Privacy policy

1. Controller and data protection contact

If you have any questions about the processing of your personal data or wish to exercise your rights as a data subject, you can contact us at any time.

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

She Owns GmbH
Clemensstr. 19a, 80803 Munich, Germany
Managing Director: Lisa Gruber
Register court: Amtsgericht München, HRB 313734
Phone: +49 160 9900 44 51
Email: info@she-owns.de

2. Purposes and legal bases of processing

We process your personal data in order to enable you to use our website securely, conveniently and functionally, and to offer our services in line with demand. Depending on how you use our online services, processing may be necessary for:

• the technical provision of the website (including IT security),
• responding to enquiries,
• the performance of contractual or pre-contractual measures,
• the analysis of usage for statistical purposes,
• the optimisation of our content or our services.

Processing only takes place where there is an appropriate legal basis, in particular:

• Art. 6(1)(a) GDPR (consent),
• Art. 6(1)(b) GDPR (contract or pre-contractual measures),
• Art. 6(1)(f) GDPR (legitimate interest, for example security, functionality or optimisation).

Where consent is required, we obtain it in advance and transparently, for example when you subscribe to our newsletter. You have the right to withdraw your consent at any time with effect for the future.

3. Note on consent as a legal basis

Where we ask for your consent to the processing of personal data, this is based on Art. 6(1)(a) GDPR. You can withdraw any consent you have given at any time with effect for the future. Withdrawal does not require any particular form and can be made, for example, by email or post. Our contact details are given above under “Controller”.

To document your consent, we also process the following information:

• first and last name (if provided)
• email address
• IP address of the device used
• date and time of consent
• status and scope of the consent given

The legal basis for this processing is Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.

The documentation data is stored for a period of three years. This period begins on the day on which you give your consent.

4. Protection of minors

Our services are aimed at adults. We do not specifically request data from children or young people. To subscribe to our newsletter, you must be at least 16 years old; otherwise we need the consent of your parents or legal guardians (Art. 8 GDPR). If we become aware that we have received data from minors without the necessary consent, we will delete it immediately.

5. Categories of recipients of personal data

Within the limits of the law, your personal data may be transferred to the following categories of recipients:

Disclosure to external service providers: In certain cases, we use external service providers who process personal data on our behalf. This is done on the basis of the following legal bases:

• to comply with statutory reporting obligations under Art. 6(1)(c) GDPR, in particular towards authorities such as social insurance institutions, tax authorities or law enforcement authorities
• to carry out pre-contractual measures or to perform a contract under Art. 6(1)(b) GDPR, for example when processing payments
• to safeguard legitimate interests under Art. 6(1)(f) GDPR, for example through commissioned service providers such as hosting providers, data centres, credit institutions, printing service providers or courier services
• on the basis of your express consent under Art. 6(1)(a) GDPR

If you take part in promotions, competitions or other services that we carry out together with partner companies, data may be passed on to these partners. In such cases, we will inform you in advance and directly at the time of the respective service.

All external service providers are carefully selected, obliged to comply with the applicable data protection provisions and regularly monitored.

Where we commission third parties to process data on our behalf, this is done exclusively on the basis of a contract under Art. 28 GDPR. Our processors are Webflow (hosting and contact form), Brevo (newsletter), IONOS (email), Pirsch (audience measurement) and pretix (ticket sales and entry). The payment providers Stripe and PayPal are themselves responsible for part of the payment data (see “Tickets and attending She Owns Day”). We do not sell any data.

6. Transfers to third countries

If we use functions or services of providers based outside the European Union (EU) or the European Economic Area (EEA), your personal data may be transferred to so-called third countries.

Such a transfer only takes place if the specific requirements of Art. 44 et seq. GDPR are met, in particular if

• there is an adequacy decision of the European Commission under Art. 45 GDPR,
• appropriate safeguards within the meaning of Art. 46 GDPR (for example EU standard contractual clauses) have been agreed,
• binding corporate rules are in place, or
• you have expressly consented to the transfer.

Note on transfers to the USA: Since July 2023, an adequacy decision of the European Commission under Art. 45 GDPR (EU-U.S. Data Privacy Framework) has applied to certain US providers. US companies certified under the Data Privacy Framework therefore ensure an adequate level of data protection.

Transfers to other US service providers that are not certified are based on appropriate safeguards, in particular the standard contractual clauses of the European Commission, or on your express consent.

Wherever possible, we give preference to providers with server locations within the EU or the EEA. A specific transfer to a third country only takes place where this is expressly stated for individual processing operations.

