Last updated: 23 September 2026
1. Controller
The controller for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:
CS Congress Service GmbH
Hausen 13
85551 Kirchheim
Germany
Phone: +49 89 670028-0
E-mail: info@congress-service.de
Managing Director: Robert Pekar
Register court Munich, HRB 241177
VAT ID: DE815762671
For any question about data protection, to exercise your rights or to ask about a specific processing activity, please use the contact details above.
2. Scope
This privacy policy applies to the website www.congress-service.de including all its subpages and language versions, as well as the online catalogue it contains. It does not apply to other providers’ websites that we merely link to. For data processed in connection with specific orders, rental and purchase contracts, the information in our contract documents applies in addition.
3. Definitions
This policy uses the terms defined in the GDPR. The most important ones are:
- Personal data is any information relating to an identified or identifiable natural person, such as name, address, e-mail address or IP address.
- Processing is any operation performed on personal data, for example collecting, storing, using, transmitting, restricting or erasing it.
- Data subject is any person whose personal data is processed, in this case above all you as a visitor to this website.
- Controller is the body that decides on the purposes and means of processing. That is us, see section 1.
- Processor is a service provider that processes data on our behalf and on our instructions, such as our hosting provider.
- Recipient is any body to which data is disclosed, whether or not it is a third party.
- Third party is any body other than the data subject, the controller and the processor.
- Consent is your freely given, informed and unambiguous agreement to a specific processing activity, which you may withdraw at any time with effect for the future.
- Pseudonymisation means that data can no longer be attributed to a person without the use of additional information.
- Profiling is the automated evaluation of personal data in order to assess or predict personal aspects. No such profiling takes place on this website.
4. Legal bases for processing
We only process personal data where there is a legal basis for doing so. The following may apply:
- Art. 6(1)(a) GDPR – your consent, for example for non-essential cookies and for loading external content.
- Art. 6(1)(b) GDPR – performance of a contract or pre-contractual measures, for example for enquiries and orders.
- Art. 6(1)(c) GDPR – compliance with legal obligations, for example commercial and tax retention requirements.
- Art. 6(1)(f) GDPR – our legitimate interest, for example in the secure and trouble-free operation of this website.
Where we obtain consent, we say so at the relevant point. Storing information on and reading it from your device is additionally governed by section 25 of the German TDDDG. Technically necessary storage takes place without consent under section 25(2) TDDDG; anything else only with your agreement.
5. Hosting and server log files
This website is hosted by an external service provider (Hostinger International Ltd., Cyprus). The host processes the data arising when the website is accessed on our behalf and on our instructions, as a processor.
Each time the site is accessed, data transmitted by your browser is automatically stored in what are known as server log files:
- IP address of the requesting device
- date and time of access
- page or file requested and volume of data transferred
- message indicating successful retrieval (status code)
- browser type, browser version and operating system
- previously visited page (referrer), where transmitted
This data is technically necessary in order to deliver the website, to ensure its stability and security and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR. We do not merge this data with other data sources.
6. Encryption
This website uses TLS encryption. You can recognise this by the address bar of your browser starting with “https://” and by the padlock symbol. Data you transmit to us cannot readily be read by third parties.
7. Cookies and consent management
Cookies are small text files stored on your device. We distinguish between:
- Necessary cookies, without which the website does not work, for example for the shopping cart, the language setting and storing your cookie choice.
- Preference cookies, which remember settings such as the language you selected.
- Statistics and marketing cookies, which we only set with your consent.
To obtain and document your consent we use the consent management tool Complianz. It stores your choice in your browser and only loads content requiring consent once you have agreed. The cookies it sets are technically necessary; the legal basis is Art. 6(1)(f) GDPR in conjunction with section 25(2) TDDDG.
Which cookies are used in detail, with name, purpose and lifespan, is set out in our Cookie policy (EU). There, and through the “Manage consent” link at the bottom of every page, you can change or withdraw your choice at any time with effect for the future. You can also delete cookies in your browser or restrict their storage from the outset. In that case some functions of the website may not be available to you.
8. Contacting us
Our contact page does not offer a form; it states our telephone number and e-mail address. If you write or call us, we process the details you provide, in particular your name, contact details and the content of your enquiry, in order to answer it.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to entering into or performing a contract, otherwise Art. 6(1)(f) GDPR based on our legitimate interest in answering enquiries. Your enquiry remains stored with us until it has been dealt with conclusively and there is no reason to keep it further. Where it constitutes business correspondence, the statutory retention periods apply, see section 16.
To send e-mails from the website, for example system notifications, we use an external mail server. Transmission is encrypted.
