1. An overview of data protection
General information
The following information provides a simple overview of what happens to your personal data when you visit our website or participate in our event. Personal data is any data that can be used to personally identify you. Detailed information on data protection can be found in our privacy policy, which is linked below.
Data collection on our website
Who is the responsible party for the recording of data on this website (i.e., the “controller”)?
Data processing on this website is carried out by the website operator. Their contact details can be found under point 2 of this privacy policy and in the legal notice of this website.
How do we record your data?
Your data is collected in two ways: firstly, through information you provide to us, such as data entered into a contact form or when ordering tickets; and secondly, automatically by our IT systems when you visit our website. This automatically collected data is primarily technical information (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you access our website.
What are the purposes we use your data for?
Some data is collected to ensure the website functions correctly. Other data may be used to analyze your user behavior. We also process data to organize and conduct our events and to communicate with you.
What rights do you have as far as your information is concerned?
You have the right to obtain information free of charge at any time regarding the origin, recipients, and purpose of your stored personal data. You also have the right to rectification or erasure of this data, as well as the right to restriction of processing. For this purpose, and for any further questions regarding data protection, you can contact us at any time at the address provided in section 2. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.
Analysis tools and tools provided by third parties
When you visit our website, your browsing behavior may be statistically analyzed. Tools that use cookies or access information on your device for this purpose will only be loaded after you have given your consent via our cookie consent tool; you can revoke this consent at any time with effect for the future. In addition, we use a cookie-free, self-operated audience measurement tool, which you can object to at any time. You can find detailed information about this in the following sections of this privacy policy.
2. General information and mandatory information
Privacy Policy
The operators of this website take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. When you use this website, various personal data are collected. Personal data is data that can be used to personally identify you. This privacy policy explains what data we collect, what we use it for, and how and for what purpose this is done. Please note that data transmission over the Internet (e.g., when communicating by email) can have security vulnerabilities. Complete protection of data against access by third parties is not possible.
Information about the responsible party (referred to as the “controller” in the GDPR)
The data processing controller on this website is:
RETAIL NXT GmbH
Zirkusweg 1
20359 Hamburg
Phone: + 49 40 66 906-900
Email: info@retail-nxt.com
The controller is the natural person or legal entity that single-handedly or jointly with others makes decisions as to the purposes of and resources for the processing of personal data (e.g., names, e-mail addresses, etc.).
For all questions regarding data protection and the exercise of your data subject rights, you can contact the aforementioned address directly.
Revocation of your consent to the processing of data
Many data processing operations are only possible with your express consent. You can revoke consent that you have already given at any time. An informal message by e-mail to us is sufficient. The legality of the data processing that took place up until the revocation remains unaffected by the revocation.
Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)
If data processing is based on Article 6(1)(e) or (f) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you, including profiling based on those provisions. The respective legal basis for processing is set out in this privacy policy. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of establishing, exercising or defending legal claims (objection pursuant to Article 21(1) GDPR). If your personal data is processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing. If you object, your personal data will no longer be used for direct marketing purposes (objection pursuant to Art. 21 para. 2 GDPR).
Right to log a complaint with the competent supervisory agency
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the place of the alleged infringement. This right to lodge a complaint is without prejudice to any other administrative or judicial remedy.
The supervisory authority responsible for us is:
The Hamburg Commissioner for Data Protection and Freedom of Information
Ludwig-Erhard-Straße 22, 20459 Hamburg
Right to data portability
You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.
Information, cancellation and rectification
Under applicable law, you have the right to request information, free of charge, about your stored personal data, its origin and recipients, and the purpose of the data processing, as well as the right to rectification or erasure of this data. For this purpose, and for any further questions regarding personal data, you can contact us at any time at the address provided in section 2.
Right to demand processing restrictions
You have the right to request the restriction of the processing of your personal data. You can contact us at any time at the address provided in section 2. The right to restrict processing exists in the following cases:
– If you dispute the accuracy of your personal data stored by us, we generally need time to verify this. You have the right to request that the processing of your personal data be restricted while we verify your claim.
– If the processing of your personal data was or is unlawful, you can request the restriction of data processing instead of deletion.
– If we no longer need your personal data, but you require it for the establishment, exercise or defense of legal claims, you have the right to request restriction of processing of your personal data instead of erasure.
