Kompakte Nutzungsbedingungen für die GxP Events Event-App

1. Anbieter

Concept Heidelberg GmbH

Rischerstraße 8, 69123 Heidelberg, Deutschland

E-Mail: info@concept-heidelberg.de

Vertreten durch den Geschäftsführer Oliver Schmidt

Telefon: +49 6221 84 44-0

Registergericht: Amtsgericht Mannheim

Handelsregisternummer: HRB 705125

Umsatzsteuer-Identifikationsnummer: DE143455811

Diese Nutzungsbedingungen gelten für die mobile Event-App „GxP Events“.

2. Geltung und Zustimmung

Mit der Installation, Aktivierung oder Nutzung der App erkennen Sie diese Nutzungsbedingungen an. Die Nutzungsbedingungen werden Ihnen vor Beginn der Nutzung angezeigt und sind jederzeit innerhalb der App unter „Rechtliches“ abrufbar und speicherbar. Sie sind ohne Registrierung abrufbar und können innerhalb der App dauerhaft aufgerufen und gespeichert werden.

3. Freiwillige Nutzung

Die Nutzung der App ist freiwillig.

Die Teilnahme an unseren Veranstaltungen ist auch ohne App möglich.

Die App können Sie grundsätzlich ohne Profil nutzen. Für personalisierte Funktionen wie das Merken von Programmpunkten oder Push-Benachrichtigungen ist ein Profil beziehungsweise eine Aktivierung durch Sie erforderlich.

3a. Meine Agenda: Die persönliche Agenda ist eine optionale Zusatzfunktion für registrierte Teilnehmer. Die ausgewählten Vorträge werden ausschließlich lokal auf dem verwendeten Endgerät gespeichert und nicht an uns übermittelt.

4. Zweck und Funktionen der App

Die App unterstützt Sie bei der Teilnahme an Veranstaltungen von Concept Heidelberg, insbesondere durch:

· Anzeige von Programm, Referenten und Zeiten,

· persönliche Planung von Programmpunkten,

· freiwillige Push-Benachrichtigungen,

· freiwillige Profilangaben,

· freiwillige Bewertungen von Vorträgen (Slido/Cisco).

Die App dient nicht der Zahlungsabwicklung oder dem Abschluss von Verträgen.

Voraussetzungen

Für die Nutzung benötigen Sie ein kompatibles Endgerät mit einer unterstützten Betriebssystemversion sowie eine Internetverbindung. Die Kosten der Datenverbindung tragen Sie selbst. Wir schulden keine Anpassung der App an jede Geräte- oder Betriebssystemvariante.

Push-Benachrichtigungen sind freiwillig und werden nur versendet, wenn Sie diese aktivieren. Sie dienen ausschließlich Veranstaltungsinformationen und organisatorischen Hinweisen. Sie können Push-Benachrichtigungen jederzeit in den App- oder Geräteeinstellungen deaktivieren.

5. Nutzerkonto und Profil

Die App kann grundsätzlich ohne Profil genutzt werden. Für einzelne personalisierte Funktionen kann ein Nutzerkonto erforderlich sein. Die hierfür erforderlichen Angaben sind wahrheitsgemäß zu machen. Freiwillige Profilangaben können jederzeit geändert oder gelöscht werden. Welche Profilangaben freiwillig sind und ob sie anderen Veranstaltungsteilnehmern angezeigt werden, wird in der jeweiligen App-Funktion kenntlich gemacht. Zugangsdaten sind vertraulich zu behandeln. Bei Anzeichen eines Missbrauchs ist Concept Heidelberg unverzüglich zu informieren. Sie können Ihr Profil in der App löschen, sofern hierfür eine entsprechende Funktion vorhanden ist. Andernfalls können Sie die Löschung Ihres Profils unter info@concept-heidelberg.de beantragen. Was nach Ende der Veranstaltung mit dem Profil und den damit verbundenen Daten geschieht, richtet sich nach den Datenschutzhinweisen.

