Privacy Policy
This English translation is provided for convenience only; the legally binding version is the German one.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Doppelweiss GmbH
Meddenwarf 1
22457 Hamburg
Germany
Managing Director: Kian Batteiger
Phone: +49 40 309 28884
Email: team@skn-campus.com
2. Your Rights
You have the following rights regarding your personal data: the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). Where you have given consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). Please contact us at the address above.
You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.
3. Hosting and Delivery of the Website
This website consists of static pages and is provided on a server we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Nuremberg, Germany. Hetzner processes the resulting data exclusively on our behalf and in accordance with our instructions (Art. 28 GDPR).
The website is delivered through the content delivery and security network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare serves the page content from a data centre near you and protects the website against attacks. In doing so, Cloudflare processes your IP address and technical connection data. The legal basis is our legitimate interest in the secure, fast and stable provision of the website (Art. 6(1)(f) GDPR). A transfer to the USA cannot be ruled out; such transfers are based on the European Commission’s Standard Contractual Clauses or on the EU-US Data Privacy Framework.
4. Server Log Files
When you access the website, information transmitted by your browser is automatically stored in server log files. This is typically: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request, and the IP address. This data serves the technical delivery of the site and the detection of faults and attacks. It is not merged with other data sources and is not used to identify you personally. The legal basis is Art. 6(1)(f) GDPR.
5. Contacting Us
If you contact us by email or telephone, we store your details in order to handle your enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or (f) (legitimate interest in responding). The data is deleted as soon as it is no longer necessary for that purpose and no statutory retention obligations prevent deletion.
The same applies if you choose “Get contacted instead” on the booking page: we then store the details you entered (first and last name, email address, telephone number, year of birth, playing position and your message) in order to contact you about your enquiry. No contract is concluded by this. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). You may object to further contact at any time without formality, and we will delete your details. If you submit the booking form, we also store the same details even if you do not go on to complete the payment — so that we can trace your enquiry and reach you.
6. Booking and Payment Processing (Stripe)
When you book through this website, we process the data you provide — first and last name, email address, telephone number, year of birth, playing position and your message — together with the billing details, in order to conclude and perform the contract. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
Payment is processed by the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). You enter your payment data, such as your card number, directly on Stripe’s payment page; we do not receive this data. Stripe processes the data in order to carry out the payment and to meet its own legal obligations, in particular fraud and money laundering prevention. This may involve a transfer to third countries, including the USA; Stripe bases such transfers on the European Commission’s Standard Contractual Clauses. Further information is available in Stripe’s privacy policy at stripe.com/privacy.
The booking data from the form is passed to Stripe via an interface operated by us at Cloudflare. For minor participants this also includes the name and email address of the booking parent or legal guardian — they are the contractual partner and the payer, and the payment cannot be matched to the contract without it. Allergy details are not transmitted to Stripe (section 7). We retain booking and billing data in accordance with statutory commercial and tax retention periods of up to ten years (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB).
7. Accommodation, Catering and Health Data
The full campus package includes accommodation and full board; the striker training module includes lunch and drinks on the training days. To arrange these we pass your name and your stated room preference to the accommodation provider, and your stated dietary requirement to the catering provider. If you book the striker training module, nothing is passed to the accommodation provider, as there is no overnight stay. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
Allergies and intolerances are health data within the meaning of Art. 9(1) GDPR and enjoy special protection. Stating them is entirely voluntary and is not required in order to take part. If you do state them, you are giving your explicit consent under Art. 9(2)(a) GDPR for us to pass this information to the catering provider for the sole purpose of preparing your meals. You may withdraw this consent at any time with effect for the future — an email to team@skn-campus.com is sufficient; we will then delete the entry, but can no longer take your requirements into account.
This information is not transmitted to Stripe: the payment provider does not need it. We delete it at the latest three months after the end of the event. The statutory retention periods for booking and billing data are unaffected by this, but they do not cover the dietary information.
8. Photography and Filming During the Event
Photographs and video recordings are made during the campus. We only use these for our public relations work if you have given us separate consent to do so (Art. 6(1)(a) GDPR). This consent is voluntary, is not required in order to take part, and may be withdrawn at any time with effect for the future.
9. Data of Minor Participants
Most campus participants are under 18. For that reason the booking form collects the year of birth as a mandatory field: without it we cannot tell whether a parent or legal guardian has to be involved. The legal basis for processing the year of birth is Art. 6(1)(b) GDPR (performance of the contract), together with our need to verify the minimum age and the validity of the contract.
