Privacy Policy
Last updated: 31 July 2026
1. General Information
The protection of your personal data is important to us. In this privacy policy, we inform you about what personal data we process, for what purposes this is done, the legal basis on which the processing is carried out, and what rights you have.
This Privacy Policy applies in particular to:
our website DeafVentures.de, including all subpages,
our registration, contact, enquiry and upload forms,
the DeafVentures Business Suite,
participant, customer, event and course portals,
the DeafVentures Academy,
invitation, waiting list and feedback functions,
video, photo and document uploads,
communication via email, telephone, SMS, iMessage and WhatsApp,
our social media presence,
the running of our courses, camps, events and trips.
Personal data is any information relating to an identified or identifiable natural person. This includes, for example, name, address, email address, telephone number, date of birth, booking details, payment details, photos, videos and technical usage data.
2. Data controller
The data controller within the meaning of the General Data Protection Regulation is:
DeafVentures – Patrick Bauer, Pia Boni and Marie Kohlen GbR
Suhrendorf 10
18569 Ummanz
Germany
Email: [email protected]
Telephone: +49 172 661 8994
Authorised partners:
Patrick Bauer
, Pia Boni
and Marie Kohlen
You can direct any data protection enquiries to [email protected] at any time.
[[Nur aufnehmen, falls ein Datenschutzbeauftragter bestellt wurde:]]
Data Protection Officer:
[[NAME ODER EXTERNER DIENSTLEISTER]]
[[ANSCHRIFT]]
[[E-MAIL-ADRESSE]]
3. Principles of data processing
We process personal data only where there is a legal basis for doing so. Depending on the nature of the processing, the following legal bases apply in particular:
Consent pursuant to Article 6(1)(a) of the GDPR
We use this legal basis, for example, for voluntary marketing consents, newsletter subscriptions, the publication of photos or videos, as well as for optional cookies and external media.
Performance of a contract and pre-contractual measures pursuant to Article 6(1)(b) of the GDPR
We use this legal basis in particular for enquiries, bookings, registrations, courses, camps, trips, events, invoices and the organisation of agreed services.
Legal obligations pursuant to Article 6(1)(c) of the GDPR
These include, in particular, tax, commercial, regulatory and statutory documentation and retention obligations.
Vital interests pursuant to Article 6(1)(d) of the GDPR
In medical or other emergencies, data may be processed or disclosed where this is necessary to protect the vital interests of the data subject or another person.
Legitimate interests pursuant to Article 6(1)(f) of the GDPR
This includes, in particular, the secure and cost-effective operation of our website and Business Suite, the prevention of misuse, IT security, the handling of general business communications, internal organisation, and the enforcement or defence of legal claims.
4. Special categories of personal data
In the context of our water sports courses, camps, trips and events, we may process special categories of personal data. These may include, in particular:
Information regarding hearing status,
information regarding deafness, hearing impairment or hearing and visual impairment,
Information on preferred means of communication,
Information on allergies and intolerances,
information on medical conditions or health limitations,
Information on medication,
Information regarding physical capacity,
Details of any need for assistance or support,
Information on disabilities,
in special cases, emergency or medical information.
Information on height, weight and clothing size may also, in connection with our courses and the selection of suitable protective or water sports equipment, provide insights into a person’s physical condition.
Insofar as this information constitutes health data within the meaning of Article 9 of the GDPR, we generally process it only on the basis of your explicit consent in accordance with Article 9(2)(a) of the GDPR.
In an acute emergency, processing may, exceptionally, be based on Article 9(2)(c) of the GDPR if the processing is necessary to protect vital interests and the data subject is unable to give their consent.
Health data is only made available to those persons who require it for the safe preparation or running of the relevant event. These may include, for example, course leaders, trainers, tour guides, assistants, those responsible for catering or accommodation, and medical support staff.
5. Recipients of personal data
Within DeafVentures, only those individuals who require personal data for their respective tasks are granted access to it.
This may include, in particular:
Shareholders and authorised team members,
trainers and course leaders,
travel and event managers,
sign language interpreters,
communication assistants,
personal assistants,
Administrative and accounting staff,
technical administrators,
contracted photographers and videographers.
In addition, data may be transferred to external recipients where this is necessary for the performance of a contract, on the basis of consent, to fulfil legal obligations or on the basis of legitimate interests.
These may include, in particular:
hosting and IT service providers,
cloud and storage service providers,
email and communications providers,
payment service providers and banks,
tax advisers and accountancy service providers,
Legal advisers and insurance companies,
Accommodation and hospitality businesses,
Kitesurfing schools and water sports centres,
Transport companies and shuttle services,
Tour operators and local agencies,
Airlines and ferry companies,
Tour leaders and guides,
Restaurants and catering companies,
Event venues,
partners,
authorities and public bodies.
Where necessary, we enter into data processing agreements in accordance with Article 28 of the GDPR with service providers who process personal data exclusively on our behalf.
