Privacy policy

1. Controller for this Website

The controller for the processing of personal data on this website is Sicherheitsnetzwerk München e.V., c/o Fraunhofer AISEC, Lichtenbergstr. 11, 85478 Garching, Germany (“we”, “us”, “our”). You can reach us at: info@security-network-munich.org

2. Purpose

This document outlines the specific information that we are obligated to provide to data subjects in the EU, EEA and UK under the General Data Protection Regulation ((EU) 2016/679 GDPR) established by the EU, and the United Kingdom General Data Protection Regulation (UK GDPR).

3. Scope

This document covers our processing of your personal data on our website https://security-network-munich.org/
In some cases, we may also need to involve other service providers, for example when you register for an event. This is because some events are organised in collaboration with other partners, and we use dedicated event platforms to handle registration and payment. We do not sell your data at any time. All our processors are carefully reviewed according to strict standards.

4. Legal Bases for Processing

We will only process your personal data if there is a legal basis to do so. Under GDPR/UK GDPR, there are four legal bases that we rely on.

Consent (Art. 6 (1) a) GDPR/UK GDPR) – If you give us your consent, we are allowed to process your personal data only for the purpose for which the consent was given. You can withdraw your consent at any time.
Contractual obligations (Art. 6 (1) b) GDPR/UK GDPR) – When we are in a contractual relationship with you, we may and must store and process the personal data required to fulfill it. This also applies to pre-contractual measures that are necessary in order to enter into the contract.
Legal obligations (Art. 6 (1) c) GDPR/UK GDPR) – Under European or German law we may at times be required to retain or disclose certain data.
Balancing of interests (Legitimate interest) (Art. 6 (1) f) GDPR/UK GDPR) – Processing on the basis of legitimate interest is permissible insofar as it is necessary to safeguard our legitimate interests or those of a third party, and your interests and fundamental rights and freedoms do not override them. Within this notice, we will inform you when we rely on legitimate interests, and what these are.

When you encounter the symbols above in the text, you will know which processing activities we carry out on which basis.

5. Our Website

5.1 Purely informational use
The following information is always sent to our servers when you visit the website:

Usage data

Websites visited
Date and time of the visit

Metadata

IP address
Date and time of the request
Time zone difference from Greenwich Mean Time (GMT)
Content of the request (specific page)
Website from which the request originates
Information about your browser (e.g. version, language, installed fonts)
Information about your operating system (e.g. version, language)
Where applicable, further information that your browser automatically sends due to the HTTP protocol

The information is used exclusively to display the website correctly on your device and to maintain the technical operation of the servers and ensure its security. The legal basis is our legitimate interest to provide you with a modern website.
Our website is hosted by WPEngine, Inc. (Irongate House, 22-30 Duke’s Place London, EC3A 7LP United Kingdom). WPEngine processes your data for the stated purposes on our behalf and is bound by a data processing agreement pursuant to Art. 28 GDPR. You can find WPEngine’s privacy policy here: https://wpengine.com/legal/privacy/
We automatically delete all server logs after 7 days. We retain the logs for this period in order to detect suspicious activity and protect our infrastructure against attacks. If we suspect misuse of our website, we may store the relevant logs for longer in order to support possible legal action.

5.2 Cookies on this website
Cookies are small text files that any website can write into your browser. Cookies may be set by ourselves (so-called first party cookies), or by third parties (so-called third party cookies).
If we set a cookie in your browser, other websites cannot read it. If other third parties set a cookie in your browser, any other website which uses the same third party cookies can read the information stored in these cookies. This allows for tracking functionality across websites.
Below you can see a list of first party cookies which we set:

