Privacy
How we handle your data.
Last updated: July 27, 2025
FastForward Global GmbH (organizer of the DDX Conference) takes your privacy seriously. This Privacy Policy explains how we collect, use, and protect your personal data when you visit ddxconference.com (our “Site”), register for DDX Conference events, join our community (e.g. WhatsApp group), subscribe to our newsletter, or otherwise interact with us. It also describes your rights under the EU General Data Protection Regulation (GDPR) and how you can exercise them. By using our Site or participating in DDX Conference activities, you agree to the practices described in this Policy.
Who We Are
The data controller responsible for your personal data is:
FastForward Global GmbH
Prankratiusstraße 5, 52355 Düren, Germany.
Email: office@fastforward.global (Attn: Privacy)
Our Data Protection Officer (DPO) is Sebastian Gier, who can be contacted at the above address/email for any privacy-related inquiries or requests.
Personal Data We Collect
We only collect personal data that is necessary for specific purposes. The categories of data we may collect include:
Contact and Identity Information: When you register for a DDX Conference event or contact us, we collect information such as your name, email address, phone number, and organization details. For event ticketing, we may also collect your job title and company name (if you choose to provide them), though such optional information is only used for event purposes (e.g. networking or badge printing) and is not retained long-term.
Event Registration and Ticketing Data: If you sign up for one of our conferences, we will collect the data needed to process your registration and attendance. This includes contact details (as above), billing address, and payment information for ticket purchases. Payment card details are not stored on our servers; they are handled securely by our payment processor (e.g. Stripe) directly. We may also record your attendance status and any preferences or special requests you communicate to us for the event.
Newsletter Subscription Data: If you subscribe to our email newsletter or updates, we collect your email address (and optionally your name) to send you our newsletter. You will need to opt in (give consent) to receive our marketing emails, and you can unsubscribe at any time.
Speaker Submission Data: If you apply or agree to be a speaker at a DDX Conference, we will collect information you provide for that purpose. This typically includes your name, contact details, professional biography, headshot photograph, job title, company/affiliation, and the title/abstract of your talk. We use this information to organize the event and promote your session (for example, on our website, agenda, and marketing materials). Speaker data is collected through a separate process and used only for conference content and promotion.
Community and Communications Data: If you contact us via email, contact form, or other channels, we will collect the information you share (such as your name, email address, and the content of your message) in order to respond to you. We will also keep records of our correspondence with you. Participation in our WhatsApp community group is entirely optional – if you choose to join, we will have access to your phone number (as will other members of that WhatsApp group), and any information you share within the group is visible to participants. Please note: WhatsApp is a third-party platform (owned by Meta) and has its own privacy policy; by joining the group, your data (including phone number and any profile information you use on WhatsApp) will be processed by WhatsApp under their terms. We do not use phone numbers from the WhatsApp group for any purpose outside the group without your consent.
Photographs and Video Recordings: We (and our event partners or sponsors) may take photographs or video footage during DDX Conference events. These may include images of speakers, exhibitors, and the audience. We may use these photographs/videos on our website, social media pages, or other promotional materials to highlight our events. By attending the event, you acknowledge that you may appear in such media. If you do not wish to be photographed or filmed, or have concerns about specific images, please let us know and we will accommodate where possible (for example, by offering designated no-photo areas or honoring requests to remove certain images).
Website Usage Data and Cookies: When you visit our Site, we (or authorized third parties) automatically collect certain technical data about your device and browsing actions through cookies and similar tracking technologies. This may include your IP address, device type, browser type, operating system, referral URL, pages viewed, and the dates/times of access. We also use analytics tools (described below) that gather information on how you interact with our Site – for example, what pages you visit, how long you stay, and what buttons you click. This usage data helps us ensure the Site’s security and performance, understand user engagement, and improve our content and user experience.
We do not knowingly collect personal data from children. DDX Conference and its services are intended for adults and professional audiences. If you are under 16, please obtain consent from a parent or guardian before providing any personal information to us.
How We Use Your Personal Data (Purposes and Legal Basis)
We process personal data only for specific purposes and under a lawful basis as permitted by GDPR. Below we explain the purposes for which we use your data and the corresponding legal grounds:
Providing Event Services: We use your information to process event registrations, issue tickets/booking confirmations, facilitate entry to the conference, and provide you with information related to the event (such as schedules, logistical updates, or last-minute changes). This is necessary for the performance of our contract with you when you register for an event (GDPR Art. 6(1)(b)). It also covers related actions like verifying your identity at check-in and communicating essential event information to attendees.
Payment Processing and Invoicing: We use the billing details you provide (name, address, etc.) to process ticket payments and issue invoices/receipts. This is also part of performing our contract with you and fulfilling legal obligations (Art. 6(1)(b) and Art. 6(1)(c) GDPR). For example, German financial regulations require us to keep records of transactions. Payment card data is collected directly by our payment processor (Stripe) and used to charge your card for the tickets; we ourselves do not see or store your full card number or security code.
