Bright Capital Websites

This Privacy Policy applies to all Bright Capital websites. These include our corporate website www.brightcapital.de as well as other existing websites, in particular the event website of the Independent Sponsors Summit (www.independentsponsorssummit.com). This Privacy Policy describes how Bright Capital collects and uses information that you provide when you visit our websites, when you receive e-mails from us, and when you register for or attend events hosted by Bright Capital. It also describes the choices you have about how we use this information and how you can access and update it.

Summary

This Privacy Policy applies to all Bright Capital websites. These include our corporate website www.brightcapital.de as well as other existing websites. This Privacy Policy describes how Bright Capital collects and uses information that you provide when you visit our websites. It also describes the choices you have about how we use this information and how you can access and update it.

In addition, this Privacy Policy explains how we process personal data in connection with invitations to, registration for and participation in the Independent Sponsors Summit, and how we use the e-mail service provider Brevo to send invitations and event-related e-mails.

Contact persons and responsibilities

Responsible entity within the meaning of data protection law:

Bright Capital GmbH
Matthias Mathieu, Karsten Batran
Große Bockenheimer Str. 24
60313 Frankfurt am Main
Germany
mittelstand@brightcapital.de
+49 69 3487 759 80

Registered office: Frankfurt am Main
Registry court: Amtsgericht Frankfurt am Main
Commercial register: HRB 99217
Managing directors: Matthias Mathieu, Karsten Batran

Contact details of the data protection officer

Bright Capital GmbH
Datenschutzbeauftragter
Große Bockenheimer Str. 43
60313 Frankfurt am Main
Germany
dataprotection@brightcapital.de
+49 69 3487 759 80

Definition of personal data

Personal data is any information about the personal and actual circumstances of a particular or identifiable person. This information includes, for example, your name, e-mail address, postal address or telephone number. Information on the basis of which your identity cannot be determined without additional data is not included. In the opinion of the supervisory authorities, IP addresses are, in particular, data that refer to personal data. The transmission of the IP address when accessing a website is a technical necessity. If necessary, the data is analysed for statistical purposes in anonymous and pseudonymised form. This means that it is not possible to identify you personally through this. In principle, our data protection declaration should be simple and understandable for everyone. For this reason, our data protection declaration generally uses the official terms of the General Data Protection Regulation (GDPR). The official definitions are explained in Art. 4 GDPR.

Data processing by visiting our website

When you visit our website, it is technically necessary that data is transmitted to our web server via your internet browser. The following data is recorded during a running connection for communication between your internet browser and our web server:

• Visited domain
• The date and time of the request
• Page from which the file was requested
• Access status (file transferred, file not found, etc.)
• The web browser, system language, operating system and device type used
• IP address of the requesting computer
• The amount of data transferred

We collect the listed data to ensure a smooth connection to the website and to enable a comfortable use of our website by the users. In addition, the log file serves the purpose of evaluating system security and stability, as well as providing administrative functions. The legal basis for the temporary storage of data or log files is Art. 6 para. 1 a. GDPR.

Storage of data

If we receive personal data from you, Bright Capital will store it on a server and use it exclusively for the purposes for which you have transmitted it to us. All the servers operated by Bright Capital are located within the European Union. Where we use external service providers (e.g. the e-mail service provider Brevo), personal data may in individual cases also be processed outside the European Union or the European Economic Area; details are set out in the section “Sending of e-mails via Brevo”. We comply with legal regulations both during transmission and after receipt, taking into account the state of the art and suitable technical and organisational measures to protect personal information and data transmitted to us. However, no transmission method over the internet or electronic storage method is one hundred percent secure. As a result, we cannot guarantee absolute safety.

Cookies

Our website uses cookies, which are stored by the browser on your device and which contain certain settings for the use of the website (e.g. for the current session). Cookies serve to make our website more user-friendly, effective and secure. Cookies are small text files that are stored on your computer and saved by your browser. Most of the cookies we use are so-called session cookies, which are automatically deleted after closing the browser. Other cookies remain stored on your end device until you delete them or the storage period expires. These cookies enable us to recognize your browser the next time you visit our website. In some cases, cookies are used to simplify website processes by saving settings (e.g. the provision of already selected options). If personal data is also processed by individual cookies implemented by us, the processing is carried out in accordance with Art. 6 para. 1 lit. b GDPR either for the execution of the contract or in accordance with Art. 6 para. 1 lit. f GDPR to safeguard our legitimate interests in the best possible functionality of the website and a customer-friendly and effective design of the page visit. You can configure your browser in such a way that you are informed about the settings of cookies and only allow cookies in individual cases, excluding the acceptance of cookies for certain cases or in general deactivating cookies and activating the automatic deletion of cookies when closing the browser. The cookie settings can be managed using the following links for the respective browser.

