Privacy Policy

EXMACHINE UG (haftungsbeschränkt)

Effective Date: September 2026

1. Overview and Scope

EXMACHINE UG (haftungsbeschränkt) (hereinafter referred to as "we", "us", or "EXMACHINE") operates as a specialized B2B experiential corporate event agency based in Berlin, Germany. We engineer high-engagement, unconventional, and privacy-first corporate formats, including proprietary experiences such as Off the Record, customized team retreats, and enterprise gatherings.

Protecting personal data and respecting individual privacy rights are fundamental to how we conduct our business. This Privacy Policy explains the nature, scope, and purpose of personal data collection and processing when visiting our website (exmachine.co), submitting corporate event inquiries, engaging our event production services, or interacting with our digital marketing campaigns in accordance with the EU General Data Protection Regulation (GDPR / DSGVO), the German Federal Data Protection Act (Bundesdatenschutzgesetz: BDSG), and the Telecommunications-Telemedia Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz: TDDDG).

2. Data Controller (Verantwortlicher)

The data controller responsible for the processing of personal data within the meaning of Article 4(7) GDPR is:

EXMACHINE UG (haftungsbeschränkt)

Wilhelm-Kabus-Straße 24

10829 Berlin, Germany

Official Contact Email: hello@exmachine.co

Website: https://exmachine.co

3. General Principles and Legal Bases for Data Processing

We process personal data strictly in compliance with statutory European and German regulations. Data processing relies on the following legal grounds:

Consent (Art. 6(1)(a) GDPR): Where you have granted explicit consent for specific processing operations, such as marketing cookies, tracking pixels, or voluntary post-event connection sharing.
Contractual Performance and Pre-Contractual Measures (Art. 6(1)(b) GDPR): Processing required to formulate customized proposals, execute commercial B2B contracts, manage venue logistics, coordinate bespoke catering, or administer guest credentials.
Legal Obligation (Art. 6(1)(c) GDPR): Processing necessary to satisfy statutory tax, accounting, and commercial record-keeping duties under German law (Handelsgesetzbuch: HGB, Abgabenordnung: AO).
Legitimate Interests (Art. 6(1)(f) GDPR): Processing necessary to safeguard our legitimate business interests, including website security, preventing fraudulent activity, corporate B2B marketing, defense against legal claims, and on-site event safety.

4. Technical Infrastructure, Website Hosting, and Google Workspace

4.1 Hosting on Wix Studio

Our website is built on and hosted by Wix.com Ltd. (Nemal Tel Aviv St 40, Tel Aviv 6350671, Israel) via Wix Studio infrastructure. When you visit our website, Wix automatically records technical access data in server logs:

Browser type and technical version
Operating system used
Referrer URL (the previous page visited)
Hostname of the accessing device
Date and time of the server request
IP address (anonymized where technically feasible)

Wix processes data on our behalf in accordance with a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR. Where data is transferred to Israel, it is protected under the European Commission's adequacy decision pursuant to Art. 45 GDPR. Where servers in third countries (e.g., the United States) are utilized, standard contractual clauses (SCCs) ensure compliant safeguards.

4.2 Corporate Email, Inquiries, and Google Workspace

Our operational infrastructure, correspondence, and internal workflows run via Google Workspace, operated by Google Cloud EMEA Limited (70 Sir John Rogerson's Quay, Dublin 2, Ireland).

When you contact us via hello@exmachine.co, submit inquiry forms on exmachine.co, or share project files, this communication is stored and processed across Google Workspace services (including Gmail, Google Drive, and Google Sheets). We maintain an active Data Processing Agreement with Google based on standard contractual clauses pursuant to Art. 28 and Art. 46 GDPR.

4.3 Contact and Inquiry Forms

When enterprise clients, HR leaders, or C-suite executives submit inquiries through our Wix Studio web forms or direct emails, we collect:

Full name and business email address
Corporate phone or WhatsApp contact number
Company name and professional title
Event scope, preferred dates, cohort size, and preliminary project briefs

Legal Basis: Art. 6(1)(b) GDPR (pre-contractual inquiries) and Art. 6(1)(f) GDPR (processing commercial inbound requests).