Name	Content	Purpose	Duration
cf_clearance	Encrypted security and clearance token	approx. 30 minutes
__cf_bm	Encrypted information used to calculate a bot score; session data where applicable	Supports the detection and prevention of automated access and malicious bots.	Stores the fact that a visitor has successfully passed a Cloudflare security check, so that the check is not repeated on every page view.
borlabs-cookie	Cookie version, consents given, domain, path, lifetime and a randomly generated	Stores the visitor’s consent decision, so that the cookie dialogue does not reappear on every page view.	60 days
Name cf_clearance __cf_bm borlabs-cookie wordpress_gdpr_cookies_allowed	Content Encrypted security and clearance token Encrypted information used to calculate a bot score; session data where applicable Cookie version, consents given, domain, path, lifetime and a randomly generated Consent status, for example 1 or true	Purpose approx. 30 minutes Supports the detection and prevention of automated access and malicious bots. Stores the visitor’s consent decision, so that the cookie dialogue does not reappear on every page view. Consent status, for example 1 or true	Duration Stores the fact that a visitor has successfully passed a Cloudflare security check, so that the check is not repeated on every page view. 60 days Stores the fact that optional cookies have been accepted.
Name cf_clearance __cf_bm borlabs-cookie wordpress_gdpr_cookies_declined	Content Encrypted security and clearance token Encrypted information used to calculate a bot score; session data where applicable Cookie version, consents given, domain, path, lifetime and a randomly generated Rejection status, for example 1 or true	Purpose approx. 30 minutes Supports the detection and prevention of automated access and malicious bots. Stores the visitor’s consent decision, so that the cookie dialogue does not reappear on every page view. Stores the fact that optional cookies have been declined.	Duration Stores the fact that a visitor has successfully passed a Cloudflare security check, so that the check is not repeated on every page view. 60 days approx. 180 days
Name cf_clearance __cf_bm borlabs-cookie wordpress_gdpr_allowed_services	Content Encrypted security and clearance token Encrypted information used to calculate a bot score; session data where applicable Cookie version, consents given, domain, path, lifetime and a randomly generated List or IDs of the permitted services	Purpose approx. 30 minutes Supports the detection and prevention of automated access and malicious bots. Stores the visitor’s consent decision, so that the cookie dialogue does not reappear on every page view. Stores which external services have been enabled by the visitor.	Duration Stores the fact that a visitor has successfully passed a Cloudflare security check, so that the check is not repeated on every page view. 60 days approx. 180 days
Name cf_clearance __cf_bm borlabs-cookie wordpress_test_cookie	Content Encrypted security and clearance token Encrypted information used to calculate a bot score; session data where applicable Cookie version, consents given, domain, path, lifetime and a randomly generated Usually WP Cookie check	Purpose approx. 30 minutes Supports the detection and prevention of automated access and malicious bots. Stores the visitor’s consent decision, so that the cookie dialogue does not reappear on every page view. Checks whether the browser accepts cookies.	Duration Stores the fact that a visitor has successfully passed a Cloudflare security check, so that the check is not repeated on every page view. 60 days Session
Name cf_clearance __cf_bm borlabs-cookie _ga	Content Encrypted security and clearance token Encrypted information used to calculate a bot score; session data where applicable Cookie version, consents given, domain, path, lifetime and a randomly generated Randomly generated visitor ID	Purpose approx. 30 minutes Supports the detection and prevention of automated access and malicious bots. Stores the visitor’s consent decision, so that the cookie dialogue does not reappear on every page view. Distinguishes individual visitors for statistical analysis.	Duration Stores the fact that a visitor has successfully passed a Cloudflare security check, so that the check is not repeated on every page view. 60 days 2 years
Name cf_clearance __cf_bm borlabs-cookie _gid	Content Encrypted security and clearance token Encrypted information used to calculate a bot score; session data where applicable Cookie version, consents given, domain, path, lifetime and a randomly generated Randomly generated visitor ID	Purpose approx. 30 minutes Supports the detection and prevention of automated access and malicious bots. Stores the visitor’s consent decision, so that the cookie dialogue does not reappear on every page view. Distinguishes visitors within a shorter analysis period.	Duration Stores the fact that a visitor has successfully passed a Cloudflare security check, so that the check is not repeated on every page view. 60 days 24 hours
Name cf_clearance __cf_bm borlabs-cookie _gat	Content Encrypted security and clearance token Encrypted information used to calculate a bot score; session data where applicable Cookie version, consents given, domain, path, lifetime and a randomly generated Usually the value 1	Purpose approx. 30 minutes Supports the detection and prevention of automated access and malicious bots. Stores the visitor’s consent decision, so that the cookie dialogue does not reappear on every page view. Limits the number of requests sent to Google Analytics.	Duration Stores the fact that a visitor has successfully passed a Cloudflare security check, so that the check is not repeated on every page view. 60 days approx. 1 minute
Name cf_clearance __cf_bm borlabs-cookie _ga_[CONTAINER-ID]	Content Encrypted security and clearance token Encrypted information used to calculate a bot score; session data where applicable Cookie version, consents given, domain, path, lifetime and a randomly generated Session and analytics information; the exact name contains the respective	Purpose approx. 30 minutes Supports the detection and prevention of automated access and malicious bots. Stores the visitor’s consent decision, so that the cookie dialogue does not reappear on every page view. Stores and counts sessions for a specific GA4 property.	Duration Stores the fact that a visitor has successfully passed a Cloudflare security check, so that the check is not repeated on every page view. 60 days up to 2 years