7. Erasure and storage period

We only process and store personal data for as long as is necessary to fulfil the respective purposes. As soon as the purpose of storage no longer applies, the data is deleted or blocked.

Data may be stored for longer where this is required by law, for example due to retention obligations under commercial, tax or anti-money laundering law (for example under the German Commercial Code, the German Fiscal Code or the German Money Laundering Act). In these cases, the data is deleted once the statutory retention periods have expired, unless there is another legal basis for the processing.

Personal data may also be stored for the duration of statutory limitation periods where this is necessary for the establishment, exercise or defence of legal claims. The standard limitation period is generally three years, but in individual cases it can be up to 30 years.

Data is only stored for longer where this is necessary to fulfil contractual or statutory obligations.

8. Your rights as a data subject

As a data subject within the meaning of the GDPR, you have various rights that you can assert against us at any time. An email to info@she-owns.de is sufficient.

• Right of access (Art. 15 GDPR): You have the right to request information about the personal data we process, including the purposes of processing, the categories of recipients, the planned storage period and your further rights in connection with this processing.
• Right to rectification (Art. 16 GDPR): You can request the immediate correction of inaccurate personal data or the completion of incomplete personal data.
• Right to erasure (Art. 17 GDPR): You have the right to request the erasure of your personal data stored by us, unless statutory retention obligations or other legal reasons prevent erasure.
• Right to restriction of processing (Art. 18 GDPR): Under certain conditions, you can request that the processing of your personal data be restricted.
• Right to data portability (Art. 20 GDPR): You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit this data to another controller.
• Right to object to processing (Art. 21 GDPR): You can object at any time to the processing of your personal data on grounds relating to your particular situation. This applies in particular to processing based on Art. 6(1)(f) GDPR.
• Right to withdraw consent (Art. 7(3) GDPR): Where we process your data on the basis of your consent, you have the right to withdraw this consent at any time with effect for the future.
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR): If you consider that the processing of your personal data infringes the GDPR, you can lodge a complaint with a data protection supervisory authority. As a rule, this is the supervisory authority of your place of residence or of our registered office. The authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

9. Provision of the website and log files

Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing device. The following data is collected:

• your IP address
• date and time of access
• page or file accessed
• website from which the access is made (referrer URL)
• browser type and version used
• your operating system
• your internet service provider

The data is also stored in the log files of our system. This data is not stored together with any other personal data relating to you.

Legal basis for processing: The legal basis for the temporary storage of the data and the log files is Art. 6(1)(f) GDPR. Our legitimate interest lies in:

• ensuring that the website functions properly
• the technical optimisation of content and presentation
• ensuring the security of our information technology systems (for example to defend against attacks)

Purpose of processing: The temporary storage of the IP address by the system is necessary to deliver the website to your device. For this purpose, your IP address must remain stored for the duration of the session. In addition, the data is stored in log files to ensure that the website functions properly. The data is not analysed for marketing purposes in this context.

Storage period: The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. Where data is collected to provide the website, this is the case when the respective session has ended. The log files are generally deleted after 7 days at the latest. Longer storage is possible if the IP addresses have been anonymised.

Right to object and removal: The collection of data to provide the website and the storage of data in log files are essential for operating the website. You therefore have no right to object in this respect.

10. Cookies

Cookies are small text files that are stored on your device when you visit a website. We do not use cookies for analytics or advertising. Only one cookie is technically necessary: our host Webflow delivers the website via the Cloudflare network. Cloudflare sets the cookie “_cfuvid”, which only contains a random identifier and protects the website against automated attacks and overload. It is deleted as soon as you close your browser. As it is strictly necessary for operating the website securely, no consent is required (Section 25(2) no. 2 TDDDG). The legal basis for the related processing is Art. 6(1)(f) GDPR. Apart from this, we do not use comparable technologies such as local storage or tracking pixels on our website. For this reason, there is no cookie banner on our website. How we measure opens and clicks in our newsletter is explained under “Newsletter”.

Should we use cookies or comparable technologies in future that are not technically necessary, we will obtain your consent in advance (Art. 6(1)(a) GDPR, Section 25(1) of the German Telecommunications Digital Services Data Protection Act, TDDDG) and update this privacy policy.

11. Social media

On our website, we link to our profiles on Instagram and LinkedIn. These are plain links. We do not embed any social media plugins or other content from these networks. You are only forwarded to the respective platform when you click on a link. No data is transmitted to the providers before then.

Pages on social media websites: We maintain pages on the websites of social networks and process personal data in this context in order to communicate with the users active there or to provide information about us. Please note that your data may be processed outside the European Union when you visit our pages. The operators of the respective social networks are responsible for this. A detailed description of the respective forms of processing and of the options to object (for example opt-out) can be found in the privacy policies of the operators of the respective social networks.

Please note that, despite joint controllership with the platform operators, we do not have full influence over the processing of data by the social networks. We recommend that you also obtain information directly from the platforms.

Instagram: We operate an Instagram page for our company on the social network instagram.com. When you visit and use this Instagram page, Instagram may analyse your usage behaviour and provide us with information derived from it (“Page Insights”). This information is used for the purposes of economic optimisation and the needs-based design of our online presence and our services. The categories of data processed are master data, contact data, content data, usage data and connection data. The recipient of the data is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, as joint controller within the meaning of Art. 26 GDPR.

The legal basis for processing the data as described here is our legitimate interest (Art. 6(1)(f) GDPR) in effective public presentation and communication via social media. Instagram is generally responsible for giving effect to your data subject rights in connection with the processing of personal data on our Instagram page. Instagram provides information on this at: https://privacycenter.instagram.com/policy

LinkedIn: We operate a company page on the social network linkedin.com. When you visit and use this company page, LinkedIn may analyse your usage behaviour and provide us with information derived from it in aggregated form (“Page Insights”). This information is used for the purposes of economic optimisation and the needs-based design of our online presence and our services. The recipient of the data is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, as joint controller within the meaning of Art. 26 GDPR. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in effective public presentation and communication via social media. LinkedIn provides information on this at: https://www.linkedin.com/legal/privacy-policy

You can also assert your rights against us. In this case, we will forward your request to the respective platform operator without delay.

12. Ways to contact us

Our website offers various ways of contacting us. Below, we inform you about the respective communication channels and the related processing of data.

Email: If you contact us by email, the personal data you provide will be used exclusively to process your enquiry. A valid email address is required so that we can assign and answer your enquiry. Any further information is provided voluntarily.

The data is processed on the basis of Art. 6(1)(b) GDPR insofar as the enquiry is related to the performance of a contract or serves to carry out pre-contractual measures. In all other cases, the processing is based on Art. 6(1)(f) GDPR, as we have a legitimate interest in handling enquiries properly. The data you provide remains with us until the purpose of storage no longer applies or you ask us to delete it, unless statutory retention obligations apply.

Click-to-email function: On our website, we use email links that allow you to open a new email to us directly. When you click on such a link, the email program set up on your device opens automatically and creates a new message to our email address. No data is transmitted to us automatically in this process. We only receive the information you provide once you send the email. This information is used exclusively to process your enquiry.

The legal basis for the processing is Art. 6(1)(b) GDPR where the contact serves to initiate or perform a contract. In all other cases, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a simple and user-friendly way of contacting us.

Contact form: If you send us a message using the contact form on our “Contact” page, the data you enter (name, email address, subject and message) will be used exclusively to process your enquiry. As a rule, a valid email address is required so that we can assign and answer your enquiry. Any further information can be provided voluntarily.

The data submitted via the form is transmitted using SSL encryption. The form is processed by our website provider Webflow, and the form data is stored by Webflow (see “External hosting”). We have concluded a data processing agreement with Webflow under Art. 28 GDPR. The data is not passed on to any other third parties.

The legal basis for the processing is Art. 6(1)(b) GDPR insofar as the enquiry is related to the performance of a contract or serves to carry out pre-contractual measures. In all other cases, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the proper handling of enquiries received via the contact form.

Phone: If you contact us by phone, the personal data you provide will be used exclusively to deal with your request. Which data is collected depends on the content of your call and the information you provide.

The data is processed on the basis of Art. 6(1)(b) GDPR insofar as the contact is related to the performance of a contract or pre-contractual measures. In all other cases, the processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in the efficient and proper handling of incoming enquiries. The data you provide during the call is only stored for as long as is necessary to deal with your request, unless statutory retention obligations apply.

13. Web analytics with Pirsch

We use a web analytics tool on our website to analyse the use of our website statistically and to optimise our online services technically and in terms of content. It helps us to understand how our website is used, for example which pages are accessed most frequently or from which sources visits to our website originate. The insights gained serve exclusively to improve the user-friendliness and efficiency of our website.

For this purpose, we use Pirsch provided by Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany. Pirsch does not use cookies and does not store any information on your device. When a page is accessed, your browser loads a script from Pirsch, and your IP address and browser identifier are transmitted to Pirsch in the process. Only information such as the page accessed, the referrer URL, the browser, the operating system, the device type and the approximate location (country, city), which is derived from the IP address, is recorded.

IP addresses are not stored. In order to count visits, Pirsch generates an identifier from the IP address, the browser identifier, the current date and a random value, which cannot be used to recognise you beyond that day or across different websites. We only receive aggregated statistics and are unable to draw conclusions about individual persons. The data is processed exclusively on servers in Germany.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the statistical analysis of the use of our website in order to improve our services. As Pirsch does not store or read any information on your device, no consent is required under Section 25(1) TDDDG. We have concluded a data processing agreement with Pirsch under Art. 28 GDPR. Further information is available at: https://pirsch.io/privacy

14. Newsletter

You can subscribe to our newsletter via our website in order to receive regular information on current topics, news and invitations from She Owns, as well as occasional short surveys. Below, we inform you about the related processing of data.

Only your email address is required to subscribe; your first and last name are optional. After submitting the form, you will receive an email with a confirmation link. Your subscription is only complete once you click on it (double opt-in). To prove your consent, we store the information listed under “Note on consent as a legal basis”.

Newsletter delivery via Brevo: We use the Brevo service (formerly Sendinblue), provided by Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, to send our newsletter. The sign-up form on our website is also provided by Brevo (sibforms.com) and is loaded as soon as a page with a form is accessed. In the process, your IP address is transmitted to Brevo. When you submit the form, your details are also sent to Brevo. Brevo is a service that organises and analyses the sending and evaluation of newsletters.

When you subscribe to our newsletter, the data you enter in the sign-up form (for example name and email address) is stored on Brevo’s servers in Germany. The data is processed for the purpose of sending the newsletter. Our newsletters contain an invisible tracking pixel and links through which Brevo counts how often an email is opened and which links are clicked. These figures are recorded anonymously and are not linked to any individual person. We therefore only see totals, such as the open rate of an issue, which helps us improve future newsletters. The legal basis for this anonymous analysis is our legitimate interest (Art. 6(1)(f) GDPR). We have concluded a data processing agreement with Brevo under Art. 28 GDPR.

The legal basis for the processing of your personal data is your consent under Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future by using the unsubscribe link in the newsletter or by sending us a corresponding message at info@she-owns.de. The data is deleted as soon as it is no longer required for the purpose of processing or you withdraw your consent. So that we do not contact you again by mistake after you have unsubscribed, your email address remains on a block list (Art. 6(1)(f) GDPR).

Further information on data processing by Brevo is available at: https://www.brevo.com/legal/privacypolicy/

15. External hosting

Our website is hosted by an external service provider (hosting provider). The personal data collected on our website is stored on the hosting provider’s servers. This may include, in particular, IP addresses, contact enquiries, meta and communication data, contract data, contact details, names, website access data and other data generated via the website.

The hosting provider is used for the purpose of providing our online services securely, quickly and efficiently through a professional provider. The legal basis for the processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in the reliable and secure provision of our website. Where the processing serves the performance of a contract or is necessary to carry out pre-contractual measures, it is additionally based on Art. 6(1)(b) GDPR.

Our hosting provider only processes your data to the extent necessary to fulfil its service obligations and follows our instructions with regard to this data.

We use the following host: Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA. Webflow delivers our website via the networks of Cloudflare, Amazon CloudFront and Fastly, in each case via the server closest to your location. A transfer of personal data to the USA can therefore not be ruled out. Webflow is certified under the EU-U.S. Data Privacy Framework, so an adequacy decision of the European Commission under Art. 45 GDPR applies. We have concluded a data processing agreement with Webflow under Art. 28 GDPR. The fonts on our website are also delivered by Webflow. No connection is made to Google Fonts or other font providers.

Our email mailbox is provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. If you send us an email, your message and the data it contains are stored on IONOS servers. We have concluded a data processing agreement with IONOS under Art. 28 GDPR. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in reliable and secure email communication.

16. Security

We want your visit to our website to be secure.

SSL and TLS encryption: For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator, we use SSL (Secure Socket Layer) or TLS (Transport Layer Security) encryption. You can recognise an encrypted connection by the fact that the address line of your browser changes from “http://” to “https://” and by the padlock symbol in the browser bar. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

17. Data processing agreements

We have concluded data processing agreements under Art. 28 GDPR with our service providers who process personal data on our behalf. These agreements ensure that the service providers only process personal data in accordance with our instructions and in compliance with data protection regulations.

18. Links to other providers

Our website may contain links to other providers to which our privacy information does not extend. The processing of personal data by these providers is governed exclusively by their respective data protection provisions.

19. Tickets and attending She Owns Day

We sell tickets for She Owns Day through pretix, a ticketing system of pretix GmbH, Berthold-Mogel-Straße 1, 69126 Heidelberg, Germany. Our website links to our ticket shop. pretix handles orders, ticket delivery and entry on our behalf and stores the data in Germany. We have concluded a data processing agreement with pretix under Art. 28 GDPR. If you pay by card or another payment method via Stripe, the data required for payment is sent to Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland. If you pay with PayPal, it is sent to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, 2449 Luxembourg. Stripe and PayPal process some of this data under their own responsibility, for example to prevent fraud and to meet legal obligations, and may also transfer it to the USA. You can find more information in the privacy notices of Stripe (https://stripe.com/privacy) and PayPal (https://www.paypal.com/de/legalhub/privacy-full). If you pay by bank transfer, your payment details go to our bank.

When you buy a ticket, we process the data required for ordering, payment, invoicing and entry, in particular your name, email address, billing address and payment information. We need the attendee’s name and email address for the badge, entry and information about the day. Your ticket is scanned at the entrance to check that it is valid. The legal basis is Art. 6(1)(b) GDPR and, for invoicing and retention, Art. 6(1)(c) GDPR. If a company or another person books a ticket for you, we receive your name and email address from the person ordering. The legal basis is then Art. 6(1)(f) GDPR; our legitimate interest lies in running the event. We inform you about this at the latest in the email with your ticket and refer you to this privacy policy there.

Storage period: We keep invoices and accounting records for eight years and order confirmations and business correspondence for six years (Section 147 AO, Section 257 HGB). With the Phoenix Pass Plus, you have permanent access to the recordings of the talks, so we store your name and email address for as long as this access exists. Data that we only need for entry and the running of the day itself, such as the time of your check-in, is deleted no later than six months after the event.

Information about future She Owns Days (direct marketing): If you have bought a ticket from us, we also use the email address from your order to send you information about future She Owns Days and similar offers of our own, even if you have not subscribed to the newsletter. We point this out to you when you order. The legal basis is Section 7(3) UWG and Art. 6(1)(f) GDPR; our legitimate interest lies in promoting our own events. You can object to this use at any time (Art. 21(2) GDPR), via the unsubscribe link in each of these emails or by email to info@she-owns.de. This does not cost you anything other than the transmission costs at basic rates. After your objection, we will no longer use your email address for marketing.

Partners, exhibitors and companies in the Corporate Lounge only receive your data if you agree at their stand and allow your badge to be scanned (Art. 6(1)(a) GDPR). From then on, the respective company is itself responsible for your data. You can withdraw your consent at any time with effect for the future.

20. Photos and videos

At She Owns Day, photos and videos are taken and the talks are recorded. The purposes and legal bases differ depending on the type of recording.

General shots: General shots show the atmosphere, groups of people or the stage with the audience, without individual people being the focus. We take them on the basis of our legitimate interest in documenting and presenting the event (Art. 6(1)(f) GDPR) and publish them on she-owns.de, on Instagram and LinkedIn, in our newsletter and as part of our press work.

Your right to object: You can object at any time to the processing of general shots in which you appear (Art. 21 GDPR), most easily by email to info@she-owns.de. If such a shot has already been published, we will remove it from our own channels or make you unrecognisable in it following your objection.

Targeted shots of individuals: We only take portraits, interviews, testimonials and other shots in which you are deliberately and recognisably the focus with your prior consent (Art. 6(1)(a) GDPR). This also applies if we use shots of you in advertising or paid ads. You can withdraw your consent at any time with effect for the future, for example by email to info@she-owns.de.

Recording of the talks: When recording the talks, we film the stage and the speakers, including sound and slides. This is based on our agreement with the speakers. The audience is not deliberately filmed. Only Phoenix Pass Plus guests receive the full recordings to watch, permanently and not publicly. We therefore also store them permanently. We only publish short excerpts of a few minutes at most on she-owns.de, Instagram and LinkedIn.

Recipients and storage period: The recordings are made by photographers and a video team commissioned by us, who act for us as processors or service providers. We store the recordings for as long as is necessary for the respective purpose. Following an objection or the withdrawal of consent, we delete the recordings concerned or remove them from our channels.

21. Changes to this privacy policy

If we start using new services or the law changes, we will update this privacy policy. The version published here applies.

Last updated: November 2026