Privacy Policy
This English translation is provided for convenience only; the legally binding version is the German one.
1. Controller
The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Doppelweiss GmbH
Meddenwarf 1
22457 Hamburg
Germany
Managing Director: Kian Batteiger
Phone: +49 40 309 28884
Email: team@skn-campus.com
2. Your Rights
You have the following rights regarding your personal data: the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). Where you have given consent, you may withdraw it at any time with effect for the future (Art. 7(3) GDPR). Please contact us at the address above.
You also have the right to lodge a complaint with a data protection supervisory authority about our processing of your personal data (Art. 77 GDPR). The authority responsible for us is the Hamburg Commissioner for Data Protection and Freedom of Information, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.
3. Hosting and Delivery of the Website
This website consists of static pages and is provided on a server we rent from Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. The server is located in Nuremberg, Germany. Hetzner processes the resulting data exclusively on our behalf and in accordance with our instructions (Art. 28 GDPR).
The website is delivered through the content delivery and security network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Cloudflare serves the page content from a data centre near you and protects the website against attacks. In doing so, Cloudflare processes your IP address and technical connection data. The legal basis is our legitimate interest in the secure, fast and stable provision of the website (Art. 6(1)(f) GDPR). A transfer to the USA cannot be ruled out; such transfers are based on the European Commission’s Standard Contractual Clauses or on the EU-US Data Privacy Framework.
4. Server Log Files
When you access the website, information transmitted by your browser is automatically stored in server log files. This is typically: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request, and the IP address. This data serves the technical delivery of the site and the detection of faults and attacks. It is not merged with other data sources and is not used to identify you personally. The legal basis is Art. 6(1)(f) GDPR.
5. Contacting Us
If you contact us by email or telephone, we store your details in order to handle your enquiry and in case of follow-up questions. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or (f) (legitimate interest in responding). The data is deleted as soon as it is no longer necessary for that purpose and no statutory retention obligations prevent deletion.
The same applies if you choose “Get contacted instead” on the booking page: we then store the details you entered (first and last name, email address, telephone number, year of birth, playing position and your message) in order to contact you about your enquiry. No contract is concluded by this. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). You may object to further contact at any time without formality, and we will delete your details. If you submit the booking form, we also store the same details even if you do not go on to complete the payment — so that we can trace your enquiry and reach you.
6. Booking and Payment Processing (Stripe)
When you book through this website, we process the data you provide — first and last name, email address, telephone number, year of birth, playing position and your message — together with the billing details, in order to conclude and perform the contract. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
Payment is processed by the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). You enter your payment data, such as your card number, directly on Stripe’s payment page; we do not receive this data. Stripe processes the data in order to carry out the payment and to meet its own legal obligations, in particular fraud and money laundering prevention. This may involve a transfer to third countries, including the USA; Stripe bases such transfers on the European Commission’s Standard Contractual Clauses. Further information is available in Stripe’s privacy policy at stripe.com/privacy.
The booking data from the form is passed to Stripe via an interface operated by us at Cloudflare. For minor participants this also includes the name and email address of the booking parent or legal guardian — they are the contractual partner and the payer, and the payment cannot be matched to the contract without it. Allergy details are not transmitted to Stripe (section 7). We retain booking and billing data in accordance with statutory commercial and tax retention periods of up to ten years (Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB).
7. Accommodation, Catering and Health Data
The full campus package includes accommodation and full board; the striker training module includes lunch and drinks on the training days. To arrange these we pass your name and your stated room preference to the accommodation provider, and your stated dietary requirement to the catering provider. If you book the striker training module, nothing is passed to the accommodation provider, as there is no overnight stay. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).
Allergies and intolerances are health data within the meaning of Art. 9(1) GDPR and enjoy special protection. Stating them is entirely voluntary and is not required in order to take part. If you do state them, you are giving your explicit consent under Art. 9(2)(a) GDPR for us to pass this information to the catering provider for the sole purpose of preparing your meals. You may withdraw this consent at any time with effect for the future — an email to team@skn-campus.com is sufficient; we will then delete the entry, but can no longer take your requirements into account.
This information is not transmitted to Stripe: the payment provider does not need it. We delete it at the latest three months after the end of the event. The statutory retention periods for booking and billing data are unaffected by this, but they do not cover the dietary information.
8. Photography and Filming During the Event
Photographs and video recordings are made during the campus. We only use these for our public relations work if you have given us separate consent to do so (Art. 6(1)(a) GDPR). This consent is voluntary, is not required in order to take part, and may be withdrawn at any time with effect for the future.
9. Data of Minor Participants
Most campus participants are under 18. For that reason the booking form collects the year of birth as a mandatory field: without it we cannot tell whether a parent or legal guardian has to be involved. The legal basis for processing the year of birth is Art. 6(1)(b) GDPR (performance of the contract), together with our need to verify the minimum age and the validity of the contract.
Who books and who consents. If the year of birth indicates a minor participant, a parent or legal guardian makes the booking. In that case we additionally process their name and their email address; by providing them they conclude the contract in their own name. The legal basis is Art. 6(1)(b) GDPR, because the guardian is our contractual partner. Where processing is based on consent, that consent is given for minors by the holder of parental responsibility (Art. 8 GDPR); consent given by the minor alone is not sufficient for us.
Health data of the child. Details of allergies and intolerances (section 7) are health data under Art. 9(1) GDPR. For minor participants the required explicit consent under Art. 9(2)(a) GDPR is given by the parent or legal guardian, not by the participant. Providing the information remains voluntary; consent can be withdrawn at any time with effect for the future, informally to team@skn-campus.com. Without the information the kitchen cannot take individual requirements into account.
Photo and video material. Recordings made for training and analysis purposes form part of the booked service (Art. 6(1)(b) GDPR). For any use beyond that, for advertising or publicity, we obtain separate written consent from the parent or legal guardian in the case of minor participants (Art. 6(1)(a), Art. 8 GDPR); from the age of 16 we additionally obtain it from the participant themselves. That consent is voluntary, is not required in order to take part, and can be withdrawn at any time with effect for the future. Without it, no publication takes place.
Data subject rights. The rights listed in section 2 belong to the minor participant; until they come of age, those rights are exercised by the parent or legal guardian. We delete the guardian’s details together with the remaining booking data once the statutory retention periods have expired (section 6).
10. Fonts
This website uses fonts (Oswald, Hanken Grotesk) that are hosted locally on our server. When you access the site, no connection is made to third-party servers such as Google Fonts, and no personal data is transmitted to third parties.
11. Cookies and Analytics
This website sets no cookies of its own and embeds no third-party content (such as maps, videos or social media plugins). Cookies and any transfer to third parties occur only if you expressly agree to the advertising measurement described in section 12. Without that agreement there is no cross-site tracking and no profiling. On Stripe’s payment page, Stripe’s own information applies.
For audience measurement we use Umami, analytics software that we run on our own server (Hetzner Online GmbH, server location Germany, see section 3). The data never leaves our infrastructure and is not passed to any third party.
Umami sets no cookies and does not store your IP address. Your IP address and browser details are combined into a hash value that changes daily, so that repeat visits within one day are not counted twice; this value cannot be reversed and is different the next day. Only the following is recorded: page visited, referring page, country-level origin, screen size, browser and operating system. This does not allow us to identify you.
The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in knowing how many people use the site and which content is in demand. As no information is stored on or read from your device, consent under § 25 TDDDG is not required for Umami. Umami therefore runs independently of your decision under section 12 — including when you decline the advertising measurement.
12. Advertising Measurement (Google Tag Manager and TikTok)
We run advertisements to make the campus known. To learn which advertisement actually led to a booking, we use Google Tag Manager and, through it, TikTok’s measurement tool (“pixel”), and where applicable Google Ads conversion measurement. The providers are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, Ireland.
When this starts. Measurement begins when the page loads. Cookies and comparable identifiers are stored on and read from your device (in particular _ttp from TikTok and _gcl_au from Google). You may object at any time — using the “Do not track” button in the notice at the bottom of the screen, or the link at the end of this section. Your objection is stored on your device and respected from the next page view onwards. You suffer no disadvantage: the website works exactly the same either way.
What is transmitted. Your IP address, details of your browser and device, the pages you visit, the referring source, the advertisement’s click identifier (such as ttclid) and whether — and which — package was booked. The providers may associate this information with your own account with them if you are signed in. Retention is governed by the providers’ own information; the _gcl_au cookie typically has a lifetime of 90 days, _ttp up to 13 months.
A report from our server — only if you enquire or book. If an enquiry or a booking is completed, our booking server additionally reports that event directly to TikTok (“Events API”). Your e-mail address and telephone number are irreversibly encrypted on our server beforehand (SHA-256); TikTok receives only these checksums, never the plain values. Also transmitted are the advertisement’s click identifier, the package booked and the amount. The sole purpose is to attribute the booking to the advertisement that prompted it. If you do not want this report, an informal message to team@skn-campus.com is enough — we will then refrain from sending it.
The legal basis is Art. 6(1)(f) GDPR: our legitimate interest in measuring the success of our advertising and spending our advertising budget economically. You have the right to object to this processing at any time under Art. 21 GDPR; the button mentioned above exists for exactly that purpose.
Transfer to third countries. Google also processes data outside the European Union, in particular through Google LLC in the USA, based on the European Commission’s adequacy decision on the EU-US Data Privacy Framework of 10 July 2023, in which Google participates, supplemented by the European Commission’s standard contractual clauses. TikTok processes data among other places in the USA, Singapore and Malaysia, based on the European Commission’s standard contractual clauses together with supplementary measures. Even so, protection fully equivalent to the European standard cannot be guaranteed in every case; in particular, access by foreign authorities cannot be ruled out.
Your objection. You may object to the advertising measurement at any time, without giving reasons, with effect for the future. The lawfulness of processing carried out until then remains unaffected. You can change your decision here.
13. Currency of This Policy
This privacy policy will be updated whenever changes to our data processing make this necessary. Last updated: 29 August 2026.