5. Cookies, Conversion Tracking, and Paid Advertising

Our website utilizes cookies and tracking technologies to measure advertising performance and deliver relevant B2B marketing across major advertising platforms. You have full control over non-essential tracking via our Cookie Consent Banner pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

5.1 Strictly Necessary Cookies

Essential cookies are deployed to ensure fundamental website operations, page security, and form transmissions pursuant to Section 25(2) TDDDG. These cookies do not require prior consent and cannot be deactivated in our systems.

5.2 Google Ads and Conversion Tracking

We use Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to run targeted search and display campaigns. Google Ads places conversion cookies when you click on one of our ads to track whether an inquiry was successfully submitted on our site.

Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (Consent).
Opt-Out: You can adjust your preferences via Google Ad Settings (https://adssettings.google.com) or revoke consent in our cookie banner.

5.3 LinkedIn Insight Tag (LinkedIn Ads)

We implement the LinkedIn Insight Tag from LinkedIn Ireland Unlimited Company (Wilton Plaza, Wilton Place, Dublin 2, Ireland) to track conversions, retarget enterprise audiences, and obtain demographic insights about professionals visiting our site. The Insight Tag enables the collection of data regarding your visit, including URL, referrer URL, IP address, device properties, and timestamp.

Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (Consent).
Opt-Out: LinkedIn members can control the use of their personal data for advertising purposes in their account settings.

5.4 Meta Pixel (Meta Ads: Facebook and Instagram)

We deploy the Meta Pixel provided by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) to evaluate the effectiveness of our campaigns on Facebook and Instagram. The pixel tracks visitor behavior after clicking on a Meta advertisement and landing on exmachine.co.

Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (Consent).
Opt-Out: You can manage your advertising preferences within your Facebook or Instagram profile settings.

6. Data Processing During Event Engineering and Operations

When an enterprise client retains EXMACHINE UG for event conceptualization and execution, we process data essential for end-to-end operational delivery:

Attendee Management: Guest rosters, corporate credentials, and badge details supplied by the client to administer check-ins, access security, and format organization.
Flexible Venue Coordination: We are not tied to any single location; we scout, secure, and operate at custom venues across Berlin, Germany, and Europe, alongside our flagship spaces at EINKELLER and Engelnest Garden. Operational data shared with venue operators or on-site security is strictly limited to verifying entry authorizations and fulfilling building safety protocols.
Special Category Data (Dietary and Accessibility Notes): Where guests voluntarily report severe allergies, food intolerances, or accessibility requirements, this data is processed solely to guarantee physical wellbeing and provide safe catering.
- Legal Basis: Art. 9(2)(a) GDPR (explicit consent via submission) and Art. 6(1)(b) GDPR. All dietary lists containing personal identifiers are permanently destroyed immediately after the event.

7. Privacy Architecture for Proprietary Formats: "Off the Record"

EXMACHINE UG designs specialized, privacy-first formats. For our flagship B2B professional matchmaking event, Off the Record, strict protocols protect executive confidentiality:

Pseudonymization and Codename Identifiers: Participants interact under assigned city codenames and physical masks. Real names, direct contact information, and current employers are never disclosed on the floor during the active session.
Bilateral Mutual Match Release: Contact information is revealed only when both participants register a mutual match post-event and explicitly consent to exchange contact details.
Strict No-Photo / No-Recording Enclaves: Mobile recording, personal cameras, and unauthorized recordings are strictly forbidden inside active matchmaking zones to protect professional discretion and personal privacy.
Limited Data Retention: Participant profiles generated solely for matching compatibility algorithms are purged within thirty (30) days following the conclusion of the event cycle.

