Privacy Policy

With this privacy policy, we aim to inform you about the nature, scope, and purpose of processing personal data (hereinafter referred to as "data"). Personal data includes all information that relates to you personally, such as your name, address, email address, or user behavior. This privacy policy applies to all data processing operations we perform, both within our core business activities and for the online media we operate.

‍

Who is responsible for data processing

Responsible for data processing:

Konfetti Event Solutions d. Sinn Julia
Kellereistraße 7
39052 Kaltern
Italy
+39 338 757 9314
hello@konfetti-weddings.com
konfetti-weddings.com/impressum

‍

Processing your data as part of our agency services

We offer agency services. If you are our customer or business partner, or are interested in our services, the nature, scope, and purpose of processing your data depend on the contractual or pre-contractual services existing between us. These include conceptual and strategic consulting, software and design development, and consulting and maintenance services in this area, campaign planning and implementation, IT and server administration, as well as other consulting and training services. In this context, the data we process includes all data provided by you for the purpose of using contractual or pre-contractual services, and which are required for processing your inquiry or the contract concluded between us. Unless otherwise stated in the further information of this privacy policy, the processing of your data and its disclosure to third parties is limited to the data that is necessary and appropriate for answering your inquiries and/or fulfilling the contract concluded between you and us, safeguarding our rights, and fulfilling legal obligations. We will inform you which data is required for this purpose before or during data collection. If we use third-party providers to render our services, the privacy policies of the respective third-party providers apply.

Data concerned:

Inventory data (e.g., names, addresses)
Payment data (e.g., bank details, invoices)
Contact data (e.g., email address, phone number, postal address)
Contract data (e.g., subject matter of contract, contract duration)

Data subjects: Customers, prospective customers, business and contractual partners

Purpose of processing: Processing of contractual services, communication and answering contact inquiries, office and organizational procedures

Legal basis: Performance of contract and pre-contractual inquiries, Art. 6 para. 1 lit. b GDPR, legal obligation, Art. 6 para. 1 lit. c GDPR, legitimate interest, Art. 6 para. 1 lit. f GDPR

‍

Your Rights under the GDPR

Under the GDPR, you have the rights listed below, which you can assert at any time with the controller named in Section 1 of this privacy policy:

Right of access: You have the right to request information from us about whether and which data we process about you.
Right to rectification: You have the right to request the rectification of inaccurate or completion of incomplete data.
Right to erasure: You have the right to request the erasure of your data.
Right to restriction of processing: In certain cases, you have the right to request that we restrict the processing of your data.
Right to data portability: You have the right to request that we transmit your data to you or another controller in a structured, commonly used, and machine-readable format.
Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority. The supervisory authority responsible is that of your usual place of residence, your workplace, or our company headquarters.

‍

Right of withdrawal

You have the right to withdraw your consent to data processing at any time.

‍

Right to object

You have the right to object at any time to the processing of your data that we base on our legitimate interest according to Art. 6 para. 1 lit. f GDPR. If you exercise your right to object, we ask you to state your reasons. We will then no longer process your personal data unless we can demonstrate to you compelling legitimate grounds for the data processing that override your interests and rights.

Irrespective of the foregoing, you have the right at any time to object to the processing of your personal data for marketing and data analysis purposes.

Please address your objection to the contact address of the controller provided above.

‍

When do we delete your data?

We will delete your data when we no longer need it or you instruct us to do so. This means that - unless otherwise stated in the individual data protection notices of this privacy policy - we will delete your data,

if the purpose of data processing has ceased and thus the respective legal basis mentioned in the individual data protection notices no longer exists, for example.
- after the termination of the contractual or membership relationships between us (Art. 6 para. 1 lit. a GDPR) or
- after our legitimate interest in further processing or storing your data ceases (Art. 6 para. 1 lit. f GDPR),
if you exercise your right of withdrawal and no other legal basis for processing within the meaning of Art. 6 para. 1 lit. b-f GDPR applies,
if you exercise your right to object and there are no compelling legitimate grounds preventing deletion.