6. Transfers to third countries
When using certain cloud, communication, analytics or social media services, as well as when travelling outside the European Economic Area, personal data may be transferred to so-called third countries.
A transfer will only take place if there is a legal basis for data protection. These include, in particular:
an adequacy decision by the European Commission,
the participation of a US company in the EU-US Data Privacy Framework,
standard contractual clauses approved by the European Commission,
binding corporate rules,
express consent,
the necessity to fulfil a contract or to carry out a trip or event organised at your request.
When travelling to third countries, it may be necessary to transfer booking or participant data to local hotels, travel agencies, guides, transport companies, airlines, kitesurfing schools or other service providers.
In some third countries, the level of data protection may not be comparable to that of the European Union. In such cases, public authorities may have more extensive rights of access without data subjects having equivalent legal remedies at their disposal.
Special categories of personal data relating to health are only transferred to recipients in third countries if this is necessary and there is an additional legal basis under Article 9 of the GDPR, in particular explicit consent.
7. Retention period
We retain personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations.
In particular, the following principles apply:
Data from general enquiries is generally deleted as soon as the enquiry has been fully processed and there are no legal or contractual grounds for further storage.
Contract, booking and event data may be stored until the expiry of the standard statutory limitation period.
Invoices and tax-relevant accounting documents are generally retained for eight years.
Commercial and business correspondence is generally retained for six years.
Data required to enforce or defend against claims may be stored until the conclusion of the relevant proceedings.
Evidence of consent is stored for as long as the consent is in use and beyond that, insofar as this is necessary to prove its lawfulness.
Newsletter data is stored until the user unsubscribes. Information regarding unsubscription may subsequently be stored in a block list to ensure that no further messages are sent.
User accounts are generally stored until the account is deleted or until the end of the user relationship.
Photographs, videos and participant feedback are stored until consent is withdrawn or until the purpose for publication ceases to apply.
Health and emergency data are generally deleted promptly after the conclusion of the relevant event, unless further storage is justified by consent, a legal obligation or the need to assert, exercise or defend legal claims.
[[Festlegen und einsetzen: Gesundheits- und Notfalldaten werden im Regelfall spätestens ___ Monate nach Abschluss der Veranstaltung gelöscht.]]
8. Technical and organisational security measures
We take appropriate technical and organisational measures to protect personal data against loss, manipulation, unauthorised access, unauthorised disclosure and other misuse.
Depending on the system, these include in particular:
encrypted data transmission using TLS or SSL,
role-based and authorisation schemes,
individual user accounts,
secure password storage,
access restrictions,
logging of security-related events,
regular data backups,
updating the software in use,
protection against malware and unauthorised access,
organisational confidentiality policies,
Restriction of access to authorised personnel,
regular review of access authorisations.
Despite these measures, data transmission over the internet can never be completely protected against all risks.
Data processing on the website
9. Visiting our website and server logs
When you visit our website, your browser automatically transmits technical information to the server.
This may include:
IP address,
date and time of access,
page or file accessed,
amount of data transferred,
referrer address,
browser type and version,
operating system,
device characteristics,
hostname of the accessing device,
Notifications of successful or failed access attempts.
This data is processed for the purpose of technically providing the website, detecting errors, ensuring stability and security, and warding off attacks or unauthorised access.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure and functional operation of our website.
Server logs are generally deleted after [[7/14/30]] days, unless a security-related incident necessitates longer retention.
10. Web hosting
Our website is hosted by the following provider:
ALL-INKL.COM – Neue Medien Münnich
Owner: René Münnich
Hauptstraße 68
02742 Friedersdorf
Germany
The hosting provider processes, in particular, technical connection data, server logs and the content stored on the servers. Depending on the specific function, this may also include form, contact, booking or user information.
Processing is carried out for the purpose of providing and securing the website on the basis of Article 6(1)(f) of the GDPR. Insofar as the provider processes data on our behalf, this is done on the basis of a data processing agreement in accordance with Article 28 of the GDPR.
11. Hosting of the DeafVentures Business Suite
The DeafVentures Business Suite is technically operated by the following provider:
[[HOSTINGANBIETER DER BUSINESS SUITE]]
[[ANSCHRIFT]]
[[LAND]]
The provider may process technical access data, server logs, database contents and other information processed within the Business Suite on our behalf.
The legal bases are Article 6(1)(b) and (f) of the GDPR. Data processing on our behalf is carried out on the basis of a contract in accordance with Article 28 of the GDPR.
[[Hier zusätzlich Datenbankanbieter, Dateispeicher, Backup-Anbieter und Authentifizierungsanbieter eintragen, sofern diese vom Hostinganbieter abweichen.]]
12. Cloudflare
We use Cloudflare’s services to deliver, secure and accelerate our online services.
The provider is, in particular:
Cloudflare Germany GmbH or Cloudflare, Inc.
