Privacy Policy

Last updated: 27 October 2026

This policy explains which personal data Formula Student Germany GmbH processes on www.formulastudent.de, for what purpose, on which legal basis, for how long, and which rights you have.

1. Controller and data protection officer

Controller:
Formula Student Germany GmbH, Georg-Elser-Str. 11, 93077 Bad Abbach, Germany
E-mail: management.7LYMEL@formulastudent.de, phone: +49 9405 5060116

Data protection officer:
Philipp Bandow, address as above
E-mail: data.prot.7LYMeL@formulastudent.de, phone: +49 9405 5060117

2. Visiting the website

Server log files. With every request, our web server stores your IP address, the time, the requested address, the status code, the amount of data transferred, the previously visited page (referrer) and your browser's identifier. This serves to deliver the website, to find errors and to fend off attacks. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure and stable operation. We delete the log files after 15 weeks at the latest.

Hosting. The website and its database run on our servers at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in data centres in the EU. Hetzner processes the data on our behalf (Art. 28 GDPR).

Error analysis. To find and fix technical errors, we use the software Sentry on our own servers. It receives technical information about errors and loading times (e.g. error message, requested page, browser, operating system, IP address) and, for some visits, a recording of the session (e.g. clicks, navigation, input and displayed content). For this, your browser stores an identifier in session storage for the duration of the session. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is being able to trace and fix errors. We only keep the data as long as we need it for error analysis.

3. Cookies and browser storage

We set cookies and browser storage entries that are necessary for the website to work, for example for login, the session and your display settings, on the basis of Section 25(2) No. 2 TDDDG. For error analysis, the website also stores a session identifier (section 2).

4. Embedded content and external services

• Videos (YouTube): Videos only load when you click "Load video". Only then does Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, receive your IP address and the page you are on; a transfer to the USA is possible. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Maps (OpenStreetMap): On our map pages, your browser loads map images from the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Your IP address and the map sections are transmitted. The European Commission has issued an adequacy decision for the United Kingdom. The legal basis is Art. 6(1)(f) GDPR (displaying the maps).
• Photo galleries (SmugMug): Our photo galleries at media.formulastudent.de are run on our behalf by Awes.me, Inc. (SmugMug), 67 E Evelyn Ave, Mountain View, CA 94041, USA. We upload photos of our events there, which may show participants and visitors. SmugMug's privacy policy also applies on the gallery site.
• Ticket shop (pretix): We sell tickets for our event at tickets.formulastudent.de via the platform of pretix GmbH, Berthold-Mogel-Straße 1, 69126 Heidelberg, Germany, which processes the order data on our behalf. The shop's privacy policy explains which data it collects.

5. User account

A user account is required to take part, to work with us and to access internal areas.

Data: username, e-mail address, password, name, title, country, language, further information depending on your role (sections 6 to 10) and the time of your last login.

Purpose and legal basis: providing the account and the related services (Art. 6(1)(b) GDPR). We process voluntary information such as whether you can be reached via Signal or WhatsApp with your consent (Art. 6(1)(a) GDPR), which you can withdraw in your profile at any time.

Sign-in with Apple or Google: You can also sign in with your Apple or Google account. Our login service then forwards you to Apple Distribution International Limited, Ireland, or Google Ireland Limited, Ireland, and after the sign-in receives your name, your e-mail address and an identifier of your account from there. The legal basis is Art. 6(1)(b) GDPR. Apple and Google are themselves responsible for their own processing.

Visibility: Depending on their role, other logged-in users can see your name, your function and your profile photo.

Retention:

• We delete unconfirmed registrations after 24 hours.
• After 3 years without activity, we reset the account and delete in particular contact and address data, uploads and internal notes.
• We keep your name, e-mail address and participation history (team, season, function) beyond that, so that we can confirm participation and document the history of the competition (Art. 6(1)(f) GDPR). You can object to this (section 18).

6. Taking part in the competition (teams)

Data: name, university, team and role, mobile number, clothing size, proof of health insurance (with a copy of an ID if needed), signed terms and conditions (Terms), proof of qualifications and, on request for a visa, date of birth and passport number.

Purpose and legal basis: running the competition according to the rules (Art. 6(1)(b) GDPR). We keep the Terms so that we can prove or defend claims in connection with the event (Art. 6(1)(f) GDPR).

Retention:

• Proof of insurance: after the check, at the latest 14 days after the end of the event.
• Terms: until the end of the third year after the event; in case of an accident or legal dispute, until it is concluded.
• Visa invitation letters: 3 months after the end of the event.
• Other information: as in section 5.