8. Photography, Media Production, and Portfolio Usage

Private Corporate Gatherings: Photography and video production during private corporate events occur only with the express contractual authorization of the commissioning client. The client remains responsible for informing its participating workforce in advance under internal workplace guidelines.
Public and Portfolio Coverage: EXMACHINE UG never publishes identifiable footage of attendees on public channels, website showcases, or marketing materials without prior explicit consent (Einwilligung) or clear corporate agreement.

9. Data Sharing and Third-Party Processors

EXMACHINE UG does not sell, rent, or trade personal data to third parties. We share data only when strictly required for service delivery, authorized by contract, or mandated by law:

Technical Service Providers: Wix Studio, Google Workspace, and CRM management platforms bound by strict Data Processing Agreements (Auftragsverarbeitungsverträge: AVV) pursuant to Art. 28 GDPR.
Hospitality and Production Partners: Aggregated guest counts, dietary notes, and technical schedules shared with catering kitchens, staging technicians, and venue managers without disclosing full personal records whenever possible.
Public Authorities: Tax offices, corporate auditors, and regulatory bodies exclusively when required under statutory German law.

10. International Data Transfers

Primary data operations are processed within Germany and the European Economic Area (EEA). If a third-party software provider processes data outside the EEA, we verify that an adequate level of data protection is preserved pursuant to Art. 45 GDPR (such as the EU-US Data Privacy Framework) or by executing Standard Contractual Clauses (SCCs) approved by the European Commission pursuant to Art. 46(2)(c) GDPR.

11. Data Retention and Erasure (Speicherdauer)

We retain personal records only for as long as required to complete the designated purpose or fulfill statutory retention schedules:

Business Inquiries: Inactive lead files and inquiry notes are deleted after six (6) months if no commercial engagement proceeds.
Commercial and Tax Records: Invoices, booking contracts, and business correspondence are archived for six (6) to ten (10) years in adherence to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).
Event Participant Rosters: Operational badge details and guest logs are deleted within thirty (30) days after final post-event reconciliation.

12. Your Rights Under GDPR (Ihre Betroffenenrechte)

As a data subject, you hold clear statutory rights under European data protection legislation:

Right of Access (Art. 15 GDPR): Obtain confirmation and details regarding the personal data we process about you.
Right to Rectification (Art. 16 GDPR): Demand immediate correction of inaccurate or incomplete personal records.
Right to Erasure (Art. 17 GDPR): Request the deletion of your personal data when statutory retention mandates or overriding legitimate interests no longer apply.
Right to Restriction of Processing (Art. 18 GDPR): Request the limitation of processing under specific legal conditions.
Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, machine-readable format or have it transferred directly to another controller.
Right to Withdraw Consent (Art. 7(3) GDPR): Revoke previously granted consent at any point with future effect without impacting the legality of processing prior to revocation.
Right to Object (Art. 21 GDPR): Object at any time, on grounds relating to your particular situation, to data processing rooted in Art. 6(1)(f) GDPR (legitimate commercial interests), including direct marketing profiling.

To exercise any of these rights, please contact us directly:

Email: hello@exmachine.co

13. Supervisory Authority (Aufsichtsbehörde)

You have the right to lodge a complaint with a data protection supervisory authority if you believe our data processing violates statutory regulations (Art. 77 GDPR). The competent supervisory authority for EXMACHINE UG in Berlin is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

Friedrichstraße 219

10969 Berlin, Germany

Phone: +49 (0)30 13889-0

Website: https://www.datenschutz-berlin.de

14. Data Security (Datensicherheit)

We maintain rigorous technical and organizational measures (TOMs) pursuant to Art. 32 GDPR to protect personal data against accidental loss, unauthorized access, destruction, or alteration. Our defenses incorporate end-to-end SSL/TLS transmission encryption across Wix and Google environments, access-controlled cloud repositories, strict role permissions, and physical security measures at our Berlin production offices.