– If you have lodged an objection pursuant to Art. 21 (1) GDPR, a balance must be struck between your interests and ours. As long as it is not yet clear whose interests prevail, you have the right to request that the processing of your personal data be restricted.
If you have restricted the processing of your personal data, these data – with the exception of their archiving – may be processed only subject to your consent or to claim, exercise or defend legal entitlements or to protect the rights of other natural persons or legal entities or for important public interest reasons cited by the European Union or a member state of the EU.
Transfer of personal data to third countries
We sometimes use services from providers who process personal data outside the European Union or the European Economic Area, or whose parent companies are located in third countries – particularly the USA. Data is only transferred if the requirements of Articles 44 et seq. of the GDPR are met.
Where an adequacy decision by the European Commission exists, we base the transfer on Article 45 GDPR. This applies to transfers to the USA if the respective recipient is certified under the EU-US Data Privacy Framework. In all other cases, we base the transfer on the standard contractual clauses issued by the European Commission pursuant to Article 46(2)(c) GDPR in conjunction with supplementary safeguards or – where applicable – on your explicit consent pursuant to Article 49(1)(a) GDPR.
Please note that third countries may not have a level of data protection comparable to that of the European Union, and in particular, access to your data by government authorities cannot be completely ruled out. You can find information about which services may involve data transfer to third countries in the relevant sections of this privacy policy.
SSL and/or TLS encryption
This website uses SSL/TLS encryption for security reasons and to protect the transmission of confidential information, such as orders or inquiries that you send to us as the website operator. You can recognize an encrypted connection by the fact that the browser's address bar changes from "http://" to "https://" and by the padlock icon in your browser's address bar. When SSL/TLS encryption is activated, the data you transmit to us cannot be read by third parties.
Opposition to advertising emails
We hereby expressly prohibit the use of contact data published in the context of website legal notice requirements with regard to sending promotional and informational materials not expressly requested. The website operator reserves the right to take specific legal action if unsolicited advertising material, such as email spam, is received.
3. Hosting
We host the content of our website with an external service provider. The personal data collected on this website is stored on the host's servers. This may include, in particular, IP addresses, contact requests, metadata and communication data, contact information, names, website access data, and other data generated via a website.
Our hosting provider is CTNM Computertechnologie + Neue Medien GmbH, Neuer Pferdemarkt 13, 20359 Hamburg. Data is processed exclusively in data centers located within Germany.
The use of the hosting provider is for the purpose of fulfilling our contractual obligations to our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast, and efficient provision of our online services by a professional provider (Art. 6 para. 1 lit. f GDPR). Our hosting provider will only process your data to the extent necessary to fulfill its contractual obligations and will comply with our instructions regarding this data. We have concluded a data processing agreement with the hosting provider in accordance with Art. 28 GDPR.
4. Data collection on our website
Cookie policy
Our website uses cookies. Cookies are small text files that are stored on your device and saved by your browser. They do not harm your computer and do not contain viruses.
Some of the cookies we use are so-called session cookies. These are automatically deleted after your visit ends. Other cookies remain stored on your device until you delete them. These cookies allow us to recognize your browser on your next visit.
Cookies that are strictly necessary for carrying out electronic communication or for providing certain functions you have expressly requested (necessary cookies) are stored on the basis of Section 25 Paragraph 2 No. 2 of the German Telemedia Act (TMG). We base the further processing of the data collected in this way on Article 6 Paragraph 1 Letter f of the GDPR; our legitimate interest lies in the technically flawless and optimized provision of our services. If consent has been requested, the storage of cookies and access to information on your device takes place exclusively on the basis of your consent pursuant to Section 25 Paragraph 1 of the TMG and Article 6 Paragraph 1 Letter a of the GDPR. You may withdraw your consent at any time.
You can also configure your browser to notify you when cookies are set, to allow cookies only in individual cases, to block cookies in certain cases or entirely, and to automatically delete cookies when you close your browser. Disabling cookies may limit the functionality of this website.
Cookie consent management (consent tool)
To obtain, manage and document your consent to the use of cookies and similar technologies, we use the consent management tool “consentmanager”.
The provider is consentmanager AB, Håltegelvägen 1b, 72348 Västerås, Sweden. The German office is located in Hamburg (consentmanager GmbH, Eppendorfer Weg 183, 20253 Hamburg). consentmanager is a subsidiary of iubenda Srl, Via San Raffaele 1, 20121 Milan, Italy.