We do not set any third party cookies on our website.

5.3 Google
We use services and platforms operated by Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). You can find Google’s privacy policy here: https://policies.google.com/privacy .

5.3.1 Google Tag Manager
Google Tag Manager is a service that allows us to manage other website services from a single interface. Google Tag Manager itself does not process any personal data; it is designed to load further services and tools, which may in turn process personal data.

5.3.2 Google Analytics
We use Google Analytics. When you visit our website, Google Analytics stores several cookies which serve to identify you and to analyse your use of our website.

On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity, and to provide us with further services relating to the use of the website and the use of the internet.

You can prevent the collection of the data generated by the cookie and relating to your use of the website (including your IP address) by downloading and installing the browser plug-in available under the following link: https://tools.google.com/dlpage/gaoptout

We use Google Analytics in order to increase the functionality of our website and to provide you with a continuously improving user experience.

Further information about Google and the processing:
Terms of service: https://www.google.com/analytics/terms/  Privacy overview: https://support.google.com/analytics/answer/6004245?hl=en

5.3.3 YouTube
On some of our web pages we have embedded videos from the YouTube platform, which is operated by Google. When you visit a web page on which a video is embedded, Google learns which web page you have visited, which IP address you are using, when you accessed the page and which video is embedded. To store further information about your interaction with the video (for example your position in the video), Google stores cookies in your browser.

Our legitimate interest in embedding YouTube is the modern communication of our events.

You can change your settings for the advertising shown to you by Google, in particular to switch off personalised advertising, by following this link:  https://adssettings.google.com/authenticated

5.4 HubSpot
On our website we embed registration forms provided by the service HubSpot, HubSpot Ireland Limited, HubSpot House, One Sir John Rogerson’s Quay, Dublin 2, Ireland.

The purpose of these forms is to enable us to process your data for newsletter registration, for registration for events, and for applying for membership of Sicherheitsnetzwerk München. The personal data you enter into the form is transmitted directly to HubSpot and processed there on our behalf (pursuant to Art. 28 GDPR).

The form is only embedded, and the associated transfer of data to HubSpot only takes place, after you have expressly given your consent to this via our cookie consent tool ‘Borlabs Cookie’.

You can find further information on how HubSpot processes your personal data here:
https://legal.hubspot.com/privacy-policy

6. Contact

When you contact us, we receive and store the additional information you send us. We will use this information to respond to your enquiry. For this we normally need the following information from you:

Email
Name
Associated company
Your message and the subject

The legal basis for this processing is either our contractual obligation, if you contact us regarding events that we organise, or our legitimate interest in responding to your enquiry, if you make a general request.

