Privacy Policy

The controller responsible for processing personal data is:

Workplace Ninja Germany UG (haftungsbeschränkt)
Winterhuder Weg 29
22085 Hamburg
Germany
Email: hello@wpninjas-germany.com

For any questions about data protection or to exercise your rights, contact us at the email address above.

This policy explains how we process personal data when you visit this website, buy a ticket for or attend a Workplace Ninja Germany event, use the event agenda, or submit a talk as a speaker. It applies to the Workplace Ninja Germany conference and to related community events we organize.

Hosting and server logs

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, United States. When you open a page, your browser automatically sends technical data that is processed in server logs: your IP address, the date and time of the request, the page requested, the referring URL, and your browser and operating system.

We use this data only to deliver the website and to keep it secure and stable. The legal basis is our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR). Vercel processes the data on our behalf under a data processing agreement. Vercel is certified under the EU-U.S. Data Privacy Framework, which provides an adequate level of protection for transfers to the United States (Art. 45 GDPR). Log data is kept only for a short period and then deleted.

No cookies or tracking

This website does not use cookies, analytics or tracking tools. Fonts are served from our own server, so no connection to third-party font providers is made.

External links

This website links to external websites, such as LinkedIn, sponsor websites and our ticket shop. No data is sent to these providers until you click a link. Once you leave our website, the privacy policy of the respective provider applies.

When you contact us by email, we process your email address, your name and the content of your message to answer your request. The legal basis is Art. 6(1)(b) GDPR where your request relates to a contract, such as a ticket or a sponsorship, and otherwise our legitimate interest in answering inquiries (Art. 6(1)(f) GDPR). We delete the correspondence once your request has been dealt with, unless statutory retention periods apply.

Tickets are sold through Sched, operated by Sched LLC, 8605 Santa Monica Blvd #69687, Los Angeles, CA 90069, United States. Sched processes the registration data on our behalf and is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

When you register, we process:

• First and last name, email address, company and job title
• Billing address and invoice details
• Ticket type, order details and check-in status
• Any further answers you give in the registration form

We use this data to process your order, issue your ticket and invoice, check you in at the venue, print your name badge and send you information about the event you registered for. The legal basis is the performance of the ticket contract (Art. 6(1)(b) GDPR) and, for invoices, our legal obligations under German commercial and tax law (Art. 6(1)(c) GDPR).

Payment

Payments are processed by Stripe. Stripe processes payment data on our behalf and, for its own purposes such as fraud prevention and meeting legal requirements, under its own responsibility. We do not receive or store your full card or account details. If you pay with Apple Pay or Klarna, those providers also process your data under their own responsibility. For details, see the Stripe privacy policy.

Our events are financed largely by sponsors, which keeps ticket prices low. For this reason, sharing attendee data with our sponsors is part of every ticket. When you buy a ticket, you agree to this by ticking the corresponding checkbox at checkout.

We share the following data with the sponsors of the event you registered for:

• Name
• Company
• Job title
• Email address

The sponsors are listed on this website and in the event information. They may use this data to contact you about their products and services. Each sponsor becomes an independent controller for the data it receives and is responsible for its own processing under its own privacy policy. You can object to marketing from a sponsor at any time directly with that sponsor, for example by using the unsubscribe link in its emails.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with effect for the future by emailing hello@wpninjas-germany.com. Withdrawing does not cancel or change your ticket. From then on, we will not share your data with any sponsor. Sharing that took place before your withdrawal remains lawful. If a sponsor has already received your data, we will inform that sponsor of your withdrawal, so that it stops processing your data on the basis of your consent and deletes it unless it has another legal basis. You can also contact a sponsor directly to object to marketing or to request deletion (Art. 17 and 21 GDPR).

Some sponsors are based outside the European Union, for example in the United States. Where the European Commission has decided that a country, or a certified company under the EU-U.S. Data Privacy Framework, offers an adequate level of protection, the transfer is based on that decision (Art. 45 GDPR). Otherwise, it is based on your explicit consent at checkout (Art. 49(1)(a) GDPR). Please note that such countries may not offer a level of data protection equivalent to the EU, and public authorities there may be able to access the data.