6. Nutzungsrecht an der App

Wir räumen Ihnen für die Dauer der Nutzung ein einfaches, nicht übertragbares und widerrufliches Recht ein, die App auf Ihren Endgeräten zu installieren und für die vorgesehenen Veranstaltungszwecke zu nutzen. Ein Anspruch auf Überlassung des Quellcodes besteht nicht. Eine Bearbeitung, Dekompilierung oder Vervielfältigung der App ist nur in den gesetzlich zwingend erlaubten Fällen zulässig.

7. Zulässige Nutzung

Sie dürfen die App nur im Rahmen der Veranstaltungsteilnahme nutzen und insbesondere:

· keine rechtswidrigen, beleidigenden oder diskriminierenden Inhalte eingeben,

· keine Rechte Dritter (z. B. Urheber-, Persönlichkeitsrechte) verletzen,

· keine technischen Maßnahmen zur Sicherung der App umgehen oder die App stören.

· keinen automatisierten Zugriff oder Scraping durchführen,

· Zugangsdaten nicht an Dritte weitergeben,

· keine personenbezogenen Daten Dritter veröffentlichen,

· externe Links oder Funktionen nicht missbräuchlich nutzen,

· die App oder ihre Infrastruktur nicht beeinträchtigen.

Bei einem Verstoß gegen diese Nutzungsbedingungen können wir einzelne Funktionen sperren oder die Nutzung der App untersagen. Wir berücksichtigen dabei Ihre berechtigten Interessen und weisen Sie vorher auf den Verstoß hin, soweit dies nach den Umständen möglich und zumutbar ist. Bei schwerwiegenden Verstößen können wir sofort sperren.

8. Inhalte, Rechte und externe Links

Die App enthält insbesondere Veranstaltungsprogramme, Referentenangaben, Zeiten, Informationen, Präsentationsinhalte und externe Links. Diese Inhalte werden nach Möglichkeit sorgfältig erstellt und aktualisiert. Änderungen, Irrtümer und kurzfristige Anpassungen bleiben vorbehalten.

Die in der App bereitgestellten Inhalte und Gestaltungselemente, insbesondere Programminformationen, Vortragsunterlagen und Präsentationen, sind urheberrechtlich oder anderweitig geschützt. Sie dürfen ausschließlich für Ihre eigene Vor- und Nachbereitung der Veranstaltung und im Rahmen der bestimmungsgemäßen Nutzung der App verwendet werden. Eine Vervielfältigung, Weitergabe an Dritte, öffentliche Zugänglichmachung oder gewerbliche Verwertung ist ohne vorherige schriftliche Zustimmung nicht gestattet. Das Anfertigen von Bildschirmaufnahmen zur Weitergabe ist untersagt.

Externe Links können auf Inhalte Dritter verweisen. Für deren Inhalte und Verfügbarkeit ist der jeweilige Anbieter verantwortlich.

9. Bewertungen und Slido/Cisco

Bewertungen von Vorträgen können über den eingebundenen Dienst Slido abgegeben werden. Slido wird von Cisco Systems, Inc. bereitgestellt und kann in einem eingebetteten Fenster angezeigt werden. Die Nutzung ist freiwillig. Einzelheiten zur Verarbeitung personenbezogener Daten ergeben sich aus den Datenschutzhinweisen der App und gegebenenfalls den Datenschutzhinweisen von Slido/Cisco. Concept Heidelberg erhält die Ergebnisse ausschließlich in zusammengefasster Form und ohne Zuordnung zu einzelnen Personen.

