Privacy.

A. Provision of the website

1. Visiting the website

Each time you visit this website, the systems used to provide it may temporarily process technical information transmitted by your device, including:

• your IP address;
• the date and time of access;
• the address of the requested page or file;
• the previously visited page (referrer), if transmitted;
• browser, operating-system and device information;
• the HTTP status code; and
• the amount of data transferred.

This information is processed to deliver the website, maintain its functionality and stability, resolve technical problems, prevent misuse and protect our information-technology systems.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in providing a reliable and secure conference website and protecting its systems against disruption and misuse.

Data required solely to deliver the website ceases to be required when the respective visit ends. Log information is deleted or anonymised as soon as it is no longer necessary for operational security, troubleshooting or the establishment, exercise or defence of legal claims.

2. Hosting

This website is hosted using OpenAI Sites, a technical hosting service provided by OpenAI. The hosting provider processes the technical request and log information described above on behalf of the controller insofar as necessary to provide, secure and maintain the website.

Service providers acting on our behalf are contractually required to process personal data only in accordance with our instructions and applicable data-protection law. Where personal data is transferred outside the European Economic Area, the transfer takes place only in accordance with Chapter V GDPR and subject to the applicable safeguards.

3. Cookies, fonts and analytics

The GSM 2026 website itself does not use analytics, advertising trackers, externally hosted fonts or non-essential cookies. If optional technologies are introduced later, this notice and any required consent mechanism will be updated before they are activated.

B. Registration through Pretix

Conference registration takes place in a separate ticket shop hosted at pretix.eu. The technical provider is:

When you open the ticket shop, Pretix processes technical information necessary to provide and secure the service and uses technically necessary cookies to maintain the shopping cart and registration session.

Registration data and purposes

Depending on the information requested in the registration form, we may process your name, email address, institutional affiliation, attendance information, consent declarations and information you provide voluntarily. The data is used to administer registrations and attendance, communicate organisational information, plan the conference and comply with legal obligations.

Data required to register for and participate in the conference is processed under Article 6(1)(b) GDPR. Processing necessary to comply with a legal obligation is based on Article 6(1)(c) GDPR. Optional information is processed on the basis of consent under Article 6(1)(a) GDPR.

If voluntarily supplied accessibility, allergy, dietary or similar information reveals health information or another special category of personal data, it is processed on the basis of explicit consent under Article 9(2)(a) GDPR. Consent may be withdrawn at any time with effect for the future.

Processing and retention

pretix GmbH processes registration data on behalf of the conference organiser as a processor under Article 28 GDPR. Registration data is accessible only to authorised members of the conference organisation team and relevant technical service providers.

Registration information is retained for as long as necessary to organise, conduct and follow up the conference. Data required to demonstrate registration, consent or compliance with legal obligations may be retained for the applicable statutory period. Other participant information is deleted or anonymised when it is no longer required.

Pretix provides additional technical privacy information on the event registration privacy page.

C. Email communication

If you contact the organisers by email, we process your email address, the date and time of the message, its contents and any other information you provide. The information is used solely to respond to and administer your enquiry.

Depending on the subject of the communication, the legal basis is Article 6(1)(b) or Article 6(1)(f) GDPR. Our legitimate interest lies in responding to enquiries concerning the conference. Correspondence is deleted after the relevant matter has been conclusively resolved unless legal obligations or legitimate documentation requirements justify continued retention.

D. External websites and social media

This website contains ordinary links to external websites and social-media services, including LinkedIn, Bluesky and Instagram. Content from these providers is not embedded directly in this website. No personal data is transmitted to these providers merely by visiting the GSM 2026 website. A connection to the respective provider is established only when you actively follow an external link.

After following such a link, the external provider is responsible for processing your personal data in accordance with its own privacy information. This may include processing information such as your IP address, device and browser information, the referring page, account information and your interactions with the platform.

The GSM 2026 organisers may operate profiles on these platforms to publish conference information and communicate with interested persons. If you interact with one of these profiles—for example by following it, commenting, sharing content or sending a message—the platform and, where applicable, the conference organiser may process the information associated with that interaction.

Further information is available in the providers’ privacy policies:

• LinkedIn Privacy Policy
• Bluesky Privacy Policy
• Instagram Privacy Policy

E. Recipients

Personal data may be accessible to authorised members of the GSM 2026 organisation team, authorised employees of the Max Planck Society, website-hosting and IT providers, pretix GmbH in connection with registration, email service providers and public authorities where disclosure is required by law.

Personal data is not sold or otherwise disclosed to third parties without authorisation.

F. Controller

G. Data Protection Officer

H. Conference privacy contact

This operational contact does not replace the Data Protection Officer of the Max Planck Society.

I. Your rights

Subject to the applicable statutory requirements and exceptions, you have the right to:

• access your personal data under Article 15 GDPR;
• rectification under Article 16 GDPR;
• erasure under Article 17 GDPR;
• restriction of processing under Article 18 GDPR;
• data portability under Article 20 GDPR;
• object under Article 21 GDPR;
• withdraw consent under Article 7(3) GDPR; and
• lodge a complaint with a supervisory authority under Article 77 GDPR.

The supervisory authority responsible for the Max Planck Society is:

J. Changes to this information

This notice may be updated if the website, registration process, service providers or applicable legal requirements change. The current version will always be available on this website.

Last updated: 24 September 2026