Communication and Support: If you contact us with questions, support requests, or feedback, we will use your contact data to communicate with you and address your inquiry. This is within our legitimate interests to provide good customer service and is often necessary pre-contract or post-contract (Art. 6(1)(f) or 6(1)(b) GDPR, depending on context). For instance, if you email us about event details or sponsorship opportunities, we process that data to respond to you.
Email Newsletters and Marketing: If you have subscribed to our newsletter or agreed to receive promotional communications, we will use your email address (and name, if provided) to send you periodic updates about DDX Conference, including news about upcoming events, new content (such as insights or podcasts), or related products and services. The legal basis for sending marketing emails is your consent (Art. 6(1)(a) GDPR). You will only receive such emails if you actively opted in (for example, by checking the subscription box or confirming your email address in a sign-up process). You have the right to withdraw your consent at any time – each marketing email will contain an “unsubscribe” link, and you can also contact us to be removed from the mailing list. We will not send you marketing communications if you have not subscribed or if you opt out.
Community Group (WhatsApp) Participation: If you join our WhatsApp community chat group, we will process your phone number and any personal data you share in the group for the purpose of facilitating peer networking and community discussion among DDX Conference participants. The legal basis is your consent/explicit action in joining the group (Art. 6(1)(a)). You can leave the group at any time, which will stop any further processing of your data in that context (aside from retention of past chat messages on WhatsApp servers, which is governed by WhatsApp’s policies). We do not use phone numbers from the group for unrelated purposes (e.g. we won’t add you to a marketing call list without separate consent).
Featuring Speakers and Content: For speakers and presenters at our events, we use the personal data provided (e.g. name, bio, photo, talk information) to advertise and run the event. This includes displaying speaker profiles on our website, event app, or printed programs, and using speaker names/likeness in promotional materials or social media announcements. This processing is based on the speaker’s consent or on the contractual arrangement for their participation (Art. 6(1)(a) or (b)). For example, by agreeing to speak at the conference, speakers generally agree that we can use their provided information publicly in connection with the event. If a speaker wishes to revoke consent for certain uses (e.g. remove their profile after the event), we will honor such requests.
Event Photography/Video for Marketing: As noted, we (or authorized partners) may capture photos or videos at our events. We use these images/videos to showcase and promote our conferences (e.g. on our website, social media, brochures for future events). Our legal basis for using event imagery that might include attendees is our legitimate interest in documenting and promoting our events (Art. 6(1)(f) GDPR). We balance this against attendees’ rights by not focusing on individuals without permission whenever feasible, and by honoring requests to remove any identifiable image of you that you object to. We do not use attendee photos for other purposes like commercial licensing. If we ever wanted to feature a clear image of an individual attendee in standalone marketing content, we would seek that person’s consent when practical.
Website Functionality and Performance: We process certain data to operate our website and ensure it works properly. For example, our web servers and hosting platform (Netlify) may log technical information (IP address, browser type, etc.) and use essential cookies to deliver content to you in the correct format and language, to remember your cookie preferences, and to maintain site security. The legal basis for this essential processing is our legitimate interest in providing a secure, functional website (Art. 6(1)(f) GDPR). This includes measures to prevent fraud or abuse on the site and to debug or troubleshoot errors. These server logs and security-related data are generally only kept for a short period (typically deleted within 30 days unless needed longer for investigation of an issue).
Analytics and User Experience Improvement: With your consent, we use analytics and feedback tools (like Google Analytics) to understand how users interact with our Site, so we can improve layout, content, and overall user experience. These tools use cookies and similar technologies to collect information about your device and browsing behavior on our site (see Cookies and Tracking below for details). The legal basis for using non-essential/analytics cookies is your consent (Art. 6(1)(a) GDPR). You can choose whether or not to allow these cookies via our cookie consent banner or settings. Data collected through analytics is aggregated and used to generate reports about website usage (e.g. total visitors, popular pages, etc.) and to identify usability issues, which helps us make informed improvements. We do not use analytics data to personally identify you, and we have configured these tools to respect privacy (for example, by anonymizing IP addresses when possible).
Advertising and Remarketing: With your consent, we use third-party advertising pixels and tags (such as the Google Ads tag, Facebook/Meta Pixel, and LinkedIn Insight Tag) on our Site. These technologies help us measure the effectiveness of our advertising campaigns on platforms like Google, Facebook/Instagram, and LinkedIn, and enable us to reach people who have shown interest in our events. If you consent to marketing cookies, these third-party tags will record that you visited our Site (and may note certain actions, like clicking on a “Get Tickets” button or visiting the schedule page). This information can be used to show you tailored ads about DDX Conference on those platforms (for example, a LinkedIn ad for our upcoming event might be shown to you if you visited our Site). The legal basis here is consent (Art. 6(1)(a)). We do not obtain personal contact information from these ad platforms unless you explicitly provide it; the process works by matching Site visitors to user accounts on those platforms via cookies or device IDs. If you do not consent to marketing cookies, these tracking tools will not be activated and our online ads will not be specifically tailored to your Site visits.
