Privacy Policy

This policy explains what personal data is processed when you visit betweenmemoryandstone.com, register for Between Memory and Stone (the conference and the MemoryLab) and attend it. It follows the General Data Protection Regulation (GDPR).

1. Who is responsible

Vitsche e.V., Skalitzer Str. 80, 10997 Berlin, Germany. Email: board@vitsche.org. Data protection questions can be sent to that address (subject: "Data protection") or to the postal address.

The event is organised together with the Pilecki Institute Berlin and Past / Future / Art. Vitsche e.V. runs this website and the registration, and decides what happens to the data described below.

2. What we process, why, and on what legal basis

2.1 Visiting the website

Our web host receives your IP address, the date and time, the page requested, the browser and operating system, and the referring page. These server logs are needed to deliver the site and keep it secure. Legal basis: legitimate interest, Art. 6(1)(f) GDPR. Logs are deleted by the host after a short rotation period.

Fonts. The typefaces are served from our own web server. Your browser does not contact Google or any other font provider.

Visitor statistics. We count visits with Umami, an analytics tool that is operated for us by our web developer on a server he runs. It sets no cookies and does not store your IP address; it records the page visited, the referrer, browser, device type, country and screen size, in aggregate. Legal basis: legitimate interest, Art. 6(1)(f) GDPR, in understanding how the site is used. You can object at any time (see section 8).

2.2 Registering for the conference

When you register we process your first and last name, email address and your message to us, and, where you give them, your social media handle and any access or dietary needs you tell us about. We also store when you registered and which version of this policy was on screen.

We use this to decide on your registration, to confirm it or tell you if it was not successful, to send you your ticket and event information, and to run the event. Legal basis: performance of a contract or steps before entering one, Art. 6(1)(b) GDPR. Information about access needs can reveal health data; we process it only with your consent, Art. 9(2)(a) GDPR, which you give by providing it and can withdraw at any time.

2.3 Your account and sign-in

Registration creates an account under your email address. You sign in with a one-time code we email to you; there are no passwords. The sign-in session is kept in your browser's local storage so you stay signed in. This is strictly necessary to provide the service you asked for (§ 25(2) no. 2 TDDDG), and the processing rests on Art. 6(1)(b) GDPR.

2.4 Emails

We email you about your registration: confirmation or decline, your ticket with its QR code, the reminder on the day of the event, and any change to the event. These are service messages for the event you registered for. Legal basis: Art. 6(1)(b) GDPR. We send no newsletters through this system.

2.5 At the event

Tickets carry a QR code. Staff scan it at the entrance to check that you are registered, and the scan time is recorded. Please bring a valid ID; we may check it against your registration, and we do not record any ID details. Legal basis: legitimate interest, Art. 6(1)(f) GDPR, in admitting only registered guests and in the safety of the event.

Filming and photography. The event is filmed and photographed, and the stage is streamed live online. Recordings and photos may show participants and are used to document the event and for public communication by the organisers and their partners, including on websites, social media and the live stream. Legal basis: legitimate interest, Art. 6(1)(f) GDPR. If you do not want to appear in recordings, tell the team at the entrance or write to us beforehand. You may object at any time (section 8). The live stream is broadcast on YouTube, a service of Google, under its own privacy policy; see section 4.

2.6 Contacting us

If you write to us, we process the contents and your address to answer you. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) if your message concerns your registration.

3. Who receives your data

We use service providers who process data only on our instructions (Art. 28 GDPR):

• Supabase — database, sign-in and file storage for registrations and accounts. The project is hosted in Germany.
• Resend — sending the emails described above.
• Hostinger — hosting of the website.
• Umami — visitor statistics, operated for us by our web developer.

Organisers and event staff of Vitsche e.V. see the data they need to run the event: names, email addresses, registration, ticket and check-in status. We do not sell data. Public authorities receive data only where the law requires it.

4. Third-party services you open yourself

The live stream links to YouTube, and the site links to Instagram, Google Maps and partner websites. Those services are operated by third parties under their own privacy policies, and process data about you once you follow a link. We load no embedded video, map or social-media content on this site.

5. Transfers outside the EU

Our database is hosted in Germany and our emails are sent through Resend's EU region, so your registration data stays in the EU. Resend and Supabase are, however, companies with a parent or group presence in the United States, which can mean access from there. For that case we rely on the European Commission's standard contractual clauses or on the provider's certification under the EU–US Data Privacy Framework. We pass no registration or website data to YouTube: the website and emails only link to it (section 4).

6. How long we keep data

• Server logs: deleted by the host after a short rotation period.
• Registration, account and ticket data: 180 days after the event, then deleted or anonymised. We keep it that long to deal with questions, complaints and claims arising from the event. Declined registrations are deleted on the same schedule.
• Statistics: aggregated and not linked to you.
• Emails you send us: until your enquiry is dealt with, then according to statutory retention duties (generally six to ten years for business correspondence).

7. Is providing data required?

Name and email are needed to register; without them we cannot process your registration. Everything else is voluntary.

8. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing rests on consent, you can withdraw it at any time with effect for the future (Art. 7(3)). Write to board@vitsche.org.

You can also complain to a data protection authority. For us this is the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59-61, 10555 Berlin, www.datenschutz-berlin.de.

9. Changes

We update this policy when the event or our processing changes. The date at the top shows when it was last revised.