Privacy Policy

1. Who is responsible (data controller)

The controller responsible for the processing of your personal data within the meaning of Art. 4(7) GDPR is:

Full operator details are listed in our Impressum. We have not appointed a Data Protection Officer (DPO), as we are not legally required to do so; for all data-protection matters, please contact us at the email above.

2. What data we collect

We only collect what you choose to give us. This website does not use tracking cookies or analytics. We collect personal data through three forms (processed via Netlify Forms — see section 4):

• Apply (to demo): your name, email address, and the free-text you submit (e.g. what you are building, links to your project), plus optional fields such as your city or links.
• Sponsor: your name, email address, and the free-text message you submit about sponsorship, plus optional company / city / links.
• Notify (waitlist): your name and email address, so we can let you know about upcoming editions.

If you simply email us at hello@demonights.eu, we process the data contained in that message. Our hosting provider may also process technical server data (such as your IP address and browser type) in server log files for the purpose of delivering and securing the site.

3. Purposes & legal bases

We process your data for the following purposes and on the following legal bases under Art. 6(1) GDPR:

Where we rely on legitimate interest (Art. 6(1)(f)), our interest is in running, funding and communicating about our events. You may object to such processing at any time (see section 6).

4. Netlify Forms (US processor) & international transfers

Our forms are submitted through and stored by Netlify Forms, provided by Netlify, Inc. (United States). Netlify acts as our processor (Auftragsverarbeiter) under Art. 28 GDPR and receives and stores the data you submit, as well as technical metadata of the submission.

Because Netlify is based in the United States, your data may be transferred to and processed in the US, which is a third country outside the EU/EEA and Switzerland. Such transfers are safeguarded by the EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR (and, where applicable, Netlify's certification under the EU–US Data Privacy Framework). You can request a copy of the relevant safeguards from us at hello@demonights.eu.

5. How long we keep your data (retention)

• Notify / waitlist: until you withdraw your consent or unsubscribe, after which your entry is deleted.
• Applications: for as long as needed to process and follow up on your application; if not selected, we delete or anonymise it within «[TO COMPLETE: e.g. 12 months]» unless you ask us to keep you in mind for future editions.
• Sponsor & general enquiries: for the duration of the correspondence and any resulting relationship, plus any statutory retention periods that may apply.

We delete or anonymise personal data once the purpose for which it was collected no longer applies and no legal retention obligation requires us to keep it.

6. Your rights

Under the GDPR (and, for Swiss residents, the FADP) you have the right to:

• Access — obtain confirmation of and a copy of the data we hold about you (Art. 15).
• Rectification — have inaccurate data corrected (Art. 16).
• Erasure — have your data deleted (“right to be forgotten”, Art. 17).
• Restriction — restrict processing in certain cases (Art. 18).
• Data portability — receive your data in a structured, machine-readable format (Art. 20).
• Object — object to processing based on legitimate interest (Art. 21).
• Withdraw consent — where processing is based on consent (e.g. the notify list), withdraw it at any time with effect for the future, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

To exercise any of these rights, just email us at hello@demonights.eu.

7. Right to lodge a complaint

You have the right to lodge a complaint with a data-protection supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR).

In Switzerland, the competent authority is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB). You may also name your lead supervisory authority here, e.g. «[TO COMPLETE: competent supervisory authority for your registered seat]».

8. Swiss FADP note

If you are located in Switzerland, the revised Swiss Federal Act on Data Protection (FADP / revDSG) applies alongside the principles above. The terminology may differ slightly (e.g. references to the GDPR articles should be read as the corresponding FADP provisions), but the substance of your rights — information, access, correction, deletion and objection — is equivalent. «[TO COMPLETE: if you regularly process Swiss personal data, consider appointing a Swiss representative under Art. 14 FADP]»

9. Contact us

For any privacy question or to exercise your rights, contact: