Privacy Policy

EventBird is a brand of Hybrid-Airplane Technologies GmbH.

Last updated: 21 August 2026

Note: This is a convenience translation. The legally binding version is the German privacy policy.

1. Data protection at a glance

General information

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on data protection, please refer to the privacy policy set out below this text.

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the section “Information on the controller” in this privacy policy.

How do we collect your data?

Your data is collected firstly when you provide it to us. This may, for example, be data you enter into a contact form or a bidding form.

Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or the time the page was accessed).

What do we use your data for?

Part of the data is collected to ensure the website is provided without errors. Other data is required in order to process enquiries and to carry out the bidding and booking process for advertising space.

What rights do you have regarding your data?

You have the right at any time to obtain information free of charge about the origin, recipients and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you may withdraw this consent at any time with effect for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

You may contact us at any time regarding this and any other questions about data protection.

2. Hosting

External hosting

This website is hosted by an external service provider (hoster). The personal data collected on this website is stored on the hoster’s servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses and other data generated via a website.

The hoster is used for the purpose of fulfilling our contract with our potential and existing customers (Art. 6 (1) (b) GDPR) and in the interest of a secure, fast and efficient provision of our online offering by a professional provider (Art. 6 (1) (f) GDPR).

Our hoster will only process your data to the extent necessary to fulfil its performance obligations and will follow our instructions with regard to this data.

We use the following hoster:

linefinity GmbH & Co. KG
Schwalbenweg 4
74229 Oedheim
Germany

3. General information and mandatory disclosures

Data protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with statutory data protection regulations and this privacy policy.

We would like to point out that data transmission over the internet (e.g. when communicating by e-mail) may have security gaps. Complete protection of data against access by third parties is not possible.

Information on the controller

The controller responsible for data processing on this website is:

Hybrid-Airplane Technologies GmbH
Lichtentaler Strasse 14
76530 Baden-Baden, Germany
Phone: +49 1523 356 2482
E-mail: datenschutz@h-aero.com

The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.

Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a justified request for deletion or withdraw your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion will take place once these reasons no longer apply.

Information on data transfer to third countries

Our website integrates tools from companies based outside the EU. When these tools are active, your personal data may be transferred to the servers of these companies. We would like to point out that third countries may not offer a level of protection comparable to EU data protection law. Where required, such transfers are based on the standard contractual clauses of the EU Commission.

Withdrawal of your consent to data processing

Many data processing operations are only possible with your express consent. You can withdraw consent you have already given at any time. The lawfulness of the data processing carried out until the withdrawal remains unaffected.

Right to object to data collection in special cases and to direct marketing (Art. 21 GDPR)

If data processing is based on Art. 6 (1) (e) or (f) GDPR, you have the right at any time to object, on grounds relating to your particular situation, to the processing of your personal data; this also applies to profiling based on these provisions. The respective legal basis on which processing is based can be found in this privacy policy.

If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims (objection pursuant to Art. 21 (1) GDPR).

If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling insofar as it is related to such direct marketing.

Right to lodge a complaint with the competent supervisory authority

In the event of infringements of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the member state of their habitual residence, place of work or the place of the alleged infringement. This right of complaint is without prejudice to any other administrative or judicial remedy.

Right to data portability

You have the right to have data that we process automatically on the basis of your consent or in performance of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another controller, this will only be done insofar as it is technically feasible.

SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries you send to us as the site operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the lock symbol in your browser bar.

When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

4. Data collection on this website

Cookies

Our website uses so-called “cookies”. Cookies are small text files and do not cause any damage to your device. They are stored on your device either temporarily for the duration of a session (session cookies) or permanently (persistent cookies). Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or your web browser deletes them automatically.

Cookies that are necessary to carry out the electronic communication process (necessary cookies) or to provide certain functions requested by you are stored on the basis of Art. 6 (1) (f) GDPR, unless another legal basis is specified. Where consent for the storage of cookies has been requested, the relevant cookies are stored exclusively on the basis of that consent (Art. 6 (1) (a) GDPR); consent may be withdrawn at any time.

You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If cookies are disabled, the functionality of this website may be limited.

Consent

This website uses statistics and marketing services that require your consent. They are described in detail in section 7: Google Analytics 4, Google Ads, the LinkedIn Insight Tag and the Meta pixel, all loaded through Google Tag Manager.

On your first visit we therefore ask whether we may load them. Until you have answered, none of them is loaded. Both options – “Accept all” and “Essential only” – are presented equally, and refusing costs you no functionality: every part of this website, bidding included, works without them.

Your answer is stored in the cookie_consent cookie for one year. You can change it at any time with effect for the future on our cookie page; withdrawing also deletes the measurement cookies already set on this website (see section 7, “Withdrawal and deletion”).

Strictly necessary cookies are not covered by this. The eb_claim cookie comes into existence solely when you place a bid and is strictly necessary for that service (see section 5); under § 25 (2) no. 2 TDDDG it requires no consent, as does cookie_consent itself, which exists only to record your decision.

The four legal pages – imprint, privacy policy, cookies and terms – load no Tag Manager and no service at all, regardless of your decision. You must be able to read what we do with your data without being measured while you read it.

Server log files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type and browser version
Operating system used
Referrer URL
Host name of the accessing computer
Time of the server request
IP address

This data is not merged with other data sources.

This data is collected on the basis of Art. 6 (1) (f) GDPR. The website operator has a legitimate interest in the technically error-free presentation and optimisation of its website — for this purpose, server log files must be recorded.

Contact and enquiry forms

If you send us enquiries via a form on this website (e.g. registration interest, upload of advertising material or a request for your own event), the details you provide in the enquiry form, including the contact details you provide there (in particular name, e-mail address, company and any uploaded files), will be stored by us for the purpose of processing the enquiry and in case of follow-up questions, and forwarded by e-mail to the responsible persons within our company. In addition, the time of transmission and your IP address are stored. We do not pass this data on without your consent.

This data is processed on the basis of Art. 6 (1) (b) GDPR if your enquiry is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Art. 6 (1) (f) GDPR) or on your consent (Art. 6 (1) (a) GDPR) if this has been requested.

The data you send us via enquiries will remain with us until you request deletion, withdraw your consent to storage, or the purpose for data storage no longer applies (e.g. after your enquiry has been processed). Mandatory statutory provisions — in particular retention periods — remain unaffected.

Enquiry by e-mail or telephone

If you contact us by e-mail or telephone, your enquiry including all resulting personal data (name, enquiry) will be stored and processed by us for the purpose of handling your request. We do not pass this data on without your consent.

5. Bidding and booking process for advertising space

Processing of your bid data

If you place a bid on an advertising space (quadrant) via this website, we process the data you provide in the bidding form. This includes in particular:

First and last name
E-mail address
Company and address
Bid amount and selected advertising space
The logo or advertising material you upload
Time of the bid and a bid ID

This data is processed in order to carry out the auction, to assign your bid, to contact you in connection with the bid and — in the event of a successful bid — to display your logo on the booked advertising space and to process the contract.

The legal basis is Art. 6 (1) (b) GDPR (implementation of pre-contractual measures or performance of a contract). In the event of a successful bid, your bid amount and your logo are displayed publicly on the respective event page.

The data will be deleted as soon as the purpose of processing no longer applies, unless statutory retention periods (in particular under tax and commercial law) prevent this.

Verification of your VAT identification number

If you enter a VAT identification number in the bidding form, we transmit it to the VAT Information Exchange System (VIES) of the European Commission for verification. Only the number itself is transmitted, no name and no address; in return we receive nothing but the information whether the number is valid.

The check is necessary in order to decide whether German VAT applies or the reverse-charge procedure does. The legal basis is Art. 6 (1) (c) GDPR (compliance with a legal obligation under VAT law) in conjunction with Art. 6 (1) (b) GDPR. If the check cannot be carried out, we invoice with German VAT.

VIES is operated by the European Commission. We store the result of the check together with your bid.

Recognising your own bids

When you place a bid, we store a randomly generated value in your browser as a cookie (eb_claim, lifetime 90 days). Its only purpose is to show you which advertising surfaces on the bidding board are your own, and to warn you if you would outbid yourself.

The value contains no personal data and, on its own, allows no conclusion about your identity. We store only its checksum, never the value itself. It is not used for analysis or advertising purposes and is not passed on to third parties.

The value belongs to the browser, not to you as a person: on a shared computer the next person sees the surfaces marked that were bid on from this browser before. Only the marking itself is shown – no names, addresses or other details of other bidders. You can delete the cookie in your browser at any time; the marking then disappears.

The legal basis is Art. 6 (1) (b) GDPR; storing it on your device requires no consent under § 25 (2) no. 2 TDDDG, because it is strictly necessary for the service you requested.

6. E-commerce and payment providers

Processing of data (customer and contract data)

We collect, process and use personal data only insofar as it is necessary for the establishment, content or modification of the legal relationship (inventory data). This is done on the basis of Art. 6 (1) (b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures. We collect, process and use personal data about the use of this website (usage data) only insofar as this is necessary to enable the user to use the service or to bill them for it.

The collected customer data will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

Payment processing and card authorisation via Stripe

To process bids and payments within the advertising-space auction, we use the payment service provider Stripe. The provider for users in the European Economic Area is Stripe Payments Europe, Ltd. (SPEL), 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (“Stripe”).

The payment form is provided by Stripe: as soon as you open the bidding window, your browser loads a script from js.stripe.com. Your IP address is transmitted to Stripe in the process – that is, before and regardless of whether you go on to place a bid. The script is what allows card details to be entered directly with Stripe so that they never reach our servers. The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in secure payment processing in which card data does not arise with us).

When you place a bid, the payment data you enter (in particular card details) is transmitted directly to Stripe and processed there. Full card details are processed exclusively by Stripe and never reach our servers; we only receive a reference (token) and the payment status. To run the auction, Stripe places a hold on the bid amount on your card on our behalf (authorisation without an immediate charge). If you are outbid, the hold is released; if you win the auction, the amount is captured at the end of the auction.

The data processed includes in particular your name, e-mail address, billing address, bid amount and card/transaction data. The legal basis is Art. 6 (1) (b) GDPR (pre-contractual measures and performance of the contract) as well as our legitimate interest in fraud-resistant payment processing (Art. 6 (1) (f) GDPR).

Stripe may transfer personal data to its parent company in the USA. The transfer is based on the EU Commission’s standard contractual clauses; in so far as and for as long as a certification under the EU-U.S. Data Privacy Framework exists, it is additionally based on that. A data processing agreement pursuant to Art. 28 GDPR is in place with Stripe. For details on data processing by Stripe, see: https://stripe.com/privacy.

Data transfer upon conclusion of a contract

We only transfer personal data to third parties if this is necessary within the scope of contract processing, for example to the credit institution commissioned with payment processing.

No further transfer of the data takes place, or only if you have expressly consented to the transfer. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.

The legal basis for data processing is Art. 6 (1) (b) GDPR, which permits the processing of data for the performance of a contract or pre-contractual measures.

7. Analytics tools and advertising

Google Tag Manager

We use Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). Tag Manager is a tool for administering other services (“tags”) and integrating them into a website without changing its code for each one. It collects no personal data of its own and sets no cookies; it loads the services described below.

Loading Tag Manager does, however, transmit your IP address to Google, and this may involve a transfer to the USA (see “Data transfer to the USA” below).

Further services may be added through the container. Which tags a container holds is administered in Google’s interface and not in this website’s code. If we add a service there, we will amend this policy accordingly before it is served. Every service loaded through the container is loaded only in the same case as the container itself: after your consent.

The legal basis for Tag Manager and for every service loaded through it is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. It is voluntary, is not a condition for using this website, and can be withdrawn at any time with effect for the future on our cookie page. Without your consent none of these services is loaded and no connection to their servers is established.

Google Analytics 4

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: Reach measurement and analysis of usage behaviour. This records, among other things, the pages visited, time spent, approximate location (derived from the IP address), device, browser and where the visit came from. In addition to the basic configuration we record three events of our own: clicks on buttons (click), opening of the bid form (form_loaded) and display of the consent notice (cookie_consent_loaded).

Legal basis: Your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Recipients: Google Ireland Limited as a processor under a contract pursuant to Art. 28 GDPR; Google LLC in the USA.

Data transfer to the USA: The transfer is based on the EU Commission’s standard contractual clauses; in so far as and for as long as a certification under the EU-U.S. Data Privacy Framework exists, it is additionally based on that. See also “Data transfer to the USA” at the end of this chapter.

Storage period: The cookies set by Google Analytics expire after two years at the latest (see the cookie table on our cookie page). The usage and event data held in the property are deleted after 14 months. Aggregated report data are not affected.

Withdrawal: You can withdraw your consent at any time with effect for the future on our cookie page. This service is then no longer loaded, and the cookies it set on this website are deleted. For details of Google’s processing see policies.google.com/privacy.

Google Ads (conversion measurement)

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Purpose: Measuring the success of our advertisements. A conversion linker records whether you reached this website through one of our ads and whether you then take an action relevant to us – we record the opening of the bid form and the time spent up to that point. On this basis, interest-based advertising may be shown to you on Google and within its advertising network.

Legal basis: Your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Recipients: Google Ireland Limited; Google LLC in the USA. For its advertising services Google does not act solely on our instructions but processes some data under its own responsibility.

Storage period: The cookie set by the conversion linker expires after 90 days. Cookies Google sets on its own domains (such as doubleclick.net) are subject to Google’s periods and expire after 13 months at the latest.

Withdrawal: You can withdraw your consent at any time with effect for the future on our cookie page. This service is then no longer loaded, and the cookies it set on this website are deleted. Independently of this you may object to personalised advertising directly with Google: adssettings.google.com.

LinkedIn Insight Tag

Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland; parent company LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.

