Data Protection Notice
This Data Protection Notice explains how personal data is processed in connection with the networking events (the “Events”) jointly organised by M&A Media Services GmbH and Fintalent Limited. It applies in addition to any privacy information provided on the respective event website.

1. Joint controllers and contact

The Events are carried out under joint controllership pursuant to Article 26 GDPR by:

M&A Media Services GmbH (mandaco)

Habenschadenstraße 16, 82049 Pullach, Germany

Represented by the Managing Director Stefan Schneider

Tel.: +49 179 4483063 · E-mail: hello@manda.co

and

Fintalent Limited

85 Great Portland Street, 1st Floor, London W1W 7LT, United Kingdom

E-mail: privacy@fintalent.com

The joint controllers have designated M&A Media Services GmbH as the single point of contact for data subjects (e-mail: hello@manda.co). You may nevertheless exercise your rights against either controller. The essence of the joint controllership arrangement is set out in Section 5 and in the joint controllership information provided with the Event.

2. Scope of this notice

This notice covers the processing of personal data of participants, speakers, partner representatives and other persons involved in the Events, for registration, communication, networking, performance, documentation and follow-up of the Events.

3. Categories of personal data

Depending on the Event and your interaction with us, we process in particular:

•     master data (title, first and last name, company, position);

•     contact data (e-mail address and, where provided, telephone number, postal address);

•     event-related data (registration, ticket, attendance, dietary or accessibility information provided voluntarily);

•     communication data (your correspondence with us);

•     payment-related data for paid Events (processed via our payment service provider);

•     voluntary information (e.g. interests, networking information).

4. Purposes and legal bases

We process your personal data for the following purposes and on the following legal bases:

Purpose
Legal basis
Registration, participant management and performance of the Event
Art. 6(1)(b) GDPR (contract); Art. 6(1)(f) GDPR (organisation)
Communication regarding the Event
Art. 6(1)(b) and Art. 6(1)(f) GDPR
Networking and participant lists
Art. 6(1)(a) GDPR (consent)
Marketing / newsletter about future events
Art. 6(1)(a) GDPR (consent)
Photographs, video and audio recordings
Art. 6(1)(f) GDPR or Art. 6(1)(a) GDPR (consent)
Compliance with legal (e.g. accounting) obligations
Art. 6(1)(c) GDPR

5. Essence of the joint controllership arrangement

M&A Media Services GmbH is primarily responsible for registration and ticketing, the technical infrastructure, the engagement of processors and the provision of information under Articles 13 and 14 GDPR. Both controllers are jointly responsible for the content and networking aspects of the Events; Fintalent leads the involvement of its professional network. The controllers support each other in handling data subject requests. The full arrangement is set out in a Joint Controllership Agreement pursuant to Article 26 GDPR; the essence is summarised here and made available to you.

6. Registration and ticketing (ticketareo)

For registration, ticketing and event management we use the platform ticketareo, operated by ticketareo GmbH, Jakob-Huber-Str. 2, 82110 Germering, Germany, as our processor under Article 28 GDPR. Via ticketareo we collect the data required for registration and participation (e.g. name, contact details, and payment information for paid tickets). The legal basis is Article 6(1)(b) GDPR (performance of the contract) and Article 6(1)(f) GDPR (effective organisation of Events). Further information: https://ticketareo.de/.

7. E-mail communication

If you contact us by e-mail, we process the data contained in your message (e.g. name, company, contact details and the resulting correspondence) solely to handle your enquiry. The legal basis is Article 6(1)(a) GDPR or, where your enquiry aims at the conclusion of a contract, Article 6(1)(b) GDPR. The data is deleted once the respective enquiry has been conclusively dealt with.