However, if we must retain (certain parts of) your data for other purposes, for example, because tax retention periods (generally 6 years for business correspondence or 10 years for accounting records) or the assertion, exercise, or defense of legal claims arising from contractual relationships (up to four years) require it, or if the data is needed to protect the rights of another natural or legal person, we will only delete (that part of) your data after these periods have expired. Until these periods expire, however, we will restrict the processing of this data to these purposes (fulfillment of retention obligations).

‍

Cloud services

We use cloud services in particular

for storing and editing documents,
for sending documents via email or exchanging files of any kind,
for our calendar management,
for preparing and executing presentations and spreadsheets,
for publishing files of any kind,
for internal and external communication via chats, audio and video conferences.

The software applications we use for these purposes are provided to us by the providers listed below on their servers. We access these servers via the internet. If you transmit your data to us in the course of communication with us or in other processes explained by us in this privacy policy, we process this data in the cloud service we use. This means that your data is stored on the servers of the third-party cloud service provider. The third-party providers process usage and metadata to secure their servers and optimize their services. In particular, we process and store your contact, customer, and contract data.

If we make files of any kind publicly available via our website using the cloud service we employ, the respective third-party cloud service provider may store cookies on your computer system if you access these files. The service provider may process the data thus collected to analyze your usage behavior or browser settings.

We point out that, depending on the country of residence of the service provider mentioned below, the data specified in more detail below may be transferred to and processed on servers outside the European Union. In this case, there is a risk that the data protection level required by the GDPR may not be maintained, and the enforcement of your rights may not be possible or may be significantly hindered. If the service provider we use offers data processing exclusively within the EU, we intend – if not already implemented – to process your data exclusively there.

Data concerned:

Inventory data (e.g., names, addresses),
Contact data (e.g., email addresses, phone and mobile numbers)
Content data (e.g., photos, videos, texts),
Usage data (e.g., access times, websites visited, interest in content),
Metadata (e.g., IP address, computer system information)

Data subjects: Prospects, communication partners, customers, employees (e.g., applicants, current and former employees)

Purpose of processing: Organization of office and administrative tasks

Legal basis: Consent, Art. 6 para. 1 lit. a GDPR, performance of contract and pre-contractual inquiries, Art. 6 para. 1 lit. b GDPR, legitimate interest, Art. 6 para. 1 lit. f GDPR

Cloud service providers used:

Apple iCloud

Service provider: Apple Inc., Infinite Loop, Cupertino, CA 95014, USA
Website: https://www.apple.com/de/
Privacy Policy: https://www.apple.com/legal/privacy/de-ww/

‍

Cookies

Our website uses cookies. Cookies are small text files, consisting of a series of numbers and letters, which are placed and stored on the device you are using. Cookies primarily serve to exchange information between the device you are using and our website. This includes, among other things, language settings on a website, login status, or the point at which a video was watched.

When you visit our websites, two types of cookies are used:

Temporary Cookies (Session Cookies): These store a so-called session ID, which allows various requests from your browser to be assigned to the common session. Session cookies are deleted when you log out or close your browser.
Persistent Cookies: Persistent cookies remain stored even after the browser is closed. This allows our website to recognize your computer when you return to our website. For example, information about language settings or login information is stored in these cookies. These cookies can also document and store your browsing behavior. This data can be used for statistical, marketing, and personalization purposes.

In addition to the above classification, cookies can also be distinguished by their purpose:

Necessary Cookies: These are cookies that are absolutely necessary for the operation of our website, to store logins or shopping carts for the duration of your session, or cookies that are set for security reasons.
Statistical, Marketing, and Personalization Cookies: These are cookies used for analysis or audience measurement. Such "tracking" cookies can store information about entered search terms or the frequency of page views. In addition, the browsing behavior of individual users (e.g., viewing specific content, using functions, etc.) can be stored in a user profile. Such profiles are used to display content to users that matches their potential interests. If we use services that store cookies for statistical, marketing, and personalization purposes on your device, we will inform you separately about this in the following sections of our privacy policy or when obtaining your consent.

