Privacy Policy.

Last updated: 15 September 2026. This is a translation provided for convenience. In case of any discrepancies, the German version shall prevail.

This policy describes which personal data we process when you visit our website alto-events.com and how we handle the data of our clients, prospects and business partners. It is based on the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

1. Controller

The controller within the meaning of Art. 4 No. 7 GDPR for the processing described here is:

Provider

ALTO - Event Performance Partners GbR

Address

Bergstraße 161, 44791 Bochum, Germany

Represented by

Alexander Guthmann and Leo Fischer

Email

info@alto-events.com

Phone

+49 155 66490718

We have not appointed a data protection officer, as the legal requirements of Art. 37 GDPR and Sec. 38 BDSG do not apply to us. Please direct any data protection enquiries to the contact details above. They will be handled personally by the partners.

2. Overview of legal bases

We process personal data exclusively on one of the following legal bases. For each processing activity, we state the specific legal basis that applies.

• Art. 6 (1) (a) GDPR: your consent, for example for analytics and embedded Google services.
• Art. 6 (1) (b) GDPR: performance of a contract or pre-contractual measures, for example for enquiries and projects.
• Art. 6 (1) (c) GDPR: compliance with legal obligations, for example retention periods under commercial and tax law.
• Art. 6 (1) (f) GDPR: our legitimate interests, for example in the secure operation of the website and in marketing our services.

Sec. 25 TDDDG additionally applies to storing information on your device and accessing it. We only use processes that are not strictly necessary for the service you have requested with your consent.

3. Hosting and server log files

Our website is hosted by Strato AG, Pascalstraße 10, 10587 Berlin. The servers are located in Germany. We have concluded a data processing agreement with Strato pursuant to Art. 28 GDPR.

Each time the site is accessed, the server automatically records data transmitted by your browser:

• domain and file accessed
• date and time of access
• amount of data transferred and status code
• browser type, browser version and operating system
• previously visited page (referrer)
• IP address of the requesting device

This data is technically required to deliver the site. We use it to ensure operation, detect faults and fend off attacks. The legal basis is Art. 6 (1) (f) GDPR. Our legitimate interest lies in the stable and secure provision of the website. This data is not merged with other data sources. According to Strato, IP addresses are stored for a maximum of seven days and then anonymised.

4. Consent management

When you first visit our website, we ask for your decision regarding the services that require consent. We store your selection in your browser so that the request does not reappear on every page view. This storage is strictly necessary to fulfil your request and therefore does not require consent under Sec. 25 (2) No. 2 TDDDG.

As proof of the consent given, we additionally log the selection made, the time and the IP address. The log is stored on our server at Strato in Germany and is not transferred to third parties. The legal basis is Art. 6 (1) (c) GDPR in conjunction with the obligation to provide evidence under Art. 7 (1) GDPR. We delete the logs after three years unless longer retention is required to defend legal claims.

Your consent is voluntary. You can withdraw it at any time with effect for the future without any disadvantage to you. You can withdraw your consent via the privacy settings on our website or informally by email. The lawfulness of processing carried out until withdrawal remains unaffected.

5. External fonts from Google Fonts

To ensure consistent display of text, we embed the fonts Jost and Newsreader via Google Fonts. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When the fonts are loaded, your browser establishes a direct connection to Google's servers at fonts.googleapis.com and fonts.gstatic.com. In the process, your IP address is transmitted to Google. Google thereby learns that our website was accessed from your device. A connection is only established after you have given your consent. The legal basis is Art. 6 (1) (a) GDPR and, insofar as your device is accessed, Sec. 25 (1) TDDDG.

Without your consent, we display the site using the system fonts available on your device. The content remains fully usable. Further information can be found in Google's privacy policy at policies.google.com/privacy and in the Google Fonts privacy notes at developers.google.com/fonts/faq/privacy.

6. Web analytics with Google Analytics

We use Google Analytics 4 with the measurement ID G-KLW72T8LJL to statistically evaluate the use of our website and improve our content. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics stores information on your device and reads it again in order to attribute repeat visits to a session. The following data in particular is processed:

• pages viewed, time spent and interactions
• source of the visit, such as a search engine or referring page
• approximate location based on the truncated IP address
• device type, screen resolution, browser and operating system
• a randomly assigned identifier for recognition within the session

Google truncates IP addresses within the EU and the EEA before processing them further. We have limited the retention period for user and event data to two months, the shortest available value. Google Signals, the collection of demographic data and linking with Google Ads are deactivated. We do not use the data for advertising purposes.