Compliance and Legal Obligations: In some cases, we may need to process personal data to comply with legal obligations, such as verifying VAT numbers for invoices, fulfilling record-keeping duties under tax law, or responding to lawful requests by public authorities. Legal basis: Art. 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation). Additionally, if it becomes necessary to establish, exercise, or defend legal claims, we may process relevant personal data as required (basis: Art. 6(1)(f) – our legitimate interest in legal protections).
We will not use your personal data for any purpose that is incompatible with the original purposes described above, unless we obtain your consent or have a clear legal basis to do so. We do not engage in any automated decision-making that produces legal or similarly significant effects on you (no profiling or algorithms that would, for example, deny services or predict personal preferences in a way that impacts you legally).
Cookies and Tracking Technologies
Our Site uses cookies and similar technologies to improve functionality, analyze traffic, and for advertising (with your consent). A “cookie” is a small text file that is stored on your device when you visit a website. We categorize cookies and trackers as follows:
Essential Cookies: These are necessary for the website to function and cannot be switched off in our systems. For example, our consent manager (CCM19) stores the choice you make in the cookie banner, so that you are not asked again on every page. Our site also keeps one entry in your browser’s local storage to remember that you have seen the opening animation. Neither is used for marketing, and neither identifies you. You can set your browser to block or alert you about these cookies, but some parts of the Site may not work then.
Analytics Cookies: These cookies collect information about how visitors use our Site, so we can measure and improve performance. We use Google Analytics (a web analytics service provided by Google) to gather usage data. Google Analytics cookies may track things like how you navigated through our Site and how much time you spent on pages. We have configured Google Analytics to anonymize IP addresses for visitors from the EU (which means Google truncates the last octet of your IP address so it cannot directly identify you). The data we get from Google Analytics is aggregated and does not identify you personally. It helps us understand trends (e.g., which pages are most popular). We only deploy Google Analytics cookies if you have given consent via our cookie banner. Google’s ability to use and share information collected by Google Analytics about your visits is restricted by Google’s Analytics Terms of Use and their Privacy Policy. You can opt out of Google Analytics at any time by adjusting your cookie settings on our site or by installing the Google Analytics Opt-out Browser Add-on.
Advertising & Social Media Pixels: These are third-party cookies or code snippets that we use for marketing and advertising purposes, only with your consent. Our Site may include:
Google Ads/DoubleClick: We may use Google Ads cookies to track conversions (for example, to know if someone who clicked our Google ad later bought a ticket) and to enable remarketing (showing relevant ads to people who visited our Site). These cookies (such as _gcl_ cookies or DoubleClick ID) can identify your browser and device and track your visit across sites. They help Google display our ads on other websites you visit, based on your past interaction with us. You can manage your Google ad settings via your Google account, or opt-out of personalized ads via tools like the NAI consumer opt-out or Your Online Choices.
Meta Pixel (Facebook/Instagram): The Meta Pixel is a piece of code we have on our Site that sends information to Facebook/Instagram. It allows us to measure the effectiveness of our Facebook ads and to reach audiences on Facebook or Instagram who may be interested in DDX events. If you consent to this pixel, Facebook may track that you visited our Site and link this information to your Facebook profile (if you have one), in order to serve you relevant ads or include your visit in aggregated advertising reports to us. The data transmitted to Meta may include your IP, a timestamp, the page URL, and an identifier (if you are logged into Facebook, possibly your user ID in hashed form). We do not get personal data about you from Facebook – only anonymized analytics. Facebook/Meta assures that EU user data is stored and processed in compliance with GDPR (Meta Platforms Ireland is the entity for EU). You can control whether Facebook shows you targeted ads by adjusting your ad preferences on Facebook, and you can revoke consent to our pixel by disabling marketing cookies or using browser tracking protection.
LinkedIn Insight Tag: We use the LinkedIn Insight Tag to track visits and conversions from our LinkedIn ads. This functions similarly to the Facebook pixel but for LinkedIn. If enabled (with your consent), it drops a LinkedIn cookie that allows us to see aggregated data about how LinkedIn users engage with our Site (for example, it can tell us that X number of people who saw our LinkedIn ad clicked through and visited the Site or completed a registration). LinkedIn may also use the data to improve their ad targeting. We do not receive any personal identifiers – just de-identified or aggregated info. You can opt out of LinkedIn’s tracking by refusing marketing cookies on our site or adjusting your LinkedIn account settings for advertising.