Firefox: support.mozilla.org/de/kb/cookies-erlauben-und-ablehnen
Internet Explorer: windows.microsoft.com/de-DE/windows-vista/Block-or-allow-cookies
Chrome: support.google.com/chrome/bin/answer.py
Safari: support.apple.com/kb/ph21411
Opera: help.opera.com/Windows/10.20/de/cookies.html

You can also individually manage the cookies of many companies and features used for advertising. Use the corresponding user tools, available at www.aboutads.info/choices/ or www.youronlinechoices.com/uk/your-ad-choices

Most browsers also offer a so-called “Do-Not-Track function” with which you can specify that you do not want to be “tracked” by websites. When this feature is enabled, your browser tells advertising networks, websites and applications that you do not want to be tracked for behavior-based advertising. Information and instructions on how to edit this function are available from the links below, depending on the provider of your browser:

Google Chrome: support.google.com/chrome/answer/2790761
Mozilla Firefox: www.mozilla.org/de/firefox/dnt/
Internet Explorer: support.microsoft.com/de-de/help/17288/windows-internet-explorer-11-use-do-not-track
Opera: help.opera.com/Windows/12.10/de/notrack.html
Safari: support.apple.com/kb/PH21416

You can also prevent scripts from being loaded by default. NoScript allows you to run JavaScripts, Java and other plug-ins only on trusted domains of your choice. For information and instructions on how to edit this feature, contact your browser vendor (e.g. for Mozilla Firefox at: addons.mozilla.org/de/firefox/addon/noscript/).

Please note that when cookies are deactivated, the functionality of this website may be limited.

Independent Sponsors Summit – invitations, registration and participation

Bright Capital hosts the Independent Sponsors Summit (“ISS”), an industry event with participation by invitation only. In this context, we process personal data of invited guests, registered participants, speakers and moderators as described below.

Categories of personal data

• Master and contact data: first and last name, academic title, company, position, business e-mail address and, where provided, business telephone number;
• Registration data: invitation and registration status, date and time of registration, participation in the day programme and/or evening programme, consent declarations given;
• Voluntary information: e.g. dietary requirements or accessibility needs, provided that you give us this information;
• Communication data: correspondence with us regarding the event and technical data generated when our e-mails are sent and read (see “Sending of e-mails via Brevo”);
• For speakers and moderators additionally: photo, short biography and the content of your contribution.

Purposes of processing

• Sending invitations and information about the ISS;
• Processing, confirming and administering your registration, including reminders and changes to the programme;
• Organisation and conduct of the event, in particular admission control, name badges, guest list, catering and coordination with the event venue;
• Communication after the event (e.g. thank-you e-mail, provision of presentations, feedback request);
• Publication of the programme including speakers and moderators;
• Evaluation of the event in order to improve future events.

Legal basis

• Processing of your registration and organisation of your participation: Art. 6 para. 1 sentence 1 lit. b GDPR (participation in the event at your request).
• Sending invitations and event information by e-mail: your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR or, where the sending is permitted by law without consent, our legitimate interest in maintaining and developing our business relationships pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR.
• Voluntary information such as dietary requirements: your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR; insofar as such information allows conclusions to be drawn about your health or religious beliefs, your explicit consent pursuant to Art. 9 para. 2 lit. a GDPR. This information is used exclusively for organising catering and is deleted after the event.
• Publication of speaker information: Art. 6 para. 1 sentence 1 lit. b GDPR (agreement on your contribution) or your consent pursuant to Art. 6 para. 1 sentence 1 lit. a GDPR.
• Documentation of consents given: Art. 6 para. 1 sentence 1 lit. c GDPR in conjunction with Art. 7 para. 1 GDPR (obligation to be able to demonstrate consent).

Recipients

For the purposes described above, we transfer personal data to the following recipients, to the extent necessary:

• Brevo as our e-mail and registration service provider (see “Sending of e-mails via Brevo”);
• the event venue in Munich, in particular the number of participants, guest list and catering requirements;
• service providers for event technology, badge printing and photography, insofar as they are engaged for the event.

A list of participants (name, company, position) will only be made available to other participants if you have consented to this.

