Privacy Policy
This privacy policy explains how we handle your personal data when you visit dehathon.com, sign up for our newsletter or register for the event.
1. Controller
Controller for the processing of data on this website: Deha e.V. Chair of the board: Fatma Balci Phone: +49 163 7727642 Email: info@deha.academy You'll find full provider information in the Imprint.
2. General information
We process personal data exclusively on the basis of the GDPR and the German Federal Data Protection Act (BDSG). Personal data is any information that can be used to identify you. Processing is based on consent (Art. 6 (1) (a) GDPR), the performance of a contract or pre-contractual measures (lit. b), or our legitimate interests (lit. f), in particular in operating the website securely and reliably. Data transmitted over the internet (e.g. by email) may have security gaps. Complete protection against access by third parties is not possible.
3. SSL / TLS encryption
For security this site uses SSL/TLS encryption. You can spot an encrypted connection by the https:// prefix in your browser's address bar and the lock icon.
4. Your rights
You always have the right to: • information about the data we store about you (Art. 15 GDPR) • correction of incorrect data (Art. 16 GDPR) • erasure (Art. 17 GDPR) • restriction of processing (Art. 18 GDPR) • data portability (Art. 20 GDPR) • object to processing (Art. 21 GDPR) • withdraw consent at any time with effect for the future (Art. 7 (3) GDPR) • lodge a complaint with a supervisory authority For any of the above, a plain email to info@deha.academy is enough. Responsible supervisory authority: Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstr. 20, 70173 Stuttgart, Germany.
5. Hosting · Vercel
This website is hosted on the cloud platform of Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you visit the site, Vercel processes technically required server log data: IP address, date and time of the request, transferred data volume, browser type, operating system, referrer URL. Legal basis: Art. 6 (1) (f) GDPR — our legitimate interest in a secure, performant and reliable delivery of the website. A data processing agreement (DPA) is in place with Vercel. For transfers to the USA, Vercel relies on the EU Standard Contractual Clauses (Art. 46 GDPR). Details: vercel.com/legal/privacy-policy and vercel.com/legal/dpa.
6. Vercel Analytics
We use Vercel Analytics for aggregated reach measurement, but only after you consent in the cookie banner. Vercel Analytics is cookieless: no cookies are set, no device fingerprints are created, and no personal identifiers are stored. Only anonymized usage statistics (page views, time on site, country) are collected. Legal basis: § 25 (1) TDDDG together with Art. 6 (1) (a) GDPR (consent). Transfer to the USA is covered by the EU Standard Contractual Clauses (Art. 46 GDPR). You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer.
7. Newsletter · Early notifications
If you sign up for updates via the form, we store your email address in order to notify you when registration opens and about the event itself. The data is stored in our database (Supabase, EU region). Legal basis: your consent under Art. 6 (1) (a) GDPR. You can withdraw your consent at any time by sending an email to info@deha.academy — we'll delete your address without delay. At the latest 12 months after the event, newsletter addresses without further relation will be deleted.
8. Event registration
For event registration we process first and last name and email address. For players, we also process mobile number, current occupation, the three preferred districts, how you heard about the Dehathon, and optional details on school, university or company, focus, team and notes. These data are required to organize your participation, contact you and form teams. To coordinate the tournament day, we may invite you to a WhatsApp group for your team using your mobile number. Other group members will see your number, and WhatsApp (WhatsApp Ireland Limited, Meta) processes it under its own privacy policy. Joining the group is voluntary and you can leave it at any time. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual measures and contract performance). Data are stored in Supabase (EU region Frankfurt). A data processing agreement is in place with Supabase. At the latest 12 months after the event, registration data will be deleted unless legal retention obligations apply.
9. Photos and videos at the event
During the event, we and photographers commissioned by us take photos and videos in which players, visitors, experts and speakers may be recognizable. We publish these recordings to document and promote the Dehathon, e.g. on this website, on our social media channels (Instagram, LinkedIn) and in press coverage. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in documenting and publicizing our event). We also point out the recordings on site. If you do not want to be photographed or filmed, please let the organizing team or the photographers on site know. You can object to the publication of recordings in which you are recognizable at any time (Art. 21 GDPR); an informal email to info@deha.academy is sufficient.
10. Database · Supabase
For storage and authentication we use Supabase (Supabase Inc., hosted in the EU region Frankfurt am Main, AWS Frankfurt). Only the newsletter and registration data described above as well as admin logins are processed. A data processing agreement (Art. 28 GDPR) is in place.
11. Email delivery · Resend
For sending confirmation and status emails (e.g. registration received, approval, waitlist) and for notifying our organizing team internally about new registrations, we use Resend (Resend, Inc., 2261 Market Street #4667, San Francisco, CA 94114, USA). Resend processes your name, email address and the content of the respective email. Legal basis: Art. 6 (1) (b) GDPR (event organization and pre-contractual measures). A data processing agreement (DPA) with Resend is in place; for the transfer to the US we rely on the EU standard contractual clauses (Art. 46 GDPR). Details: resend.com/legal/privacy-policy and resend.com/legal/dpa.
12. Cookies & consent management
This site does not set tracking cookies. On your first visit we show a cookie banner with two equally weighted options (Accept all / Reject all) plus a detail layer for granular control. Categories: • Essential: technically necessary browser storage (localStorage keys “dehathon-tweaks” for theme/audio preferences, “dehathon-consent” for your cookie choice). These values never leave your device. • Analytics (optional): Vercel Analytics, see section 6. Your choice is stored locally in your browser (key “dehathon-consent”) and re-prompted after no more than 12 months. You can change or fully withdraw your consent at any time via the “Cookie settings” link in the footer. Legal basis for non-essential storage: § 25 (1) TDDDG together with Art. 6 (1) (a) GDPR.
13. Fonts
The fonts used on this website (Anton, Space Grotesk, JetBrains Mono) are loaded locally via Next.js. There is no connection to servers operated by Google or other providers.
14. Admin access
For the protected admin area we use Supabase Auth (email + password). Access is restricted to authorized persons only. Authentication data are stored encrypted.
15. External links
In the footer we link to our LinkedIn and Instagram profiles. Merely visiting our page does not transmit any data to these platforms. Only when you actively click on one of the links is a connection to the respective platform established; from that point on the privacy policy of the platform applies.
16. Embedded videos · Google Drive
On the “Dehathon Promo” page we embed a video stored on Google Drive (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The video only loads once you actively click “Load video”. Only then is a connection to Google established, and Google processes, among other things, your IP address and browser information; this may include a transfer to the USA. Legal basis: Art. 6 (1) (a) GDPR (your consent given by clicking). Details: policies.google.com/privacy.
17. Changes to this policy
We reserve the right to update this privacy policy so that it always meets the latest legal requirements or to reflect changes to our services. The current version applies to your next visit.