Privacy notice

This notice applies to the pinn website and – in section 5 – to the pinn application. For the data of an event’s guests, the privacy policy shown in that event applies in addition. The German version is authoritative.

1. Controller

Irgendwas mit Medien GmbH
Rüttenscheider Str. 14
45128 Essen

Represented by the managing directors Christian Boenisch and Jan Weiner
Email: irgendwas@imm.one

2. No cookies, no tracking

The website sets no cookies, uses no analytics or tracking services and embeds no third-party content. Fonts and graphics are loaded from our own server only.

3. Hosting and server log files

Website and application run on servers of IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, in a data centre in the EU; object storage and backups are in Germany. A data processing agreement under Art. 28 GDPR is in place with IONOS.

When a page is requested, the server processes technically necessary data: a shortened IP address (only the first two blocks of IPv4, the first 32 bits of IPv6), date and time, the address requested, status code, amount of data and browser identifier (user agent). Personal links are masked. The purpose is secure and stable operation, the legal basis our legitimate interest under Art. 6(1)(f) GDPR. Log files are deleted automatically after seven days at the latest.

4. Contact by email

When you email us – including our support (support@getpinn.de) – we process your details to answer your request (Art. 6(1)(b) or (f) GDPR). We delete them once they are no longer needed and no statutory retention obligations apply.

5. The pinn application

Who is responsible

For the data of an event’s guests, the organiser (our customer) is the controller. Irgendwas mit Medien GmbH processes it on the organiser’s behalf (Art. 28 GDPR). The privacy policy shown in the event applies.

Irgendwas mit Medien GmbH is itself responsible for organiser accounts and for the operation and security of the application. The legal basis is Art. 6(1)(b) GDPR (contract with the customer) and (f) (secure operation).

Signing up as an organiser

Organisers who sign up provide organisation, name and email address and accept our terms of use; we store the version and the time. To prevent abuse, the server briefly counts in memory how often sign-up was requested from an IP address or for an email address; this count is not stored and expires after one hour.

Organiser accounts

We store name, email address, role and organisation. The password is stored only as a hash, the two-factor secret encrypted; for passkeys only the public key is stored. The data is kept until the account is deleted or the contract ends.

Sign-in and cookies

For sign-in the application sets a technically necessary session cookie (§ 25(2) no. 2 TDDDG). A shortened IP address and the browser identifier are stored with the session. A session lasts at most 12 hours; expired sessions are deleted.

For guests the application sets technically necessary cookies that remember the personal guide link on the device. A device used as a check-in station gets its own device cookie after the PIN has been entered.

Access logs

For accountability we log who viewed, changed or exported which personal data and when – without IP addresses.

Profile photos and check-in

A profile photo is optional at registration and is only shown at check-in. There is no face recognition. The QR code on the badge contains only a random identifier, no personal data.

After a badge scan the check-in station only sees first and last name and the profile photo. Without a connection the station briefly keeps only the random badge identifier, check-in or check-out and the time in the browser (IndexedDB) until it syncs with the server; the entries are deleted afterwards.

For the final report pinn sums up an event's data (e.g. registrations, check-ins per hour and ticket category, countries). The report contains no names or email addresses and is available only to the event's organiser.

Encryption, backups and email

Data is transferred encrypted via TLS. Profile photos and logos are stored encrypted. Encrypted database backups are kept for at most 30 days. Application emails are sent via the email service Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), which receives the recipient address and the content of the email. A data processing agreement under Art. 28 GDPR is in place with Brevo. Organisers can set a sender name and reply address for guest emails per event. Emails contain no tracking and no read receipts.

Deletion

Organisers set a deletion period for each event. After it, the guests’ data – details, profile photos, consents, invitations and check-ins – is deleted automatically.

6. Third countries and profiling

No personal data is transferred to countries outside the EU or EEA. There is no automated decision-making, including profiling (Art. 22 GDPR).

7. Your rights

You have the right at any time to

• access the data we hold about you (Art. 15 GDPR),
• rectification (Art. 16), erasure (Art. 17) and restriction of processing (Art. 18),
• data portability (Art. 20).

Right to object (Art. 21 GDPR)

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR) – for example server log files or contact requests – you may object at any time on grounds relating to your particular situation. An informal message to the email address above is enough.

You can also complain to a data protection supervisory authority, for example the authority responsible for our registered office: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen, Kavalleriestraße 2–4, 40213 Düsseldorf, Germany.

8. Encryption

Website and application are served exclusively over HTTPS (TLS).

Last updated: October 2026