Photographs and video recordings

During the event, photographs and, where applicable, video recordings may be taken and used for reporting on the event on our websites and on our social media channels (e.g. LinkedIn). The legal basis is our legitimate interest in documenting and presenting the event (Art. 6 para. 1 sentence 1 lit. f GDPR). We will point this out at the venue. If you do not wish to be photographed, please let our team or the photographer know on site. You may object to the processing at any time (see “Right of objection”).

Storage period

We delete the registration and participation data no later than 12 months after the event, unless statutory retention obligations apply. Information on dietary requirements or accessibility needs is deleted immediately after the event. If you have consented to receive invitations to future events, we store your contact data until you withdraw your consent or unsubscribe. We retain evidence of consents given for the duration of the processing based on them and for up to three years thereafter in order to be able to demonstrate compliance with data protection requirements.

Sending of e-mails via Brevo

We send invitations, registration confirmations, reminders and other event-related e-mails as well as newsletters using the e-mail marketing service Brevo. The provider is Brevo GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, a company of the Sendinblue group (Sendinblue SAS, 17 rue Salneuve, 75017 Paris, France) (“Brevo”).

Data processed

Brevo processes on our behalf your e-mail address, your name, company and position, the further data you provide when registering, as well as technical data generated when our e-mails are sent and opened (time of dispatch, delivery status, IP address, information on the device and e-mail program used, time of opening and links clicked).

Data processing on our behalf

Brevo processes your data exclusively on our behalf and in accordance with our instructions. We have concluded a data processing agreement with Brevo pursuant to Art. 28 GDPR, which forms part of Brevo’s Terms of Service. Brevo uses carefully selected sub-processors for the provision of its services. In addition, Brevo uses certain usage data under its own responsibility to prevent spam, phishing and fraud and to secure its services. Further information can be found in Brevo’s privacy policy: www.brevo.com/legal/privacypolicy/.

Transfer to third countries

According to Brevo, the data are stored exclusively on servers within the European Union (France, Germany and Belgium). In individual cases, however, Brevo states that personal data may be transferred to sub-processors in countries outside the European Economic Area, in particular the USA and India. In such cases, the transfer is based on the EU Standard Contractual Clauses (Art. 46 para. 2 lit. c GDPR) or, for recipients in the USA certified under the EU-U.S. Data Privacy Framework, on the adequacy decision of the European Commission (Art. 45 GDPR).

Registration and proof of consent

If you register for the ISS or consent to receiving invitations, you do so actively by submitting the registration form; consent to receiving invitations is given via a checkbox that is not pre-ticked. After submitting the form, you immediately receive a confirmation of receipt by e-mail. In order to be able to demonstrate your registration and consent, we store the time of registration, your IP address and the wording of the declaration of consent (Art. 6 para. 1 sentence 1 lit. c and lit. f GDPR in conjunction with Art. 7 para. 1 GDPR).

Analysis of opening and click rates

Our e-mails contain a so-called tracking pixel and tracked links, which allow us to determine whether and when an e-mail was opened and which links were clicked. This information is assigned to your e-mail address and stored in Brevo. We use it to organise the event (e.g. targeted reminders and follow-ups) and to improve our communication. The legal basis is our legitimate interest in the efficient organisation of the event and the improvement of our communication (Art. 6 para. 1 sentence 1 lit. f GDPR). You may object to this analysis at any time. As the analysis cannot be deactivated for individual recipients, an objection is implemented by unsubscribing you from our e-mails, either via the link contained in every e-mail or by e-mail to dataprotection@brightcapital.de. You can also prevent the tracking pixel from loading by deactivating the automatic display of images in your e-mail program.

Unsubscribing and withdrawal

Every invitation and event e-mail contains a link which you can use to unsubscribe from further e-mails at any time and free of charge. Alternatively, you can send us an e-mail to dataprotection@brightcapital.de. After you unsubscribe, your e-mail address is stored in a blocklist in Brevo so that you do not receive any further e-mails from us. The legal basis for this is our legitimate interest in complying with your objection (Art. 6 para. 1 sentence 1 lit. f GDPR). The lawfulness of the e-mails sent before the withdrawal remains unaffected. Transactional e-mails that are directly connected with an existing registration (e.g. confirmation or cancellation notice) may still be sent to you as long as you are registered.