Who books and who consents. If the year of birth indicates a minor participant, a parent or legal guardian makes the booking. In that case we additionally process their name and their email address; by providing them they conclude the contract in their own name. The legal basis is Art. 6(1)(b) GDPR, because the guardian is our contractual partner. Where processing is based on consent, that consent is given for minors by the holder of parental responsibility (Art. 8 GDPR); consent given by the minor alone is not sufficient for us.
Health data of the child. Details of allergies and intolerances (section 7) are health data under Art. 9(1) GDPR. For minor participants the required explicit consent under Art. 9(2)(a) GDPR is given by the parent or legal guardian, not by the participant. Providing the information remains voluntary; consent can be withdrawn at any time with effect for the future, informally to team@skn-campus.com. Without the information the kitchen cannot take individual requirements into account.
Photo and video material. Recordings made for training and analysis purposes form part of the booked service (Art. 6(1)(b) GDPR). For any use beyond that, for advertising or publicity, we obtain separate written consent from the parent or legal guardian in the case of minor participants (Art. 6(1)(a), Art. 8 GDPR); from the age of 16 we additionally obtain it from the participant themselves. That consent is voluntary, is not required in order to take part, and can be withdrawn at any time with effect for the future. Without it, no publication takes place.
Data subject rights. The rights listed in section 2 belong to the minor participant; until they come of age, those rights are exercised by the parent or legal guardian. We delete the guardian’s details together with the remaining booking data once the statutory retention periods have expired (section 6).
10. Fonts
This website uses fonts (Oswald, Hanken Grotesk) that are hosted locally on our server. When you access the site, no connection is made to third-party servers such as Google Fonts, and no personal data is transmitted to third parties.
11. Cookies and Analytics
This website sets no cookies of its own and embeds no third-party content (such as maps, videos or social media plugins). Cookies and any transfer to third parties occur only if you expressly agree to the advertising measurement described in section 12. Without that agreement there is no cross-site tracking and no profiling. On Stripe’s payment page, Stripe’s own information applies.
For audience measurement we use Umami, analytics software that we run on our own server (Hetzner Online GmbH, server location Germany, see section 3). The data never leaves our infrastructure and is not passed to any third party.
Umami sets no cookies and does not store your IP address. Your IP address and browser details are combined into a hash value that changes daily, so that repeat visits within one day are not counted twice; this value cannot be reversed and is different the next day. Only the following is recorded: page visited, referring page, country-level origin, screen size, browser and operating system. This does not allow us to identify you.
The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in knowing how many people use the site and which content is in demand. As no information is stored on or read from your device, consent under § 25 TDDDG is not required for Umami. Umami therefore runs independently of your decision under section 12 — including when you decline the advertising measurement.
12. Advertising Measurement with Google (only with your consent)
We run advertisements to make the campus known. To learn which advertisement actually led to a booking, we may use Google Tag Manager and, through it, Google Ads conversion measurement. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
None of this happens before you consent. Until you agree, no Google script is loaded, no connection to a Google server is made and no cookie is set. We load Google Tag Manager only at the moment you click “Agree” in the notice at the bottom of the screen.
If you agree, cookies are stored on your device (in particular _gcl_au) and the following is transmitted to Google: your IP address, details of your browser and device, the pages you visit and whether a booking was completed. Google may associate this information with your own Google account if you are signed in. Retention is governed by Google’s own information; the cookie used for conversion measurement, _gcl_au, typically has a lifetime of 90 days.
Transfer to the USA. Google also processes data outside the European Union, in particular through Google LLC in the USA. This is based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, in which Google participates, supplemented by the European Commission’s standard contractual clauses. Even so, protection fully equivalent to the European standard cannot be guaranteed in every case; in particular, access by US authorities cannot be ruled out.
The legal basis is solely your consent under § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR, and for the transfer to third countries additionally Art. 49(1)(a) GDPR.
Your withdrawal. You may withdraw your consent at any time, without giving reasons, with effect for the future. The lawfulness of processing carried out until then remains unaffected. You suffer no disadvantage: the website works exactly the same either way. You can change your decision here.
13. Currency of This Policy
This privacy policy will be updated whenever changes to our data processing make this necessary. Last updated: 24 August 2026.