Privacy Policy

The controller responsible for processing personal data on this website is:

OMC Events-Marketing & e-Communication UG (haftungsbeschränkt)
Tränkestrasse 17
70597 Stuttgart
Germany

Email: info@omc-group.de
Website: https://www.omc-group.de

If you have questions about data protection or wish to exercise your rights, please contact us at the email address above.

Protecting personal data is important to us. We process personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection provisions, in particular the German Telecommunications Digital Services Data Protection Act (TDDDG).

Personal data is any information relating to an identified or identifiable natural person, such as names, contact details and IP addresses.

We process personal data in particular to provide our website, handle business enquiries, securely manage our digital services and comply with legal obligations.

When you visit our website, technically necessary information is processed. This may include:

• IP address of the accessing device
• Date and time of access
• Pages and files accessed
• Browser type and version
• Operating system
• Referrer URL, if transmitted
• Technical status and error messages

Processing serves to provide, stabilise, analyse errors in and secure our website.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure and functional operation of our website.

Processing takes place via the hosting and cloud infrastructure used. Retention of technical log data depends on the respective purposes and the services actually used. The specific retention periods or deletion criteria are still to be finally documented.

Our website was created with the Lovable platform and is provided via the Lovable Cloud infrastructure used for the project.

Technically necessary data such as IP addresses, access information and system logs may be processed in this context.

In addition, editorial content and approved project media are stored in the cloud infrastructure.

Processing is based on Art. 6(1)(f) GDPR for the secure and reliable provision of our website.

Lovable may use further service providers for technical provision. Where these process personal data on our behalf, the requirements of Art. 28 GDPR apply.

Information on data protection at Lovable: https://lovable.dev/privacy

The contractual partners, sub-processors, processing regions and any third-country transfers applicable to our specific project are documented on the basis of the contract and service provider documents.

If you contact us via the contact form or by email, we process the data you provide in order to handle and answer your enquiry. This includes in particular:

• Name
• Email address
• Content of your message
• Other information provided voluntarily

Enquiries submitted via the website form are forwarded by email to orga@omc-group.de.

According to the current technical review, the content of enquiries is not permanently stored in our website's database.

However, messages are processed and stored in our business email inbox or email archive.

In addition, technical delivery logs and temporary storage may arise at the email delivery service used.

Your contact details are not automatically used for advertising emails.

Legal bases

If your enquiry relates to pre-contractual measures or the performance of a contract with you, processing is based on Art. 6(1)(b) GDPR.

For other business enquiries, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in handling and answering incoming enquiries and in business communication.

Business emails and contact enquiries are stored in accordance with their respective purpose and the applicable statutory retention obligations.

We distinguish between general contact enquiries, ongoing business correspondence and documents subject to statutory retention.

For general contact enquiries that do not lead to a business relationship and are not subject to a statutory retention obligation, our planned deletion concept provides for retention of generally no more than twelve months after processing has been completed, unless a continuing legitimate purpose justifies longer storage.

This organisational deletion rule will only be applied as binding operational practice once it has actually been introduced.

For business records subject to retention, § 257 HGB and § 147 AO apply in particular. Depending on the type of document, the statutory retention periods are generally six, eight or ten years.

Longer storage may be necessary where legal obligations, ongoing proceedings or the establishment, exercise or defence of legal claims justify it.

Once the respective purposes no longer apply and the relevant retention periods have expired, the data will be deleted in accordance with the deletion procedure actually introduced.

Retention periods of technical delivery logs and possible temporary storage at the email delivery service are documented separately on the basis of the service provider's information.

To protect our contact form against automated requests and misuse, we use a technical limit on the frequency of requests.

For this purpose, a technical check value is derived from the email address provided.

This check value serves to recognise repeated requests and to limit use of the form.

Such a check value may still constitute personal data.

The technical limit works with a time window of one hour. According to the current implementation, resetting the request counter does not automatically delete the stored check value.

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our communication systems against spam, automated attacks and misuse.

The actual retention period and the deletion of check values must be finally determined and documented.

A protected administration area is available for managing and editing our website. It is intended exclusively for authorised persons.

When logging in, the following data in particular may be processed:

• Email address and account identifier
• Login and session information
• Times of login events
• Information about access permissions

Login is via the authentication methods offered in the project by Lovable or Google.

To manage the login session, technically necessary information is stored in the browser's local storage.

