Privacy Policy

for the website www.laufgelage.de and the Laufgelage registration platform

Last updated: 8 October 2026

 

1. Who is responsible?

The controller responsible for processing your personal data is

VWI-Hochschulgruppe Erlangen-Nürnberg e.V.
c/o Friedrich-Alexander-Universität Erlangen-Nürnberg, Technische Fakultät
Cauerstraße 7, 91058 Erlangen, Germany
registered in the register of associations of the Local Court (Amtsgericht) of Fürth under VR 200019, represented by the board.

For all questions about data protection and to exercise your rights, you can contact us at datenschutz@laufgelage.de. We have not appointed a data protection officer because, having checked, we are not obliged to do so (Art. 37 GDPR, Section 38 of the German Federal Data Protection Act, BDSG).

This policy applies to our website www.laufgelage.de, to the registration platform at anmelden.laufgelage.de (the addresses www.anmelden.laufgelage.de and www.laufgelage.de/anmelden permanently redirect there) and to the running of the Laufgelage. We use “you” for everyone whose data we process.

 

2. Key points at a glance

 

• • To register, we need your contact details, your cooking address and some information for allocating the teams. Without this information, you cannot take part.
  • The Laufgelage only works if the teams can find each other: If you are a host, the teams coming to you will receive your team name, the name of the team member to whom the address belongs, your address including floor and doorbell name, and your telephone number. If you are a guest, the team cooking for you will receive your team name, your first names and telephone numbers and, summarised for both guest teams, information on eating habits and alcohol.
  • Information on allergies, intolerances and preferences is voluntary. It is only passed on to the team cooking for you with your explicit consent.
  • The platform is operated by a service provider on our behalf. The database and application logic run in the EU; some technical services use providers through which data may reach the USA (sections 6 and 11). Payment is made via PayPal.
  • We do not use analytics or advertising cookies.
  • We delete the event data no later than eight weeks after the Laufgelage, and information on allergies after just 14 days.
  • You have the right of access, rectification, erasure, restriction, data portability and objection, and you can lodge a complaint with a supervisory authority (section 13).

 

3. Visiting our website

 

3.1 Providing the website and server logs

When you visit www.laufgelage.de, your browser transmits technically necessary data to the server: IP address, date and time of access, the page accessed, the previously visited page (referrer), browser type and version, operating system and the amount of data transferred. We process these data to deliver the website, to ensure its security and to fend off attacks. The legal basis is our legitimate interest in a secure and functioning website (Art. 6(1)(f) GDPR). Our web host stores the access logs for six weeks and the error logs for five days (up to 100,000 entries); they are then deleted unless they are needed for longer to investigate a security incident.

The website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany, which processes the data on our behalf (Art. 28 GDPR).

 

3.2 No analytics, no advertising

We do not use any analytics, tracking or advertising tools on the website and do not store any information on your device that is not strictly necessary for operating the website (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). We deliver fonts, images and the video on the home page from our own server. The website is built with WordPress; for the contact form, sending emails, redirects, multilingual content (Polylang) and a countdown we use plug-ins that run on our own web space. The language of the website is determined by the address of the page; the multilingual plug-in does not set a cookie. Should we use services requiring consent in future, we will obtain your consent beforehand via a consent banner and update this policy.

 

3.3 HTTPS connection

The website and the registration platform can only be accessed via an encrypted connection (HTTPS/TLS).

 

3.4 Links to social networks

Our website links to our profiles on Instagram and LinkedIn and to a WhatsApp community. These are simple links; no data are transmitted to these networks when you visit our website. Only when you click a link are you taken to the respective provider, which is then itself responsible for the processing (section 9).

 

3.5 Map of the catchment area

On the home page, we show the catchment area of the Laufgelage as an image that we deliver from our own server. Google receives no data when you simply visit our website. Only when you click on the image or the link does the map open on Google My Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) in a new tab; Google is itself responsible for the processing there, and data may be transferred to the USA (section 11).

 

4. Emails about your Laufgelage and newsletter

For the Laufgelage you have registered for, we send you emails with information about the procedure, your route, changes and the closing event. These emails are part of performing the participation contract (Art. 6(1)(b) GDPR); they do not contain advertising and therefore cannot be unsubscribed from. By contrast, we only send you information about future Laufgelage events if you have subscribed to the newsletter.