Cloudflare may be used as a content delivery network, DNS service, proxy and security service between your device and our servers. In particular, the following data may be processed: IP address, device information, browser information, content accessed, times of access and security information.
The purpose of the processing is, in particular:
the secure provision of the website,
to defend against attacks,
to protect against automated or unauthorised access,
to improve loading times,
to ensure technical availability.
The legal basis is Article 6(1)(f) of the GDPR. Our legitimate interest lies in the secure, efficient and reliable provision of our services.
Where data is transferred to the USA, this is done, depending on the specific processing activity, on the basis of an adequacy decision, participation in the EU-US Data Privacy Framework or appropriate safeguards such as standard contractual clauses.
13. Cookies and similar technologies
Our website and the Business Suite use cookies and similar technologies such as local storage, session storage, pixels, scripts or device identifiers.
Technologies that are strictly necessary from a technical point of view are used to ensure that our services function, can be operated securely, or to provide a feature you have expressly requested.
Where personal data is processed in this context, the processing is based in particular on Article 6(1)(f) of the GDPR. Access to your device is also governed by Section 25(2) of the TDDDG.
Cookies and similar technologies that are not technically necessary are only used if you have given your prior consent. The legal bases are Section 25(1) of the TDDDG and Article 6(1)(a) of the GDPR.
You may change or withdraw your consent at any time via the cookie settings on our website. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.
Detailed information on the cookies currently in use, the services, providers, purposes and retention periods can be found in our separate Cookie Policy and in the cookie settings.
14. Consent management with Complianz
We use the WordPress plugin Complianz to obtain, store and document consent for cookies and external services.
In particular, the following information may be stored:
consent status,
selected cookie categories,
time of consent,
version of the underlying information,
technical browser or device information,
a truncated or pseudonymised identifier.
Processing is necessary to implement your choices and to be able to provide evidence of consent.
The legal bases are Article 6(1)(c) and (f) of the GDPR and Section 25 of the TDDDG.
15. WordPress and Elementor
Our website is based on WordPress and is designed using, amongst other tools, Elementor.
This may involve the use of technically necessary cookies or local storage information, for example to display content, save settings, troubleshoot errors or manage logged-in users.
For standard website visitors, WordPress and Elementor functions are generally executed on our own servers or on servers commissioned by us. Data is only transmitted to the software manufacturers if additional external functions, libraries, telemetry or cloud services have been activated.
The legal basis for technically necessary processing is Article 6(1)(f) of the GDPR.
16. WooCommerce and shop functions
We use, or provide, WooCommerce for shop, shopping basket, product and booking functions.
When using these functions, the following data in particular may be processed:
selected products or services,
shopping basket contents,
order number,
name and address,
billing and delivery address,
email address,
Telephone number,
Payment method,
Payment status,
Vouchers and discounts,
technical session IDs.
Data processing is carried out for the purpose of preparing and fulfilling the order in accordance with Article 6(1)(b) of the GDPR, as well as to comply with tax and commercial law obligations in accordance with Article 6(1)(c) of the GDPR.
Technically necessary shopping basket and session cookies are used on the basis of Section 25(2) of the German Telemedia Act (TDDDG).
Forms, bookings and events
17. Contact and enquiry forms
If you use a contact or enquiry form, we will process the data you enter.
This may include:
Name,
email address,
telephone number,
Subject,
Message,
Details of a desired event,
Group or organisation details,
uploaded documents,
technical information relating to the submission process.
Data is processed in order to deal with your enquiry. Where your enquiry is aimed at concluding a contract, the legal basis is Article 6(1)(b) of the GDPR. For general enquiries, processing is based on Article 6(1)(f) of the GDPR.
18. Event, course and travel registrations
When you register for a course, camp, event, retreat or trip, we process the data necessary for the preparation, booking, organisation and invoicing.
This may include, in particular:
Personal and contact details
First name and surname,
address,
date of birth,
email address,
Telephone number,
Emergency contact,
Billing address.
Event and booking details
Selected event,
Travel dates,
Course or service package,
Additional services,
Accommodation,
meals,
Breakfast,
Shuttle or transport,
Assistance requirements,
Room or group requests,
Booking status,
Waiting list status,
Participation and attendance status,
Cancellations,
Vouchers and refunds.
Equipment and organisational details
Height,
weight,
Clothing size,
Shoe size,
water sports equipment required,
previous experience,
ability to swim,
Course level.
Contact details
Hearing status,
preferred form of communication,
German Sign Language,
signs accompanying spoken language,
spoken language,
need for interpreting or assistance.
Diet and health information
Diet,
allergies,
food intolerances,
Medical conditions,
medicines,
physical limitations,
medical emergency information.
Declarations and evidence
Consent to the terms and conditions of participation,
Liability and safety declarations,
consents,
signatures,
Proof of parental authority,
insurance or travel documents, where required.
Processing is carried out for the purpose of taking pre-contractual measures and for the performance of the contract in accordance with Article 6(1)(b) of the GDPR.
