Skip to content
Menu
Legal Information

Data Protection

Privacy Policy

As of: 13 October 2026

Table of Contents

Data Controller

bavAIRia e.V.
Friedrichshafener Str. 1
82205 Gilching
Germany

Tel.: 081052729270
Email: info@bavAIRia.net
www.bavAIRia.net

Authorised representatives: Dr Ingo Eickmann, Thomas Hirsch, Victor Maier, Frank Negretti, Dr Lena Stern (Chair of the Board)

Email address: info@bavAIRia.net

Legal notice: To legal notice

Overview of Processing Activities

The following overview summarises the types of data processed and the purposes of their processing, and refers to the data subjects concerned.

Types of Data Processed

  • Master data.
  • Contact details.
  • Content data.
  • Usage data.
  • Metadata, communication and procedural data.
  • Log data.

Categories of Data Subjects

  • Prospective clients and interested parties.
  • Communication partners.
  • Users.

Purposes of Processing

  • Communication.
  • Handling contact enquiries.
  • Security measures.
  • Audience measurement.
  • Provision of our online services and user experience.
  • Provision of map content.
  • Information technology infrastructure.
  • Public relations and informational purposes.

Relevant Legal Bases

Relevant legal bases under the GDPR: Below is an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations in your or our country of residence or registered office may apply. Should more specific legal bases be applicable in individual cases, we will inform you of these in this privacy policy.

  • Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Legitimate interests (Art. 6(1)(f) GDPR) – Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

National data protection regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. This includes, in particular, the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains, among other things, specific provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and transfer as well as automated individual decision-making, including profiling. Furthermore, data protection laws of the individual federal states (Landesdatenschutzgesetze) may apply.

Security Measures

In accordance with legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access, entry, disclosure, ensuring availability, and segregation of the data. Furthermore, we have established procedures to ensure the exercise of data subjects’ rights, the erasure of data, and responses to data vulnerabilities. We also take into account the protection of personal data during the development and selection of hardware, software, and procedures in accordance with the principle of data protection by design and by default.

Securing online connections using TLS/SSL encryption technology (HTTPS): To protect users’ data transmitted via our online services from unauthorised access, we use TLS/SSL encryption technology. Secure Sockets Layer (SSL) and Transport Layer Security (TLS) are the cornerstones of secure data transmission on the internet. These technologies encrypt the information transmitted between the website or app and the user’s browser (or between two servers), thereby safeguarding the data from unauthorised access. TLS, as the more advanced and secure version of SSL, ensures that all data transmissions meet the highest security standards. When a website is secured by an SSL/TLS certificate, this is indicated by HTTPS appearing in the URL. This serves as an indicator to users that their data is being transmitted securely and in encrypted form.

Transfer of Personal Data

We only transfer personal data to third parties if this is necessary for the provision of our online services, we are legally obliged to do so, relevant consent has been obtained, or another legal basis under data protection law permits the transfer.

Within the scope of operating this website, personal data may be transferred, in particular, to technical service providers, hosting providers, providers of analytics and communication services, and providers of embedded content. This includes, in particular, services for web hosting, dispatching newsletters, audience measurement, and the provision of map services.

Where service providers process personal data on our behalf, this is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR.

General Information on Data Retention and Erasure

We erase personal data that we process in accordance with statutory regulations as soon as the underlying consent is withdrawn or no further legal basis for the processing exists. This applies to cases where the original purpose of processing ceases to apply or the data is no longer required. Exceptions to this rule apply if statutory obligations or specific legitimate interests require a longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal enforcement or the protection of the rights of other natural or legal persons, must be archived accordingly.

Our data protection notices contain additional information regarding the retention and erasure of data that specifically applies to certain processing activities.

If multiple retention periods or erasure deadlines apply to a specific item of data, the longest period shall always prevail. Data that is no longer retained for its original intended purpose, but rather on the basis of statutory requirements or other reasons, will be processed by us exclusively for the reasons that justify its retention.