When registering for the Laufgelage, you can tick a box to consent to us informing you by email about future Laufgelage events and the start of their registration (newsletter). The legal basis is your consent (Art. 6(1)(a) GDPR). To ensure that nobody enters someone else’s address, the person who ticked the box receives a confirmation email with a link with which they confirm their consent; we only add persons to the mailing list who click the link themselves. The co-registered person can subscribe to the newsletter in their self-service area (section 5.7) and then also receives a confirmation email, which they must confirm. We delete requests that are not confirmed after 30 days; until then, we store the request with the email address and the time in order to be able to prove the subscription process (Art. 6(1)(f) GDPR; for the person who ticked the box, also point (a)). We store the email address, the time of consent and confirmation and the wording of the consent.

You can withdraw your consent at any time, using the unsubscribe link in every message, using the unsubscribe button of your email program or by emailing datenschutz@laufgelage.de. We store your address until you withdraw consent and the records of your consent for three more years afterwards so that we can prove that we had your consent (Art. 7(1), Art. 6(1)(f) GDPR). We send the notifications via the registration platform (section 6).

 

5. Registration and participation in the Laufgelage

 

5.1 What information we collect

Mandatory information per person: first name, surname, age, university, faculty or degree programme, telephone number, email address, eating habits (selection without stating reasons: vegan, vegetarian, also meat/fish), drinks preference: with or without alcohol (without stating reasons), whether the food may be spicy.

Mandatory information per team: team name, cooking address with floor, name on the doorbell and access instructions, who the address belongs to, living situation (own flat, shared flat, student residence), information on a shared kitchen (double occupancy) including a shared code word that allows teams using the same kitchen to be matched with each other, and the chosen language.

Voluntary information: gender, how you heard about the Laufgelage, allergies, intolerances and preferences in a shared free-text field (section 5.4), a gift or discount code, the consents under sections 4, 5.10 and 7.

From the cooking address, we calculate coordinates and the district in order to plan the routes and to check whether the address is within the event area.

 

5.2 What we use the information for and on what legal basis

 

Purpose	Legal basis
Concluding and performing the participation contract: confirmation, waiting list, allocating the teams to courses and routes, sending the routes and organisational information, tickets and admission, cancellation and refunds	Contract (Art. 6(1)(b) GDPR)
Checking the minimum age of 18 and matching teams of similar age; mixing degree programmes	Contract (point (b))
Voluntary information on gender for our anonymous statistics; it is not used for the allocation	Consent (point (a))
Voluntary information on how you heard about us, to evaluate our advertising, only in aggregated form	Consent (point (a))
Allergies, intolerances and preferences (free-text field)	Explicit consent (Art. 9(2)(a) GDPR), section 5.4
Checking against the blocklist	Legitimate interest (point (f)), section 5.9
Accounting and retention of payment records for tax purposes	Legal obligation (point (c)) in conjunction with Section 147 of the German Fiscal Code (AO)
Proof of consents given; establishing and defending legal claims	Legitimate interest (point (f))
Anonymised evaluation after the event (numbers of participants, age groups, degree programmes, districts) to plan future Laufgelage events	Legitimate interest (point (f)); the evaluation contains no names, contact details, addresses or free text, and groups of fewer than five persons are combined

 

5.3 If you also register your team partner

If one team member registers the team, we receive the other person’s information from them (Art. 14 GDPR). Please inform your team partner about the registration and about this privacy policy beforehand. Both team members receive the registration confirmation, or the waiting list notification if registered on the waiting list, at their own email address, with a reference to this policy; at the latest with this, we also provide this information to the co-registered person. Consents, including those relating to information on allergies and intolerances, can only be given by each person for themselves; the co-registered person gives their own consents (photographs, drinks sponsor, storage for the next Laufgelage, newsletter, gender and the question of how they heard about us, their own consent regarding allergies) themselves in the “My consents” section of their self-service area (section 5.7). Nothing is pre-filled, nothing is taken over from the information provided by the registering person, and a consent is only deemed to have been given once the co-registered person has ticked the relevant box and saved. If the registering person enters information on allergies, intolerances or preferences of their team partner, we need that person’s own consent; see section 5.4.

