Privacy policy

The joint controller responsible for this website is

Messe München GmbH
Am Messesee 2
81829 Munich
Germany

Phone: +49 89 949-20720
Email: info@messe-muenchen.de

Data Protection Officers:

Messe München GmbH
Data Protection Officer
Am Messesee 2
81829 Munich
Germany
Phone: +49 89 949-20045
Email: dsb@messe-muenchen.de

Bundesverband Gesundheits-IT – bvitg e. V
Markgrafenstraße 56
10117 Berlin
Germany
Email: datenschutz@bvitg.de

bvitg Service GmbH
Markgrafenstraße 56
10117 Berlin
Germany
Email: datenschutz@bvitg.de

What data do we collect?

Depending on how our websites and online offerings are used, we process various types of personal data:

Newsletters, surveys and competitions

When you subscribe to our newsletters or participate in surveys or competitions, we collect your email address and, if applicable, your name, the time you gave consent, the type of offering, and details on your interests or responses.

Contact inquiries and feedback

When you submit an inquiry, we store your name, job title, company, email address, as well as the time and content of the communication.

Social media

Comments, shares, and likes may be processed when you interact with our profiles on platforms such as Facebook, X, LinkedIn, Instagram, YouTube, Xing, or TikTok.

Registration and login

Registration is required for certain areas. As part of that, we usually process your name, your email address, the time of registration, and any consent you may have given. You can find more details in the respective registration process.

Log files

When you visit our website, technical information is automatically collected – such as browser type, operating system, IP address, referring site, and duration of use. This data is stored for 30 days.

Cookies and tracking

We automatically collect certain usage data by means of cookies and similar technologies. You can find all the details in our information on cookies and tracking technologies.

Email marketing

As part of our email marketing, we analyze open rates, click-through rates, and bounce rates in accordance with Article 6(1) point (f) of the General Data Protection Regulation (GDPR). As a data subject, you can find all the details in our Privacy Policy for Email Marketing (DMEA).

Where does your data come from?

The data usually comes directly from you. In some cases, this data is collected automatically or transmitted by third parties—for example, when someone else registers on your behalf or when another website operator provides us with information about the referring website.

Mandatory disclosures are indicated as such in our forms and are usually required so that a contract can be concluded or certain offerings can be accessed.

Sharing third-party data

If you are providing data on behalf of another person, please ensure that you are authorized to do so and that the data subject in question has been informed about processing of it in accordance with this Privacy Policy.

What do we use your data for and what is the basis for that?

You can find information below on the purposes for which we process the data specified in Section 2 and the legal bases that apply to that.

3.1 Newsletters, surveys, competitions, and direct marketing

On our websites, you can voluntarily subscribe to newsletters or participate in surveys and competitions. In these cases, we use your data to:

• send you information about Messe München and its associated companies on a regular or ad-hoc basis—by email or regular mail;
• inform you about current and upcoming events we are hosting or guest events, including exhibitors, sponsors, and cooperation partners;
• notify you about opening, accompanying, and follow-up events—including trade fairs organized by other companies in the group in Germany and abroad;
• conduct market research, online surveys, and personalized advertising.

Legal basis: Your consent (Article 6(1) point (a) GDPR). You can find information about your right to withdraw consent in Section 7.

3.2 Contact inquiries

When you send us an inquiry, we process your data so that we can respond appropriately—including, if applicable, with relevant information material.

Legal basis:

• Legitimate interest in responding to your inquiry and to conduct press and public relations work (Article 6(1) point (f) GDPR)
• Performance of a contract, provided your inquiry relates to an existing or pending contract (Article 6(1) point (b) GDPR)

3.3 Social networks and social media channels

Links on our websites

On our websites, you will find links to our social media channels. These links will only transfer data to the respective platform operators if you explicitly click on them. If you do not click on them, no data will be transmitted to third parties.

Our social media profiles

We operate public profiles on the following platforms. We use these profiles to provide information about our events, get in touch with you, and build business relationships.

When you visit one of our profiles or interact with our content (e.g. by liking, commenting on, or sharing it), both we and the respective platform operator process personal data—such as your user name, interaction data, and technical information like your IP address.

Joint responsibility

We are jointly responsible with the respective platform operators for operating our profiles (Article 26 GDPR). We have concluded agreements to that effect with the operators. You can find the platforms’ privacy policies here: Information on Cookies and Tracking Technologies.

Legal basis: Processing is based on our legitimate interest in conducting public relations work, communicating with customers, and maintaining business contacts (Article 6(1) point (f) GDPR). We have weighed up that your interests do not conflict with this, as the use of social media is voluntary and the profiles are publicly accessible.

3.4 Operation, security, and rectification of problems

We use the data collected in the log files to ensure secure and smooth operation of our websites – including rectification of technical problems. Log files are deleted after 30 days.

Certain cookies and similar technologies also collect data for these purposes.

Legal basis: Legitimate interest of Messe München and the users (Article 6(1) point (f) GDPR).

You can find details on the technologies we use in our specific privacy policies.

3.5 Registration and ticket shop

When you purchase a ticket, register for an event, or use enhanced features on our websites, we process your data to establish and fulfill the contractual relationship.

Legal basis: Performance of a contract (Article 6(1) point (b) GDPR).

You can find more information on data privacy in the respective ticket shop.

3.6 Analysis, optimization, and personalized marketing

We use cookies and similar technologies to:

• analyze the use of our websites and measure their performance (functional technologies—legal basis: legitimate interest, Article 6(1) point (f) GDPR);
• improve the effectiveness of our email marketing;
• to show you personalized ads that match your interests (marketing technologies – legal basis: your consent, Article 6(1) point (a) GDPR).

You can find details on the technologies we use in our specific privacy policies.