Data Processed:

Usage data (e.g., access times, clicked web pages)
Communication data (e.g., information about the device used, IP address).

Data Subjects: Users of our online services

Processing Purpose: Displaying our websites, ensuring the operation of our websites, improving our online offering, communication and marketing

Legal Basis:
Legitimate Interest, Art. 6 para. 1 lit. f GDPR
If we do not obtain your consent for setting cookies, we base the processing of your data on our legitimate interest in improving the quality and user-friendliness of our website, particularly its content and functions. You have the right to object to the use of cookies set by us based on our legitimate interest, via your browser's security settings. There, you can specify whether you want to accept no cookies at all, only accept them upon request, or have cookies deleted after each time you close your browser. If cookies are disabled for our website, it may no longer be possible to use all functions of the website to their full extent.

Consent, Art. 6 para. 1 lit. a GDPR
If we ask for your permission to place certain cookies on your device before your visit to our website, and you consent to this, your given consent serves as the legal basis. As part of your consent, we will inform you about which specific cookies we set. If you do not give this consent, only the technically necessary cookies, which are required for the proper operation of our websites and their display in your browser, will be set. If you have consented to the setting of cookies, you have the option to withdraw your consent at any time.

_cf_bm Cookie
‍Our website uses the _cf_bm cookie, provided by Cloudflare, our Content Delivery Network (CDN). This cookie is used to detect and prevent automated traffic, protecting our website from so-called "bad bots." It is a technically necessary cookie that contributes to the functionality of Cloudflare's security and bot management solutions. The _cf_bm cookie contains encrypted information that can only be decrypted by Cloudflare, as well as time-related data used to calculate a bot score and, if applicable, for anomaly detection. It does not store any personal data and is required for the functionality of our website. The cookie is not used to track users across different websites or sessions and automatically expires after 30 minutes of inactivity. Further information on data processing by Cloudflare can be found in Cloudflare's privacy policy.

‍

Web hosting

We use a provider to host our websites, on whose servers our websites are stored and made available for retrieval on the internet (hosting). In this process, the provider may process all data transmitted via your browser that arises from the use of our websites. This includes, in particular, your IP address, which the provider needs to deliver our online offering to the browser you are using, as well as all entries you make via our website. In addition, the provider we use may

the date and time of access to our website
time zone difference to Greenwich Mean Time (GMT)
access status (HTTP status)
the amount of data transferred
the Internet service provider of the accessing system
the browser type and version you are using
the operating system you are using
the website from which you may have accessed our website
the pages or sub-pages you visit on our website.

collect. The aforementioned data is stored as log files on our provider's servers. This is necessary to ensure the stability and security of our website's operation.

Data concerned:

Content data (e.g., posts, photos, videos)
Usage data (e.g., access times, clicked web pages)
Communication data (e.g., information about the device used, IP address)

Data subjects: Users of our online presence

Purpose of processing: Displaying our websites, ensuring the operation of our websites

Legal basis: Legitimate interest, Art. 6 para. 1 lit. f GDPR

Web host(s) commissioned by us:

Webflow, Inc.

Service provider: Webflow, Inc.
Website: Webflow, Inc. 208 Utah, Suite 210, San Francisco, CA 94103, USA
Privacy Policy: https://webflow.com

We host our website with Webflow. The provider is Webflow, Inc., 398 11th Street, 2nd Floor, San Francisco, CA 94103, USA (hereinafter: Webflow). When you visit our website, Webflow collects various log files, including your IP addresses, which are anonymized.

Webflow is a tool for creating and hosting websites. Webflow stores cookies or other recognition technologies that are necessary for displaying the site, providing certain website functions, and ensuring security (necessary cookies).

For details, please refer to Webflow's privacy policy: https://webflow.com/legal/eu-privacy-policy

The use of Webflow is based on Art. 6 para. 1 lit. f GDPR. We have a legitimate interest in presenting our website as reliably as possible. If corresponding consent has been requested, processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TTDSG, insofar as the consent includes the storage of cookies or access to information on the user's end device (e.g., device fingerprinting) within the meaning of the TTDSG. Consent can be revoked at any time.

For data transfers to the USA, the provider has joined the EU-US Data Privacy Framework, which, based on an adequacy decision by the European Commission, ensures compliance with the European level of data protection.

Data Processing Agreement: We have concluded a Data Processing Agreement (DPA) with the aforementioned provider. This is a contract required by data protection law, which ensures that the provider processes the personal data of our website visitors only according to our instructions and in compliance with the GDPR.

‍

Content Delivery Network

We use a Content Delivery Network (CDN) to deliver our websites. A CDN is a network of regionally distributed servers connected via the internet. The CDN provides scalable storage and delivery capacities. This optimizes the loading times of our websites and ensures optimal data throughput even during peak loads. User requests on our websites are routed through CDN servers. Statistics are generated from these data streams. This serves, on the one hand, to detect potential threats to our websites from malware early on, and on the other hand, to continuously improve our offerings and make our websites more user-friendly for you.

We would like to point out that, depending on the country of residence of the service provider mentioned below, data collected via the service may be transferred to and processed outside the European Union. In this case, there is a risk that the level of data protection required by the GDPR may not be maintained, and the enforcement of your rights may be difficult or impossible.

Affected Data:

Content data (e.g., posts, photos, videos)
Usage data (e.g., access times, clicked websites)
Communication data (e.g., information about the device used, IP address)

Purpose of Processing: Technical optimization of the website, analysis of errors and user behavior

Legal Basis: Legitimate interest, Art. 6 para. 1 lit. f GDPR

CDN Service Providers Used:

Amazon CloudFront

Service Provider: Amazon Web Services, Inc., 410 Terry Avenue North, Seattle WA 98109, USA
Website: https://aws.amazon.com/de/
Privacy Policy: https://aws.amazon.com/de/privacy/?nc1=f_pr.

Cloudflare

Service Provider: Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA
Website: https://www.cloudflare.com/
Privacy Policy: https://www.cloudflare.com/privacypolicy/
Scope of Data Collection: https://blog.cloudflare.com/what-cloudflare-logs/

Fastly

‍Service Provider: Fastly Inc., 475 Brannan St. #300, San Francisco, CA 94107, USA
Website: https://www.fastly.com
Privacy Policy: https://www.fastly.com/de/privacy

‍

Contacting Us

If you contact us via email, social media, phone, fax, mail, our contact form, or any other means, and provide us with personal data such as your name, phone number, or email address, or give further details about yourself or your request, we will process this data to respond to your inquiry within the scope of our existing pre-contractual or contractual relationship.

Data concerned:

Inventory data (e.g., names, addresses)
Contact data (e.g., email address, phone number, postal address)
Content data (texts, photos, videos)
Contract data (e.g., subject of contract, contract duration)

Data subjects: Prospects, customers, business and contract partners

Purpose of processing: Communication and answering contact inquiries, office and organizational procedures

Legal basis: Performance of contract and pre-contractual inquiries, Art. 6 para. 1 lit. b GDPR, legitimate interest, Art. 6 para. 1 lit. f GDPR

‍

Review Seal

To give you a first impression of the quality of our offers and services, we display a selection of customer reviews and the overall rating derived from all reviews via the review seal (also called review widget) integrated on our website. If you click on the widget, you will be redirected to the respective provider's website. There you can view all reviews of our offer. You also have the option to rate us there.

The provider's seal integrated on our website is displayed via an interface from the respective provider's server. For this purpose, when you visit our website, a data connection is established to the provider's server. Through this, the provider receives certain data that is necessary to display the content of the widget to your browser. This includes your assigned IP address and other access data.

Data concerned:

Usage data (e.g., access times, clicked websites)
Communication data (e.g., information about the device used, IP address).

Data subjects: Customers, users of our website

Purpose of processing: Obtaining customer feedback, as well as interest- and behavior-based marketing

Legal basis: Consent, Art. 6 para. 1 lit. a GDPR, legitimate interest, Art. 6 para. 1 lit. f GDPR

We use the following review seals:

‍

Online Advertising

We use services for displaying online advertising. Through the services we use, certain user data is collected via a cookie or pixel. This includes, in particular, information about which website you came from to reach our online presence (so-called referrer), which pages of our online presence you accessed, how long you visited our pages, and what interactions you performed there. In addition, data about the browser, computer system, and device type you used is collected. Such a service can also collect demographic information, such as age or gender, as pseudonymous values. If you have consented to the collection of your location data, this may also be processed, depending on the provider. To collect and store this data, the respective service places a cookie or a so-called tracking pixel on your device, which also collects your associated IP address. However, this is shortened using a so-called IP masking procedure, so that the IP address can no longer be assigned to your visit to our website. Generally, no clear data such as names or email addresses are stored when using the respective service. This is only the case if you are a member of a social network that offers one of the services listed below and links your profile with the aforementioned data.

The data collected by the service we use is evaluated to generate a report with statistical statements about the number of visitors generated through advertising and the success of the advertising measure. The reports include, among other things, the total number of users who were redirected to our website via our ads. Additionally, the reports contain information about users' devices and browsers, their locations, and the times when the advertisement was clicked. However, the reports do not contain any information that could personally identify you as a user of our site.

We would like to point out that, depending on the service provider's location, data collected via the service may be transferred and processed outside the European Union. In this case, there is a risk that the data protection level required by the GDPR may not be maintained, and the enforcement of your rights may be difficult or impossible.

Affected Data:

Usage data (e.g., access times, clicked web pages)
Communication data (e.g., information about the device used, IP address)

Data Subjects: Users of our online services

Purpose of Processing: Reach measurement, campaign success monitoring, remarketing, and interest- and behavior-based marketing

Legal Basis: If we have requested your consent before using the respective service, this constitutes the legal basis, Art. 6 para. 1 lit. a GDPR. Otherwise, we use the respective service based on our legitimate interest to direct visitor traffic to our website, analyze this traffic, and thereby continuously improve the functions, offers, and user experience, Art. 6 para. 1 lit. f GDPR.

We use the following service providers for online advertising:

Facebook Pixel

Service Provider: Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA
European Headquarters: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland
Website: https://www.facebook.com
Privacy Policy: https://www.facebook.com/about/privacy
Opt-Out Option: https://www.facebook.com/settings?tab=ads

Google Ads

Service Provider: Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
European Headquarters: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
Website: https://ads.google.com/home/
Privacy Policy: http://www.google.de/intl/de/policies/privacy

‍

Web Analytics and Statistics

To record and statistically evaluate visitor traffic on our website, we use web analytics services. Such services collect data including which website you came from to reach our website (so-called referrers), which pages of our website you accessed, how long you visited our pages, and what interactions you performed there. In addition, data about the browser, computer system, and device type you use are collected. Furthermore, such a service can also collect demographic information, such as age or gender, as pseudonymous values. If you have consented to the collection of your location data, this may also be processed, depending on the provider.

To collect and store this data, the web analytics service we use typically places a cookie on your device, which also collects your assigned IP address. However, this is truncated using a process called IP masking, so that the IP address can no longer be associated with your visit to our website. Furthermore, no clear data such as names or email addresses are stored. Neither we nor the service we use know the identity of the visitors to our websites.

When collecting data, the service provider can, however, create pseudonymized usage profiles with information from the use of various devices by using cookies.