 

5.4 Allergies, intolerances and preferences

The person registering the team enters the allergies, intolerances and preferences of both team members in a shared free-text field. Information on allergies and intolerances is health data; we treat all information in this field as such. We only store it with the explicit consent of the person concerned (Art. 9(2)(a) GDPR): the registering person consents to their own information by ticking one box and confirms by ticking a second box that their team partner has been informed about the information concerning them and has explicitly consented to its storage and transmission. The co-registered person receives a notice about this with their own registration confirmation and can explicitly consent in the self-service area or declare that they do not consent; in that case we will not pass on the information about them and will delete it. As the field is shared, we delete the information concerning them before the allocation, or they delete it themselves in the self-service area until then. We only pass the information on to the host team cooking for you so that it can prepare the course safely for you. The hosts may only use the information for this purpose and must delete it after the event. This information is voluntary; you can take part without it, but the host team will then not know about your allergy. Your team partner can see the information in the self-service area via their own link. Each team member can withdraw their consent at any time with effect for the future and request the deletion of the information about them (datenschutz@laufgelage.de); until the allocation has been created, you can also delete the information yourself in the self-service area. We delete the information 14 days after the event.

 

5.5 What other participants learn about you

At the Laufgelage, the teams visit each other. For this, the teams must receive the necessary information about each other. This is part of the service we owe you (Art. 6(1)(b) GDPR):

 

• • If you are a host, the teams coming to you receive, with their route email, your team name, the full name of the team member to whom the cooking address belongs, the first names of both team members, your cooking address with floor, the name on the doorbell, your access instructions and your telephone numbers. A team’s route email lists this information for all stations on its route. Each time your guests display the map image in this email, Google receives the coordinates of your cooking address; the image address contains no names (section 6).
  • If you are a guest, the team catering for you receives your team name, your first names and your telephone numbers, summarised for both guest teams the number of persons who drink alcohol, the eating habits and whether the food may be spicy, and, only with consent, the information on allergies, intolerances and preferences.

Under our terms and conditions of participation, participants may only use these data for the event and for keeping in personal contact and may not pass them on to third parties. You are responsible for how you handle the data you receive yourself. Irrespective of this, if a host credibly asserts that a participant has caused damage in their home, we will, on request, tell the host that participant’s name and contact details so that the host can pursue their claims (Art. 6(1)(f) GDPR).

 

5.6 Payment via PayPal

You pay the participation fee via PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg); there you can also pay by credit card or direct debit. You enter your payment details directly with PayPal; neither we nor our service provider receive card or account details. Your browser loads the payment component from PayPal only after you have clicked “Register with obligation to pay”; in the process, PayPal receives technical device data and your IP address, and the component creates an entry in your browser’s local storage (section 6, storage on your device). We integrate it because the payment you want would otherwise not be possible. The platform sends PayPal the amount, the payment reference and a transaction number and receives back the payment status, the transaction ID and the payer’s email address. We make refunds via PayPal. PayPal is itself responsible for processing the payment; its privacy statement applies (https://www.paypal.com/de/legalhub/privacy-full). The legal basis is the participation contract (point (b)).

During the payment process, the platform temporarily stores your form entries for no more than 90 minutes so that the registration can be completed after payment.

 

5.7 Self-service area, cancellation and waiting list

With your own registration confirmation or, if you are placed on the waiting list, with your waiting list notification, you receive, like your team partner, your own personal link to the self-service area. The link contains a key that unlocks your team’s data and, in the “My consents” section, only your own consents; you cannot see or change the other person’s consents there. Please do not pass the link on. There you can change your other information and that of your team and cancel your team’s registration until the allocation has been created; after that, please contact kontakt@laufgelage.de for this purpose. Teams on the waiting list can also cancel there afterwards. If one person cancels the team, this applies to both; the other person is informed by email. You can give, change and withdraw your consents there until the end of the day of the event; you can also withdraw a consent at any time by email to datenschutz@laufgelage.de. If the consent to the drinks sponsor’s visit is withdrawn after we have handed over the visit list, we will notify the sponsor of the withdrawal; a consent to the sponsor’s visit that is given only after the visit list has been handed over cannot be taken into account for the visit. As proof, we store for each consent the person, the time, the language and the version of the wording. Anyone who registers after the registration deadline or does not get a place because the event is oversubscribed is placed on the waiting list; if a team moves up, we process its data like those of all participants.