3.7 Compliance with legal obligations

In certain cases, we are legally obligated to process your data—for example, under commercial and tax law in connection with contracts, business communications, or payments. We also retain any consent and approvals you give so that we can furnish proof of that.

Legal basis:

• Compliance with legal obligations (Article 6(1) point (c) GDPR)
• Legitimate interest in proving compliance with legal requirements, e.g. accountability under Article 5(2) GDPR (Article 6(1) point (f) GDPR)

Who do we share your data with?

Internal processing

When you subscribe to a newsletter or submit an inquiry, your data is processed by the responsible departments at Messe München—in particular by Product Marketing & Communication, Corporate Marketing & Communications, and the event team in question.

Sharing of data within the group

Where necessary, we share your data (e.g. contact details, event information, ticket status, or fields of interest) with other group companies or our foreign representative offices. Our foreign representative offices are your local point of contact and will assist you throughout the entire process—from registration and visa matters to follow-up support after the event.

Legal basis: Performance of a contract (Article 6(1) point (b) GDPR). 

External links and third-party providers

Some of our websites contain links to external providers. If you click on such a link, you will leave our website and be redirected to the third-party provider’s site. That site has its own privacy and cookie policies—in this case, the third-party provider is solely responsible for processing your data.

Legal basis: Your consent (Article 6(1) point (a) GDPR).

External service providers (processors)

For certain tasks, we engage specialized service providers who process your data on our behalf—for example, in the following areas:

• Shipment and mailings
• Market research and email marketing
• Hosting and IT support
• Website and content management
• Data management

These service providers act solely in accordance with our instructions.

Legal basis: Legitimate interest (Article 6(1) point (f) GDPR).

Public authorities and bodies

In cases required by law, we may disclose your data to public authorities – for example, to comply with tax or commercial law obligations, in connection with administrative proceedings, or pursuant to a court order.

Legal basis: Compliance with legal obligations or a public interest (Article 6(1) point (c) or (e) GDPR).

Courts, attorneys, and auditors

In connection with legal disputes, legal advice, or audits, your data may be disclosed to courts, attorneys, or auditors.

Legal basis: Compliance with legal obligations or a legitimate interest (Article 6(1) point (c) or (f) GDPR).

You can find more information in our specific privacy policies as well as in the Information on Cookies and Tracking Technologies.

Some of our foreign representative offices, group companies of Messe München GmbH, as well as service providers and third-party vendors we engage (e.g. social media, cookies, and tracking services) are based in countries outside the EU. Many of these countries do not have the same high level of data protection as the EU. One reason for this is the lack of legal requirements, independent supervisory authorities, or data protection laws and legal remedies in those countries. 

When we transmit personal data to such countries, we do so only subject to certain conditions: 

1. Adequacy decision by the EU Commission: In some cases, the EU Commission confirms that the country in question offers an adequate level of data protection (Article 45(3) GDPR). 

2. Appropriate safeguards: In other cases, we use what are termed standard contractual clauses that have been approved by the European Commission (Article 46 GDPR). In addition, we take further protective measures if needed. 

You can request a copy of these safeguards from us (e.g. by email—you can find our contact details in Section 1 of this Privacy Policy). 

Instances where data may still be transmitted:

• We transmit data to other group companies of Messe München GmbH or other website visitors if this is necessary for the performance of a contract (Article 49(1) point (b) or (c) GDPR).
• In other cases, we transmit data if you have given us your explicit consent, even though the level of data protection in those countries may be lower and this may entail risks (Article 49(1) point (a) GDPR).

You can find more information in our Information on Cookies and Tracking Technologies.

We store personal data only for as long as it is needed for the purpose in question. The data will be erased after that. Here are a few specific examples:

• Newsletter data: If you cancel your newsletter subscription, we will erase the data we have stored for this purpose.

If we process your data based on your consent or the legitimate interests of Messe München or a group company of Messe München GmbH, we will cease processing the data for this purpose and erase it once you withdraw your consent or object to processing of it. This does not apply if statutory exceptions or retention requirements apply. 

Special retention periods:

• We do not erase data that must be retained for commercial or tax purposes until the statutory retention periods have expired. These are usually 6 or 10 years.
• We store proof of consent for up to 3 years after the consent has been withdrawn or has become invalid.

You can find more information in our Information on Cookies and Tracking Technologies.

You have the right to contact us at any time if you have concerns. You can find our contact details in Section 1 of this Privacy Policy. Here is an overview of your rights:

Your data protection rights (pursuant to Articles 12 to 21 GDPR)

• Right of access: You have the right to know which personal data about you we process.
• Right to rectification: You may request that inaccurate or incomplete data be corrected.
• Right of erasure: You may request that we erase your data, provided there are no legal grounds preventing us from doing so.
• Right to restriction of processing: You may request that we restrict the use of your data.
• Right to data portability: You can receive your personal data in a portable format so that you can disclose it to others.
• Withdrawal of consent: If you have given us your consent, you may withdraw it at any time with effect for the future.

Your right to object (pursuant to Article 21 GDPR) 

If we process your data on the basis of a “legitimate interest” (Article 6(1) point (f) GDPR), you may object at any time with effect for the future. This applies in particular if you have personal reasons that preclude processing of your data. 

Objection to marketing: You may notify us at any time that you no longer wish us to use your data for marketing purposes. You can also cancel your subscription to the newsletter simply by clicking the unsubscribe link in the email. 

Right to lodge complaints with a supervisory authority 

If you believe that we are not processing your data in compliance with data protection regulations, you may lodge a complaint with the data protection supervisory authority of your choice. In Germany, this is governed by Article 77 GDPR in conjunction with Section 19 of the German Data Protection Act (BDSG).