This tool allows us to obtain your consent before setting cookies that are not technically necessary, in accordance with Article 6(1)(a) GDPR and Section 25(1) TDDDG. Your consent decision is stored and documented so that you do not need to be asked again when you revisit the website and so that we can comply with our obligation to provide evidence under Article 7(1) GDPR. In particular, your consent decision, the time of consent, an anonymized identifier, and technical information about your device are processed. The use of the consent tool itself is necessary for the fulfillment of our legal obligations (Article 6(1)(c) GDPR).
You can adjust or withdraw your consent at any time with effect for the future via the cookie settings on our website.
We have concluded a data processing agreement with the provider in accordance with Article 28 of the GDPR. Further information: https://www.consentmanager.net/de/datenschutz/
Server log files
The Provider of the Site is provided with automated Information in its Server-Log-Date, the Ihr Browser is automatically enabled. Dies sind:
– Browser type and browser version
- Operating system used
– Referrer URL
– Hostname of the accessing computer
– Time of server request
- IP address
This data is not merged with other data sources.
This data is collected on the basis of Article 6(1)(f) GDPR. The website operator has a legitimate interest in the technically flawless presentation, optimization, and security of its website – for this purpose, the server log files must be recorded.
The log files are deleted after seven days, unless they are needed for longer to investigate a specific security incident.
Request by e-mail, telephone, or fax
When you contact us by email, telephone, or fax, your inquiry, including all resulting personal data (name, contact details, content of the inquiry), will be stored and processed by us for the purpose of handling your request. We will not share this data without your consent.
The processing of this data is based on Art. 6 para. 1 lit. b DSGVO, if your request is related to the performance of a contract or is required to carry out pre-contractual action. In all other cases, the processing is based on your consent (Article 6 para. 1 lit. a DSGVO) and / or on our legitimate interests (Art. 6 para. 1 lit. f DSGVO), as we have a legitimate interest in the effective Processing of requests addressed to us.
The data you send us via contact request will remain with us until you request its deletion, revoke your consent to its storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory legal provisions – in particular, statutory retention periods – remain unaffected.
WhatsApp communication
For individual one-to-one communication, we use WhatsApp (WhatsApp Ireland Limited). This involves processing your phone number and the content of your messages. Depending on the situation, this processing is based on Article 6(1)(b) or (f) of the GDPR. Use of WhatsApp is voluntary; alternatively, you can contact us by email or phone.
5. Analysis Tools
Google Tag Manager
This website uses Google Tag Manager. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The Google Tag Manager is a solution that allows us to manage and integrate website tags (e.g., analytics and marketing tools) into our website via a single interface. The Tag Manager itself does not create user profiles, store cookies, or perform independent analyses. It simply ensures the deployment of the integrated tools, which are only loaded after you have given your consent via our cookie consent tool. When the Tag Manager is accessed, your IP address is transmitted to Google servers.
The use of this service is based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG, insofar as this includes the storage of cookies or access to information on your device. You may withdraw your consent at any time. We have concluded a data processing agreement with Google. Transfer to the USA is not excluded; see section 2, "Transfer of personal data to third countries".
Google Analytics
This website uses functions of the web analytics service Google Analytics. Provider is the Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics allows us to analyze the behavior of our website visitors. Various usage data, such as page views, time spent on the site, operating systems used, and the user's origin, are collected. Google Analytics uses technologies that enable user recognition for the purpose of analyzing user behavior (e.g., cookies or device fingerprinting). The information collected by Google about the use of this website is generally transmitted to and stored on a Google server; transfer to the USA is possible.
Legal basis
The use of Google Analytics is based solely on your consent pursuant to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. You grant this consent via our cookie consent tool. Google Analytics will not be loaded without your consent. You can withdraw your consent at any time with effect for the future via the cookie settings.
IP anonymization
We have activated IP anonymization on this website. This means that your IP address is shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area before being transmitted. The IP address transmitted by your browser as part of Google Analytics will not be merged with other Google data.