 

5.8 Tickets and admission wristbands

After registering, each participant receives a ticket with a personal QR code. At the wristband stands and at the evening box office, members and helpers of our association scan the code using time-limited access (scanner link) or search for your name or your full telephone number if you cannot show the code; you then receive your admission wristband. No personal data are displayed before the scan; afterwards, your name, your team name and the status of your ticket appear and, in the case of a search (part of a name of at least four characters, or a full telephone number), no more than 20 hits without telephone numbers; the redemption status and time are stored. On admission to the closing event, the admission staff only check the wristband and your minimum age; they do not receive any registration data, except, where applicable, the name of a banned person (section 5.9). The legal basis is the participation contract (point (b)).

 

5.9 Blocklist

Until the registration platform implements the check, which is scheduled to happen by 4 April 2027, no automatic check takes place. Until then, the board checks registrations by hand against the ban entries (email address, telephone number and name) before the allocation is created. As in the rest of this section, the legal basis is our legitimate interest (Art. 6(1)(f) GDPR); we store the entries for as long as those on the blocklist (two years, for serious breaches up to five years from the decision). We pass on to the wristband stands and the admission staff (section 5.8) at most the name of a banned person so that they can be refused admission. Until implementation, we enforce bans only by rejecting a registration or by refusing admission under the terms and conditions of participation.

From implementation of the automatic check, which is scheduled to happen by 4 April 2027, the following applies: When you register, we check your email address and telephone number against a blocklist. On this list, we record persons who have seriously breached the terms and conditions of participation at previous events and are therefore excluded from future events (§ 8(4) to (6) of the terms and conditions of participation). If either of these details matches, registration is not possible; you will be shown this before payment. The entries of a registration rejected in this way are discarded immediately; we only count how often this happens.

The legal basis is our legitimate interest, and that of the participants and hosts, in being protected from repeated assaults and serious disturbances, particularly as the courses take place in private homes (Art. 6(1)(f) GDPR). For each entry, the list contains only the email address and telephone number of the banned person, where possible as check values (hash values from which the address and number cannot be recovered), the category of the reason for the ban, the date of the decision and the expiry date. Inclusion on the list is decided by the board or jointly by the two persons responsible for the Laufgelage designated by it; anyone who is included is notified in text form (for example by email) of the reason and duration. Bans apply for two years, and for up to five years in the case of serious breaches. We delete the entries when the ban expires or is lifted, for technical reasons at the latest within 14 days. You can request a review of a ban and object to the processing at any time (section 14). There is no decision based solely on automated processing: the check merely implements the board’s decision.

 

5.10 Additional voluntary information when registering

 

• • Storage beyond the event and course history. With your consent, we store your name, your email address, your telephone number and the courses you have cooked, for the next Laufgelage, so that, as far as possible, you do not have to cook the same course again next time. The platform takes the stored courses into account when allocating teams; however, it cannot guarantee a different course next time in every case. We do not use this information to pre-fill your registration. We delete this information twelve months after the end of the event, unless you consent again when registering anew (point (a)).
  • Visit from a drinks sponsor. With your consent, we pass on your first names and surnames, your mobile number, your cooking address with floor and doorbell name, your drinks preference (with or without alcohol), and the course at which the sponsor visits you to our drinks sponsor, currently Red Bull Germany GmbH & Co. KG, Osterwaldstraße 10, 80805 Munich, Germany, so that it can visit you during the Laufgelage and prepare drinks for you and your guests (point (a)). Each team member consents for themselves. We only pass on the cooking address if the person in whose home the cooking takes place has also consented. The drinks sponsor may use the information only for this visit and not for further advertising; otherwise, it is itself responsible for any further processing. If the sponsor changes, we will only pass on your data once you have consented again for the new sponsor.
  • Announcements of future Laufgelage events (section 4).

Participation does not depend on any of these consents. You can withdraw any consent at any time with effect for the future.

