Privacy Policy - SAP Academic Community Conference DACH 2026

1. Responsible Party

Responsible for the processing of personal data within the meaning of Art. 5 lit. j revFADP and Art. 4 No. 7 GDPR is:

SAP ACC Competence Center HES-SO Valais – Institute of Computer Science c/o Sébastien Gard Techno-Pôle 3 CH – 3960 Sierre

Email for data protection inquiries: sapacc26@ost.ch

The operational organization of the conference and website is carried out in cooperation with OST – Eastern Switzerland University of Applied Sciences and other academic partners (in particular the University of Liechtenstein, SAP Academic Board DACH, SAP University Alliances). The above-mentioned party remains responsible for the processing of personal data via this website.

The appointment of a data protection officer is not legally required. The email address provided above is available for all data protection matters.

2. Data Processed, Purposes and Legal Bases

2.1 Access to the Website (Server Log Files)

When visiting the website, technically necessary information is automatically collected by the web server and temporarily stored in so-called log files. This includes: IP address, date and time of access, volume of data transferred, page accessed (referrer), browser used and operating system.

This data is used exclusively for stable operation, IT security (e.g. defense against attacks), and statistical evaluation in aggregated form. No merging with other data sources takes place.

Legal basis: Legitimate interest in a secure and functional web presence (Art. 6 para. 1 lit. f GDPR); under the revFADP, processing is based on the principles of Art. 6 revFADP (lawfulness, proportionality, purpose limitation).

Retention period: Generally a maximum of 7 days; longer storage only in the event of specific security-related incidents.

2.2 Conference Registration

For registration for the SAP ACC DACH 2026, we collect the information necessary for participation. This typically includes: first and last name, academic title, university or organization, position, business address, email address, billing address if applicable, details on participation in individual sessions, and optional information such as dietary requirements or accessibility needs.

This data is processed to handle participation: registration, invoicing, preparation of name badges and participant documents, catering planning, organization of the evening event, communication relating to the conference, and to fulfill accounting and tax obligations.

Legal basis: Performance of the participation contract or pre-contractual measures (Art. 6 para. 1 lit. b GDPR); legal obligations, in particular under Swiss contract law and tax regulations (Art. 6 para. 1 lit. c GDPR, Art. 31 para. 1 revFADP); for voluntary additional information (e.g. photography consent), consent (Art. 6 para. 1 lit. a GDPR).

Retention period: Organizational data until the conclusion of the conference and a reasonable post-processing period; accounting-relevant documents are retained for ten years in accordance with Art. 958f CO (Switzerland).

2.3 Submission of Contributions (Call for Contribution)

If you submit an academic or practice-oriented contribution (paper, short paper, poster, workshop), we process your contact details, institutional affiliation, and the submitted contribution in order to conduct the review process, include it in the conference program, and — upon acceptance — to publish the contribution materials within the agreed framework.

Legal basis: Pre-contractual measure and performance of contract (Art. 6 para. 1 lit. b GDPR); for further publication (e.g. proceedings), consent or a separate author agreement.

2.4 Contact

If you reach us via the contact form, by email, or by phone, we use your details (name, email address, message text, and any additional information voluntarily provided) exclusively to handle your inquiry and any subsequent communication.

Legal basis: Legitimate interest in careful handling of incoming inquiries (Art. 6 para. 1 lit. f GDPR) or — where the inquiry relates to participation — initiation of a contractual relationship (Art. 6 para. 1 lit. b GDPR).

Retention period: Until the inquiry has been fully processed; thereafter deletion, unless statutory retention obligations apply.

3. Cookies and Similar Technologies

The website uses cookies and similar technologies. Technically necessary cookies enable the basic operation of the site (e.g. storing your cookie selection, session management, language selection) and are set without separate consent.

Non-essential cookies (e.g. for analysis or convenience purposes) are only activated after your explicit consent via the consent banner. You can adjust or withdraw your consent at any time with future effect by accessing the cookie settings on the website again or by deleting cookies in your browser.

Legal basis for non-essential cookies: Consent pursuant to Art. 6 para. 1 lit. a GDPR, in Germany in conjunction with § 25 para. 1 TDDDG, in Austria in conjunction with § 165 TKG; in Switzerland additionally the transparency obligation under Art. 19 revFADP.

