Privacy Statement

Last updated: 14 October 2026

1. Controller

First Contact e.V.
c/o Technische Hochschule Deggendorf
Dieter-Görlitz-Platz 1, 94469 Deggendorf, Germany
Phone: +49 151 46143069
Email: info@firstcontact-ev.de
Represented by the board: Anneliese Schützenberger (1st chair), Julian Süß, Alberto Gómez Conejero.

First Contact e.V. is not legally required to appoint a data protection officer. For any data protection request please write to the email address above.

2. Overview

This website presents the firstcontact career fair (floor plan, exhibitor list, fair guide) and offers a private area where exhibiting companies, the First Contact board and stand managers organise their participation. We only process personal data where it is needed for these purposes. We do not use advertising or tracking tools; visitor statistics are collected without cookies (see section 4) and we do not sell or pass on your data for marketing.

3. Hosting and server log files

The website runs on a virtual server in Microsoft Azure (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland), located in the Azure region “Spain Central” (EU). A data processing agreement under Art. 28 GDPR is in place with Microsoft.

When you visit the site, the server automatically stores: IP address, date and time of the request, requested page, referrer URL, browser type and version, and operating system. This is necessary to deliver the website and to keep it secure (Art. 6(1)(f) GDPR). Log files are deleted after 14 days at the latest unless they are needed to investigate a security incident.

4. Cookies and consent

We only use technically necessary cookies: login session (WordPress / Ultimate Member), language selection (Polylang) and the storage of your cookie choice (Complianz, cookies beginning with cmplz_, stored for 365 days). Legal basis is § 25(2) TDDDG and Art. 6(1)(f) GDPR. You can review or change your choice at any time via the “Manage consent” button. Details are listed in our Cookie Policy.

Fonts are hosted on our own server; no connection to Google or other font providers is made.

Visitor statistics: to understand how the website is used (e.g. how often the floor plan or the exhibitor list is viewed), we use Koko Analytics, which runs entirely on our own server. It sets no cookies, stores no IP addresses and creates no user profiles; it only counts page views, the visited page and the referring website, as aggregated figures. Visits by logged-in users are not counted. No data is passed to third parties. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving the website). The aggregated statistics are deleted after 24 months.

5. User accounts (private area)

Accounts are created by the First Contact board for exhibiting companies, board members and stand managers; there is no public registration. We process: name, email address, username, password (stored only as a hash), role and, for stand managers, a phone number. Purpose: access to the private area and organisation of the fair (Art. 6(1)(b) GDPR, and Art. 6(1)(f) GDPR for board members and stand managers acting for the association). Accounts are deleted when they are no longer needed, at the latest 12 months after the last fair the account was used for.

To protect logins against brute-force attacks we log failed login attempts with IP address and time and temporarily block an IP after repeated failures (Loginizer; Art. 6(1)(f) GDPR). These entries are deleted automatically after the lockout period.

6. Exhibitor and fair organisation data

For each exhibiting company we store company details (name, address, sector, website, languages spoken at the stand, stand number) and the people who attend the stand on fair day (name, whether they attend, meal choice: standard, vegetarian or vegan). Company details and stand numbers are published on the floor plan and exhibitor list because this is the purpose of the fair (Art. 6(1)(b) GDPR). Personal data of company staff is only visible to the company itself, its stand manager and the First Contact board.

Fair organisation data is deleted or anonymised at the latest 12 months after the fair, unless statutory retention periods (e.g. for invoices, § 147 AO) apply.

7. Contact by email or phone

If you contact us, we process the data you provide (e.g. name, email, message) to answer your request (Art. 6(1)(b) or (f) GDPR) and delete it once the request has been dealt with, unless statutory retention periods apply.

8. Backups

To prevent data loss, the First Contact board makes backups of the website manually when needed, for example before major changes and before the fair (UpdraftPlus). Backups are stored on the server and in a Google Drive account of the association (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). Transfers to Google LLC in the USA cannot be excluded; they are based on the EU–U.S. Data Privacy Framework adequacy decision and standard contractual clauses. Legal basis: Art. 6(1)(f) GDPR. Only the two most recent backups are kept; older ones are deleted automatically.

9. Recipients

Data is only passed on to the processors named above (Microsoft Azure hosting, Google Drive backups) and, for catering, to the catering provider (meal choice only). There is no other transfer to third parties or third countries.

10. External links

Our website links to external sites (e.g. the association’s Facebook page). Data is only transferred to these providers when you click the link; their own privacy policies apply.

11. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw any consent with effect for the future (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): where we process data on the basis of Art. 6(1)(f) GDPR you may object at any time for reasons arising from your particular situation.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

12. Security

The site is only accessible via encrypted HTTPS (TLS). Access to the private area is restricted by roles so that each user only sees the data they need.

13. Changes

We may update this privacy statement when the website or legal requirements change. The current version is always available on this page.