15. Changes to This Privacy Policy

We reserve the right to amend this Privacy Policy to ensure continuous conformity with updated legal mandates or to mirror structural evolutions in our event portfolio, advertising channels, and operational integrations. The most current version is always accessible directly at exmachine.co

Privacy Policy

1. Overview and Scope

2. Data Controller (Verantwortlicher)

The data controller responsible for the processing of personal data within the meaning of Article 4(7) GDPR is:

EXMACHINE UG (haftungsbeschränkt)

Wilhelm-Kabus-Straße 24

10829 Berlin, Germany

Official Contact Email: hello@exmachine.co

Website: https://exmachine.co

3. General Principles and Legal Bases for Data Processing

We process personal data strictly in compliance with statutory European and German regulations. Data processing relies on the following legal grounds:

Consent (Art. 6(1)(a) GDPR): Where you have granted explicit consent for specific processing operations, such as marketing cookies, tracking pixels, or voluntary post-event connection sharing.

Contractual Performance and Pre-Contractual Measures (Art. 6(1)(b) GDPR): Processing required to formulate customized proposals, execute commercial B2B contracts, manage venue logistics, coordinate bespoke catering, or administer guest credentials.

Legal Obligation (Art. 6(1)(c) GDPR): Processing necessary to satisfy statutory tax, accounting, and commercial record-keeping duties under German law (Handelsgesetzbuch: HGB, Abgabenordnung: AO).

Legitimate Interests (Art. 6(1)(f) GDPR): Processing necessary to safeguard our legitimate business interests, including website security, preventing fraudulent activity, corporate B2B marketing, defense against legal claims, and on-site event safety.

4. Technical Infrastructure, Website Hosting, and Google Workspace

4.1 Hosting on Wix Studio

Our website is built on and hosted by Wix.com Ltd. (Nemal Tel Aviv St 40, Tel Aviv 6350671, Israel) via Wix Studio infrastructure. When you visit our website, Wix automatically records technical access data in server logs:

Browser type and technical version

Operating system used

Referrer URL (the previous page visited)

Hostname of the accessing device

Date and time of the server request

IP address (anonymized where technically feasible)

4.2 Corporate Email, Inquiries, and Google Workspace

Our operational infrastructure, correspondence, and internal workflows run via Google Workspace, operated by Google Cloud EMEA Limited (70 Sir John Rogerson's Quay, Dublin 2, Ireland).

4.3 Contact and Inquiry Forms

When enterprise clients, HR leaders, or C-suite executives submit inquiries through our Wix Studio web forms or direct emails, we collect:

Full name and business email address

Corporate phone or WhatsApp contact number

Company name and professional title

Event scope, preferred dates, cohort size, and preliminary project briefs

Legal Basis: Art. 6(1)(b) GDPR (pre-contractual inquiries) and Art. 6(1)(f) GDPR (processing commercial inbound requests).

5. Cookies, Conversion Tracking, and Paid Advertising

Our website utilizes cookies and tracking technologies to measure advertising performance and deliver relevant B2B marketing across major advertising platforms. You have full control over non-essential tracking via our Cookie Consent Banner pursuant to Section 25(1) TDDDG and Art. 6(1)(a) GDPR.

5.1 Strictly Necessary Cookies

Essential cookies are deployed to ensure fundamental website operations, page security, and form transmissions pursuant to Section 25(2) TDDDG. These cookies do not require prior consent and cannot be deactivated in our systems.

5.2 Google Ads and Conversion Tracking

We use Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to run targeted search and display campaigns. Google Ads places conversion cookies when you click on one of our ads to track whether an inquiry was successfully submitted on our site.

Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (Consent).

Opt-Out: You can adjust your preferences via Google Ad Settings (https://adssettings.google.com) or revoke consent in our cookie banner.

5.3 LinkedIn Insight Tag (LinkedIn Ads)

Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (Consent).

Opt-Out: LinkedIn members can control the use of their personal data for advertising purposes in their account settings.

5.4 Meta Pixel (Meta Ads: Facebook and Instagram)

We deploy the Meta Pixel provided by Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland) to evaluate the effectiveness of our campaigns on Facebook and Instagram. The pixel tracks visitor behavior after clicking on a Meta advertisement and landing on exmachine.co.

Legal Basis: Art. 6(1)(a) GDPR and Section 25(1) TDDDG (Consent).