4. Integrated External Services

The website is operated as a WordPress instance and, where possible, embeds fonts, scripts, and media locally in order to minimize data transfers to third parties. Where external services are used (e.g. map services for displaying event venues, video embeds, font CDNs), these are only loaded after your consent or with privacy-friendly mode enabled. For technical reasons, your IP address may be transmitted to the respective provider.

Links to third-party websites (including sponsor websites, tourism information for the St. Gallen–Lake Constance region, websites of the participating universities, and SAP) are identifiable as such. The respective operators are solely responsible for the content and data protection of these linked sites.

5. Disclosure to Third Parties

Your personal data is only shared to the extent necessary for conducting the conference, required by law, or expressly consented to by you. Categories of recipients may include:

Co-organizers and program committee (HES-SO Valais, OST – Eastern Switzerland University of Applied Sciences, University of Liechtenstein, SAP Academic Board DACH, SAP University Alliances), to the extent necessary for the substantive and organizational implementation;
Processors within the meaning of Art. 9 revFADP or Art. 28 GDPR, namely hosting and IT service providers, payment service providers, and providers of registration and submission platforms, acting on the basis of a data processing agreement;
On-site service providers (Würth-Haus Rorschach, SAP “The Circle” at Zurich Airport, catering, hotel partners if applicable) exclusively for organizationally necessary purposes (e.g. room, menu, and room planning);
Authorities and courts, to the extent there is a legal obligation to disclose.

Personal data is not passed on to sponsors (including SEEBURGER, LuilMomo, Nova Intelligence) for their own advertising purposes. If a participant list is created or contact opportunities are offered to sponsors in connection with the conference, this is done exclusively on the basis of your prior, voluntary consent.

6. Transfer Abroad

Personal data is generally processed within Switzerland and the EEA. Where data is transferred to countries outside this area (for example through the use of services provided by internationally active providers), this only takes place if the recipient country ensures an adequate level of data protection (Federal Council list of states pursuant to Art. 16 revFADP or adequacy decision by the EU Commission pursuant to Art. 45 GDPR) or if appropriate safeguards exist, in particular standard contractual clauses pursuant to Art. 46 GDPR or the standard contractual clauses recognized by the FDPIC.

7. Rights of Data Subjects

Under applicable data protection laws, you have the following rights:

Access to the data processed about you (Art. 25 revFADP, Art. 15 GDPR);
Rectification of inaccurate data (Art. 32 para. 1 revFADP, Art. 16 GDPR);
Erasure of data that is no longer needed or unlawfully processed (Art. 32 para. 2 revFADP, Art. 17 GDPR);
Restriction of processing (Art. 18 GDPR);
Data portability (Art. 28 revFADP, Art. 20 GDPR);
Objection to processing based on legitimate interests (Art. 21 GDPR);
Withdrawal of consent with future effect (Art. 7 para. 3 GDPR, Art. 6 para. 7 revFADP);
Right not to be subject exclusively to automated individual decision-making (Art. 21 revFADP, Art. 22 GDPR). Automated individual decisions with legal effect are not made in the context of the conference.

To exercise your rights, an informal message to sapacc26@ost.ch is sufficient. For the purpose of identity verification, we may ask you for appropriate proof.

8. Right to Lodge a Complaint with a Supervisory Authority

Independently of other legal remedies, you may contact a data protection supervisory authority at any time:

Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern – edoeb.admin.ch
Germany: The state data protection authority responsible for your place of residence or work; an overview can be found at bfdi.bund.de
Austria: Austrian Data Protection Authority (DSB), Barichgasse 40–42, 1030 Vienna – dsb.gv.at
Liechtenstein: Data Protection Office Liechtenstein, Vaduz – datenschutzstelle.li

9. Data Security

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, or falsification. The website transmits data encrypted via TLS/HTTPS. Access to registration and submission systems is secured through authentication, restrictive permissions, and regular updates to the software used. However, absolute security for data transmissions over the internet cannot be technically guaranteed.

10. Changes to this Privacy Policy

We reserve the right to adapt this privacy policy in order to bring it into line with changed legal requirements or adjustments to the website or conference process. The version published on this page shall be the authoritative version at any given time.

Last updated: April 2026