 

5.11 Reimbursement if a course is cancelled

If you apply for reimbursement of your food costs after a course has been cancelled (§ 10(5) of the terms and conditions of participation), we process the information from your application: the cancelled course, the receipt, the IBAN, the BIC and the name of the account holder. We use it only to check the application and to transfer the reimbursement; the legal basis is the participation contract (point (b)). We keep the application and the receipt as accounting records (section 12).

 

6. Service providers and technical services of the registration platform

The registration platform is operated on our behalf and in accordance with our instructions by Philip Sebastian Lissmann & Steve André Withers GbR, Würzburg, Germany (data processing under Art. 28 GDPR). With our approval, it uses the following further processors:

 

Provider	Task	Location
Google Cloud EMEA Limited, Dublin, Ireland (Google Cloud, Firebase)	Servers, database, application logic, delivery of the web pages, server logs	Database in Belgium and the Netherlands, application logic in Belgium; delivery of the web pages via a global network; sign-in service for our administrators’ accounts in the USA; server logs without a fixed region
Lettermint B.V., Zwolle, Netherlands	Sending emails (confirmations, routes, tickets, changes, announcements)	EU

What these services learn about you. Google Maps Platform and basemap.de do not work on our behalf (section 10). We are responsible for integrating these services and for the resulting transmission to Google and to the Federal Agency; the providers themselves are responsible for the further processing there. Google Maps Platform (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): Only after you have confirmed the data notice in the registration form or in the self-service area does your browser, when you enter your cooking address, send the characters entered, your IP address and technical browser data to Google in order to display address suggestions. The platform determines the coordinates of the cooking address from the address suggestion selected; Google receives only the data stated above in this process (characters entered, IP address, browser data), no names. Addresses are converted into coordinates on the server only for data imports, likewise without names. The route email contains a map image which your email program loads from Google when it displays or loads the images; in the process, Google receives the reader’s IP address and the coordinates of the three cooking locations on the route. The image address contains no names. If your email program loads images via a Google service (such as Gmail), Google may be able to attribute the retrieval to your account; some programs load images as soon as the email is received. If you switch off the loading of images in your email program, this transmission does not take place; the map image is then not displayed, and the information on the route is in the text of the email. The legal basis is our legitimate interest in recording addresses correctly, in plausible journeys and in a clear route map for the teams (Art. 6(1)(f) GDPR). Google may transfer data to the USA; according to Google, the EU-US Data Privacy Framework and the standard contractual clauses apply to this (section 11).

basemap.de (Federal Agency for Cartography and Geodesy (Bundesamt für Kartographie und Geodäsie), Richard-Strauss-Allee 11, 60598 Frankfurt am Main, Germany): The map of the event area in the registration form is initially collapsed. Only when you expand it does your browser load map tiles from basemap.de; in the process, the Federal Agency receives your IP address, your browser identifier and the map section displayed. The servers are located in Germany. The legal basis is our legitimate interest in showing you before registration whether your cooking address is within the event area (Art. 6(1)(f) GDPR).

Storage on your device. The registration platform only stores the following entries in your browser that are strictly necessary for registration and the self-service area (Section 25(2) no. 2 TDDDG): in session storage, the note that you have confirmed the data notice (until you close the tab); in local storage, the chosen language, German or English, only if you have changed the language; in the administration area, which only administrators of our association use, the sign-in session and working settings. The platform does not set any cookies. Your browser loads the payment component from PayPal only after you have clicked “Register with obligation to pay”; in the process, PayPal receives technical device data and your IP address. The component creates an entry with a random identifier in your browser’s local storage, which serves to process and secure the payment. We integrate the component because the payment you want would otherwise not be possible (Section 25(2) no. 2 TDDDG); PayPal itself is responsible for the processing by PayPal (section 5.6).

 

7. Photos and videos

At the closing event and in public event areas, we and photographers commissioned by us take overview and atmosphere photographs and video recordings. We do not take any photographs or recordings in the hosts’ homes. We use recordings in which people appear only as part of a crowd or incidentally for reporting and for promoting future Laufgelage events on our website and our social media profiles; the legal basis is our legitimate interest in documenting and promoting the event (point (f)). We only publish recordings in which you can be individually recognised with your consent (point (a)), which you give when registering or on site and can withdraw at any time. You can object to being photographed or filmed on site; we will then not publish any recording in which you can be recognised.