Managing Cookies: When you first visit our Site, you will be presented with a cookie consent banner that allows you to accept or reject different categories of cookies (except the strictly necessary ones). You can update your preferences at any time by [using our cookie settings tool/link] (if available) or by clearing cookies in your browser and revisiting the site to see the consent banner again. Additionally, most web browsers allow you to control cookies through their settings (e.g., you can block third-party cookies or all cookies). Do note that disabling all cookies might affect site functionality.
How We Share Your Data
We treat your personal data with care and confidentiality. We do not sell your personal information to third parties. However, in order to run our operations, we rely on certain trusted third-party service providers with whom your data is shared to the extent necessary for their services. These providers process data on our behalf (as “data processors”) or jointly with us, under strict data protection agreements. The main scenarios of sharing are:
Event Platform (Registration & Ticketing): We use an external ticketing platform Lu.ma (Luma) to manage event registrations and ticket purchases. When you register for a DDX Conference event via our Site’s “Get Tickets” interface, the personal information you input (name, email, etc., and payment details) is processed through Luma’s system. Luma acts as a data processor for us, storing your registration data and sending confirmation emails/tickets. We have a Data Processing Agreement with Luma to ensure your data is handled securely and in compliance with GDPR. Luma may retain your data on their servers as part of our event records; we ensure that they do not use your data for any purpose other than facilitating our event. (See also Luma’s own privacy policy for information on their security and GDPR compliance.) If we alternatively use another ticketing service (e.g., Eventbrite or similar) for certain events, the same principles apply – your data will be processed by that service for ticketing, under their privacy terms, and we will ensure GDPR compliance through appropriate agreements.
Payment Processor: For handling payments, we use Stripe. When you pay for a ticket, the payment details (such as credit card number, expiration, CVC, as well as your name and billing address) are transmitted securely to Stripe. Stripe processes your payment and confirms to us that the payment was successful. Stripe is a PCI-DSS compliant payment processor; it may act as an independent controller for certain financial data (e.g., credit card info) for regulatory reasons, but it only uses your data to process the transaction you authorized. We do not have access to your full card data at any point. Stripe’s privacy policy will govern the financial information you provide at checkout, and they are committed to GDPR compliance (Stripe’s European entity is Stripe Payments Europe, Ltd., based in Ireland). We may receive from Stripe some limited information, like the last four digits of your card or card type, which we use for recordkeeping and fraud prevention.
Website Hosting and Form Entries: Our website is hosted by Netlify (Netlify, Inc., San Francisco, USA). When you open a page, Netlify’s servers receive your IP address and the usual request data in order to deliver the page and keep the site secure; those server logs are kept for a short period only. When you fill in one of our forms — the newsletter sign-up, the partner enquiry or the volunteering form — what you enter is passed through a small function on Netlify and stored in Notion (Notion Labs, Inc., San Francisco, USA), which we use as the place where we read and work on those entries. Nothing else is stored there: the newsletter form asks for your email address and nothing more. Both companies are U.S.-based; we have data processing agreements with Standard Contractual Clauses in place with both, and neither is allowed to use your data for anything other than the service they provide to us. We use your email address to send you the DDX newsletter and for nothing else, and you can have it removed at any time by writing to office@fastforward.global.
Email Service: Our email communications (including support or info emails and some newsletter sending) are handled through Google Workspace (Gmail). This means if you email us at our provided contact address, your message and our reply will be stored on Google’s email servers. Google acts as a processor for our email data, under a GDPR-compliant agreement. Similarly, if we send out a manual newsletter or announcement to a list of subscribers, we may do so via Gmail or a similar email service. All such communications will always have an unsubscribe option if applicable. Google may process metadata about emails (like timestamps and IP addresses involved in sending) for security, but it does not access the content of our emails for advertising purposes because as a business customer we have a strict contract. (See Google’s privacy and security commitments for Workspace customers for more details.) We only share your email with Google’s service to the extent necessary to send you emails.
Analytics and Tracking Providers: As described, we use tools like Google Analytics and advertising pixels from Google, Meta, and LinkedIn. When these tools are enabled (with your consent), they will collect data directly from your browser/device for their respective purposes and share reports or insights with us. In these cases, we aren’t exactly “sending” your personal data to these providers; rather, they collect it through their embedded code on our Site. However, it’s important to note:
Google Analytics (provided by Google Ireland Limited) receives your site usage info; Google is a processor for us in providing aggregate analytics, but Google may use some data for its own business purposes as outlined in its privacy policy (e.g., improving its Analytics service). We have configured Google Analytics to minimize data sharing (for instance, we haven’t enabled broader Google data sharing features).
