Who is responsible

BSides Berlin is run by Tick Tech Talks UG (haftungsbeschränkt), Danneckerstr. 14, 10245 Berlin, Germany ("we", "our", "us"). For any question about your data, write to contact@bsides.berlin. This policy explains how we handle your personal data when you use this website, buy a ticket, register as an attendee, or pick up your badge.

Website

This website is static. We set no cookies and run no analytics or advertising. The website is hosted on GitHub Pages by GitHub, Inc., San Francisco, USA. GitHub records the IP address of each visitor in its server logs for security reasons. GitHub is certified under the EU-U.S. Data Privacy Framework. See GitHub Pages data collection and the GitHub privacy statement.

The venue section embeds a Google Maps map. When that section loads, your browser sends your IP address to Google Ireland Limited, Dublin, Ireland. Google's privacy policy: policies.google.com/privacy. The icon font is loaded from the jsDelivr content delivery network, which also receives your IP address: jsDelivr privacy policy. Legal basis for these: Art. 6(1)(f) GDPR (our legitimate interest in showing the venue and displaying the site).

Links to YouTube, X and LinkedIn are plain links. Nothing is loaded from those services until you click.

Tickets and registration

Ticket sales, attendee registration, ticket delivery and badge pickup for BSides Berlin 2026 (12-13 November 2026, CIC Berlin) run on tickets.gophercon.eu. This is the ticketing service of Tick Tech Talks UG (haftungsbeschränkt), which also runs GopherCon Europe. We wrote it and we run it. All emails about your order and ticket are sent from tickets@gophercon.eu on behalf of BSides Berlin, with contact@bsides.berlin as the reply address. The service has no analytics and sets no cookies for buyers or attendees. The only cookie is a sign-in cookie for our door team at the venue.

Buying a ticket

You pay on a Stripe payment link. Stripe Payments Europe, Ltd. (Dublin, Ireland) processes the payment and issues the invoice on our behalf. Stripe processes the buyer's name, email address, billing address and payment data. Stripe is the only party that sees card data. We do not store card data. After payment, Stripe notifies our server. Our server stores the order (buyer name, email address, billing address, invoice number and amount, ticket type and number of tickets) and emails the buyer the invoice PDF and one registration link per ticket. Legal basis: Art. 6(1)(b) GDPR (performance of a contract). We keep invoice and order data for 10 years under § 147 AO and § 257 HGB. Stripe's privacy policy: stripe.com/en-de/privacy.

Registering an attendee

Each attendee opens their registration link and enters their name, company or employer, email address and the country where they work. We store these four details with the ticket. Name and company are printed on the badge. The attendee then receives a ticket PDF with a QR code by email. If buyer and attendee are different people, the buyer is in CC of the ticket email. Legal basis: Art. 6(1)(b) GDPR.

Anonymous statistics

The registration form also asks for company size, job title, years of Go experience, years of AI experience, tech stack and which conference days you plan to attend. These answers are stored without any link to you or your ticket. We use them only for anonymous statistics and for the headcount per day. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in planning the event and reporting on it in anonymous form).

Special requests

The optional "special requests" field (for example dietary needs or accessibility) is stored with the ticket and used only for catering and accessibility planning. By filling it in you consent to this use under Art. 6(1)(a) GDPR, and under Art. 9(2)(a) GDPR where the text reveals health data. You can withdraw this consent at any time by email to contact@bsides.berlin. We then delete the entry.

Newsletter checkbox

The registration form has an optional checkbox to subscribe to the GopherCon Europe newsletter on Substack. We store only the yes/no flag with the ticket. If you tick it, we import your email address into Substack. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw at any time by email to contact@bsides.berlin or with the unsubscribe link in every newsletter. Substack's privacy policy: substack.com/privacy.

Badge pickup at the venue

At the venue, our staff open the QR link of your ticket and record the badge pickup with a timestamp and the name of the staff member who scanned it. Staff can export CSV lists of attendees for badge printing and for the attendance records. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running the event and keeping attendance records).

How long we keep attendee data

Attendee data (name, company, email address, country, badge pickup) is kept for the attendance records and deleted at the latest 12 months after the event. Invoice and order data is kept for 10 years as described above. Anonymous statistics contain no personal data and are kept.

Processors for the ticketing service

These companies process data on our behalf under data processing agreements:

• Stripe Payments Europe, Ltd., Dublin, Ireland: payment and invoicing. stripe.com/en-de/privacy
• Neon, LLC, a Databricks, Inc. company, San Francisco, USA: hosts our Postgres database in the AWS region eu-central-1 (Frankfurt, Germany). Databricks, Inc. and Neon, LLC are certified under the EU-U.S. Data Privacy Framework, and the EU Standard Contractual Clauses apply in addition. neon.com/privacy-policy, neon.com/dpa
• Plus Five Five, Inc. (Resend), San Francisco, USA: sends the transactional emails (invoice and registration email, ticket email) from tickets@gophercon.eu. Transfers are covered by the EU Standard Contractual Clauses that are part of Resend's data processing addendum. resend.com/legal/dpa
• Hetzner Online GmbH, Gunzenhausen, Germany: hosts the server in its data centre in Nuremberg, Germany. hetzner.com/legal/privacy-policy

Email

Emails you send to contact@bsides.berlin, including replies to ticket emails, are stored in our mailbox at our email provider, Namecheap, Inc. (Private Email). Namecheap's privacy policy: namecheap.com/legal/general/privacy-policy. Legal basis: Art. 6(1)(b) or (f) GDPR, depending on the content of your message.

Photos and video

We photograph and film the event and may publish the material, including talk recordings on YouTube. Tell us at the registration desk or by email if you prefer not to appear in photos.

Your rights

Under the GDPR you have the right to access, rectify and erase your personal data, to restrict or object to its processing, and to data portability, each within the limits of the law. Where processing is based on your consent, you can withdraw it at any time with effect for the future. To exercise these rights or for any concern about your data, write to contact@bsides.berlin. You also have the right to lodge a complaint with a supervisory authority, in our case the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Changes to this policy

We may update this policy from time to time. Changes are posted on this page.

Last updated: 13 October 2026