“@goldenerkochloeffel” photo competition. You take part in the competition by sending a photo of your dish that shows the current semester to our Instagram account @goldenerkochloeffel by direct message, together with your team name, the course and a short description of the dish. We use this information only internally to assign the entries, to check from the team name and the allocation whether you took part in the Laufgelage and cooked the course, to detect manipulation of the vote, for example by automated accounts, and to run the competition (points (b) and (f)); we usually delete the direct messages after the Laufgelage, at the latest 30 days afterwards. We publish the photos of the dishes, combined into collages by course, as an Instagram story for our followers to vote on and then permanently in the story highlights of the respective Laufgelage; your name and your profile are not mentioned. If people can be recognised in a photo, we only publish it if we have their consent (point (a)); please send it to us with your entry, a short message from the person shown is sufficient. Without it, we will not include the photo in the collage. We base the continued display in the story highlights on our legitimate interest in documenting the competition (point (f)); if you ask us at datenschutz@laufgelage.de, we will remove your photo without undue delay (section 14). We visit the winners in person and present a prize; for this we ask for their address, which we use only for this purpose and delete after the visit (point (b)). Only with your consent do we take a photo of you with your dish on this occasion and publish it as a post on Instagram (point (a)); we obtain the consent by direct message and keep this message as proof, notwithstanding the deletion of the other direct messages, for as long as the photo is published and, after a withdrawal, for three years from the end of the calendar year of the withdrawal (section 12); the photo remains visible until you withdraw your consent. Meta is responsible for the processing on Instagram itself (section 9).

 

8. Contacting us

If you email us (kontakt@laufgelage.de, datenschutz@laufgelage.de), we process your address and the content of the message to answer your enquiry. The legal basis is the participation contract insofar as your enquiry concerns it (point (b)), and otherwise our legitimate interest in answering enquiries (point (f)). Our mailboxes are operated on our behalf by STRATO GmbH (section 3.1). We delete the messages once the enquiry has been dealt with and there is no obligation to retain them.

If you use our contact form, we process the information you enter there for the same purpose and on the same legal basis. The form stores the entries in our website’s database at STRATO and forwards them to us via the STRATO email server. We delete the entries from the website’s database as soon as your enquiry has been dealt with, at the latest after six months. You will receive an automatic acknowledgement of receipt for messages sent to datenschutz@laufgelage.de.

 

9. WhatsApp community, Instagram and LinkedIn

We run a WhatsApp community, the Instagram profiles @laufgelage and @goldenerkochloeffel and a LinkedIn page for the Laufgelage. WhatsApp and Instagram belong to Meta (WhatsApp Ireland Limited and Meta Platforms Ireland Limited, Dublin, Ireland), which are themselves responsible for the processing in their services; data may be transferred to the USA in the process. Joining the WhatsApp community is voluntary and not a requirement for taking part; you will also receive all important information by email. By joining, you consent to your telephone number and profile name being visible to us as administrator and, depending on the community settings, to other members (point (a)); you can leave the community at any time. We run our Instagram profiles on the basis of our legitimate interest in communicating with participants and interested persons via the channels they use (point (f)). We are jointly responsible with Meta for the statistics on these profiles that Meta provides to us (Art. 26 GDPR); Meta has undertaken to fulfil the rights of data subjects in this respect. You can find the essence of this arrangement at https://www.facebook.com/legal/terms/page_controller_addendum .We run our LinkedIn page for the same reason (point (f)); the provider is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. We are jointly responsible with LinkedIn for the page statistics (Art. 26 GDPR); LinkedIn has assumed responsibility for fulfilling the rights of data subjects in this respect https://www.linkedin.com/legal/user-agreement. Section 11 applies to transfers to the USA.