Please note that, depending on the country of residence of the service provider mentioned below, data collected via the service may be transferred and processed outside the European Union. In this case, there is a risk that the data protection level required by the GDPR may not be met, and the enforcement of your rights may be difficult or impossible.

Data Processed:

Usage data (e.g., access times, pages clicked)
Communication data (e.g., information about the device used, IP address).

Data Subjects: Users of our online services

Purpose of Processing: Reach measurement, campaign success monitoring, remarketing, and interest- and behavior-based marketing

Legal Basis: If we have requested your consent before using the respective service, this constitutes the legal basis, Art. 6 para. 1 lit. a GDPR. Otherwise, we use the respective service based on our legitimate interest in analyzing the visitor traffic on our websites to continuously improve their functions, offerings, and user experience, Art. 6 para. 1 lit. f GDPR.

We use the following web analytics services:

Google Analytics 4

Service Provider: Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
EU Headquarters: Google Dublin, Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland
Website: https://marketingplatform.google.com/intl/de/about/analytics/
Privacy Policy: https://policies.google.com/privacy?hl=de
Note on data transfer to Google Analytics servers: When our website is accessed within the EU (based on the geographical location according to the IP address), the IP address assigned to you is collected exclusively via servers in the EU and used as geolocation data, after which it is immediately deleted. It is neither logged nor used in any other way. The other measurement data is then forwarded to Google Analytics servers for evaluation.
Opt-Out Option: If you do not want your data to be used by Google Analytics, you can install an opt-out plugin that will prevent your data from being collected on our website in the future. You can get this plugin here: https://tools.google.com/dlpage/gaoptout?hl=de

‍

Our social media presences

We maintain online presences within the social networks listed below. If you visit one of these presences, the data detailed below will be collected and processed by the respective provider. Typically, this data is collected for advertising and market research purposes, and user profiles are created from it. Data can be stored in the user profiles regardless of the device you use. This is particularly true if you are a member of the respective platform and logged in. The user profiles can be used by the providers to display interest-based advertising to you. You have a right to object to the creation of user profiles. To exercise this right, you must contact the respective provider.

If you have an account with one of the providers listed below and are logged in there while visiting our website, the respective provider may collect data about your usage behavior on our website. To prevent such linking of your data, you can log out of the provider's service before visiting our site.

For what purpose and to what extent data is collected by the provider, you can find in the respective privacy policies of the providers, as communicated below.

Please note that, depending on the country of residence of the provider mentioned below, data collected via their platform may be transferred and processed outside the European Union. In this case, there is a risk that the data protection level required by the GDPR may not be met, and the enforcement of your rights may be difficult or impossible.

Affected Data:

Inventory and contact data (e.g., name, address, phone number, email address)
Content data (e.g., posts, photos, videos)
Usage data (e.g., access times, clicked websites)
Communication data (e.g., information about the device used, IP address).

Purpose of Processing: Communication and marketing, tracking and analysis of user behavior

Legal Basis: Consent, Art. 6 para. 1 lit. a GDPR, legitimate interests Art. 6 para. 1 lit. f GDPR

Objection Options: For the respective objection options (opt-out), we refer to the information provided by the providers linked below.

We maintain online presences on the following social networks:

Instagram

Service Provider: Instagram Inc., 1601 Willow Road, Menlo Park CA 94025, USA
Parent Company: Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA
EU Headquarters: Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland
Website: https://www.instagram.com/
Privacy Policy: http://instagram.com/about/legal/privacy

‍

Security Measures

Furthermore, we implement state-of-the-art technical and organizational security measures to comply with data protection laws and to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorized access by third parties.

‍

Updates and Changes to this Privacy Policy

This privacy policy is currently valid and was last updated in June 2026. Due to changes in legal or regulatory requirements, it may become necessary to adapt this privacy policy.

This privacy policy was created with the help of the privacy policy generator from SOS Recht. SOS Recht is an offering of Mueller.legal Rechtsanwälte Partnerschaft, based in Berlin.