9. Online catalogue and shopping cart
Our product overview is based on the WooCommerce shop software. You can view items and place them in a shopping cart. A technically necessary cookie is set for this, which assigns the contents of your cart to your session.
Registration as a customer is not possible, and no payment service provider is currently activated. No payment is therefore processed through the website. Rentals, purchases and services are handled outside this website by way of quotation, order confirmation and invoice. Should we activate an ordering and payment function in future, we will add the service providers then used to this policy.
The legal basis for the cart function is Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
10. Website security
To protect against attacks we use the security software Wordfence. It checks access to the website, detects suspicious patterns and blocks attempted attacks. In doing so it evaluates and logs, for a limited period, in particular the IP address, the time, the address requested and the browser identifier.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in fending off attacks and in the security of our systems.
11. Language setting and page building
We use the Polylang extension to deliver content in two languages. It stores your language choice in a cookie so that your next visit opens in the language you last selected. We use the Elementor page builder to design individual pages. Both components run on our own server, so no transfer to third parties results from them.
12. Google fonts and maps
Google Fonts may be embedded for a consistent display of typefaces. When such a font is loaded, your browser establishes a connection to Google servers and your IP address is transmitted. The same applies to embedded map material from Google Maps.
This content is only loaded after you have consented through the cookie notice. The legal basis is Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. A transfer to the USA cannot be ruled out. Further information is available in Google’s privacy policy at https://policies.google.com/privacy.
13. Automattic and Jetpack
We use the Jetpack extension provided by Automattic Inc., 60 29th Street #343, San Francisco, CA 94110, USA. The active components are shop analytics and the Blaze advertising module. Technical access data such as IP address and browser identifier may be transmitted to Automattic in the process.
Where cookies are set or read in this context, this only happens with your consent under Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. Information from the provider is available at https://automattic.com/privacy/.
14. Other integrated services
Our website additionally has interfaces to the following providers:
- Meta Platforms Ireland Ltd., Dublin – a connection of the product catalogue to Facebook. Visitor tracking via a Facebook pixel is not set up on this website. Information: https://www.facebook.com/privacy/policy
- Intuit Inc. (Mailchimp), USA – a connection for sending messages to recipients who have given us their consent. Without your express sign-up, your data is not transmitted to Mailchimp. Information: https://www.intuit.com/privacy/statement/
A web analytics service such as Google Analytics is not in use on this website.
15. Recipients, processing on our behalf and transfers to third countries
We only pass on your data where this is necessary for the purposes described, where you have consented or where we are legally obliged to do so. Recipients are in particular our hosting provider, IT service providers and the providers named in this policy. Where service providers process data on our behalf and on our instructions, data processing agreements under Art. 28 GDPR are in place.
Where data is transferred to providers in the USA, we rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework where the provider is certified, or on standard contractual clauses under Art. 46(2)(c) GDPR. Third countries may not offer a level of data protection equivalent to the European one, and access by government authorities cannot be entirely ruled out.
16. Retention periods
We store personal data only for as long as is necessary for the respective purpose. After that we erase it, unless a statutory retention obligation applies. As a guide:
- server log files: short term, usually a few days to weeks
- security logs: until the security purpose no longer applies
- enquiries without contractual relevance: until they have been dealt with conclusively
- commercial letters and tax-relevant documents: six and ten years respectively under sections 257 HGB and 147 AO
- record of your cookie choice: up to one year, after which you are asked again
17. Your rights
You have the following rights vis-à-vis us:
- Access under Art. 15 GDPR as to whether and which data we process about you
- Rectification of inaccurate or incomplete data under Art. 16 GDPR
- Erasure under Art. 17 GDPR, unless a retention obligation applies
- Restriction of processing under Art. 18 GDPR
- Data portability under Art. 20 GDPR in a common, machine-readable format
- Withdrawal of consent under Art. 7(3) GDPR with effect for the future
- Complaint to a supervisory authority under Art. 77 GDPR
Right to object under Art. 21 GDPR: where we process data on the basis of legitimate interests, you may object to that processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims.
The supervisory authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany. You may also contact the supervisory authority where you are located.
18. No automated decision-making
Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.
19. Obligation to provide data
You are under no obligation to provide us with personal data. However, without the details required for an enquiry or a contract we cannot deal with your request.
20. External links
Our website contains links to other providers’ websites. We have no influence over their data processing. The privacy information of the respective provider applies there.
21. Changes to this privacy policy
We adapt this privacy policy whenever the legal situation, our services or the data processing on this website change. The version published here applies in each case.