Health data is also processed only on the basis of explicit consent in accordance with Article 9(2)(a) of the GDPR, unless another specific legal basis applies.
19. Digital signatures
Signatures can be captured digitally in our forms.
In doing so, we process:
the image of the signature,
the name of the person signing,
the time and assignment of the signature,
the associated form,
and, where applicable, technical verification data.
The purpose is to document binding registrations, declarations, consents or the conclusion of contracts.
The legal basis is Article 6(1)(b) of the GDPR. In the case of signatures on consent forms, Article 6(1)(a) or Article 9(2)(a) of the GDPR applies. The storage of supporting data may also be based on Article 6(1)(f) of the GDPR.
20. Registration of multiple persons and third-party data
A person may, where applicable, register additional participants, family members, children, support staff or group members.
In this case, we may not receive personal data directly from the data subject, but from the person registering them, a group leader, a legal representative, a support worker or a cooperation partner.
The person making the registration is obliged to inform the other data subjects about the data transfer and this privacy policy. Health data relating to other persons may only be provided if there is appropriate authorisation or explicit consent to do so.
We may contact the data subject directly, if necessary, to confirm details, obtain consent or organise the event.
21. Underage participants
For events aimed at children and young people, we process data relating to underage participants as well as their parents or other legal guardians.
This may include, in particular:
the child’s name and date of birth,
contact details of the legal guardians,
emergency contacts,
health information,
communication and support needs,
Authorisation to collect the child,
consent forms,
Details regarding the transfer of supervision,
consent for photographs and videos.
Contracts and legally relevant declarations are, as a rule, provided by the legal guardians, unless the minor is able to provide them validly themselves.
Consent to non-essential data processing, in particular the public use of photographs and videos, is obtained separately.
22. Participant lists and disclosure of contact details
For the purpose of organising accommodation, car-sharing arrangements, travel groups or joint activities, lists of participants or contact details may be shared with other participants.
Such disclosure shall only take place if:
it is necessary for the provision of an expressly requested joint service,
there is a legal basis for doing so, or
the data subject has given their explicit consent.
In particular, we will not publish or pass on telephone numbers or email addresses to other participants without consent.
Consent that has been given may be withdrawn at any time with effect for the future.
DeafVentures Business Suite
23. General information on the Business Suite
The DeafVentures Business Suite is our central application for managing and organising business processes.
The Business Suite provides the following functions in particular:
contact and customer management,
Participant management,
Event and course management,
travel management,
Booking and registration management,
Waiting lists,
Invitations,
Participant status and attendance,
Tasks and follow-ups,
Email communication,
Documents and templates,
Invoices and payment status,
Contracts and consents,
Media management,
OneDrive integration,
Photo, video and document uploads,
Video feedback,
Academy content,
Lessons and quizzes,
project and marketing workflows,
internal notes,
logging and security features.
The data processed depends on which features you use and your relationship with DeafVentures.
24. User accounts and login
A user account may be required for certain areas of the Business Suite, Academy or participant portals.
In this context, we process in particular:
Name,
email address,
user ID,
encrypted or hashed password,
role and permissions,
Date and time of registration,
time of last login,
failed login attempts,
security and session information,
technical log data.
Passwords are not stored in plain text.
Processing is carried out for the purpose of providing and securing the user account. The legal basis is Article 6(1)(b) of the GDPR, insofar as the account is necessary for the provision of an agreed service. Security and log data are also processed on the basis of Article 6(1)(f) of the GDPR.
25. Customer, contact and participant management
The Business Suite can be used to store data relating to prospective customers, customers, participants, accompanying persons, support staff, team members and cooperation partners.
This includes, in particular:
Master and contact data,
Booking and contract data,
event attendance,
communication history,
invoices and payments,
Documents and consents,
internal organisational notes,
special requests,
Communication and assistance requirements,
health data, where applicable.
The purpose is to process enquiries and to prepare, carry out and follow up on our services.
The legal basis is Article 6(1)(b), (c) and (f) of the GDPR. For special categories of personal data, Article 9 of the GDPR also applies.
Internal notes must be factual, limited to the purpose and necessary for the organisation. Judgemental, discriminatory or unnecessary information will not be stored.
26. Event management, waiting lists and invitations
The Business Suite supports the planning and organisation of events.
In particular, the following data may be processed:
Event and date,
participant status,
booking status,
Waiting list position,
Invitation status,
Acceptance or refusal,
Number of participants,
Accommodation and meals,
Payments and outstanding amounts,
Attendance history,
information sent,
individual organisational notes.
Invitation links or personalised form links may be assigned to a specific person or event. Such links must not be passed on to unauthorised persons.
Processing is carried out in accordance with Article 6(1)(b) of the GDPR or, in the case of purely organisational measures, on the basis of Article 6(1)(f) of the GDPR.
27. Email functions of the Business Suite
The Business Suite can be used to send personalised and automated emails. These include, for example:
registration confirmations,
booking confirmations,
invoices,
payment reminders,
event information,
invitations,
waiting list information,
Changes to dates,
travel documents,
Upload links,
feedback requests,
Academy news,
organisational reminders.
In particular, the following data is processed: email address, name, event, booking status, message text, time of dispatch, delivery status and, where applicable, error messages.
Transactional and event-related messages are sent on the basis of Article 6(1)(b) of the GDPR. General business communications may be based on Article 6(1)(f) of the GDPR.
Marketing emails are only sent if consent or another legal basis has been provided.
[[Falls Öffnungs- oder Klicktracking verwendet wird:]]
Where we track whether an email has been opened or a link clicked, this is done only after prior notification and, where necessary, on the basis of consent in accordance with Article 6(1)(a) of the GDPR.
[[Falls kein Tracking eingesetzt wird, den vorherigen Absatz löschen und stattdessen einsetzen: Wir verwenden in unseren E-Mails kein personenbezogenes Öffnungs- oder Klicktracking.]]
28. Invoices, payments and bookkeeping
In the Business Suite, invoices can be created, sent and managed.
In doing so, we process in particular:
Name or company name,
billing address,
email address,
services booked,
invoice amount,
Invoice number,
Invoice date,
payment terms,
payment status,
Bank or transaction references,
cancellations, credit notes and refunds.
Data is processed for the purpose of fulfilling the contract in accordance with Article 6(1)(b) of the GDPR and to comply with statutory accounting and record-keeping obligations in accordance with Article 6(1)(c) of the GDPR.
Data may be transferred to banks, payment service providers, tax advisers, accountancy service providers or tax authorities.
29. Documents, contracts and file uploads
Documents can be uploaded, created or managed via our website or Business Suite.
These may include:
registration forms,
contracts,
consent forms,
invoices,
travel documents,
proof of insurance,
powers of attorney,
Identity documents, where exceptionally required,
medical or organisational evidence,
photos and videos,
feedback files.
We only process documents that are necessary for the stated purpose. Please do not submit any additional sensitive information that is not required.
The legal basis depends on the purpose and is Article 6(1)(a), (b), (c) or (f) of the GDPR. If a document contains health data, Article 9 of the GDPR also applies.
30. Microsoft 365 and OneDrive
We use Microsoft 365 and Microsoft OneDrive to store, organise, back up and make files available.
The provider for customers in the European Economic Area is usually:
Microsoft Ireland Operations Limited
, Ireland
The following types of content, in particular, can be stored in OneDrive:
photos and videos,
participant feedback,
event media,
documents,
contracts,
invoices,
Templates,
marketing materials,
uploaded files,
internal project documents.
Depending on their function, files can be retrieved from OneDrive via the Microsoft Graph API, displayed in the Business Suite, included in emails or made available for embedding on the website.
In the Business Suite, technical file information such as drive identifier, file ID, file name, file type, storage location, size, thumbnail or access status may be stored for this purpose.
Depending on the content, processing is carried out on the basis of Article 6(1)(b), (c) or (f) of the GDPR. In the case of voluntarily uploaded media or publications, Article 6(1)(a) of the GDPR may apply.
Where Microsoft processes data on our behalf, this is done on the basis of a data processing agreement. Microsoft may also, in some cases, act under its own data protection responsibility with regard to certain diagnostic, security or account data.
Data transfers outside the European Economic Area may take place, depending on the service and configuration, on the basis of an adequacy decision, the EU-US Data Privacy Framework or standard contractual clauses.
31. Video feedback and media uploads
Participants may, where applicable, upload photos, videos, audio recordings or other feedback via a personal link. Depending on the device used, a recording may be made directly using a smartphone, tablet or webcam.
In particular, the following may be processed:
image and voice,
sign language and facial expressions,
Name or participant identification,
event,
feedback content,
recording date,
File name,
technical device and browser information,
IP address,
Upload time.
Photographs, videos and audio recordings constitute personal data. They are not considered biometric data solely on that basis. Biometric data within the meaning of Article 9 of the GDPR is present, in particular, where technical processes are used to uniquely identify a person. DeafVentures does not carry out such automatic biometric identification.
Uploading is voluntary. The legal basis for storage and internal analysis is Article 6(1)(a) of the GDPR.
Publication on our website, on social media, in advertisements, presentations, printed materials or other media takes place only to the extent that separate consent has been given.
Consent may be withdrawn at any time with effect for the future. Upon withdrawal, we will remove the content from the media under our control, provided there are no legal grounds preventing this. Materials that have already been printed cannot be recalled. In the event of further dissemination by third parties or search engines, complete deletion may not be guaranteed.
32. DeafVentures Academy, learning content and quizzes
The DeafVentures Academy may be used to provide educational videos, lessons, documents, quizzes and other training content.