Data transfer and recipient

We do not sell your personal data to third parties. Your personal data will not be passed on to third parties unless

• we have explicitly indicated this in the description of the respective data processing,
• you have given your explicit consent in accordance to Art. 6 para. 1 sentence 1 lit. a GDPR,
• the disclosure pursuant to Art. 6 para. 1 sentence 1 f GDPR is necessary to assert, exercise or defend legal claims and there is no reason to assume that you have an outright interest worthy of protection in not disclosing your data,
• that a legal obligation exists for the transfer pursuant to Art. 6 para. 1 sentence 1 lit. c GDPR and
• this is required under Art. 6 para. 1 sentence 1 lit. b GDPR for the processing of contractual relationships with you.

We also use external service providers, which we have carefully selected and commissioned in writing, to carry out our services. They are bound by our instructions and are regularly checked by us. With which we have concluded order processing contracts in accordance with Art. 28 GDPR, if necessary. These are service providers for web hosting, sending e-mails (in particular Brevo, see “Sending of e-mails via Brevo”), the organisation of events (e.g. the event venue of the Independent Sponsors Summit) and maintaining our IT systems, etc. The service providers will not pass this data on to third parties.

Duration of data storage

We adhere to the principles of data avoidance and data minimization. Accordingly, we will only store your personal data for as long as necessary to achieve the purposes stated here or in accordance with the various storage periods prescribed by law. Once the targets have been met or these deadlines have expired, the relevant data is routinely blocked or deleted in accordance with legal requirements. Specific storage periods for data processed in connection with the Independent Sponsors Summit are set out in the relevant section above.

Rights of the persons concerned

In the following section you will find information on the rights of persons concerned which are granted to you by the current data protection laws with regard to the entity responsible of the processing of your personal data: The right to request information about your personal data processed by us in accordance with Art. 15 GDPR. In particular, you may request information about the purposes of processing, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the existence of a right to rectification, deletion, restriction of processing or objection, the existence of a right of complaint, the origin of your data, if these have not been collected by us, and the existence of automated decision-making including profiling and, if applicable, meaningful information regarding their details. The right to immediately request the correction of incorrect or complete personal data stored by us in accordance with Art. 16 GDPR. The right to request the deletion of your personal data stored by us in accordance with Art. 17 GDPR, unless the processing is necessary to exercise the right to freedom of expression and information, to fulfil a legal obligation, for reasons of public interest or to assert, exercise or defend legal claims. The right, pursuant to Art. 18 GDPR, to demand the restriction of the processing of your personal data if the accuracy of the data is disputed by you, the processing is unlawful, but you refuse to have it deleted and we no longer need the data, but you need it to assert, exercise or defend legal claims or you have filed an objection against the processing pursuant to Art. 21 GDPR. The right, in accordance with Art. 20 GDPR, to receive your personal data that you have provided to us in a structured, current and machine-readable format or to request its transfer to another person responsible. The right to revoke your consent granted pursuant to Art. 7 para. 3 GDPR at any time with effect in the future. The right to complain to a supervisory authority pursuant to Art. 77 GDPR. As a rule, you can contact the supervisory authority of the federal state in which we have our registered office or, if applicable, that of your usual place of residence or work. The right to revoke consent granted pursuant to Art. 7 para. 3 GDPR: You have the right to revoke consent to the processing of data once granted at any time with effect for the future. In the event of revocation, we will delete the data concerned without delay, unless further processing can be based on a legal basis for processing without consent. The revocation of consent shall not affect the legality of the processing carried out on the basis of the consent until revocation;

Right of objection

If your personal data is processed by us on the basis of legitimate interests pursuant to Art. 6 para. 1 sentence 1 lit. f GDPR, you have the right to object to the processing of your personal data in accordance with Art. 21 GDPR, insofar as this is for reasons arising from your particular situation. If the objection is directed against the processing of personal data for the purpose of direct marketing, you have a general right of objection without the requirement to indicate a special situation.

You may object at any time and free of charge to receiving invitations and event information by e-mail, in particular via the unsubscribe link contained in every e-mail.

If you wish to exercise your right of revocation or opposition or any of your other rights, simply send an e-mail to dataprotection@brightcapital.de with the subject “Data protection Bright Capital websites”. If necessary, you must provide proof of your identity or that it is your account.

Subject to alterations

Bright Capital reserves the right to change this Privacy Policy at any time in accordance with the law. If we make significant changes, we will notify you by posting a notice on this website before the change takes effect. We ask you to check this page regularly for current information on our data protection practices.

Status of this data protection declaration: October 2026