Data retention and erasure: The following general periods apply to retention and archiving under German law:

  • 10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheet, as well as the working instructions and other organisational documents required for their understanding (Section 147(1) No. 1 in conjunction with (3) Fiscal Code of Germany (AO), Section 257(1) No. 1 in conjunction with (4) German Commercial Code (HGB)).
  • 8 years – Accounting records, such as invoices and expense vouchers (Section 147(1) No. 4 and 4a in conjunction with (3) sentence 1 AO, Section 14b(1) German VAT Act (UStG) and Section 257(1) No. 4 in conjunction with (4) HGB).
  • 6 years – Other commercial documents: received commercial or business correspondence, copies of dispatched commercial or business correspondence, other documents insofar as they are relevant for taxation, e.g. hourly wage slips, cost accounting sheets, calculation documents, price tags, as well as payroll accounting documents, provided they do not already constitute accounting vouchers, and till rolls (Section 147(1) Nos. 2, 3, 5 in conjunction with (3) AO, Section 257(1) Nos. 2 and 3 in conjunction with (4) HGB).
  • 3 years – Data required to address potential warranty and damages claims or similar contractual claims and rights, and to process related enquiries based on previous business experience and customary industry practices, will be retained for the duration of the regular statutory limitation period of three years (Sections 195, 199 German Civil Code (BGB)).

Rights of Data Subjects

Rights of data subjects under the GDPR: As a data subject under the GDPR, you have various rights, which arise in particular from Articles 15 to 21 GDPR:

  • Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
  • Right to withdraw consent: You have the right to withdraw consent given at any time.
  • Right of access: You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and to access such data as well as further information and a copy of the data in accordance with statutory provisions.
  • Right to rectification: In accordance with statutory provisions, you have the right to demand the completion of data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: In accordance with statutory provisions, you have the right to demand that data concerning you be erased without undue delay or, alternatively, to demand the restriction of the processing of the data in accordance with statutory provisions.
  • Right to data portability: You have the right to receive personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, or to demand its transfer to another controller in accordance with statutory provisions.
  • Right to lodge a complaint with a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of personal data relating to you infringes the GDPR. The complaint may be lodged, in particular, with a supervisory authority in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

Provision of Online Services and Web Hosting

We process users’ data in order to provide them with our online services. For this purpose, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or end device.

  • Types of data processed: Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved); log data (e.g. log files concerning logins or retrieval of data or access times).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing and legitimate interests: Provision of our online services and user-friendliness; information technology infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)); security measures.
  • Retention and erasure: Erasure in accordance with the details in the section “General Information on Data Retention and Erasure”.
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Provision of online services on rented storage space: To provide our online services, we use storage space, computing capacity, and software that we rent or otherwise obtain from an appropriate server provider (also referred to as a “web host”); Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
  • Collection of access data and log files: Access to our online services is logged in the form of so-called “server log files”. Server log files may include the address and name of the retrieved web pages and files, date and time of retrieval, data volumes transferred, notification of successful retrieval, browser type and version, the user’s operating system, referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. Server log files may be used, on the one hand, for security purposes, e.g. to avoid server overloads (especially in the case of abusive attacks, so-called DDoS attacks), and on the other hand, to ensure server stability and capacity utilisation; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Erasure of data: Log file information is stored for a maximum period of 30 days and subsequently erased or anonymised. Data whose further retention is required for evidentiary purposes is exempt from erasure until the final clarification of the respective incident.
  • ALL-INKL: Services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacities); Service provider: ALL-INKL.COM – Neue Medien Münnich, Owner: René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://all-inkl.com/; Privacy policy: https://all-inkl.com/datenschutzinformationen; Data processing agreement: Provided by the service provider.

Contact Form

When you contact us via our online contact form, we process the personal data you provide in order to process and respond to your enquiry.

Mandatory details processed include your name, email address, and the content of your message. You may optionally provide details regarding your organisation, a telephone number, and select the subject matter of the enquiry.

The form data is transmitted to us exclusively by email and is not additionally stored in the website backend. We use Contact Form 7 to provide the form. To protect against automated spam submissions, we use WP Armour – Honeypot Anti Spam. This employs a check field that is invisible to regular users, allowing automated entries to be detected.

Processing is carried out on the basis of Art. 6(1)(b) GDPR, insofar as the enquiry serves the initiation or performance of a contract or other legal relationship. In all other cases, processing is based on our legitimate interest in the proper handling of incoming enquiries pursuant to Art. 6(1)(f) GDPR.

The data is erased as soon as it is no longer required for processing the enquiry, provided that statutory retention or documentation requirements or other legitimate grounds do not necessitate longer storage.

  • Types of data processed: Master data; contact details; content data; metadata, communication and procedural data.
  • Data subjects: Prospective clients and communication partners.
  • Purposes of processing and legitimate interests: Processing and responding to contact enquiries; communication.
  • Retention and erasure: Erasure in accordance with the details in the section “General Information on Data Retention and Erasure”.
  • Legal bases: Performance of a contract and pre-contractual enquiries pursuant to Art. 6(1)(b) GDPR; legitimate interests pursuant to Art. 6(1)(f) GDPR.

Use of Cookies

The term “cookies” refers to functions that store and read information on users’ end devices. Cookies can also be used for various purposes, such as ensuring the functionality, security, and convenience of online services, as well as compiling analyses of visitor traffic. We use cookies in accordance with statutory regulations. To this end, where required, we obtain users’ prior consent. If consent is not required, we rely on our legitimate interests. This applies where storing and reading information is strictly necessary to provide expressly requested content and features. This includes, for instance, storing preferences and ensuring the functionality and security of our online services. Consent may be withdrawn at any time. We provide clear information on its scope and which cookies are used.

Information on data protection legal bases: Whether we process personal data using cookies depends on consent. Where consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are set out above in this section and in the context of the respective services and procedures.

Retention period: With regard to the retention period, a distinction is made between the following types of cookies:

  • Temporary cookies (also: session cookies): Temporary cookies are erased at the latest after a user leaves an online service and closes their end device (e.g. browser or mobile application).
  • Permanent cookies: Permanent cookies remain stored even after the end device is closed. For example, login status can be saved and preferred content can be displayed directly when the user visits a website again. Similarly, user data collected using cookies can be used for audience measurement. Unless we provide users with explicit information regarding the nature and retention period of cookies (e.g. when obtaining consent), users should assume that they are permanent and that their storage period can be up to two years.

General information on withdrawal and objection (opt-out): Users may withdraw any consent granted at any time and, furthermore, lodge an objection against processing in accordance with statutory requirements, including via their browser’s privacy settings.

  • Types of data processed: Metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); consent (Art. 6(1)(a) GDPR).

Further information on processing activities, procedures and services:

  • Processing of cookie data on the basis of consent: We employ a consent management solution to obtain users’ consent for the use of cookies or the procedures and providers mentioned within the consent management framework. This process serves to obtain, log, manage, and withdraw consents, particularly regarding the use of cookies and comparable technologies used to store, read, and process information on users’ end devices. Under this procedure, users’ consent is obtained for the use of cookies and the associated processing of information, including the specific processing activities and providers specified in the consent management procedure. Users also have the option to manage and withdraw their consents. The consent declarations are stored to avoid repeated requests and to be able to demonstrate consent in accordance with legal obligations. Storage takes place server-side and/or in a cookie (a so-called opt-in cookie) or by means of comparable technologies in order to assign the consent to a specific user or their device. Insofar as no specific information on providers of consent management services is provided, the following general notices apply: Consent is stored for up to two years. A pseudonymous user identifier is created and stored together with the time of consent, information on the scope of consent (e.g. relevant categories of cookies and/or service providers), as well as details about the browser, system, and end device used; Legal bases: Consent (Art. 6(1)(a) GDPR).
  • BorlabsCookie: Storage and management of consents (consent to cookies and data processing), logging of user decisions, displaying data protection and cookie notices, enabling users to withdraw or adjust consent; Service provider: Executed on servers and/or computers under our own responsibility under data protection law; Website: https://de.borlabs.io/borlabs-cookie/; Further information: An individual user ID, language, types of consent, and the time of submission are stored server-side and in a cookie on the user’s device.

Google Maps

We embed the Google Maps service to display geographical information and make it easier to find the locations shown. The provider of the service in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The map does not load automatically when the page is accessed. A notice is displayed first. A connection to Google’s servers is only established and the map loaded via the Google Maps JavaScript API once you actively select the “Load map” button.

When the map is loaded, your IP address, information about the browser used, operating system, and end device, the page accessed, as well as interaction and, where applicable, location data may be transmitted to Google. If you are signed in to a Google account, Google may associate the processing with your user account.

Processing is carried out on the basis of your consent pursuant to Art. 6(1)(a) GDPR and, insofar as information is stored in or accessed from your terminal equipment, pursuant to Section 25(1) TDDDG. Consent may be withdrawn at any time with effect for the future via the cookie or privacy settings.