Für Inhalte, die Sie selbst in der App eingeben, insbesondere Profilangaben, ein Profilbild oder Bewertungen, räumen Sie uns das Recht ein, diese ausschließlich im Rahmen der jeweiligen App-Funktion und für die Dauer der Nutzung zu verarbeiten und anzuzeigen. Eine weitergehende Nutzung, insbesondere zu Werbezwecken, findet nicht statt. Sie bleiben für die von Ihnen eingegebenen Inhalte verantwortlich und stellen sicher, dass Sie über die erforderlichen Rechte verfügen.

10. Verfügbarkeit, Updates und Änderungen

Wir bemühen uns um eine stabile Bereitstellung der App, können aber keine jederzeitige Verfügbarkeit garantieren.

Wartungen, technische Störungen und Ausfälle von Drittanbietern können die Nutzung vorübergehend beeinträchtigen.

Funktionen können aus technischen, organisatorischen oder rechtlichen Gründen geändert, ergänzt oder eingestellt werden.

Über wesentliche Änderungen dieser Nutzungsbedingungen werden Nutzer in geeigneter Weise informiert. Änderungen der Verarbeitung personenbezogener Daten werden in den Datenschutzhinweisen berücksichtigt.

Wir können diese Nutzungsbedingungen ändern, wenn dies aufgrund geänderter Funktionen, technischer Entwicklungen oder rechtlicher Anforderungen erforderlich ist. Über wesentliche Änderungen informieren wir Sie beim nächsten Start der App. Widersprechen Sie den geänderten Bedingungen, können Sie die Nutzung beenden und durch eine Mail an info@concept-heidelberg.de die Lösung Ihres Profils beantragen.

11. Datenschutz

Für die Verarbeitung personenbezogener Daten in der App gelten die gesonderten Datenschutzhinweise für die GxP Events Event-App, abrufbar direkt in der App und über die Veranstaltungswebseite.

Bitte lesen Sie diese Hinweise sorgfältig.

12. Beendigung und Löschung

Die App und einzelne Funktionen können insbesondere nach dem Ende einer Veranstaltung deaktiviert oder eingestellt werden. Sie können die Nutzung jederzeit beenden, die App deinstallieren und – soweit vorhanden – Ihr App-Profil löschen. Die Verarbeitung und Löschung personenbezogener Daten richtet sich nach den Datenschutzhinweisen. Gesetzliche Ansprüche bleiben unberührt.

13. Anwendbares Recht

Es gilt das Recht der Bundesrepublik Deutschland. Soweit gesetzlich zulässig, ist Gerichtsstand der Sitz der Concept Heidelberg GmbH.

14. Stand und Version

Stand: 15. September 2026

Version: 1.0

Concise Terms of Use for the GxP Events Event App

1. Provider

Concept Heidelberg GmbH

Rischerstraße 8, 69123 Heidelberg, Germany

Email: info@concept-heidelberg.de

Represented by: Oliver Schmidt

Telephone: +49 6221 84 44-0

Commercial Register: HRB 705125

Register Court: Mannheim Local Court

VAT identification number: DE143455811

These Terms of Use apply to the mobile event app “GxP Events”.

2. Scope and Acceptance

By installing, activating or using the App, you accept these Terms of Use. The Terms of Use are displayed to you before you start using the App and are available at any time within the App under “Legal” for access and saving. They can be accessed without registration and can be permanently accessed and saved within the App. If a checkbox is used, it must expressly link to these Terms of Use. Participation in Concept Heidelberg events is independent of use of the App.

3. Voluntary Use

Use of the App is voluntary.

Participation in our events is also possible without the App.

You can generally use the App without a profile. A profile or activation by you is required for personalised functions such as saving agenda items or receiving push notifications.

3a. My Agenda: The personal agenda is an optional additional feature for registered participants. The selected sessions are stored exclusively on the device being used and are not transmitted to us.

4. Purpose and Functions of the App

The App supports you in participating in events organised by Concept Heidelberg, in particular through:

· Display of the programme, speakers and times,

· Personal planning of agenda items,

· Voluntary push notifications,

· Voluntary profile information,

· Voluntary ratings of presentations (Slido/Cisco).