Meta (Facebook) and LinkedIn as recipients of pixel data are considered independent controllers for the data they receive (since they use it to deliver services to us and potentially personalize content to you). They assure compliance with GDPR and have their own lawful bases for processing (consent via our site’s banner, and their legitimate interests for providing aggregated insights to us). We do not provide any contact information about you directly to these platforms – the integration is cookie-based.
Event Partners and Sponsors: We do not share attendee personal data (such as your name or email) with our event partners or sponsors without your explicit consent. If we ever intend to share data with a sponsor (for example, if a sponsor would like to receive the email addresses of attendees for a one-time follow-up), we will ask you clearly during the registration process (via a checkbox or similar) whether you agree to such data sharing. Only if you opt-in will we share your contact information with that specific third party. In the normal course of events, any partner or sponsor communications to attendees are facilitated by us (e.g., we might send an email on the sponsor’s behalf, so your contact info isn’t directly given out). Rest assured, we will never give your personal details to any third-party for their own marketing use unless you have a) agreed to it, or b) it is required to fulfill a service you requested (for example, if you sign up for a co-hosted event where data sharing is necessary and that will be made clear to you).
Legal Disclosures: On rare occasions, we may need to share data if required by law or valid legal process. For instance, if we receive a court order or a request from law enforcement or a regulatory authority requiring us to disclose certain attendee information, we are obligated to comply. Similarly, if necessary to enforce our Terms & Conditions or to protect our rights, property, or safety (or that of our attendees and staff), we might disclose information to our legal advisors or to authorities. We will ensure such requests are legitimate and will only provide the minimum data necessary in response.
Aside from the above, your personal data is accessible to our internal team members who need to process it for the purposes described (e.g., our registration team, our marketing team for newsletters). Those team members are bound by confidentiality and data protection obligations.
We also ensure that all external processors who handle data (like Luma, Stripe, Netlify, Notion, etc.) have committed to appropriate security measures to protect your data. They are not allowed to use your data for anything other than the specific service they are providing to us.
WhatsApp Community Group
For those attendees and community members who choose to join our DDX Conference WhatsApp group: please be aware that this is a voluntary, opt-in community forum. By joining, you will typically be able to see the phone numbers and profile names of other members, and they will see yours. WhatsApp is provided by Meta Platforms and has its own privacy policy and terms of service. We do not control WhatsApp’s platform or how WhatsApp processes your data; we simply create the group as a host. We highly recommend that you review WhatsApp’s privacy policy to understand how they use your phone number, messaging data, and any metadata.
Within the WhatsApp group, any messages or content you post are visible to all other members of that group. We expect all members to use such information respectfully and only for community interaction related to DDX topics. We will never add you to the WhatsApp group without your explicit request or consent. Typically, we provide a group invite link, and it’s your choice whether to click and join. If at any time you wish to leave the WhatsApp group, you are free to do so — this will remove your access and stop further sharing of your number/name in the group (though previous messages you sent may still be visible in the chat history on others’ devices, unless they individually delete them).
We do not use the WhatsApp group phone number list for any outside marketing, nor do we extract data from WhatsApp for our own databases. However, WhatsApp (the company) might use phone numbers for its own purposes (such as connecting with your WhatsApp account activity). Also note that WhatsApp may transfer data to servers outside the EU (e.g., to the U.S.) as part of its service; by using WhatsApp you are subject to their data transfer practices. If you have privacy concerns about the group, you can always reach out to us directly via email instead, or use our other channels for community engagement.
In summary, participating in the WhatsApp group is optional and at your own discretion. We encourage you to never share sensitive personal information in the group. We will do our best to moderate the group to ensure a positive and safe community experience, but each member is responsible for what they share.
International Data Transfers
DDX Conference is based in Germany, but many of our service providers are located outside the European Economic Area (EEA). Whenever we transfer (or allow access to) your personal data outside the EEA, we take steps to ensure it remains protected according to GDPR standards.
Some examples of cross-border data situations in our context:
Our website host (Netlify), the service that stores our form entries (Notion), our analytics tools (Google) and certain marketing platforms (Meta/Facebook, LinkedIn) are headquartered in the United States or other countries outside the EU. This means that the data collected through our Site (e.g., via cookies or when you fill out forms) may be stored on servers in the U.S. or otherwise accessed by our providers’ personnel in those countries.
We have signed Data Processing Addendums (DPAs) with our providers that include Standard Contractual Clauses (SCCs) approved by the European Commission, which contractually require the recipient to protect your data to EU standards. For instance, our agreements with Netlify, Notion and Stripe incorporate SCCs for EU data export.
EU-U.S. Data Privacy Framework: Some of our U.S. partners may be certified under the new EU-U.S. Data Privacy Framework (DPF). For example, Google LLC and Meta Platforms, Inc. have publicly committed to comply with the DPF principles for relevant data transfers, which means that for those companies, personal data transferred to the U.S. is covered by an EU Commission adequacy decision (July 2023) – essentially it is considered protected at a level comparable to EU law. Where our providers are DPF-certified, data transfers to them in the U.S. are based on that mechanism. In cases where a provider is not covered by an adequacy decision, we rely on the aforementioned SCCs and additionally assess whether any further safeguards are needed (such as encryption in transit and at rest, etc.).