Purpose: Measuring the success of our advertisements on LinkedIn and delivering audience-based advertising. The Insight Tag records the page view, clicks on buttons (click), opening of the bid form (form loaded) and the sending of a bid confirmation (email sent). This transmits, among other things, your IP address, device and browser details, the page visited and the time of the visit.

What this means beyond measurement: This service does not merely count visits. If you are signed in to LinkedIn – including in another tab – LinkedIn can attribute your visit to this website to your existing member profile there and combine it with the details you have given LinkedIn, such as employer, position and industry. From the resulting behaviour LinkedIn builds audiences, which we and other advertisers can use to address people who have already encountered this website or who resemble its visitors. The analyses made available to us are aggregated and allow no conclusions about individual people – that does not hold for LinkedIn itself.

Legal basis: Your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Recipients: LinkedIn Ireland Unlimited Company; LinkedIn Corporation in the USA.

Storage period: The cookies set by LinkedIn expire between 24 hours and 12 months (see the cookie table on our cookie page). LinkedIn states that it removes the direct identifiers of the members recorded within seven days and deletes the remaining data within 180 days.

Withdrawal: You can withdraw your consent at any time with effect for the future on our cookie page. This service is then no longer loaded. Please note: we cannot technically delete the cookies on the linkedin.com domain (see “Withdrawal and deletion” at the end of this chapter). Independently of this you may object to the use of your data for advertising purposes directly with LinkedIn: linkedin.com/psettings/guest-controls/retargeting-opt-out.

Meta pixel (Facebook and Instagram)

Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland; parent company Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA.

Purpose: Measuring the success of our advertisements on Facebook and Instagram and delivering audience-based advertising. This records the page view on every page where the container loads, and the viewing of an offer (ViewContent). It transmits, among other things, your IP address, device and browser details, the page visited and the time of the visit.

What this means beyond measurement: Of the four services described here, this one reaches furthest. If you are signed in to Facebook or Instagram, Meta can attribute your visit to your account there. Meta further combines these details with data it collects on other websites and in apps that also use Meta advertising tools – so the observation does not end at this website. On this basis Meta builds audiences, including lists of people who have visited this website and groups of similar people derived from them. Your browser can be recognised even without a Meta account. What conclusions Meta draws from these data is beyond our knowledge and beyond our influence.

Legal basis: Your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG).

Joint controllership: For the collection and transmission of data by the pixel we are joint controllers with Meta Platforms Ireland Limited (Art. 26 GDPR). Meta has provided an addendum allocating the respective responsibilities: facebook.com/legal/controller_addendum. Under it, Meta is responsible for informing data subjects at the point of collection; you may exercise your data subject rights against us as well as against Meta. Meta alone is responsible for the further processing after transmission.

Recipients: Meta Platforms Ireland Limited; Meta Platforms, Inc. in the USA.

Storage period: The _fbp cookie set on this website expires after 90 days. Cookies Meta sets on its own domains are subject to Meta’s periods and expire after 90 days at the latest. On Meta’s further processing see facebook.com/privacy/policy.

Withdrawal: You can withdraw your consent at any time with effect for the future on our cookie page. The pixel is then no longer loaded. Please note: we cannot technically delete the cookies on the facebook.com domain (see “Withdrawal and deletion” at the end of this chapter). Independently of this you may object to the use of your data for advertising purposes in the ad settings of your Meta account: facebook.com/settings?tab=ads.

Data transfer to the USA

All four services named above have parent companies in the USA, and using them transfers personal data – at least your IP address – there, or makes it retrievable there. The basis on which each one does so is stated with that service.

The common framework: by its decision of 10 July 2023 the European Commission established that an adequate level of protection exists in the USA for companies certified under the EU-U.S. Data Privacy Framework. Whether a company is certified – and whether it still is – can be checked at dataprivacyframework.gov/list. Independently of that, every transfer rests on the European Commission’s standard contractual clauses under Art. 46 (2) (c) GDPR; a certification is added for as long as it exists, and its lapse does not leave the transfer without a basis.

We point out that even under these conditions US authorities may gain access to personal data and that you may have no legal remedies against this comparable to those under European law. If you do not want this, choose “Essential only” on our cookie page – then none of these services is loaded.

Withdrawal and deletion

You can withdraw your consent at any time on our cookie page. Withdrawal takes effect for the future; the lawfulness of the processing carried out until then is unaffected. On withdrawal we delete the cookies of the services named above, in so far as they were set on this website.

We cannot delete cookies on the providers’ own domains. A cookie can only be removed from the domain that set it; cookies on linkedin.com, facebook.com or doubleclick.net are technically out of this website’s reach. They are no longer sent to the providers after withdrawal, because their services are no longer loaded. If you wish to remove them as well, you can do so in your browser settings or through the providers’ objection options named above.