In particular, the following may be processed:
User account,
courses booked or assigned,
lessons accessed,
progress made,
quiz questions and answers,
results,
completion status,
certificates,
Time and duration of use,
technical usage and error data.
Processing is carried out for the purpose of providing and delivering the booked or allocated learning programme in accordance with Article 6(1)(b) of the GDPR.
Security and functional data are processed on the basis of Article 6(1)(f) of the GDPR.
An automated assessment of quiz answers may take place. This assessment serves solely to display learning progress or results. As a general rule, no decision is made exclusively by automated means that produces legal effects concerning the data subject or significantly affects them in a comparable manner.
33. Project, task and marketing management
The Business Suite may include functions for managing projects, tasks, marketing materials, quotations, contracts, invoices, enquiries and approvals.
In particular, the following may be processed:
names and contact details of contact persons,
project assignments,
tasks and responsibilities,
internal comments,
message histories,
quotes and contracts,
files and drafts,
Approval status,
deadlines and follow-ups.
The processing serves the purposes of internal organisation and the conduct of our business activities. The legal bases are Article 6(1)(b) and (f) of the GDPR.
34. Logging, security and fault diagnosis
To ensure security and traceability, certain processes may be logged within the Business Suite.
These may include:
Logging in and out,
failed login attempts,
user ID,
IP address,
time of an action,
changes to data records,
sending of emails,
uploading or downloading of files,
technical errors,
security incidents.
Processing is carried out on the basis of Article 6(1)(f) of the GDPR. Our legitimate interest lies in securing the systems, troubleshooting and preventing unauthorised access.
Log data is deleted after [[30/90/180]] days, unless it is required for the investigation of a security incident or for the enforcement or defence against claims.
35. Data backups
We carry out regular data backups to ensure the availability and recoverability of our systems.
In doing so, personal data may temporarily remain in a backup copy even after it has been deleted from the active system. Backup copies are not used for operational purposes and are overwritten or deleted once the specified backup cycle has expired.
Processing is carried out on the basis of Article 6(1)(f) of the GDPR.
The current backup cycle is [[ANZAHL TAGE ODER MONATE]].
Communication
36. Contact via email and telephone
If you contact us by email or telephone, we process your contact details and the content of the communication.
This processing is carried out to deal with your enquiry. The legal basis is Article 6(1)(b) of the GDPR where a booking, a contract or pre-contractual measures are involved. For other business enquiries, the legal basis is Article 6(1)(f) of the GDPR.
Emails are processed via the following provider:
[[E-MAIL-PROVIDER, beispielsweise ALL-INKL.COM oder Microsoft 365]]
[[ANSCHRIFT UND LAND]]
37. WhatsApp, SMS and iMessage
We may offer communication via WhatsApp, SMS or iMessage.
In particular, the following data is processed during such communication:
Telephone number,
name or profile name,
Profile picture, if visible,
content and time of messages,
files sent,
Delivery and read status,
technical communication data.
WhatsApp is provided by companies within the Meta Group. When you use WhatsApp, it may, in particular, process telephone numbers, device information, communication metadata and other data under its own responsibility. Data may be transferred outside the European Economic Area.
We only use WhatsApp for event-related communication if you have expressly requested this or given your consent. Alternatively, you can contact us by email.
Confidential health information, identity documents or particularly sensitive documents should not be sent via messaging apps without being asked to do so.
The legal basis for communication required under a contract is Article 6(1)(b) of the GDPR. For voluntary communication via messaging apps, the legal basis is Article 6(1)(a) of the GDPR.
38. Newsletters and promotional communications
If you subscribe to our newsletter or other promotional information, we process in particular:
email address,
name (if applicable),
time of registration,
text of consent,
time of confirmation,
technical verification data,
interests or choice of event, where provided voluntarily.
Processing is carried out on the basis of your consent in accordance with Article 6(1)(a) of the GDPR.
We may use a double opt-in procedure for registration. You will receive an email in which you must confirm your registration. This procedure serves to verify that the email address provided is actually used by the person registering.
You may withdraw your consent at any time via the unsubscribe link in an email or by sending a message to [email protected].
After you unsubscribe, we may store your email address on a block list to ensure that no further marketing messages are sent. The legal basis for this is Article 6(1)(f) of the GDPR.
[[Newsletteranbieter eintragen oder Abschnitt anpassen:]]
We use the following for sending communications:
[[ANBIETER]]
[[ANSCHRIFT UND LAND]]
39. Advertising to existing customers
Where permitted by law, we may send customers information about our own similar offers.
You may object to the use of your contact details for marketing purposes at any time, without incurring any costs other than the transmission costs in accordance with standard rates.
Payment processing
40. Bank transfer
When you pay by bank transfer, we process the following in particular:
the account holder’s name,
IBAN or account details, where these are apparent from the payment transaction,
payment amount,
purpose of payment,
Booking or invoice number,
payment date.
