Last updated: 10 October 2026
This is a translation of the German "Datenschutzerklärung". In case of discrepancies, the German version prevails.
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation (GDPR) is:
NFITS Events gGmbHContact: Felipe Jacob Custodio Romero
Email: info@nfits-events.de
No data protection officer has been designated, as the statutory requirements of Section 38 of the German Federal Data Protection Act (BDSG) are not met.
This privacy policy informs you about the processing of personal data when you visit our websites, register online for our events, contact us, and take part in our events and competitions. It is linked in every registration form and is therefore made available to you at the time your data is collected.
The association Nachwuchsförderung IT-Sicherheit e.V. (NFITS) supports our events. Association members who work in the organising team are part of our organisation and process personal data solely under our instructions (Art. 29 GDPR); they are bound to confidentiality. The association itself does not process your data for its own purposes. Emails from the organising team may therefore use sender or reply addresses of the association or of the respective event.
The websites of our events and our registration systems are hosted by NETMOUNTAINS Group GmbH, Industriestraße 76, 42551 Velbert, Germany, on servers in Germany. NETMOUNTAINS processes personal data on our behalf under an agreement pursuant to Art. 28 GDPR. On each access, information transmitted by your browser is stored automatically in server log files: the page requested, date and time of access, amount of data transferred, referring page, browser type and version, operating system and IP address. These data serve to ensure trouble-free operation and to detect and fend off attacks, and are deleted no later than four weeks after collection. The legal basis is Art. 6(1)(f) GDPR.
The website nfits-events.de is hosted on GitHub Pages. When the site is accessed, GitHub (GitHub, Inc., 88 Colin P. Kelly Jr. St., San Francisco, CA 94107, USA, or GitHub B.V., Prins Bernhardplein 200, 1097 JB Amsterdam, Netherlands) logs the visitor's IP address for security purposes under its own responsibility. Details are set out in GitHub's privacy statement at docs.github.com/site-policy/privacy-policies/github-general-privacy-statement. This processing may take place in the USA; GitHub is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the EU Commission exists (Art. 45 GDPR). The legal basis for using GitHub Pages is our legitimate interest in providing the website simply and securely (Art. 6(1)(f) GDPR).
We only use strictly necessary session cookies that are required to use our registration systems and competition platforms and that are deleted when you close your browser. The legal basis is Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act (TDDDG) in conjunction with Art. 6(1)(b) GDPR, and otherwise Art. 6(1)(f) GDPR. We do not use cookies for analytics or advertising, nor any analytics tools. Our websites and registration systems do not load fonts, scripts or other content from third-party servers. Should an individual service exceptionally embed third-party content, we point this out there separately.
If you contact us by email, we process your details to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR where the enquiry relates to a contract, and otherwise Art. 6(1)(f) GDPR. The data are deleted as soon as they are no longer required for handling the enquiry and no retention obligations apply.
When you register for our events and their side programme, apply for media accreditation, or sign up as a volunteer, we process the information provided or uploaded in the respective registration form. Depending on the event and your role, this includes in particular:
The respective form indicates which information is mandatory. Without the mandatory information we cannot process your registration.
We process these data to handle your registration, to plan and run the event (in particular participant management, access control, catering, accommodation, shift planning, issuing invitation letters, reimbursing expenses), and to communicate with you in connection with the event. The legal basis is Art. 6(1)(b) GDPR.
We process the date of birth to comply with the age limits and age categories of the respective competition (Art. 6(1)(b) GDPR). We also process the date of birth and parental consent form of minor participants to perform the participation agreement concluded with the legal guardians (Art. 6(1)(b) GDPR) and to fulfil our duty of supervision (Art. 6(1)(f) GDPR). Where the German Youth Protection Act (Jugendschutzgesetz) imposes obligations on the organiser for individual programme items, in particular evening events (Sections 4, 5 and 9 JuSchG), the processing is also based on Art. 6(1)(c) GDPR.
The evaluation of feedback and internal event planning are based on our legitimate interest in the proper running and improvement of our events (Art. 6(1)(f) GDPR). Optional information is processed on the basis of your consent (Art. 6(1)(a) GDPR).
Information on food allergies and intolerances and on accessibility and support needs constitutes health data; information on religiously motivated diets may allow conclusions about your religious beliefs (Art. 9(1) GDPR). We collect this information solely to plan catering accordingly and to enable you to take part without barriers. The respective fields are marked as optional in the form and carry the consent text; by filling them in, you explicitly consent to the processing for these purposes (Art. 9(2)(a) GDPR). Your participation does not depend on whether you provide this information. You may withdraw your consent at any time with effect for the future by removing the information from your registration or by emailing us. Access to this information is restricted to the persons responsible for these tasks; it is passed on to service providers only where necessary for the stated purposes and, where possible, without reference to individuals.
Where processing is based on consent and the data subject is under 16 years of age, the consent of the legal guardians is required (Art. 8 GDPR); this concerns in particular the optional information under section 6.3. For the decision on photo and video recordings under section 7, the consent of the legal guardians is required for all minor participants; we additionally take the wishes of the minor into account. We therefore ask minor participants to complete the registration together with their legal guardians; the guardians then make these decisions as part of the registration.
