as long as necessary for the purposes for which it was collected. Registration data is typically deleted 6 months after the event, unless we have your consent to keep it for future event notifications or legal obligations require longer retention.

9. Your Rights

Under GDPR, you have the following rights:

• Right to access your personal data (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure ("right to be forgotten") (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing (Art. 21 GDPR)
• Right to withdraw consent at any time
• Right to lodge a complaint with a supervisory authority

To exercise these rights, please contact us at contact@xpunconf.org.

10. Updates to This Policy

We may update this privacy policy from time to time. The current version will always be available on our website. Last updated: July 26, 2025.