7. Academy and workshops

For workshops, we process the participants' name, team and university and issue a certificate of attendance (Art. 6(1)(b) GDPR). For payment, see section 11.

8. Volunteers

Data: in particular profile photo, contact details, place of residence, preferred areas of work, experience and qualifications, arrival, departure and overnight stays, clothing sizes, catering preferences, gender (for room allocation) and, after acceptance, proof of health insurance.

Purpose and legal basis: selection, deployment planning, accommodation and equipment (Art. 6(1)(b) GDPR). We only process health information such as allergies if you provide it voluntarily, and only for catering (Art. 9(2)(a) GDPR). We keep short internal notes for deployment planning.

Recipients: For accommodation, we pass your name, the nights and the room allocation to the partner hotel. Other volunteers see your photo, your name and special qualifications such as first aider.

Retention: as in section 5; proof of insurance as in section 6.

9. Judges

Data: contact details, company, photo, field of expertise, experience, availability, information on connections to teams and, voluntarily, a CV.

Purpose and legal basis: selection and deployment planning (Art. 6(1)(b) GDPR); the information on connections to teams serves to avoid conflicts of interest (Art. 6(1)(f) GDPR). If you act as a judge for a partner, your company receives your contact details.

10. Partners, their staff and press

• Partner contacts: contact details and company to manage the partnership (Art. 6(1)(b) or (f) GDPR).
• Partner staff: We receive your name, company and working days from your employer to issue access passes (Art. 6(1)(f), Art. 14 GDPR).
• Press: contact details, media outlet, function and proof of journalistic activity for accreditation (Art. 6(1)(b) GDPR). If we decline an accreditation, we delete the proof.

11. Payments, invoices, expenses

Data: billing details of the team or company, payment details and, for expense refunds, name, address and bank details.

Purpose and legal basis: billing (Art. 6(1)(b) GDPR) and statutory retention (Art. 6(1)(c) GDPR in conjunction with Section 147 AO and Section 257 HGB). We delete the records 8 years after the end of the year in which they were created.

Payment providers: We process online payments via Stripe and PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg), and card payments at our events, for example for merchandise, via Stripe, SumUp and Zettle (PayPal). For online payments, we transmit the amount, the payment reference and the team; the provider tells us the name, e-mail address and transaction number of the payer. The providers process the payment data under their own responsibility.

12. Communication

We keep sent e-mails for queries until the end of the season (1 October) and changes to mailing lists for 3 years. We only send messages via Signal or WhatsApp with your consent (section 5).

13. Questions about the rules

Teams ask questions about the rules via our ticket system. We process name, team, text and attachments to answer the questions (Art. 6(1)(b) GDPR). We may publish questions and answers of general interest as FAQ for logged-in users.

14. Certificates

Participants, volunteers and judges can receive a certificate of participation with a QR code. Anyone who checks the code sees the name, function and years of participation (Art. 6(1)(b) GDPR).

15. Photos and videos

At our events, including the Academy and workshops, we and photographers commissioned by us take photos and videos. We publish them on our website, in our photo galleries and on social networks. The legal basis is our legitimate interest in reporting on our events (Art. 6(1)(f) GDPR) and, for teams, also the Terms (Art. 6(1)(b) GDPR).

16. Recipients and service providers

The following service providers process data on our behalf (Art. 28 GDPR):

Other recipients are those named in this policy (partner hotels, judges' companies, payment providers) and authorities where we are legally obliged.

Backups. We keep backups for up to 36 months (Art. 6(1)(f), Art. 32 GDPR). Until then, they may also contain data that we have already deleted in the live system.

17. Transfers to third countries

Data may be transferred to the USA for YouTube after your click (section 4), when you sign in with Apple or Google (section 5) and for our photo galleries at SmugMug (section 4). The basis is the EU-U.S. Data Privacy Framework where the provider participates in it, otherwise the European Commission's standard contractual clauses. Backups at Google Cloud are stored in Switzerland, for which the European Commission has issued an adequacy decision.

18. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and the right to withdraw consent at any time with effect for the future (Art. 7(3)). To exercise them, contact our data protection officer (section 1).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We will then no longer process the data unless there are compelling legitimate grounds or the processing serves the establishment, exercise or defence of legal claims.

Complaint: You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.

19. Obligation to provide data

The information marked as mandatory is required for an account and for taking part in our events; without it, we cannot provide the respective service.