The App is not used for payment processing or the conclusion of contracts.

Requirements

To use the App, you need a compatible device with a supported operating system version and an internet connection. You bear the costs of the data connection yourself. We do not owe adaptation of the App to every device or operating system variant.

Push notifications are voluntary and are only sent if you activate them. They serve exclusively to provide event information and organisational notices. You can deactivate push notifications at any time in the App or device settings.

5. User Account and Profile

The App can generally be used without a profile. A user account may be required for individual personalised functions. The information required for this purpose must be provided truthfully. Voluntary profile information can be changed or deleted at any time. Which profile information is voluntary and whether it is displayed to other event participants is indicated in the respective App function. Login details must be kept confidential. If there are indications of misuse, Concept Heidelberg must be informed without undue delay. You can delete your profile in the App if a corresponding function is available. Otherwise, you can request deletion by contacting info@concept-heidelberg.de. What happens to the profile and related data after the end of the event is governed by the data protection notices.

6. Right to Use the App

For the duration of use, we grant you a simple, non-transferable and revocable right to install the App on your devices and use it for the intended event purposes. There is no entitlement to the source code. Editing, decompiling or reproducing the App is only permitted where legally mandatory.

7. Permitted Use

You may use the App only in connection with participation in the event and, in particular:

·  do not enter any unlawful, insulting or discriminatory content,

·  do not infringe any rights of third parties (e.g. copyrights or personal rights),

·  do not circumvent any technical measures securing the App or disrupt the App.

·  do not carry out scraping or automated access,

·  do not pass on login details to third parties,

·  do not publish personal data of third parties,

·  do not misuse external links or functions,

·  do not impair the App or its infrastructure.

In the event of a breach of these Terms of Use, we may block individual functions or prohibit use of the App. We will take your legitimate interests into account and notify you of the breach in advance insofar as this is possible and reasonable in the circumstances. In the event of serious breaches, we may block access immediately.

8. Content, Rights and External Links

The App contains, in particular, event programmes, speaker details, times, information, presentation content and external links. These contents are prepared and updated with due care wherever possible. Changes, errors and short-notice adjustments remain reserved.

The content and design elements provided in the App, in particular programme information, presentation materials and presentations, are protected by copyright or otherwise protected. You may use them exclusively for your own preparation and follow-up of the event and within the scope of the intended use of the App. Reproduction, disclosure to third parties, making available to the public or commercial exploitation is not permitted without our prior written consent. Making screenshots for distribution is prohibited.

External links may refer to third-party content. The respective provider is responsible for the content and availability of such third-party content.

9. Ratings and Slido/Cisco

You may submit ratings of presentations via the integrated Slido service. Slido is provided by Cisco Systems, Inc. and may be displayed in an embedded window. Participation is voluntary. Details of the processing of personal data are set out in the App’s data protection notices and, where applicable, Slido/Cisco’s data protection notices. Concept Heidelberg receives the results exclusively in summarised form and without attribution to individual persons.

For content that you enter yourself in the App, in particular profile information, a profile picture or ratings, you grant us the right to process and display it exclusively within the respective App function and for the duration of use. No further use, in particular for advertising purposes, takes place. You remain responsible for the content you enter and ensure that you have the necessary rights.

10. Availability, Updates and Changes

We endeavour to provide the App reliably, but cannot guarantee availability at all times.

Maintenance, technical faults and outages of third-party providers may temporarily impair use.

Functions may be changed, supplemented or discontinued for technical, organisational or legal reasons.

Users will be informed in an appropriate manner about material changes to these Terms of Use. Changes to the processing of personal data will be reflected in the data protection notices.

We may amend these Terms of Use where this is necessary due to changed functions, technical developments or legal requirements. We will inform you of material changes when you next start the App. If you object to the amended terms and conditions, you may terminate your use of the service and request the deletion of your profile by sending an email to info@concept-heidelberg.de.