 

10. Recipients at a glance

 

• • our platform service provider and its subprocessors (section 6), our web host and email provider STRATO, each bound by our instructions;
  • Google Maps Platform (Google Ireland Limited, Dublin, Ireland) for address suggestions, the conversion of addresses in data imports and the map image in the route email, and basemap.de (Federal Agency for Cartography and Geodesy, Frankfurt am Main, Germany) for the map of the event area, each as an independent controller (section 6);
  • other participants to the extent described in section 5.5;
  • PayPal for payment (section 5.6);
  • with your consent, the drinks sponsor (section 5.10);
  • the members of our association entrusted with running the event, insofar as they need the data for their task;
  • authorities, courts or our legal advisers, if we are obliged to do so or if this is necessary to establish or defend legal claims.

We do not sell your data and do not pass them on to third parties for advertising purposes, except, with your consent, to the drinks sponsor for its visit (section 5.10).

 

11. Transfers to countries outside the EU

Some of the providers mentioned or their parent companies are based in the USA (Google LLC, Meta Platforms, Inc., LinkedIn Corporation). Where data reach the USA in this context, we rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) insofar as the recipient is certified under it, and otherwise on the Commission’s standard contractual clauses (Art. 46(2)(c) GDPR). Certification status: Google LLC as at 8 October 2026, including the UK and Swiss extensions; Meta Platforms, Inc. and LinkedIn Corporation. Where our processors transfer data to the USA, you can obtain a copy of the standard contractual clauses by contacting datenschutz@laufgelage.de; for Google Maps Platform, Meta and LinkedIn as independent controllers, we refer to the information in their privacy policies.

 

12. How long we store your data

 

Data	Storage period
Registration, address, route, ticket and waiting list data	Deletion or anonymisation no later than eight weeks after the event
Allergies, intolerances and preferences	14 days after the event; earlier if consent is withdrawn
Form entries during the payment process	90 minutes
Payment and reimbursement records	Insofar as we are obliged to retain them under tax law, eight years from the end of the calendar year (Section 147(1) no. 4, (3) and (4) AO)
Entries of a registration rejected because of the blocklist (from implementation of the automatic check)	Immediate deletion
Blocklist	Two years, for serious breaches up to five years from the decision; deletion upon expiry or lifting, for technical reasons at the latest within 14 days
Newsletter	Until consent is withdrawn; requests without confirmation 30 days
Storage beyond the event and course history	Twelve months after the end of the event; immediately if consent is withdrawn
Records of consents	Records relating to the registration (name, email address, wording, language and version, and type and time of the consent or confirmation and of any withdrawal): exported to us before the event data are deleted, kept by us for three years from the end of the calendar year in which the consent was given or withdrawn, deleted at the service provider together with the event data; records relating to the newsletter: at the service provider three years from the end of that calendar year, on termination of the contract handed over to us
Website server logs	Access logs six weeks, error logs five days
Registration platform server logs	30 days
Backups	30 days on a rolling basis; deletions take effect in the backups when the backups expire
Published photos and videos	Until consent is withdrawn or you object (section 14)

We keep anonymised evaluations from which no person can be identified any longer without a time limit.

 

13. Your rights

You have the right of access to your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18) and to data portability (Art. 20). You can withdraw any consent at any time with effect for the future (Art. 7(3)); the processing carried out until then remains lawful. To do so, please contact datenschutz@laufgelage.de.

You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority responsible for us: Bayerisches Landesamt für Datenschutzaufsicht (Bavarian Data Protection Authority), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

 

14. Your right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your data that we base on our legitimate interest (Art. 6(1)(f) GDPR); this applies in particular to the blocklist (section 5.9) and to overview photographs and recordings (section 7). We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (Art. 21(1) GDPR). Please send your objection informally to datenschutz@laufgelage.de.

 

15. Obligation to provide data; no automated decision-making

We need the data marked as mandatory to conclude and perform the participation contract. Without them, you cannot take part. All other information is voluntary.

The platform allocates the teams to courses and routes using an algorithm. This is an organisational assignment, not a decision that produces legal effects concerning you or similarly significantly affects you; the board can change the allocation at any time. The check against the blocklist also merely implements a decision previously taken by the board; you can request at any time that a person review the check and the ban (section 5.9). No decision based solely on automated processing within the meaning of Art. 22 GDPR takes place.

 

16. Changes

We update this policy when our processing or the legal situation changes. The version published on this page applies; we will inform you by email about significant changes that affect your current registration.