Despite these safeguards, it’s important to note that when data is in a non-EU jurisdiction, it might be subject to foreign laws (for example, U.S. government agencies could, under certain conditions, access personal data for national security purposes). We carefully select our providers and share only what’s necessary, to minimize these risks. By using our Site or services, you understand that your personal data may be transferred to our partners in countries outside your own.
If you have questions about our international data transfers or want more details about the safeguards in place, feel free to contact us (see Contact Us below).
Data Retention
We will not keep your personal data for longer than is necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law. In general:
Event Registration Data: If you register for an event, we will retain your personal details for as long as needed to manage the event and any follow-up actions. Basic attendee information (name, contact, ticket purchase) is typically kept until the event has concluded and then for a period of time thereafter in case of any post-event issues (such as providing attendance certificates, addressing inquiries, or handling refunds if applicable). We may archive your contact information to inform you of future events only if you have given consent to such marketing; otherwise, we will not use it to proactively contact you about new events. Certain transaction-related data (invoices, payment records) will be retained for legal compliance (e.g. accounting/tax regulations in Germany often require us to keep records for up to 10 years).
Optional Data Removal: For any extra information you provided during registration that isn’t strictly needed long-term (for example, your job title and company, if we requested those for badge purposes), we will delete or anonymize that portion of the data after the event is over. We aim to practice data minimization – so once the immediate need (networking or context) is past, we remove those optional details from our active databases, typically within a few months post-event.
Newsletter Subscriber Data: We keep your email on our mailing list until you unsubscribe or until we decide to cease sending newsletters. If you unsubscribe from our newsletter, we will promptly remove your email from the active distribution list. (We may still retain your email in a suppression list to make sure we honor your opt-out and don’t accidentally send you emails again, or in archives/backups, but we won’t use it for marketing once you’ve unsubscribed.)
Speaker Data: Information about speakers (bios, photos, talk recordings) may be kept on our website or archives as part of documenting past events. If you are a speaker and you wish to have your personal data (e.g., bio or photo) removed or updated after the event, you can let us know. Otherwise, we might retain speaker profiles on our site indefinitely as part of event history, or until it’s no longer relevant. Any contractual agreements with speakers regarding content usage will also govern retention (for instance, if a talk recording is only allowed to be available for a certain time, we will take it down accordingly).
WhatsApp Group: We do not store WhatsApp messages or participant lists outside of the WhatsApp application. The group chat history remains available to members as long as the group exists. If you leave the group, you won’t have access to the history, but copies of messages you sent may still reside in other members’ apps until they delete them. We typically continue the WhatsApp group as an ongoing community forum; if it’s discontinued, the messages would remain on WhatsApp’s servers per their retention policy, but not be actively used by us.
Web Analytics Data: Data collected via Google Analytics is aggregated and stored within those platforms. Google Analytics retains aggregated site data for a default period (which we have set to an appropriate timeframe, e.g., 14 or 26 months) after which it is automatically deleted. In any case, this data is not tied directly to your identity in our systems.
Server Logs: Our web server logs and security logs are generally kept for a short duration (around 30 days, as mentioned) unless we need them longer to investigate security incidents. They are then overwritten or deleted.
Legal Records: If any personal data is part of a legal process or investigation (e.g., an injury report at an event, or a transaction dispute), we will retain that data as long as necessary to resolve the matter and as required by law (e.g., until a claim is resolved, or for the duration of litigation).
After the applicable retention period, we will either securely delete your personal data or anonymize it (so it can no longer be associated with you). For example, we might retain aggregate statistics about event attendance or website traffic that no longer identify any individuals.
Your Rights under GDPR
As an individual whose personal data we process, you have several rights under the General Data Protection Regulation. You may exercise the following rights at any time:
Right to Be Informed: You have the right to be given clear and transparent information about how we use your personal data (which is exactly the purpose of this Privacy Policy).
Right of Access: You have the right to request a copy of the personal data we hold about you, as well as information on how we process it. This helps you understand what data we have and verify that we are processing it lawfully.
Right to Rectification: If any of your personal data that we have is inaccurate or incomplete, you have the right to have it corrected or updated without undue delay. For example, if you change your email address or notice a typo in the info we have on file, let us know and we will fix it.
Right to Erasure: Also known as the “right to be forgotten”. You can ask us to delete or remove your personal data in certain circumstances. For instance, if the data is no longer necessary for the purpose it was collected, or if you withdraw consent and we have no other legal basis to keep it, or if you object to processing and we have no overriding interest, or if we processed your data unlawfully. Note that this right is not absolute – sometimes we may need to retain certain information despite a deletion request (e.g., to comply with a legal obligation or in defense of legal claims), but we will inform you if that’s the case.