Demographics
This website uses the "demographic characteristics" feature of Google Analytics. This allows reports to be generated that contain information about the age, gender, and interests of website visitors. This data comes from Google's interest-based advertising and from third-party visitor data. You can deactivate this feature at any time via the ad settings in your Google account or prevent the collection of your data altogether via our cookie settings.
Storage duration
User- and event-level data stored by Google that is linked to cookies or similar technologies is automatically deleted after two months.
Data processing
We have concluded a data processing agreement with Google in accordance with Article 28 of the GDPR. Further information on how Google Analytics handles user data can be found in Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de
Matomo
This website also uses the open-source web analytics service Matomo. We operate Matomo ourselves on our own servers. The collected data is not transmitted to Matomo or any other third parties; the data remains exclusively with us.
We use Matomo to collect information about the use of our website, such as pages visited, time spent on the site, browser and operating system used, and the referring page. Matomo is configured on our system so that no cookies are set and no information is accessed on your device. Your IP address is shortened before being stored, so that it cannot be associated with a specific person. We do not create any personal user profiles based on this data.
Legal basis
Since Matomo operates without cookies and does not access your device, consent is not required under Section 25 Paragraph 1 of the German Telemedia Act (TDDG). Processing is based on our legitimate interest, pursuant to Article 6 Paragraph 1 Letter f of the GDPR, in a privacy-friendly, statistical analysis of user behavior to improve our services. Given the absence of cookies and the truncated IP address, your legitimate interests do not override ours.
Right of objection
You can object to this processing at any time in accordance with Article 21 Paragraph 1 GDPR – informally by email to info@retail-nxt.com. Furthermore, our Matomo installation respects your browser's "Do Not Track" setting: if this is activated, no data is collected.
Storage duration
The raw data collected will be deleted after twelve months. Aggregated, non-personally identifiable analyses will be retained for statistical purposes beyond this period.
6. Newsletter and email communication
Newsletter distribution via Brevo
We use the Brevo service for sending our newsletter and for registration and contact forms. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.
Data categories and purpose
When you subscribe to our newsletter, we process the data you provide – at least your email address, optionally your name, company, and position – to send you information about our events, program content, and offers. When you access areas of the website that integrate Brevo functions, a connection is also established to Brevo's servers, during which technical data such as your IP address is processed.
Double opt-in
Registration for our newsletter uses a double opt-in process. After registering, you will receive an email in which you must confirm your subscription. This ensures that no one can register using someone else's email address. For verification purposes, we log the registration, the sending of the confirmation email, and the confirmation itself, including the IP address used and the time.
measuring success
Our newsletters contain tracking pixels and personalized links that allow us to record whether and when an email is opened and which links are clicked. This analysis helps us tailor our content to the interests of our recipients. Performance measurement is based solely on your consent, which you grant when subscribing to the newsletter. You can withdraw your consent at any time via the unsubscribe link in every newsletter email; a separate opt-out from performance measurement only is technically not possible.
Legal basis
Your data is processed based on your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with Section 7 para. 2 no. 3 of the German Unfair Competition Act (UWG). You can withdraw your consent at any time by unsubscribing via the unsubscribe link at the end of each newsletter email or by sending us an informal message. The lawfulness of the processing carried out until the withdrawal of consent remains unaffected.
Storage duration
Your data will be stored by us or our mailing service provider until you unsubscribe from the newsletter and will be deleted after you unsubscribe. We also retain your registration and cancellation confirmations, as well as your email address on a suppression list, to prevent future mailings and to be able to prove that you gave your consent (Art. 6 para. 1 lit. f GDPR). Data stored by us for other purposes remains unaffected.
We have concluded a data processing agreement with Brevo in accordance with Article 28 of the GDPR. Further information: https://www.brevo.com/de/legal/privacypolicy/
7. Ticket shop and payment processing
Ticket shop
Tickets for our events are sold through our online shop at tickets.retail-nxt.com. When you order a ticket, we process the inventory and order data you provide (in particular, name, company, position, billing and contact details, as well as information about the ticket booked).
The ticketing system is technically operated by a company within our corporate group that acts as a data processor for us in accordance with Article 28 of the GDPR. Your order data will not be shared with any third parties outside our company beyond the purpose of payment processing.
The legal basis for processing is Article 6(1)(b) GDPR (performance of the participation agreement) and Article 6(1)(c) GDPR, insofar as we are subject to commercial and tax law retention obligations. We retain invoice and booking data for ten years in accordance with the statutory periods under Section 147 AO and Section 257 HGB.