7. Storage Period

We store your data – unless otherwise stated in this privacy policy – for as long as necessary for the duration of our business relationship with you. This also includes the initiation and execution of a contract. Storage beyond this is possible if a statutory retention obligation exists, for example under the German Fiscal Code (Abgabenordnung) or the German Commercial Code (Handelsgesetzbuch). In this case the data is stored securely for the duration of the retention period and subsequently deleted once it is no longer required. Where storage and processing are based on consent, we store your data until you withdraw your consent.

8. Social Media

We operate the following social media pages:

Twitter page: https://x.com/MCSC_org
Two pages on LinkedIn: https://www.linkedin.com/company/security-network-munich https://de.linkedin.com/showcase/munich-cyber-security-conference
A YouTube channel: https://www.youtube.com/channel/UCpqbZ3EHzAsF9Zbd3J1dCdw

We use these social media platforms for the purpose of publicising our cooperations and events.

The social media platforms described in more detail below collect data about your behaviour and interests when you visit our pages, and in some cases provide us with an anonymised analysis of visitor groups and interactions. This processing of your data is carried out on the basis of our legitimate interest in better understanding our target audiences pursuant to Art. 6 (1) f) GDPR.

In addition, the data may be processed by the social media platforms for their own market research and advertising purposes. Cookies may be stored on your computer that are used to analyse usage behaviour. Further data about your devices, internet connection or location may also be collected and, where applicable, linked to your account.

A user profile may be created about you, even if you are not logged in to the social media platforms or do not have an account. These profiles can be used to display advertisements tailored to you on various platforms.  How the social media platforms use the data from visits to the social media pages for their own purposes, and how long the social media platforms store this data, is not clearly stated by the social media platforms and is not known to us beyond the processing operations mentioned above.

It may happen that, when you visit our social media pages, your data is processed outside the European Union. Please consult the privacy policies of the individual platforms to find out how your data is protected in a third country in this case.

Overview and information about the platforms used:

Twitter is a social media platform provided by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland, with the parent company Twitter, Inc., 1355 Market Street #900, San Francisco, California 94103.
You can find Twitter’s privacy notice here: https://www.twitter.com/en/privacy  You can find information about Twitter’s privacy settings here: https://help.twitter.com/en/safety-and-security/twitter-privacy-settings
To change privacy settings regarding personalised advertising, follow these instructions:  https://help.twitter.com/en/safety-and-security/privacy-controls-for-tailored-ads
LinkedIn is a business platform provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland, with the parent company LinkedIn Corporation, 1000 W. Maude Ave., Sunnyvale, California 94085. We have entered into a joint controllership agreement with LinkedIn, which you can access here:  https://legal.linkedin.com/pages-joint-controller-addendum. In summary, LinkedIn declares itself responsible for all processing operations relating to your personal data on the platform. It also declares itself responsible for implementing data subject rights.
You have the right at any time to assert your data subject rights vis-à-vis LinkedIn or us regarding our LinkedIn page and the Page Insights running on it.
If you contact us, we will forward your request directly to LinkedIn for a response.
You can access LinkedIn’s privacy policy here: https://www.linkedin.com/legal/privacy-policy If you have a LinkedIn account, you can adjust your privacy settings at https://www.linkedin.com/psettings/.
YouTube is a video portal and network provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.  You can access Google’s privacy policy here: https://policies.google.com/privacy?hl=en  If you have a YouTube or Google account, you can adjust your advertising settings at https://adssettings.google.com/authenticated. 
At https://myaccount.google.com/activitycontrols you can set whether your web and app activity is recorded by Google, whether a location history is stored, and whether your searches on YouTube are saved.

9. Your Rights

At any time you can exercise the following rights by contacting us. In some cases we will ask you to confirm your identity in order to prevent misuse.

Right of access
Right to rectification or erasure
Right to restriction of processing
Right to data portability
Right to lodge a complaint with a supervisory authority

You may also object to processing operations that are based on our legitimate interest (⚖), if our balancing of interests should turn out differently due to your particular situation.