Processing by Google may also take place on servers outside the European Economic Area. Google bases corresponding data transfers, inter alia, on recognised transfer mechanisms, notably the EU-U.S. Data Privacy Framework. Further information can be found in Google’s privacy policy at https://policies.google.com/privacy.

  • Types of data processed: Usage data; location data; metadata, communication and procedural data.
  • Data subjects: Users.
  • Purposes of processing: Presentation of geographical information and provision of map content.
  • Legal bases: Consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
  • Service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
  • Privacy policy: https://policies.google.com/privacy

Newsletters and Electronic Notifications

We send newsletters, emails, and further electronic notifications (hereinafter “newsletters”) exclusively with the consent of the recipients or on the basis of a statutory permission. Insofar as the contents of the newsletter are outlined as part of registration, these contents are decisive for the user’s consent. Providing your email address is normally sufficient to subscribe to our newsletter. However, to offer you a personalised service, we may request your name for personal address in the newsletter or further details if required for the purpose of the newsletter.

Erasure and restriction of processing: We may store unsubscribed email addresses for up to three years based on our legitimate interests before deleting them, in order to prove previously granted consent. The processing of this data is restricted to the purpose of potential defence against claims. An individual request for erasure is possible at any time, provided that the previous existence of consent is simultaneously confirmed. In the case of obligations to permanently honour objections, we reserve the right to store the email address exclusively for this purpose in a blocklist.

The registration process is logged on the basis of our legitimate interests for the purpose of proving its proper execution. Where we commission a service provider to dispatch emails, this is done on the basis of our legitimate interests in an efficient and secure delivery system.

Content:

We regularly send information about events, projects, networking activities, trade fair participations, delegation trips, as well as current developments, offers, and activities of bavAIRia e.V. and its network.

  • Types of data processed: Master data (e.g. full name); contact details (e.g. email addresses); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved); usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions).
  • Data subjects: Communication partners.
  • Purposes of processing and legitimate interests: Marketing (e.g. via email).
  • Legal bases: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).
  • Right to object (opt-out): You may unsubscribe from our newsletter at any time, i.e. withdraw your consent or object to further receipt. A link to unsubscribe from the newsletter can be found at the end of each newsletter, or you may use one of the contact options provided above, preferably email, for this purpose.

Further information on processing activities, procedures and services:

Web Analytics, Monitoring and Optimisation

We use Matomo for web analytics and audience measurement. In doing so, information regarding page views, time of access, duration of visit, referrer URLs, as well as the browser and operating system used, is processed in particular.

Matomo is only loaded after your consent has been obtained. Consent is obtained via Borlabs Cookie and may be withdrawn at any time with effect for the future. The IP address is truncated using IP masking. Matomo is hosted and operated directly by us on the infrastructure deployed for bavAIRia and BayKD. The data collected with Matomo is not used for remarketing or for creating personalised advertising profiles.

  • Types of data processed: Usage data (e.g. page views and duration of visit, click paths, intensity and frequency of use, device types and operating systems used, interactions with content and functions); metadata, communication and procedural data (e.g. IP addresses, timestamps, identification numbers, persons involved).
  • Data subjects: Users (e.g. website visitors, users of online services).
  • Purposes of processing and legitimate interests: Audience measurement (e.g. access statistics, recognition of returning visitors).
  • Retention and erasure: Matomo cookies are stored for a maximum period of 13 months. Otherwise, erasure takes place in accordance with the details in the section “General Information on Data Retention and Erasure”.
  • Security measures: IP masking (pseudonymisation of the IP address).
  • Legal bases: Consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing activities, procedures and services:

  • Matomo: Matomo is software used for web analytics and audience measurement. When Matomo is used, cookies are created and stored on the user’s end device. The user data collected through the use of Matomo is processed solely by us and is not shared with third parties. The cookies are stored for a maximum period of 13 months: https://matomo.org/faq/general/faq_146/; Legal bases: Consent (Art. 6(1)(a) GDPR); Erasure of data: The cookies have a maximum retention period of 13 months.

Amendments and Updates

We kindly ask you to inform yourself regularly about the content of our privacy policy. We will adapt the privacy policy as soon as changes to our data processing activities make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that addresses may change over time, and we ask that you verify the details before contacting them.