Stripe
We use the payment service provider Stripe for processing payments in our ticket shop. For customers within the EEA, the provider is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
When you make a payment, the necessary payment data (e.g., name, billing address, payment amount, bank account details or card information) is transmitted to and processed by Stripe. Card data is collected directly by Stripe; we do not receive complete payment information ourselves. Stripe may also process data for fraud prevention and to fulfill its own legal obligations, and may transmit this data to affiliated companies, including those in the USA.
The legal basis is Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(f) GDPR regarding fraud prevention. Further information: https://stripe.com/de/privacy
8. Plug-ins and Tools
Google Web Fonts
This website uses web fonts provided by Google for consistent font display. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When you visit a page, your browser loads the necessary web fonts into its cache to display text and fonts correctly. For this to work, your browser must connect to Google's servers. This allows Google to know that our website was accessed via your IP address. If your browser does not support web fonts, a standard font from your computer will be used.
The data is retrieved based on your consent pursuant to Art. 6 para. 1 lit. a GDPR and § 25 para. 1 TDDDG. This consent can be revoked at any time.
Google Maps
This page uses the Google Maps service via an API. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
To use the functions of Google Maps, it is necessary to store your IP address. This information is generally transmitted to and stored on a Google server; transfer to the USA is possible. The provider of this website has no influence on this data transfer.
We use Google Maps to present our online services in an appealing way and to make it easy to find the locations we list on our website. The map service will only be loaded after you have given your consent via our cookie consent tool; the legal basis for this is Article 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw your consent at any time. Further information: https://policies.google.com/privacy?hl=de
Google reCAPTCHA
We use “Google reCAPTCHA” (hereinafter “reCAPTCHA”) on this website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
reCAPTCHA is used to verify whether data entry on this website (e.g., in a contact form) is done by a human or an automated program. To do this, reCAPTCHA analyzes the website visitor's behavior based on various characteristics. For this analysis, reCAPTCHA evaluates various pieces of information, such as the IP address, the time spent on the website, and mouse movements made by the user. The data collected during this analysis is forwarded to Google.
The storage and analysis of data is based on Article 6(1)(f) GDPR. We have a legitimate interest in protecting our website from abusive automated access and spam. If consent has been requested, processing is carried out exclusively on the basis of Article 6(1)(a) GDPR and Section 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information on the user's device (e.g., device fingerprinting). Consent can be withdrawn at any time.
For more information about Google reCAPTCHA, please see the Google Privacy Policy and the Google Terms of Service: https://policies.google.com/privacy?hl=de and https://policies.google.com/terms?hl=de
YouTube
We embed videos from the YouTube platform on our website. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When you access a page with an embedded YouTube video, a connection is established to YouTube's servers, allowing YouTube to know which of our pages you have visited; this applies even if you are not logged into YouTube. If you are logged into your YouTube account, you allow YouTube to directly associate your browsing behavior with your personal profile.
The integration is based on your consent given via the cookie consent tool (Art. 6 para. 1 lit. a GDPR, § 25 para. 1 TDDDG). You can withdraw your consent at any time. Data may be transferred to the USA. Further information: https://policies.google.com/privacy?hl=de
9. Customer relationship management (Pipedrive)
We use the CRM system Pipedrive to process and store contact data. The provider is Pipedrive OÜ, a company incorporated under Estonian law, Mustamäe tee 3a, 10615 Tallinn, Estonia, registered in the Estonian Commercial Register under number 11958539.
To process and respond to your requests and messages as quickly as possible, we store your contact details and the history of our communication in Pipedrive. Data submitted when using our forms or after purchasing a ticket is sent to Pipedrive and stored on Pipedrive's servers.
The legal basis is Art. 6 para. 1 lit. b GDPR, insofar as the processing serves the initiation or fulfillment of a contract, otherwise Art. 6 para. 1 lit. f GDPR on the basis of our legitimate interests in the efficient processing of inquiries, existing customer management and new customer business.
Your data will be reviewed for its continued necessity three years after the last contact and deleted, unless it is still required for ongoing business relationships or statutory retention periods apply.