11. Data Protection

The separate data protection notices for the GxP Events event app apply to the processing of personal data in the App and are available directly in the App and via the event website.

Please read these notices carefully.

12. Termination and Deletion

The App and individual functions may be deactivated or discontinued, in particular after the end of an event. You may terminate use at any time, uninstall the App and, where available, delete your App profile. The processing and deletion of personal data is governed by the data protection notices. Statutory claims remain unaffected.

13. Applicable Law

The law of the Federal Republic of Germany shall apply. To the extent permitted by law, the place of jurisdiction shall be the registered office of Concept Heidelberg GmbH.

14. Status and Version

Status: 15 September 2026

Version: 1.0

Privacy Policy for the GxP Events Event App

1. Controller

The controller responsible for the processing of personal data in connection with the Event App is:

Concept Heidelberg GmbH Rischerstraße 8 69123 Heidelberg Germany

E-mail: info@concept-heidelberg.de

Data Protection Officer: Mr Detlef Benesch E-mail: datenschutz@concept-heidelberg.de

AppYourself GmbH is responsible for the technical development and submission of the app to the app stores on behalf of Concept Heidelberg GmbH. Concept Heidelberg GmbH is responsible for the app's content and compliance with data protection laws.

2. Voluntary Use of the App and Access without a User Account

Use of the Event App is voluntary. Participation in an event is also possible without using the Event App. If you do not provide the required information, you will not be able to use the respective personalised function. This does not affect your participation in the event.

The App can generally be used without a user account and without providing personal data, provided that the function accessed does not require a user account.

Personal data may be required for personalised functions, in particular for managing a profile, assigning you to selected events, and receiving push notifications. Which information is required or voluntary is indicated in the respective input form or during onboarding.

Providing an e-mail address and a name is only required if this is necessary for the desired function, user account management, or communication in connection with the event. Providing the company is generally voluntary unless it is required for an event function expressly explained in the individual case.

3. What Data Are Processed

Depending on how the App is used and which functions are activated, the following data may be processed:

Profile Data

Name, e-mail address, and voluntary information such as role or status at the event, for example participant, speaker, or visitor. Voluntary profile fields are marked as such. All profile data are entered into the App exclusively by you. No automatic transfer from the booking system takes place.

Event and Usage Data

Selected event or events, participation information, saved programme items, and other data that users enter themselves within activated App functions, such as ratings or contact forms.

Technical Data

IP address, time and technical information about the device used, in particular device type, operating system, browser or App version, device language, time zone, and technical identifiers, insofar as these are required for operation, security, or the assignment of a push service.

Push and Device Data

When push notifications are activated, a push token, device assignment, device model, operating system and App version, application key or package name, as well as data relating to dispatch and delivery may in particular be processed. No user data or user IDs from the App profile are transmitted to the push service.

Error and Log Data

For technical security, error analysis, and troubleshooting, error reports, stack traces, timestamps, operating system, browser and App version, device information, the URI of the affected App page, technical HTTP requests, and the IP address may be processed. Content entered by users is processed only insofar as this is actually necessary for technical error analysis. AppYourself uses Sentry exclusively as an internal technical monitoring and error analysis tool. No personal data from the customer App or its users are transmitted to Sentry. The error and diagnostic data are processed exclusively within the infrastructure operated by AppYourself. Sentry is therefore not used as a sub-processor for processing the customer’s personal data.

Location Data

According to the current configuration, the Event App is not designed for continuous location determination. Location data are not processed unless a specific function described in the individual case requests the corresponding permission and the data subject activates it.

3.1 Contact Form

If you send us enquiries via the contact form, we store the information you provide in the enquiry form, including the contact details you enter there, for the purpose of processing the enquiry and in the event of follow-up questions. We do not pass on this data without your consent.

This data is processed on the basis of Art. 6 para. 1 lit. b GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively processing the enquiries addressed to us (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR), if this was requested; consent may be withdrawn at any time.