This information serves authentication and access security and is not used for general visitor analysis.

The legal basis for processing personal data is generally Art. 6(1)(f) GDPR. Where processing is necessary for an employment relationship, the applicable provisions may additionally apply.

Storing and accessing information on the device is additionally subject to § 25 TDDDG. A statutory exemption from the consent requirement may apply to strictly necessary functions.

The specific authentication providers, retention periods and account deletion procedures are documented according to the technical configuration actually used.

According to the current technical review, no cookies or comparable browser storage entries are set during an ordinary visit to our website without logging in.

For the protected editorial area, technically necessary session information is stored in local storage. It serves exclusively for logging in and managing protected access.

Such technologies are used in compliance with § 25 TDDDG.

Should technologies requiring consent be used in future, they will only be activated after any necessary consent has been given.

According to the current technical review, we do not use analytics or advertising programs on our website to automatically track visitor behaviour.

No automated visitor analysis for marketing purposes currently takes place.

Should such services be used in future, the data protection information will be supplemented and any necessary consent obtained.

According to the current technical review, the fonts used on our website are provided locally. Loading these fonts therefore does not establish a direct connection to external font servers.

Our website contains or enables links to external websites and digital platforms. These may include in particular:

• YouTube
• Google Maps
• Matterport
• Kuula
• External project and reference pages
• 5D-Visual.Media

When you follow an external link, you leave our website. The respective operator is generally responsible for data processing there.

According to the current technical review, external videos, maps or similar content are not automatically loaded when a page is accessed normally.

If external media are embedded directly in future and consent is required for this, such content will only be activated after appropriate consent.

This privacy policy will be supplemented with the necessary information about the respective providers when such functions are introduced.

Personal data is only disclosed where necessary for operating the website, handling enquiries, carrying out business transactions or complying with legal obligations. Recipients may include in particular the following categories:

• Hosting and cloud service providers
• Email and communication service providers
• Authentication providers
• Technical service providers for operation and security
• Tax advisors and other advisors bound by professional secrecy
• Competent authorities where legally required

Where necessary, corresponding agreements pursuant to Art. 28 GDPR are concluded with processors.

Personal data is not disclosed for third-party advertising purposes.

When using international cloud, communication and authentication services, personal data may be processed outside the European Union or the European Economic Area.

Such transfers are subject to the requirements of Art. 44 et seq. GDPR.

Depending on the recipient and destination country, adequacy decisions of the European Commission or appropriate safeguards such as EU standard contractual clauses may apply.

The recipients, destination countries and transfer mechanisms actually used for our specific website project are to be documented on the basis of the respective contract documents.

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, manipulation and unlawful processing.

These include in particular appropriate access restrictions, authorisation concepts and encrypted data transmission.

The security measures are reviewed and adapted in line with technical and organisational requirements.

Subject to the statutory requirements, you have the following rights:

• Access (Art. 15 GDPR): you may request information about the processing of your personal data.
• Rectification (Art. 16 GDPR): you may request the correction of inaccurate or completion of incomplete data.
• Erasure (Art. 17 GDPR): you may request the deletion of personal data unless legal or other overriding reasons prevent this.
• Restriction (Art. 18 GDPR): under certain conditions you may request restriction of processing.
• Data portability (Art. 20 GDPR): under the statutory conditions you may request your data in a structured, commonly used and machine-readable format.
• Objection (Art. 21 GDPR): you may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to processing for direct marketing at any time.
• Withdrawal of consent (Art. 7(3) GDPR): you may withdraw consent at any time with effect for the future.

To exercise your rights, please contact: info@omc-group.de

If there are reasonable doubts about your identity, we may request additional information where necessary and proportionate.

If you believe that the processing of your personal data violates data protection law, you may lodge a complaint with a data protection supervisory authority pursuant to Art. 77 GDPR.

For companies based in Baden-Württemberg, the competent authority is generally:

The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg
Website: https://www.baden-wuerttemberg.datenschutz.de

You may also contact another legally competent supervisory authority.

According to the current technical review, no automated decision-making including profiling within the meaning of Art. 22 GDPR takes place in the processing described here.

The technical limitation of contact form requests serves to protect against misuse.

We will adapt this privacy policy when legal requirements, technical functions or the processing of personal data change.

The current version is published on our website.

Last updated: 19 October 2026