Privacy Policy

Effective date: 2026-06-08 — GSDS'26 (ONE DAY).

1. Data controller

ONE DAY · IBK · contact: privacy@onedayibk.at

2. Data we collect

Registration data: first/last name, email, phone, age confirmation, GDPR consent, role-specific data.
For attendees under 16: parental consent (file upload).
Event-day data: QR check-ins, station, time.
Optional: push subscription endpoint (if enabled).

3. Lawful basis

Consent (Art. 6(1)(a) GDPR) and contract performance (Art. 6(1)(b)) for event participation.

4. Recipients

Email service: Resend. SMS service (volunteers/creatives): Twilio. Photo gallery: Pixieset. Instagram Graph API. All sub-processors operate within EU/EEA or under SCC.

5. Retention

Registration data: 12 months after event. Check-ins / audit log: 24 months. Push subscriptions: until revoked.

6. Your rights

Right to access, rectify, erase, restrict, portability, object — write to privacy@onedayibk.at.

7. Cookies

We use only strictly-necessary session cookies + locale preference. No advertising cookies.

8. Changes

This policy may be updated. We will post the new version here with a new effective date.

Imprint & privacy (PDFs) · Stay Safe — city & street tips