The data you enter in the contact form will remain with us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. after your enquiry has been processed, at the latest after 6 months). Mandatory statutory provisions—in particular retention periods—remain unaffected.

4. Purposes and Legal Bases of Processing

Provision and Use of the Event App

Account, profile, event, and usage data are processed to provide the requested App functions, assign you to selected events, and perform the respective event services. The legal basis is Article 6 para. 1 lit. b GDPR insofar as processing is necessary for the use of the expressly requested function; otherwise, Article 6 para. 1 lit. f GDPR applies on the basis of our legitimate interest in a functioning and secure Event App.

Voluntary Profile Information

Voluntary information such as role, status, or photograph is processed only if the person concerned provides this information themselves and uses the respective function. The legal basis is generally consent pursuant to Article 6 para. 1 lit. a GDPR. Your profile data are visible exclusively to you and are not shown to other participants.

Push Notifications

Push notifications are voluntary. They are activated only if the data subject actively permits this during onboarding or in the App settings. The push and device data required for dispatch are processed for this purpose. The legal basis is consent pursuant to Article 6 para. 1 lit. a GDPR.

Consent can be withdrawn at any time in the App settings and via the operating system settings. Refusal or subsequent deactivation does not prevent the continued voluntary use of the App. During registration, participants can select the event for which they wish to receive push notifications. We use this selection exclusively to ensure that notifications are sent only for the event in which the data subject is actually participating.

Push notifications are sent only if participants have activated this function in the settings. If the push notification function is deactivated, no push notifications are sent—even if one or more events have been selected.

Operation, Security, and Error Analysis

Technical data, error reports, and security logs are processed to provide the App, detect security incidents, analyse errors, and improve stability. The legal basis is Article 6 para. 1 lit. f GDPR on the basis of our legitimate interest in secure and reliable operation.

Legal Obligations and Legal Defence

Insofar as processing is necessary to fulfil statutory retention or documentation obligations, it is carried out on the basis of Article 6 para. 1 lit. c GDPR. Article 6 para. 1 lit. f GDPR may be relevant for the assertion, exercise, or defence of legal claims.

5. Service Providers and Recipients Used

The following service providers or categories of service providers are used for operation, hosting, push dispatch, and technical support.

AppYourself GmbH

AppYourself GmbH, Karl-Wiechert-Allee 10, 30625 Hannover, Germany, provides the platform for the Event App and processes data as a processor pursuant to Article 28 GDPR. In particular, profile, event, usage, and technical data are processed insofar as this is required for platform operation.

Amazon Web Services (AWS)

Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, provides hosting and infrastructure services for the platform and processes the data as a processor pursuant to Art. 28 GDPR. The processing location is Frankfurt am Main, Germany.

Google or Firebase Services

Firebase services provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, are used for backend, database, and storage services as a processor pursuant to Art. 28 GDPR. The processing location is Frankfurt am Main, Germany. Technical usage, connection, and metadata are processed, in particular IP address, user agent, SDK and operating system versions, API calls, request volume, latencies, error rates, and infrastructure metadata. Google does not use the stored user data for its own purposes. Cloud Firestore, Cloud Storage, Firebase Extensions, and Cloud Functions are used. These can be evidenced in writing.

Pushwoosh

Pushwoosh, Inc. is used to send voluntarily activated push notifications. In particular, push tokens, device and technical platform data, as well as data relating to device assignment and dispatch, are processed for this purpose. The device data are stored in Germany; however, access from a third country, in particular by the US company or its service providers, cannot be ruled out in general. Dispatch takes place via Pushwoosh. Pushwoosh Inc. is certified under the EU-U.S. Data Privacy Framework (DPF) for Non-HR Data. Only Non-HR Data are processed; in particular, no personal data of employees in the HR context. You can view the current entry in the DPF register via the official DPF website. (07.09.2026)

A residual risk remains, which is mitigated by encryption, data minimisation, and 90-day periods. Provider: Pushwoosh Inc. 1875 I St, NW, Office 513 Washington, DC 20006 United States, with processing locations in Nuremberg and Frankfurt. Processing is carried out as commissioned processing pursuant to Article 28 GDPR.