Right to Restrict Processing: You have the right to request that we limit the processing of your data in certain situations. This means we would store your data but not actively use it until the restriction is lifted. You might exercise this if, for example, you contest the accuracy of the data (while we verify it), or you object to our processing (while we consider your objection request), or if processing is unlawful but you prefer restriction over deletion.
Right to Data Portability: For data that you have provided to us and that we process by automated means on the basis of your consent or for performance of a contract, you have the right to obtain that data from us in a structured, commonly used, machine-readable format, and you have the right to transmit that data to another controller (or have us transfer it, where technically feasible). In plain terms, this mostly applies to things like data you gave us directly in a digital form. We will assist in providing your data in a convenient format if you request it.
Right to Object: You have the right to object to our processing of your personal data when that processing is based on our legitimate interests (Art. 6(1)(f) GDPR) or on public interest (Art. 6(1)(e)), and you believe your rights and interests outweigh ours. If you object, we must stop that processing unless we have compelling legitimate grounds that override your rights or if we need to continue processing for the establishment, exercise, or defense of legal claims. Importantly, you have an unconditional right to object to the processing of your personal data for direct marketing purposes. This means if you object to any use of your data for marketing (including profiling related to marketing), we will cease such use immediately. For example, you can opt out of our newsletters or ask us to stop any targeted advertising processing and we will comply.
Rights Related to Automated Decision-Making: You have rights to not be subject to decisions based solely on automated processing (including profiling) that have legal or similarly significant effects on you. As we stated, we do not make such automated decisions without human involvement about you. If that ever changes, we will inform you and ensure your rights in that regard (such as the right to human intervention, to express your point of view, and to contest the decision).
Right to Withdraw Consent: If we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. For example, if you gave consent for receiving our newsletter or for the use of certain cookies, you can withdraw consent by unsubscribing from the newsletter or adjusting your cookie settings. Withdrawing consent will not affect the lawfulness of any processing we did based on your consent before you withdrew it. Once consent is withdrawn, we will stop the processing in question. (If you withdraw consent for the WhatsApp group by leaving it, we stop processing your data in that context; if you withdraw consent for marketing emails, we stop sending them, etc.)
To exercise any of your rights, please contact us using the contact information provided in this Policy. We may need to verify your identity before fulfilling certain requests (to ensure we don’t give your data to an unauthorized person). We will respond to your request as soon as possible, and in any event within one month as required by GDPR. If the request is complex or numerous, we can extend this by an additional two months, but we will inform you and explain why if that is the case. In general, we will charge no fee for fulfilling a rights request. However, if a request is manifestly unfounded or excessive (for example, repetitive requests), we are permitted either to charge a reasonable fee or to refuse the request, but we will justify our decision if that happens.
Security Measures
We have implemented appropriate technical and organizational measures to secure your personal data and protect it against unauthorized access, alteration, disclosure or destruction. These include using secure transmission (our Site is served over HTTPS/TLS encryption to protect data in transit), restricting access to personal data to staff and service providers who need it, and ensuring our processors also implement robust security (for example, Stripe is certified to PCI standards for payment security, Netlify and Google have high security protocols, etc.). We regularly review our data handling practices and will adapt safeguards as needed to address new threats or vulnerabilities.
Despite our efforts, no website or internet transmission is completely secure. For example, if you communicate with us via email or WhatsApp, please be aware those communications might not be end-to-end encrypted (email generally isn’t, WhatsApp is end-to-end encrypted though). Please take care in deciding what information you send us through unsecure channels. If we ever experience a data breach that poses significant risks to your rights and freedoms, we will notify you and the relevant authorities as required by law.
Third-Party Links and Services
Our Site and communications may contain links to third-party websites or services that are not operated by us (for example, links to our profiles on Instagram, LinkedIn, Twitter, YouTube, or to partner organizations’ sites). If you click those links, you will be directed away from our Site, and any information you provide or actions you take on those external sites are governed by the privacy policy of the respective third party. We do not have control over and are not responsible for the content, privacy practices, or data handling of external websites. We encourage you to review the privacy policies of any third-party sites or services you interact with.
Specifically, if you engage with us on social media platforms (e.g., by commenting on our LinkedIn posts or sending us a message via Instagram), those interactions are also subject to the terms and privacy practices of those platforms. We do get to see information you share with us on those platforms (for instance, your social media username and whatever you comment), and we may use that information to respond to you or improve our services, but we will not export personal data from social media for other uses without notifying you. Keep in mind that anything you post publicly on our social pages can be seen by others, so please refrain from sharing sensitive personal details in such public comments.