We have concluded a data processing agreement with Pipedrive in accordance with Article 28 of the GDPR. You can access Pipedrive's privacy policy here: https://www.pipedrive.com/en/privacy
10. RETAIL NXT Event App
We provide our participants, exhibitors, and speakers with the RETAIL NXT event app. The responsible party is RETAIL NXT GmbH (see section 2).
Purpose of processing
The app serves to organize and conduct the event, as well as to connect participants with each other (matchmaking). Based on stored profile and interest data, the matchmaking function suggests suitable contacts; users can then exchange messages and arrange conversations or meetings.
Processed data categories
– Master data: Name, company, position or job title, email address
– Profile data: profile picture, short description, industry, topics and interests (basis for the matching algorithm)
– Networking and usage data: sent and received contact or meeting requests, chat messages between users, perceived program items
– Technical data: App usage data
The app does not collect location data. No third-party analytics or crash reporting SDK is integrated.
Push notifications
If you consent to receiving push notifications, we will inform you via the app about program changes, contact requests, and organizational information. These notifications are sent via our own servers; we do not use a third-party push notification service. The legal basis for this is your consent pursuant to Art. 6 para. 1 lit. a GDPR, which you can revoke at any time with effect for the future via your device's system settings or within the app.
Visibility to other participants:
For the matchmaking function, parts of your profile (e.g., name, company, position, profile picture, interests) will be visible to other app users at the event so they can contact you. You can deactivate the matchmaking function at any time in the app settings; your profile will then no longer be displayed for matching with other participants.
Legal basis
– Provision of core app functions (program, ticket, access): Art. 6 para. 1 lit. b GDPR (performance of a contract in the context of event participation)
– Visibility of the profile to other participants and use of the matchmaking and chat function: Art. 6 para. 1 lit. a GDPR (consent), as this involves disclosing data to third parties (other participants). Consent can be withdrawn at any time by deactivating the function.
Operations and order processing
The app accesses only our existing participant data, which we have already collected for this and other purposes. It is operated on the infrastructure of our corporate group; the operating group company acts as a data processor for us in accordance with Article 28 of the GDPR. Your data will not be transferred to third parties outside our company.
App Stores
When downloading the app via the Apple App Store or the Google Play Store, the data protection regulations of Apple or Google also apply, over whose data processing we have no influence.
Storage duration
Your profile, including matchmaking and chat data, will be deleted six months after the event ends, unless legal retention obligations apply or you have consented to further use. You can request the deletion of your account at any time before then.
Your rights
You can edit your profile at any time via the app settings, disable matchmaking visibility, or request the deletion of your account including all matchmaking data (see section 2 for contact information).
11. Image and sound recordings at the event
As part of RETAIL NXT, we or service providers commissioned by us (photographers, film crews) produce image and sound recordings. We use these for reporting on the event (e.g., photo gallery on our website, press and social media posts) as well as for promoting the event, including in subsequent years.
Legal basis
For overview and situational recordings of the event (hall shots, panel discussions, networking situations), we base the processing on Article 6 Paragraph 1 Letter f GDPR. Our legitimate interest lies in documenting and promoting the event as well as in press and public relations work. Sections 22 and 23 of the German Copyright Act (KUG) also apply.
For recordings in which individuals are clearly identifiable in the foreground (e.g., portraits, posed photos, interviews), we rely on your consent pursuant to Art. 6 para. 1 lit. a GDPR, which we obtain separately on site. For speakers, processing is additionally based on Art. 6 para. 1 lit. b GDPR.
Recipients
Commissioned photo and film service providers, agencies, press representatives, and the operators of the social media platforms we use. Publication via platforms such as LinkedIn or YouTube may involve the transfer of personal data to third countries; see section 2, "Transfer of personal data to third countries".
Objection and revocation
You can object to the making and publication of recordings at any time – either on-site to the photo or video team or our event staff, or afterwards informally by email to info@retail-nxt.com. We will then remove the recordings in question from our channels. You can revoke any consent you have given at any time with effect for the future. Please note that we have only limited control over recordings that have already been transmitted to third parties (e.g., the press) or further distributed by participants.
Storage duration
Images and audio recordings will be deleted five years after the event. We will retain selected recordings beyond this period for archiving and documentation purposes, in order to maintain a traceable history of the event series (Art. 6 para. 1 lit. f GDPR). Your right to object remains unaffected.