Slido (Cisco Systems, Inc.)

The “Slido” service may be integrated into the Event App for rating presentations. The integration takes place via an embedded window (iframe).

When you access the rating function and submit a rating, your entries are transmitted to Slido. We see your rating only in aggregated form and without attribution to individual persons; in particular, we do not see names, e-mail addresses, or user identifiers.

Slido is provided by Cisco Systems, Inc., 170 West Tasman Drive, San Jose, CA 95134, USA. For the technical operation of the rating function, Cisco processes, as our processor pursuant to Article 28 GDPR, in particular the IP address, device and connection data, and the ratings submitted. Processing is based on a data processing agreement with Cisco.

Where personal data are transferred to the USA in this context, Cisco states that it relies on the EU-U.S. Data Privacy Framework (DPF) and appropriate safeguards pursuant to Article 46 GDPR for these transfers. Technical and organisational measures such as encryption and data minimisation provide additional safeguards. Cisco Systems, Inc. is certified under the EU-U.S. Data Privacy Framework (DPF) for Non-HR Data. We last checked the current entry in the DPF register on 07.09.2026. Only Non-HR Data are processed; in particular, no personal data of employees in the HR context.

Use of Slido is voluntary. The legal basis for loading the Slido window and the associated processing of your IP address, device and connection data, and your rating is your consent pursuant to Article 6 para. 1 lit. a GDPR, which you provide by accessing the rating function. You can use the Event App fully without participating in the ratings.

IONOS SE

Elgendorfer Straße 57, 56410 Montabaur, Germany, provides the web presentation of the presentations as a hosting service provider and processes, in particular, technical and usage data for delivering the content and ensuring stability and security. As Concept Heidelberg provides this website, the processing is carried out as commissioned processing pursuant to Article 28 GDPR with Concept Heidelberg.

6. Transfers to Third Countries

The data from the Event App are stored and processed on servers in Germany. In the following cases, access from a third country, in particular a transfer to the USA within the framework of DPF certification, cannot be ruled out. Only Non-HR Data are processed; the remaining residual risk is reduced by encryption and data minimisation:

- Pushwoosh Inc., USA: We rely on the DPF certification and supplementary technical and organisational measures (encryption, data minimisation, 90-day deletion periods) for this transfer.

- Cisco Systems, Inc., USA (Slido): We rely on the DPF certification and supplementary technical and organisational measures (encryption, data minimisation) for this transfer.

7. Storage Period and Deletion

Personal data are deleted or anonymised as soon as the respective purpose no longer applies and there are no statutory retention obligations or legitimate reasons for longer storage.

Profile data are deleted no later than 90 days after the end of the last event you selected, unless you delete the profile yourself beforehand and insofar as no statutory retention obligations prevent this.

Push tokens and associated device data are stored for as long as the push service is activated and the token is valid. Inactive device data are deleted no later than after 90 days.

Error reports, crash reports, and technical operational and security logs are generally deleted no later than after 90 days, unless longer storage is exceptionally necessary to investigate a specific security incident or due to statutory obligations.

Production user data are deleted from the production system when a deletion action is carried out or when the relevant contractual or App purpose ends. User data backups are used exclusively for restoration and are deleted on a rolling basis with a maximum remaining term of 90 days. Infrastructure backups without user data are deleted on a rolling basis every 30 days. After a restoration, the regular deletion rules are reapplied promptly.

Evidence of consent granted, in particular for activating push notifications, is stored for the duration of the consent and subsequently for three years to demonstrate lawfulness.