The sole legal basis is your consent pursuant to Art. 6 (1) (a) GDPR and Sec. 25 (1) TDDDG. Without consent, no script is loaded and no value is stored on your device. You can withdraw your consent at any time via the privacy settings. We have concluded a data processing agreement with Google. Details can be found at policies.google.com/privacy. Independently of our website, you can prevent data collection using Google's browser add-on at tools.google.com/dlpage/gaoptout.

7. Appointment booking via Google Calendar

To arrange an intro call, we embed the Google Calendar appointment scheduler. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The scheduler is loaded in a frame (iframe) directly from Google's servers. In the process, Google receives your IP address and technical information about your browser and may store information on your device. Users with a Google account may be recognised by Google.

The scheduler is only loaded after you have given your consent. The legal basis for embedding it is Art. 6 (1) (a) GDPR and Sec. 25 (1) TDDDG. Alternatively, you can reach us at any time by email or phone without involving a third-party provider.

For the booking itself, we collect your name, your company or event, the planned event date, your email address and your phone number. We use this information to create the appointment, send you a confirmation with a Google Meet link and prepare for the call. The legal basis is Art. 6 (1) (b) GDPR, as the processing takes place at your request and in preparation for a potential contract. Appointment data remains in our calendar for three years and is then deleted unless it has become part of an ongoing business relationship.

8. Contact by email and phone

We do not use a contact form. You can reach us by email and phone. In doing so, we process your contact details and any information you voluntarily provide in order to respond to your enquiry.

The legal basis is Art. 6 (1) (b) GDPR for enquiries relating to an existing or prospective contract, and otherwise Art. 6 (1) (f) GDPR, based on our legitimate interest in responding to enquiries. Enquiries that do not lead to a business relationship are deleted six months after the last contact.

Note: Unencrypted emails can be read by third parties during transmission. For confidential content, please feel free to agree on a different method of transmission with us.

9. Job applications

Applications reach us via info@alto-events.com. We process the data submitted exclusively to review your application and conduct the selection process. The legal basis is Sec. 26 (1) BDSG in conjunction with Art. 6 (1) (b) GDPR. After the process has been completed, we delete the documents after six months at the latest. Longer inclusion in our applicant pool only takes place with your express consent, which you can withdraw at any time.

10. Data of our clients and business partners

As part of our consulting and project work, we process personal data of contact persons at our clients, service providers and partners. This includes:

• contact and communication data such as name, position, company, email address and phone number
• contract and billing data such as quotes, orders, invoices and payment information
• project documents such as concepts, evaluations, presentations and minutes
• interview notes from conversations we conduct as part of analyses

The purposes are the initiation, performance and invoicing of our services as well as ongoing communication. The legal basis is Art. 6 (1) (b) GDPR, and for contact persons at our contractual partners additionally Art. 6 (1) (f) GDPR, based on our legitimate interest in conducting the business relationship. Art. 6 (1) (c) GDPR applies to obligations under tax and commercial law.

We evaluate interview notes exclusively in aggregated form. We do not assess individual employees of our clients.

11. Google Workspace

We handle our email communication, calendars, video conferences via Google Meet and the storage of documents and project files with Google Workspace in the Business Starter edition. The contractual partner is Google Cloud EMEA Limited, Velasco, Clanwilliam Place, Dublin 2, Ireland.

Google processes the data stored there on our behalf as a processor. We have concluded Google's Cloud Data Processing Addendum, which implements the requirements of Art. 28 GDPR. In the edition used, data is also stored on servers in the United States. Further details can be found in Section 14.

The legal basis for its use is Art. 6 (1) (f) GDPR. Our legitimate interest lies in operating a reliable and secure working environment for a small team. Insofar as the processing serves the performance of a contract with you, we base it on Art. 6 (1) (b) GDPR. Google's privacy notice can be found at cloud.google.com/terms/cloud-privacy-notice.

12. Other service providers and recipients

We only pass on personal data insofar as this is necessary for the stated purposes or there is a legal obligation to do so. Recipients are:

Strato AG

Pascalstraße 10, 10587 Berlin. Hosting of the website and the consent log. Processor.

Google Cloud EMEA Limited

Velasco, Clanwilliam Place, Dublin 2, Ireland. Google Workspace for communication, calendars and document storage. Processor.

Google Ireland Limited

Gordon House, Barrow Street, Dublin 4, Ireland. Analytics, fonts and appointment scheduler on this website.

DocuSign

DocuSign International (EMEA) Limited, 5 Hanover Quay, Dublin 2, Ireland. Electronic signature of contracts and agreements.