The processing is carried out for the purpose of executing and allocating the payment in accordance with Article 6(1)(b) of the GDPR, as well as to fulfil statutory retention obligations in accordance with Article 6(1)(c) of the GDPR.
The banks involved process the payment data under their own responsibility in accordance with data protection law.
41. PayPal
We may offer payments via PayPal.
The provider is:
PayPal (Europe) S.à r.l. et Cie, S.C.A.
, 22–24 Boulevard Royal
, L-2449 Luxembourg
If you select PayPal, the data required for payment processing will be transmitted to PayPal. This may include, in particular, your name, email address, billing details, payment amount, order or booking number, device information and transaction data.
PayPal generally processes payment and account data under its own responsibility in accordance with data protection law. PayPal may use data for payment processing, fraud prevention, risk assessment, compliance with legal obligations and the administration of the PayPal account.
The legal basis for the transfer of data by us is Article 6(1)(b) of the GDPR.
External content and services
42. Google Fonts
Fonts from Google Fonts may be used on our website.
Where fonts are stored locally on our server, no connection to Google is established when the page is accessed.
[[Eine der beiden folgenden Varianten behalten:]]
Option A – locally embedded:
The Google fonts used on our website are hosted locally. Consequently, no connection is made to Google to retrieve the fonts when the website is accessed.
Option B – external retrieval:
When a font is retrieved externally, a connection to Google’s servers may be established. In particular, your IP address, browser information and the page you are viewing may be transmitted.
External retrieval only takes place with your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.
The provider for users in the European Economic Area is usually Google Ireland Limited, Ireland. Data may also be processed by Google LLC in the USA.
43. Google reCAPTCHA
We may use Google reCAPTCHA to protect forms from automated submissions, spam and misuse.
In particular, the following data may be processed:
IP address,
referrer address,
browser and device information,
mouse and keyboard movements,
time spent on the site,
existing Google cookies,
result of the abuse check.
The provider is Google Ireland Limited, Ireland. Data may also be transferred to Google LLC in the USA.
The service is only loaded with your consent. The legal basis is Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.
The website forms may not be usable, or may only be usable to a limited extent, if you do not authorise the service. In this case, you can alternatively contact us by email.
44. YouTube
Videos from the YouTube platform may be embedded on our website.
The provider for users in the European Economic Area is Google Ireland Limited, Ireland.
When an embedded video is loaded, the following data in particular may be transmitted to Google:
IP address,
page accessed,
browser and device information,
time of access,
interaction with the video,
existing Google or YouTube identifiers.
If you are logged into a Google account, Google may, where applicable, associate your usage with your account.
YouTube content is only loaded if you have given your consent. The legal basis for this is Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.
45. Google Maps
Maps from Google Maps may be embedded on our website.
The provider for users in the European Economic Area is Google Ireland Limited, Ireland.
When a map is loaded, the following data in particular may be processed: IP address, device information, location information, the page accessed and interactions with the map.
Google Maps is only loaded with your consent. The legal bases are Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.
46. Instagram and Facebook content
Our website may incorporate content, posts, feeds or buttons from Instagram or Facebook.
The provider is:
Meta Platforms Ireland Limited
, Merrion Road
, Dublin 4
, D04 X2K5
, Ireland
When such content is loaded, information such as your IP address, browser details, device information, the page you are visiting, cookies and interactions may be transmitted to Meta. This may also occur even if you do not have an account with Instagram or Facebook.
If you are logged in to a Meta service, Meta may, where applicable, associate your visit with your account.
The content is only loaded with your consent. The legal bases are Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.
47. Sourcebuster JS
WooCommerce may use Sourcebuster JS to store the origin of a website visit and to associate it with a subsequent order or booking.
In particular, information regarding the original source of the visit, the referring page, campaign parameters, the browser and the session may be processed.
Insofar as Sourcebuster is required solely for the technical attribution of a current order, the processing is based on Article 6(1)(f) of the GDPR and Section 25(2) of the TDDDG.
Where the information is used for further statistical, analytical or marketing purposes, processing takes place only with your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.
48. Statistical, analytical and marketing services
[[Diesen Abschnitt nur veröffentlichen, wenn tatsächlich entsprechende Dienste aktiv sind. Die derzeitige Cookie-Liste nennt unter anderem Mixpanel- und tk_ai-Kennungen, deren Ursprung geprüft werden muss.]]
With your consent, we may use statistical, analytical or marketing services to understand how our websites are used and how successful certain content or campaigns are.
In particular, the following data may be processed:
IP address,
pseudonymous user ID,
device and browser,
pages visited,
clicks and interactions,
referrer,
campaign parameters,
Duration of use,
approximate region,
repeat visits.
Processing takes place solely on the basis of your consent in accordance with Article 6(1)(a) of the GDPR and Section 25(1) of the TDDDG.
Service providers used:
[[ANALYSEANBIETER UND ANSCHRIFTEN EINTRAGEN]]
49. External links
Our website contains links to external websites and third-party services.