8. Technical Storage, Device Permissions, and Tracking

According to the current configuration, the native Event App does not use any non-essential analytics or advertising tracker. Firebase Analytics is disabled. Additional analytics, tracking, or advertising functions are not activated without prior review and, where required, consent.

Technical storage and device permissions may be used insofar as they are required for operating the App, logging in, security, or a function activated by the data subject. This includes, in particular, permissions for push notifications. Permissions can be managed and withdrawn via the App or operating system settings.

Functions that are not required, such as Google Maps, PayPal, payment processing within the App, social networks, interest-based advertising, continuous geolocation, and general web tracking functions, are not part of these Event App privacy notices. If any of these functions is activated in the future, the privacy notices will be amended before use and App users will be informed about the purposes, legal bases, and data categories.

8a. Personal Agenda / Local Storage

When using the “My Agenda” feature, the sessions selected by you are stored exclusively on your device in your web browser’s local storage. No personal data such as your name, email address, or contact details are collected for this purpose.

Your selected sessions are not transmitted to us or to any server and are not analyzed by us. The local storage is used solely to display your personal session selection when you continue using the feature on the same device and/or in the same browser.

You can change or delete your saved selection at any time using the corresponding function within the application. In addition, the locally stored data can be removed through your browser settings by deleting the website data.

Please note that, independently of this feature, technically necessary data, in particular your IP address and other connection data, may be processed by the respective website operator or hosting provider when you access the website. The provisions of this Privacy Policy apply to such processing.

9. External Content and Websites

The App may link to external websites or content or display such content in an embedded area. These App privacy notices do not apply to such external websites; only the privacy policies published there apply.

Websites linked in the Event App:

www.gmp-navigator.com

www.gmp-compliance.org

10. Rights of Data Subjects

Within the scope of the statutory requirements, data subjects have the right of access, rectification, erasure, restriction of processing, data portability, and objection. Consent that has been granted may be withdrawn at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

Requests to exercise these rights may be sent to datenschutz@concept-heidelberg.de or to the address stated above. Where necessary, we coordinate the processing with AppYourself and other processors used. Requests are generally answered within one month; an extension is possible only under the statutory conditions.

In addition, you have the right to lodge a complaint with a data protection supervisory authority. The competent supervisory authority for Concept Heidelberg GmbH is generally the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg, Postfach 10 29 32, 70025 Stuttgart, e-mail: poststelle@lfdi.bwl.de, https://www.baden-wuerttemberg.datenschutz.de/.

11. Automated Decision-Making

No automated decision-making, including profiling within the meaning of Article 22 GDPR, takes place in connection with the Event App.

12. Changes to These Privacy Notices

We may amend these privacy notices if the App functions, the service providers used, or the legal requirements change. The current version is published in the App. The version stated at the end of these privacy notices is authoritative.

13. Download via the App Stores

Apple or Google are independently responsible for downloading the Event App from the Apple App Store or Google Play. We have no influence over the processing carried out there, such as the processing of user account and download data. The privacy notices of the respective provider apply.

Version date: 31.08.2026

Version: 1.1

Validity for the “GxP Events” Event App

Für die in der GxP-Events-App bereitgestellten Texte, Präsentationen, Bilder, Grafiken, Logos und sonstigen Inhalte gelten die Hinweise zu Urheberrecht und Bildnachweisen der Concept Heidelberg GmbH. Diese Hinweise können Sie hier einsehen./The copyright notices and image credits provided by Concept Heidelberg GmbH apply to the texts, presentations, images, graphics, logos, and other content made available in the GxP Events app. You can view these notices here.

Urheberrecht & Bildernachweise - GMP Navigator

Wir sind nicht bereit oder verpflichtet, an Streitbeilegungsverfahren vor einer Verbraucherschlichtungsstelle teilzunehmen./We are neither willing nor obligated to participate in dispute resolution proceedings before a consumer arbitration board.