Badge scanning at sponsor booths

Sponsors may offer to scan your name badge at their booth. Scanning is voluntary. If you let a sponsor scan your badge, that sponsor receives the contact details linked to your badge and becomes an independent controller for them. The legal basis is your consent, given by choosing to have your badge scanned (Art. 6(1)(a) GDPR).

Photographers and videographers work at our events, and sessions may be recorded on video with audio. Photos and recordings may show attendees, speakers and sponsors. We use them to document the event and to report on it on this website, on our social media channels such as LinkedIn, in press coverage and to promote future Workplace Ninja events.

The legal basis is our legitimate interest in documenting and promoting our community events (Art. 6(1)(f) GDPR). We take care to respect your interests: if you do not want to be photographed or filmed, tell our team at the registration desk and you will receive a marker on your badge. Our photographers and videographers will then not take photos or footage focused on you, and we will not publish such material if it is taken by mistake. You may still appear incidentally in wide shots of the venue or the audience.

Session recordings focus on the stage. If you ask a question during a recorded session, your voice and image may be recorded. If you do not want this, please ask your question after the recording has ended.

You can object to the use of photos or recordings showing you at any time by emailing hello@wpninjas-germany.com. We will then remove the photos, or remove or edit the recordings, on channels we control where this is technically possible.

Speakers agree to the recording and publication of their sessions separately when they accept a speaking slot.

The event agenda is also provided through Sched (see section 5). You can view the agenda without an account. If you create an account, for example to build a personal schedule, save sessions or give session feedback, Sched processes the data you provide, such as your name, email address and selected sessions.

The legal basis is the performance of the service you request (Art. 6(1)(b) GDPR). Sched processes the event and agenda data on our behalf. For your own Sched account, Sched is also responsible under its own privacy policy. Sched is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR). For details, see the Sched privacy policy.

We collect talk submissions through Sessionize, operated by Web-ideja Ltd., Croatia. When you submit a talk, we process your name, contact details, profile information, photo and session details to review submissions and organize the event. For accepted speakers, we publish the name, photo, profile and session details on this website, in the agenda and in event promotion.

The legal basis is the performance of the speaker agreement and the steps taken at your request before it (Art. 6(1)(b) GDPR). Sessionize is an independent controller for your Sessionize account. For details, see the Sessionize privacy policy.

Depending on the purpose, personal data is shared with:

• Service providers that process data on our behalf: Vercel (hosting), Sched (tickets, registration and agenda) and Stripe (payments)
• Sessionize, for talk submissions, as described in section 9
• Stripe for its own purposes, and Apple Pay or Klarna when you choose them, under their own responsibility
• Sponsors of the event, as described in section 6
• Photographers and videographers working on our behalf
• Tax advisors and authorities where required by law

Where data is transferred to the United States, the transfer is based on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) or, where a provider is not certified, on standard contractual clauses adopted by the European Commission (Art. 46 GDPR). Transfers to sponsors outside the EU are described in section 6.

We keep personal data only as long as needed for the purpose it was collected for. Registration data is deleted after the event once it is no longer needed for follow-up, such as answering questions or handling refunds. Orders and invoices are kept for the periods required by German commercial and tax law, currently up to ten years. Photos and recordings are kept as long as they are used for documenting and promoting our events, unless you object.

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15 GDPR)
• Have inaccurate data corrected (Art. 16 GDPR)
• Have your data deleted (Art. 17 GDPR)
• Have processing restricted (Art. 18 GDPR)
• Receive your data in a portable format (Art. 20 GDPR)
• Object to processing based on our legitimate interests (Art. 21 GDPR)
• Withdraw consent at any time with effect for the future (Art. 7(3) GDPR)

To exercise these rights, email hello@wpninjas-germany.com.

Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22
20459 Hamburg
Germany
datenschutz-hamburg.de

We update this policy when our services or legal requirements change. The current version is always available on this page.

Last updated: November 12, 2026