Simply displaying a link does not, as a rule, result in any data being transmitted to the linked provider. Only when you open the link is a connection established to the respective provider’s website.
The respective provider is generally responsible for data processing on external websites.
Social media
50. Social media presence
We maintain profiles on social networks and video platforms, in particular:
Instagram,
Facebook,
YouTube,
TikTok where applicable, and other platforms.
When you visit our profiles or interact with our content, both we and the relevant platform provider process personal data.
This may include:
profile name,
profile picture,
public profile information,
comments,
Likes and reactions,
Direct messages,
shared content,
reach and statistics data,
technical usage information.
We process your data to communicate with you, answer your questions, present our offers and analyse the use of our content.
The legal basis, depending on the specific process, is Article 6(1)(a), (b) or (f) of the GDPR.
Platform providers may process data for their own purposes, in particular for profiling, personalisation, advertising, analysis and security. We have only limited influence over such processing.
In the case of certain statistical functions, we and the platform provider may be jointly responsible for parts of the processing.
Photographs, videos and publications
51. Photographs and video recordings at events
Photographs and videos may be taken at our courses, camps, trips and events.
These recordings may serve the following purposes:
internal documentation,
souvenirs for participants,
reporting on events,
publication on our website,
publication on social media,
use in leaflets, brochures or presentations,
public relations,
Promotion of future events,
press and media relations.
We only publish portrait photographs, interviews, testimonials and promotional images on the basis of prior consent.
The legal basis is Article 6(1)(a) of the GDPR.
In the case of overview shots of a public event or photographs in which individual persons are not the main focus, processing may, in individual cases, be based on Article 6(1)(f) of the GDPR as well as the relevant provisions of media and copyright law. In doing so, we take into account the legitimate interests of the individuals depicted.
You can let us know before or during an event if you do not wish to be filmed.
52. Participant comments and testimonials
If you provide us with feedback, a review, a quote, a photograph or a video for publication, we will process the content you have shared.
In particular, your name, image, voice, sign language, the event and your review may be published.
Publication takes place solely on the basis of consent in accordance with Article 6(1)(a) of the GDPR.
You may withdraw your consent at any time with future effect.
Rights of data subjects
53. Right of access
You have the right to request information as to whether, and if so, which personal data we process about you.
54. Rectification
You have the right to have inaccurate data rectified and incomplete data completed.
55. Erasure
You may request the erasure of your personal data, provided that there are no statutory retention obligations or other legal grounds preventing such erasure.
56. Restriction of processing
Subject to the statutory conditions, you may request that the processing of your data be restricted.
57. Data portability
Provided the legal conditions are met, you may request that the data you have provided be supplied to you in a structured, commonly used and machine-readable format, or that this data be transferred to another data controller.
58. Withdrawal of consent
You may withdraw any consent you have given at any time with effect for the future.
The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.
59. Right to object
You have the right, on grounds relating to your particular situation, to object at any time to processing based on Article 6(1)(e) or (f) of the GDPR.
We will then no longer process the data in question, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims.
If personal data is processed for the purposes of direct marketing, you may object to such processing at any time without giving reasons. Following your objection, the data will no longer be used for direct marketing.
60. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority.
The supervisory authority responsible for our registered office is:
The State Commissioner for Data Protection and Freedom of Information, Mecklenburg-Western
Pomerania Schloss Schwerin
Lennéstraße 1
19053 Schwerin
Department:
Werderstraße 74a
19055 Schwerin
Telephone: +49 385 59494 0
Email: [email protected]
You may also contact another competent data protection supervisory authority.
61. Exercising your rights
To exercise your rights, you can contact us at the following address:
DeafVentures – Patrick Bauer, Pia Boni and Marie Kohlen GbR
Suhrendorf 10
18569 Ummanz
Email: [email protected]
To prevent unauthorised access to your data, we may require you to provide suitable proof of your identity.
Further mandatory information
62. Obligation to provide data
The provision of certain personal data is necessary for the conclusion or performance of a contract.
Without the necessary personal details, contact details, booking details, billing details or security details, we may not be able to process a registration, booking or participation.
Voluntary information and consents are marked as such. Failure to give voluntary consent generally has no effect on the ability to book a contractual service. This applies in particular to newsletters, consent to receive marketing communications and the publication of photos or videos.
Health or safety information may be required if safe participation cannot be guaranteed without this information. The processing of such data takes place only under the specific conditions set out in Article 9 of the GDPR.
63. Automated decision-making
As a general rule, we do not make any decisions based solely on automated processing that have legal effects on you or significantly affect you in a comparable manner.
Automatic calculations, reminders, status updates, waiting list functions or quiz assessments serve solely to support our organisational processes.
64. Changes to this Privacy Policy
We may amend this privacy policy if our services, systems, service providers or legal requirements change.
The version published on our website at any given time shall apply.
Date of this Privacy Policy: 31 July 2026.