Your Choices
Opting Out of Marketing: As mentioned, you can unsubscribe from our emails at any time by clicking the link in the footer of any newsletter, or by contacting us to remove you. If you have a user account on any platform we provide (if applicable), you might also adjust communication preferences there. For WhatsApp or any community channel, you can leave at any time. We will respect all opt-outs promptly.
Cookie Preferences: You can choose not to allow certain cookies as explained in the Cookies section. Using our cookie consent tool, you can refuse analytics/advertising cookies and still use the Site for basic browsing. If you change your mind, you can update your preferences similarly.
Do Not Track: Our Site currently does not respond to “Do Not Track” browser signals in a standardized way. However, as noted, you can achieve a similar effect by declining tracking cookies on our site’s consent banner, which effectively tells our tracking tools not to engage. Additionally, you may use private browsing modes or tracker-blocking browser extensions if you wish to further reduce tracking.
Updating Information: If you need to update any information you’ve provided to us (for example, correct a misspelled name, or update an email address), please let us know. If we offer any self-service profile or account, you could edit details there; otherwise, an email to us will suffice and we’ll update our records.
Complaints and Supervisory Authority
We hope to resolve any privacy concerns you might have directly and promptly. You can always reach out to us (contact details below) with questions or complaints about how we handle your data, and we will do our best to address them.
If you believe we have not complied with applicable data protection laws or have not adequately respected your rights, you have the right to lodge a complaint with a supervisory data protection authority. You may do so in the EU member state where you reside, where you work, or where the alleged infringement occurred.
Our lead supervisory authority in Germany is the Data Protection Authority for the state of North Rhine-Westphalia (since FastForward Global GmbH is registered in that region). The contact details are:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)
Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
Phone: +49 (0)211 38424-0
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de
You can contact them or any other relevant data protection regulator. In addition, if you are based outside the EU (for example, in the UK or elsewhere), you may have the right to complain to your local privacy regulator about our activities if they fall under their jurisdiction.
We would appreciate the chance to deal with your concerns before you approach a regulator, so please consider reaching out to us first. Your trust is extremely important to us, and we will take your privacy concerns seriously.
Contact Us
If you have any questions about this Privacy Policy, or wish to exercise your rights or get further information, please contact us:
FastForward Global GmbH – DDX Conference Team
Email: office@fastforward.global (please include “Privacy Query” in the subject line for clarity)
Postal Mail: FastForward Global GmbH, Prankratiusstraße 5, 52355 Düren, Germany.
Attn: Data Protection Officer (Sebastian Gier)
We will be happy to assist you with any questions or requests regarding your personal data.
Changes to this Privacy Policy
We may update or revise this Privacy Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. If we make significant changes, we will notify users by posting a prominent notice on our Site or by other appropriate means. The “Last updated” date at the top of this Policy indicates when the latest changes were made. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.
By continuing to use our Site or services after any revisions become effective, you acknowledge the updated terms. If you do not agree to any update, you should stop using our Site and services and, if necessary, exercise your rights (such as withdrawing consent or requesting data deletion).
Thank you for taking the time to read our Privacy Policy. We are committed to safeguarding your personal data and ensuring transparency about our data practices. Your privacy and trust are important to us, and we will continue to do our utmost to protect them while providing you with a valuable and engaging DDX Conference experience. If you have any further questions or concerns, please do not hesitate to contact us. Your feedback on privacy matters is also welcome, as it helps us improve. Have a great day and enjoy the DDX Conference content and events!
Additional GDPR Information
Data Retention:
We retain personal data only for as long as necessary to fulfill the purposes described above. Ticketing and event-related data are generally stored for up to 24 months after each event, unless longer retention is required for legal, tax, or accounting obligations. Marketing data (e.g., newsletter subscriptions) is kept until you unsubscribe or request deletion. Cookies and analytics identifiers follow the retention periods defined by each provider.
Your Rights Under GDPR:
You have the right to request access to your personal data, correction of inaccurate data, deletion of your data, restriction of processing, objection to processing, and data portability. Where processing is based on consent, you may withdraw your consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with your local supervisory authority.
International Data Transfers:
Where personal data is transferred outside the European Economic Area (EEA), such transfers are safeguarded through EU Standard Contractual Clauses (SCCs), adequacy decisions, or other appropriate safeguards as required by GDPR. Our service providers (such as hosting, analytics, and ticketing partners) comply with these requirements.
Security Measures & Breach Notification:
FastForward Global GmbH implements appropriate technical and organizational measures to protect personal data, including encrypted transmission, access controls, and data minimization practices. In the unlikely event of a personal data breach that may result in a risk to your rights and freedoms, we will notify affected individuals and the relevant supervisory authority in accordance with GDPR requirements.
Empowering leaders of tomorrow’s digital experiences to shape positive futures.
Partner Get Tickets Balanstraße 63, 81541 Munich, Germany