8. Newsletter and event communications

With your consent (Article 6(1)(a) GDPR) we send you a newsletter and information about future events. For the technical dispatch we may use the service Mailchimp (Intuit Inc., 2700 Coast Avenue, Mountain View, CA 94043, USA) as our processor under Article 28 GDPR; the transfer is based on the EU Standard Contractual Clauses and Mailchimp’s EU-US Data Privacy Framework certification. Registration takes place via a double opt-in procedure. You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in the newsletter or by e-mail to hello@manda.co.

9. Cookies and web analytics on the event website

The event website uses technically necessary cookies and local storage on the basis of Article 6(1)(f) GDPR and § 25(2) TTDSG. Cookies or tools for analysis or marketing purposes are used only on the basis of your consent given via the cookie banner (Article 6(1)(a) GDPR, § 25(1) TTDSG). For reach analysis we may use the open-source tool Matomo, configured without the use of tracking cookies, on the basis of Article 6(1)(f) GDPR. You can object to the analysis at any time via the opt-out provided.

10. Video and streaming

For online or hybrid Events and for embedded videos we may use streaming services such as Vimeo (Vimeo.com, Inc., 330 West 34th Street, New York, USA). When you access such content, a connection to the provider’s servers is established and data (e.g. IP address) may be transferred, including to servers outside the EU/EEA, subject to appropriate safeguards. The legal basis is Article 6(1)(f) GDPR (functional provision of the content) or your consent.

11. Photographs, video and audio recordings at Events

Photographs, video and audio recordings may be made at the Events. These are processed on the basis of Article 6(1)(f) GDPR (legitimate interest in documentation and communication) or on the basis of your consent, and may be used for press, information and documentation purposes. You may object to such processing at any time; you are free to remain in areas not covered by recordings.

12. Participant lists and networking

If you give your consent, your data (name, company, position) may be included in participant lists and made available to other participants for networking purposes. Participation in the Event does not depend on this consent.

13. Recipients of your data

Recipients of your data may be: the joint controllers (MAMS and Fintalent); processors (e.g. event/ticketing platform, CRM, communication and payment service providers) engaged under Article 28 GDPR; and event partners (only where necessary to carry out the Event or on the basis of your explicit consent). Partners that receive data on the basis of consent process it under their own responsibility.

14. International data transfers

As one of the joint controllers (Fintalent) is established in the United Kingdom, personal data may be transferred between the EU/EEA and the UK on the basis of the European Commission’s UK adequacy decision or, where applicable, appropriate safeguards under Article 46 GDPR (e.g. EU Standard Contractual Clauses together with the UK IDTA/Addendum). Where processors are located in other third countries (e.g. the USA), transfers take place only on the basis of an adequacy decision or appropriate safeguards under Chapter V GDPR.

15. Retention

We store your personal data only for as long as necessary for the purposes described above. Beyond that, data is stored only where statutory retention obligations (e.g. under commercial or tax law) require it, after which it is deleted or anonymised.

16. Your rights

As a data subject you have the following rights under the GDPR (and, where applicable, the UK GDPR):

•     right of access (Art. 15 GDPR);

•     right to rectification (Art. 16 GDPR);

•     right to erasure (Art. 17 GDPR);

•     right to restriction of processing (Art. 18 GDPR);

•     right to data portability (Art. 20 GDPR);

•     right to object (Art. 21 GDPR); and

•     right to withdraw consent at any time with effect for the future (Art. 7(3) GDPR).

To exercise your rights, please contact the single point of contact (hello@manda.co) or either joint controller. You also have the right to lodge a complaint with a data protection supervisory authority.

17. Automated decision-making and profiling

We do not use your data for automated decision-making or profiling within the meaning of Article 22 GDPR.

18. Security

We take appropriate technical and organisational measures to protect your personal data against unlawful or accidental access, loss, alteration or unauthorised disclosure, including encryption of data in transit (SSL/TLS).

19. Changes to this notice

This Data Protection Notice is valid as of July 2026. We may amend it in the light of the further development of our Events or of changed legal or regulatory requirements. The current version is made available in connection with the respective Event.

Pullach / London, July 2026