Privacy notice

Who is responsible

Hack&More is the event platform of Manage & More's hackathons. The controller for the personal data it processes is:

UnternehmerTUM GmbH
Lichtenbergstraße 6
85748 Garching b. München
Germany

You can reach us about your data at privacy@hackandmore.de, and about anything else at hello@hackandmore.de.

UnternehmerTUM GmbH has appointed a data protection officer, whom you can also contact directly:

Alexander Stolberg-Stolberg, SVF Lawyers
Oberanger 30
80331 Munich
Germany
Email: stolberg@unternehmertum.de

What Hack&More stores

Hack&More keeps only what running a hackathon needs:

• Your name and email address. They come from the guest list of the hackathon you registered for on Luma. When an admin imports that list, Hack&More reads three of its columns only: your name, your email address and whether your registration was approved. Everything else in the export is ignored and never stored.
• Your activation and check-in. When you activated your account, which version of the terms you accepted, and when you checked in at the venue.
• Your sessions. When you log in, Hack&More keeps a session so you stay logged in. It stores no IP address and no details about your device with it.
• Your login requests. When you asked for a login code or link, so the code can be checked and requests can be limited.
• Email delivery records. Which kind of email was sent to you, when, and whether it was delivered. Hack&More does not keep the address, the subject or the text of an email once it has been sent.
• The audit log. Which account changed what and when, recorded by account and record ids only, never with names, email addresses or free text.
• Server logs. Technical records of each request, which hold no names, email addresses or login codes.
• Judge links. The name an organizer gives each judge's link, and each time the link was opened, with the time and the kind of device (such as "Safari on iPhone"), never an IP address.

Admins and desk staff also have an account with their name and email address and the roles they hold. Judges have no account.

Why, and on which legal basis

• To run the hackathon you registered for (Art. 6 (1) (b) GDPR): importing the guest list, activating your account, logging you in, checking you in, sending you the emails about the hackathon and showing you what the hackathon offers.
• To keep the platform secure and working (Art. 6 (1) (f) GDPR): limiting repeated login attempts, keeping the audit log, keeping server logs and reporting errors. Our legitimate interest is a platform that cannot be misused and that we can repair quickly on the day of an event.

Who can see your data

The organizers of a hackathon see the names and email addresses of its participants. For team requests, checked-in participants see the names and masked email addresses of the hackathon's activated participants. The public gallery of a hackathon shows the names of team members; you can hide your name, or delete your account, and you then appear as "Private user" while the project stays. Links to repositories and videos in the gallery stay under their owners' control, who can make them private at any time.

Cookies and public pages

When you log in, the app sets one session cookie, which is strictly necessary to keep you logged in (§ 25 (2) No. 2 TDDDG). The public pages, such as this privacy notice, the Impressum and the pages of each hackathon, set no cookie and load nothing from other sites. Images on a hackathon's page are served from Hack&More's own copy, so opening a page sends nothing to the site an image came from. External videos and other embeds load only after you click them.

Processors

Hack&More uses the following service providers, each bound by a data processing agreement. Where a provider offers an EU region, Hack&More uses it.

• Fly.io hosts the app, its database and its logs in Frankfurt, Germany (fra). Fly.io is a US company, so access from the United States is possible. Transfer basis: the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
• Tigris, provided through Fly.io, stores uploaded files. Hack&More's files are kept in a single region in Frankfurt, Germany (fra). Transfer basis for any access from the United States: the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise the EU Standard Contractual Clauses.
• Resend sends Hack&More's emails from Ireland (eu-west-1) and keeps their delivery data for 30 days. Its primary processing takes place in the United States. Transfer basis: the EU-U.S. Data Privacy Framework and the EU Standard Contractual Clauses.
• Cloudflare answers the DNS queries for the hackandmore.de domain on its global network and receives the domain's email reports, which hold sending servers and counts but no message content. Transfer basis: the EU-U.S. Data Privacy Framework and, otherwise, the EU Standard Contractual Clauses.
• GitHub hosts Hack&More's source code and runs its tests and deploys. It receives no data about participants. Transfer basis: the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise the EU Standard Contractual Clauses.
• Discord receives Hack&More's error reports and alerts, which carry the kind of error, the page, a request id and a count, and never any personal data. Transfer basis: the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise the EU Standard Contractual Clauses.
• Apple iCloud receives the email you send to Hack&More's addresses. Transfer basis: the EU-U.S. Data Privacy Framework where the provider is certified, and otherwise the EU Standard Contractual Clauses.

How long Hack&More keeps it

• People who took part keep their account and projects until they delete them, since that is their history and the public record of the hackathon.
• People who were imported but never activated their account or checked in are deleted six months after the hackathon ends.
• Sessions are deleted once they expire.
• Login requests and the email records that belong to them are deleted after 30 days.
• Delivery reports from the email provider (whether an email was delivered or bounced) are deleted after 30 days.
• Judge links with their names are deleted 90 days after the link ended, and the record of each time a link was opened 90 days after that opening.
• Server logs, with any IP addresses and device details they hold, are deleted after 90 days.
• Rows of an import that failed (a row with no email address, for example) are deleted 30 days after the import.
• Import runs, with their record of what each row changed, are deleted six months after the hackathon ends, together with the people who were never activated.
• Your previous email address, after an organizer changed it, is deleted once the notice to that address has been sent, and after 30 days at the latest.
• The audit log keeps its entries, which name accounts by id only, so once an account is deleted they no longer point to a person.

Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to receive it in a portable format (Art. 20) and to object to processing based on our legitimate interest (Art. 21). Write to privacy@hackandmore.de for any of them.

You can also complain to a data protection authority. The authority for UnternehmerTUM GmbH is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.