In some cases we receive personal data not from you but from another person: for example when legal guardians are named in the parental consent form, when a contact person registers a guest or a delegation, or when a sending organisation nominates participants to us. In these cases the data originate from the registering person or organisation. We process them for the purposes set out in section 6.2; the legal basis is, as long as no participation agreement with you exists yet, our legitimate interest in preparing and running the event (Art. 6(1)(f) GDPR), and otherwise Art. 6(1)(b) GDPR. We inform the persons concerned of this privacy policy at the latest upon first contact, and in any case within one month (Art. 14 GDPR). Anyone who provides data about other persons must inform them of the disclosure beforehand and make this privacy policy available to them. Anyone who provides optional information under section 6.3 or makes the decision under section 7 on behalf of another person may do so only with that person's authorisation, and for minors with the authorisation of the legal guardians.
Photos and videos are taken at our events, which we use for documentation and for public relations on our websites, in reports to partners and funding bodies, and on our social media channels. This also applies to introduction videos that teams or participants provide to us for publication. On social networks we publish only such recordings and competition results (section 9); registration data or other personal data from our systems are not shared there.
Taking the recordings is based on our legitimate interest in documenting the event and in public relations (Art. 6(1)(f) GDPR). We use and publish recordings in which you are individually recognisable only with your consent, which you can give or refuse when registering (Art. 6(1)(a) GDPR, Sections 22 and 23 of the German Art Copyright Act, KUG). This choice is voluntary and has no effect on your participation. It is visible to our photo and media team on site, for example through a marking on your badge; our team does not deliberately photograph persons without consent, and recordings in which they are nevertheless individually recognisable are not used. Section 6.4 applies to minors. You may withdraw your consent at any time with effect for the future; we then remove the recordings concerned from our publications. We cannot recall copies that have already been distributed, for example by sharing on social networks.
Overview shots in which individuals appear merely as part of the event are used on the basis of Art. 6(1)(f) GDPR and Section 23(1) no. 3 KUG. Ceremonies and parts of the competition may be recorded or live-streamed; persons on stage are recognisable in this context, and your decision under this section applies to it as well. Accredited media representatives are responsible for their own recordings.
Publication makes the recordings accessible worldwide; this is covered by your consent to publication. The operators of the social networks on which we publish process the recordings under their own responsibility and their own privacy policies; for users in the EU, the European establishment of the respective operator is generally responsible and uses the instruments of Chapter V GDPR for any transfers to third countries. We keep recordings for as long as they are needed to document our events and for our public relations. We review raw material after the event and delete recordings we do not need for these purposes.
To run our competitions, we operate competition platforms on which participants retrieve challenges and submit solutions. In doing so, we process login credentials and user accounts, submissions and solution attempts, scores, and technical log data (in particular IP addresses, times and types of access). The purposes are running and scoring the competition, ensuring its integrity, in particular detecting and investigating rule violations, and fending off attacks on the platform. The legal basis is Art. 6(1)(b) GDPR, and for integrity and security measures Art. 6(1)(f) GDPR. We delete log data and submissions after scoring and any appeal procedures are complete, and no later than six months after the end of the competition.
We publish rankings and results of our competitions exclusively with the names of the teams or the countries represented, including permanently as part of the competition's history. We do not publish the names of individual participants.
Within our organisation, only those persons who need your data to perform their tasks have access to it. Beyond that, we transfer personal data to the following categories of recipients:
We transfer personal data to countries outside the European Union and the European Economic Area in the following cases:
Visa invitation letters are handed over exclusively to the participants themselves; we do not transmit them to authorities abroad.
We store personal data only for as long as necessary for the respective purposes or as required by statutory retention obligations. We delete health data and information on diet and accessibility no later than four weeks after the end of the event. We delete registration and accreditation data upon completion of follow-up work, and no later than six months after the end of the event. Data that form part of invoices, reimbursements or other accounting records are retained under Section 257 of the German Commercial Code (HGB) and Section 147 of the German Fiscal Code (AO): accounting records for eight years, commercial books and annual accounts for ten years. Data we need as evidence for funding bodies are retained for the duration of the respective retention obligation, for European Union funding usually five years after the final payment. We document consent given or refused for photo and video recordings for as long as the recordings are used. Section 7 applies to the recordings themselves, section 8 to competition platforms. If you withdraw your registration, we delete your data unless retention obligations prevent this.
We do not take automated decisions with legal effect or similarly significant impact, and we do not carry out profiling (Art. 22 GDPR). For fully booked programme items, free places are simply allocated in the order in which registrations are received.
You have the right to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR) and data portability (Art. 20 GDPR). You may withdraw any consent you have given at any time with effect for the future; the lawfulness of processing carried out before the withdrawal remains unaffected. To exercise your rights, an informal message to info@nfits-events.de is sufficient.
You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The supervisory authority competent for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestr. 2-4, 40213 Düsseldorf, Germany.
Where we process your personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. Send your objection to info@nfits-events.de.
We reserve the right to amend this privacy policy if the legal situation or our processing activities change. The version published at nfits-events.de/datenschutz.html applies.