Qonto

Olinda SAS, 18 rue de Navarin, 75009 Paris, France. Business account and payment processing.

Tax advisors

Transfer of invoices and accounting records to fulfil tax obligations pursuant to Art. 6 (1) (c) GDPR.

13. Freelancers and sponsorship partners

Part of our service consists of referring suitable freelancers and service providers and bringing organisers and potential sponsors together. In doing so, we pass on the contact details of the respective contact persons, such as name, position, company and business contact details.

The legal basis is Art. 6 (1) (b) GDPR insofar as the disclosure is necessary to perform the contract concluded with you. Otherwise, we rely on Art. 6 (1) (f) GDPR, based on our legitimate interest in referral and marketing. You can object to the disclosure at any time pursuant to Art. 21 GDPR. We do not pass data on to recipients outside this purpose, and we do not sell data.

14. Processing on behalf of our clients

In projects, we receive access to data of event participants, such as registration, accreditation or ticketing data. We process this data exclusively in accordance with the instructions of the respective organiser as a processor pursuant to Art. 28 GDPR. In these cases, the controller within the meaning of the GDPR is the organiser, not us.

This is based on a data processing agreement with the respective client that sets out the purpose, scope, duration and technical and organisational measures. We do not use this data for our own purposes. After the project ends, we delete or hand over the data in accordance with the client's instructions.

Data subjects should direct requests for access or deletion regarding this data to the respective organiser. Any requests that reach us will be forwarded to the controller without delay.

15. Transfers to third countries

When using Google Workspace and the Google services embedded on this website, data is also processed on servers in the United States. Google LLC is certified under the EU-US Data Privacy Framework. On 10 July 2023, the European Commission adopted an adequacy decision for this framework pursuant to Art. 45 GDPR. In addition, Google has concluded standard contractual clauses pursuant to Art. 46 (2) (c) GDPR, which also apply should the adequacy decision cease to apply.

Please note that US authorities may, under certain conditions, access data and that legal protection against this may not meet European standards. The adequacy decision is currently under judicial review. For processing based on your consent, by making your selection you also consent to the associated transfer pursuant to Art. 49 (1) (a) GDPR.

16. Retention periods at a glance

Data	Duration
Server log files with IP address	seven days at most, then anonymised
Consent log	three years
Google Analytics data	two months
Appointment bookings	three years
Enquiries without a contract	six months after the last contact
Application documents	six months after completion of the process
Commercial and business letters	six years pursuant to Sec. 257 HGB and Sec. 147 AO
Invoices and accounting records	eight years pursuant to Sec. 147 AO

Beyond this, we store data for as long as the respective purpose exists or retention is required to assert and defend legal claims.

17. Your rights

You have the following rights with respect to us:

• access to the data stored about you pursuant to Art. 15 GDPR
• rectification of inaccurate or incomplete data pursuant to Art. 16 GDPR
• erasure of your data pursuant to Art. 17 GDPR, unless a retention obligation applies
• restriction of processing pursuant to Art. 18 GDPR
• receipt of your data in a common format pursuant to Art. 20 GDPR
• objection to certain processing pursuant to Art. 21 GDPR
• withdrawal of consent given, with effect for the future, pursuant to Art. 7 (3) GDPR

An informal message to info@alto-events.com is sufficient to exercise these rights. We will respond within one month. Exercising your rights is free of charge.

18. Right to lodge a complaint with a supervisory authority

You can lodge a complaint with a data protection supervisory authority at any time, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for us is:

Authority

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia)

Address

Kavalleriestraße 2-4, 40213 Düsseldorf, Germany

Email

poststelle@ldi.nrw.de

Web

www.ldi.nrw.de

19. Data security

This website uses TLS encryption. You can recognise an encrypted connection by the padlock symbol in your browser and by the address bar beginning with https. In addition, we use technical and organisational measures pursuant to Art. 32 GDPR to protect your data against loss, manipulation and unauthorised access. These include restricting access to the partners, two-factor authentication for the accounts used and regular reviews of the services used.

20. No automated decision-making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

21. Provision of your data

The provision of your data is neither required by law nor by contract. However, we need certain information, such as contact and billing details, to conclude and perform a contract. Without this information, we cannot conclude or fulfil a contract. No information beyond the technically necessary data is required to visit our website.

22. Changes to this policy

We will amend this privacy policy as soon as our services, the tools we use or the legal requirements change. The version published here applies in each case. The date of the current version can be found at the top of this page.