12. Data processing in connection with event participation and transfer to partners
(1) Recording during the event process
For the organization and execution of RETAIL NXT, we process your participant data, in particular your name, company, position, email address, and ticket or badge number. Specifically, the following information is recorded:
– admission to Masterclass or Xpo Stage sessions presented by RETAIL NXT partners (scan your badge at the entrance),
– scanning your badge by partners or other participants for the purpose of contacting you,
– participation in side events such as lunches or pre-event dinners,
– marking, bookmarking or saving partner sessions in the RETAIL NXT Event app.
The legal basis for carrying out the event itself (access control, capacity management, scheduling) is Art. 6 para. 1 lit. b GDPR as well as our legitimate interest in an orderly event (Art. 6 para. 1 lit. f GDPR).
(2) Sharing your contact details with partners
If you have given us your consent, we will forward your contact details (name, company, position, email address, and, if applicable, telephone number and postal address) to the relevant partner. This partner may then contact you after the event by email, post, or telephone to provide you with further information on the topics presented, as well as on their own products and services.
We obtain your consent at the specific moment – when your badge is scanned, when you register for the side event, or in the app. The receiving partner will be named. Your data will not be shared without your consent; participation in sessions and side events is possible regardless.
The legal basis is Article 6(1)(a) GDPR. The partners process your data as separate controllers upon receipt; their respective privacy policies apply to this processing.
(3) Revocation
You can withdraw your consent at any time with effect for the future, informally by email to info@retail-nxt.com or directly to the respective partner. The lawfulness of the processing carried out until the withdrawal remains unaffected.
(4) Storage period
Participation and scan data will be deleted six months after the event. Invoicing and booking data will be retained for ten years in accordance with the statutory retention periods under Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). Evidence of consent given will be retained for the duration of the applicable limitation periods in order to comply with our accountability obligations under Article 5(2) of the GDPR.
13. Applications
We process applicant data only for the purpose and within the scope of the application process, in accordance with legal requirements. The legal basis is Article 6 Paragraph 1 Letter b GDPR in conjunction with Section 26 Paragraph 1 BDSG (establishment of an employment relationship) as well as Article 6 Paragraph 1 Letter f GDPR, insofar as data processing becomes necessary for us in the context of legal proceedings.
The application process requires applicants to provide us with the necessary application data. This data is specified in the job descriptions and generally includes personal information, postal and contact addresses, and application documents such as cover letters, resumes, and certificates. Applicants may also voluntarily provide us with additional information.
Insofar as special categories of personal data within the meaning of Art. 9 para. 1 GDPR are voluntarily disclosed during the application process, their processing is additionally carried out in accordance with Art. 9 para. 2 lit. b GDPR (e.g. health data such as the status of being severely disabled).
Applications can be submitted to us via email. Please note that emails are generally sent unencrypted. We therefore cannot assume any responsibility for the transmission of the application between the sender and its receipt on our server.
If your application is successful, we will process the data you provided for the purposes of your employment. Otherwise, your data will be deleted. Data will also be deleted if you withdraw your application, which you are entitled to do at any time.
Your data will be deleted six months after the application process has concluded, so that we can answer any follow-up questions and comply with our obligations under the General Equal Treatment Act. If we would like to include your application in our applicant pool beyond this period, we will obtain your separate consent in accordance with Article 6(1)(a) of the GDPR.
14Participation in contests via LinkedIn
As part of our marketing activities, we occasionally hold competitions on the LinkedIn platform, where prizes such as tickets to the RETAIL NXT Conference are given away. For participation in these competitions, we collect only the personal data necessary for conducting the competition. This typically includes the participant's name and LinkedIn profile. In some cases, we may request additional information from winners, such as their email address or postal address, to ensure proper prize fulfillment.
The processing of this data is based on your consent (Art. 6 para. 1 lit. a GDPR) within the context of your active participation in the competition. Your data will be used exclusively for the respective purpose and will not be passed on to third parties – with the exception of service providers who support us in the processing and are contractually obligated to data protection.
After the competition has ended and the prizes have been awarded, your data will be deleted unless there are legal retention periods to the contrary or you have expressly consented to further processing.
Please also note LinkedIn's privacy policy, as participation in such a competition regularly involves the use of the platform's functions.
This privacy policy is effective as of May 2026.