Opt-Out: You can manage your advertising preferences within your Facebook or Instagram profile settings.

6. Data Processing During Event Engineering and Operations

When an enterprise client retains EXMACHINE UG for event conceptualization and execution, we process data essential for end-to-end operational delivery:

Attendee Management: Guest rosters, corporate credentials, and badge details supplied by the client to administer check-ins, access security, and format organization.

Special Category Data (Dietary and Accessibility Notes): Where guests voluntarily report severe allergies, food intolerances, or accessibility requirements, this data is processed solely to guarantee physical wellbeing and provide safe catering.

Legal Basis: Art. 9(2)(a) GDPR (explicit consent via submission) and Art. 6(1)(b) GDPR. All dietary lists containing personal identifiers are permanently destroyed immediately after the event.

7. Privacy Architecture for Proprietary Formats: "Off the Record"

EXMACHINE UG designs specialized, privacy-first formats. For our flagship B2B professional matchmaking event, Off the Record, strict protocols protect executive confidentiality:

Pseudonymization and Codename Identifiers: Participants interact under assigned city codenames and physical masks. Real names, direct contact information, and current employers are never disclosed on the floor during the active session.

Bilateral Mutual Match Release: Contact information is revealed only when both participants register a mutual match post-event and explicitly consent to exchange contact details.

Strict No-Photo / No-Recording Enclaves: Mobile recording, personal cameras, and unauthorized recordings are strictly forbidden inside active matchmaking zones to protect professional discretion and personal privacy.

Limited Data Retention: Participant profiles generated solely for matching compatibility algorithms are purged within thirty (30) days following the conclusion of the event cycle.

8. Photography, Media Production, and Portfolio Usage

Private Corporate Gatherings: Photography and video production during private corporate events occur only with the express contractual authorization of the commissioning client. The client remains responsible for informing its participating workforce in advance under internal workplace guidelines.

Public and Portfolio Coverage: EXMACHINE UG never publishes identifiable footage of attendees on public channels, website showcases, or marketing materials without prior explicit consent (Einwilligung) or clear corporate agreement.

9. Data Sharing and Third-Party Processors

EXMACHINE UG does not sell, rent, or trade personal data to third parties. We share data only when strictly required for service delivery, authorized by contract, or mandated by law:

Technical Service Providers: Wix Studio, Google Workspace, and CRM management platforms bound by strict Data Processing Agreements (Auftragsverarbeitungsverträge: AVV) pursuant to Art. 28 GDPR.

Hospitality and Production Partners: Aggregated guest counts, dietary notes, and technical schedules shared with catering kitchens, staging technicians, and venue managers without disclosing full personal records whenever possible.

Public Authorities: Tax offices, corporate auditors, and regulatory bodies exclusively when required under statutory German law.

10. International Data Transfers

11. Data Retention and Erasure (Speicherdauer)

We retain personal records only for as long as required to complete the designated purpose or fulfill statutory retention schedules:

Business Inquiries: Inactive lead files and inquiry notes are deleted after six (6) months if no commercial engagement proceeds.

Commercial and Tax Records: Invoices, booking contracts, and business correspondence are archived for six (6) to ten (10) years in adherence to Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB).

Event Participant Rosters: Operational badge details and guest logs are deleted within thirty (30) days after final post-event reconciliation.

12. Your Rights Under GDPR (Ihre Betroffenenrechte)

As a data subject, you hold clear statutory rights under European data protection legislation:

Right of Access (Art. 15 GDPR): Obtain confirmation and details regarding the personal data we process about you.

Right to Rectification (Art. 16 GDPR): Demand immediate correction of inaccurate or incomplete personal records.

Right to Erasure (Art. 17 GDPR): Request the deletion of your personal data when statutory retention mandates or overriding legitimate interests no longer apply.

Right to Restriction of Processing (Art. 18 GDPR): Request the limitation of processing under specific legal conditions.

Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, commonly used, machine-readable format or have it transferred directly to another controller.