Privacy Policy

Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the InfiniVent platform (www.infinivent.eu) is:

MEG, proprietor Bernhard A. Knop e. K.
Catthagen 4
38364 Schöningen
Germany

Phone: +49 – 5352 – 934 2600
Email: hello@infinivent.eu
Web: www.infinivent.eu

Further information (e.g. VAT ID, commercial register) can be found in our Imprint.

General information on data processing

This Privacy Policy applies exclusively to the InfiniVent platform and describes which personal data are processed when you visit and use its features (location search, location detail pages, favourites list, registration, provider account, enquiries, reviews, contact form, tariff booking).

The platform is designed so that no cookies are set and no tracking or analytics services are used in normal operation. Personal data are processed only to the extent technically necessary for the relevant feature or where you have given your consent. The following sections describe the details.

Version of this statement: 4 October 2026 (Textversion 2026-10-04).

Hosting and server operation

The platform is operated on webspace hosting provided by United Domains (WordPress Pro webspace); according to the provider, the server is located in Germany. When the website is accessed, the server processes technically necessary connection data (e.g. IP address, browser type, time, page accessed) in order to deliver the content and protect the platform against attacks. Data are transmitted in encrypted form via HTTPS/TLS.

Server and security logs

The platform itself does not set cookies and does not store IP addresses permanently. IP addresses are used exclusively on a transient basis (for a maximum of 1 hour, in hashed form) to limit abuse (rate limits).

A mail log outside the web root records only the recipient, subject and sending status; email contents and access tokens are not logged. We currently have no information from the hosting provider regarding its own server logs (scope and retention period); this point must be reviewed legally before launch into production.

Visiting the website

When the public pages are accessed, connection data (IP address, browser identifier, time, URL accessed, amount of data transferred) are processed. This is technically necessary to deliver the page and ensure secure operation.

Technically verified: no cookies are set, and no tracking, analytics, marketing or advertising services are used. The WordPress core merely stores a technical emoji-support test in the browser's session storage (sessionStorage, key wpEmojiSettingsSupports, without personal data). Public interfaces (REST API) are used exclusively for read-only functions such as search, the home page and availability checks.

Language selection (localStorage)

If you select a language in the language switcher, your browser stores the selection locally only (localStorage, key iv_lang). This is functional storage without a cookie: the language is stored only when you explicitly select it, is not transmitted to our servers and can be deleted at any time via your browser settings.

Favourites list

The favourites list stores selected location identifiers exclusively locally in your browser (localStorage, key iv_compare_ids). No account is required and no favourites list is stored on our servers. When you open the favourites list, the stored identifiers are resolved via the public search API. The entries can be deleted at any time via your browser settings.

Maps and OpenStreetMap

Maps on location detail pages and in the location search are displayed using the locally integrated Leaflet library. The map data (tiles) are loaded from OpenStreetMap (tile.openstreetmap.org) on a “map only after click” basis (two-click solution): simply opening the page does not establish a connection to OpenStreetMap. The tiles are loaded only when you click the “Load map” button; your IP address is transmitted to OpenStreetMap in the process.

Your choice is not stored; no cookie or storage entry is created. The privacy notices of OpenStreetMap apply to its data processing. Whether and in what form consent is required to load the map must be reviewed legally before launch into production.

Registration

The following data are processed to register a location (registration via the “List a location” wizard): email address (required), provider details (provider, country, contact person, contact details, optional VAT ID) and location details (title, description, address, classification, capacity and prices, rooms, facilities and rules, surroundings, gallery images).

The process takes place without a password using the magic link procedure (see below). Consents (Privacy Policy, Terms and Conditions, content, optional AI notice) are stored with a timestamp and a reference to the text version. The data are created as a provider and location record and are published only after moderation. To prevent abuse, a honeypot field, a time check and a limit of 3 registration starts per hour and email address are used.

For technical administration, a WordPress user account (iv_<ID>, Subscriber role, random password) is created internally; password-based login is not provided.

Magic link procedure

Login and registration take place without a password: you receive a one-time link (magic link) by email containing a random token. The token is valid for 60 minutes and can be used only once. Only a hash of the token is stored in the record's metadata; the plain-text token is neither stored nor logged.

Session token and session management

After successful verification, a session token is issued and used to access protected features (provider account, location editing, availability, enquiries). The session token is also stored only as a hash with an expiry time (60 minutes) in the metadata and is automatically removed from the URL upon transmission. No session cookies are used; the token is invalidated when you log out.

Provider and contact data

Provider data stored during registration and account management (company, contact person, address, telephone, email, website, optional VAT ID) are used to manage the provider account, communicate, moderate and administer paid tariffs. Contact details that you enter in your location profile may be displayed on the public location page so that event organisers can contact you.

Location data

Location data (title, description, address, geographic coordinates, classification, capacity, prices, rooms, facilities, rules, surroundings, gallery images, availability) are processed to display the location on the platform and make it searchable. Publication takes place only after moderation. Geographic coordinates are used exclusively to display the map; the map is loaded only after you click “Load map” (see the section “Maps and OpenStreetMap”).

Location enquiries

If you submit an enquiry via a location profile or the favourites list, the following information is processed: name, email address, telephone number (optional), requested period (from/to, time), your message and any additional services requested from MEG Group.

Required elements are consent to being contacted and consent to this Privacy Policy; you may optionally consent to disclosure to MEG Group (consent_meg) and to being recorded as a lead (consent_lead). The enquiry is stored as a record, sent by email to the location operator and sent to you as confirmation. The enquiry is transmitted to MEG Group only if you have expressly consented to the disclosure. To prevent abuse, a honeypot field and a limit of 5 enquiries per hour and IP address (transient, hashed) are used.

Contact form

The contact form processes your name, company (optional), email address, telephone number (optional), subject and message. Confirmation of this Privacy Policy is required. The message is sent by email to hello@infinivent.eu and is not stored permanently. To prevent abuse, a honeypot field and a limit of 3 messages per hour and IP address (transient, hashed) apply.

Reviews

When you submit a review, the star rating (1–5), your text and a consent referencing the text version are processed. Reviews are moderated before publication; reviews cannot be submitted for test enquiries.

Consents on forms

The following consents are obtained on the platform and documented with a timestamp and a reference to the text version: registration (Privacy Policy, Terms and Conditions, content, optional AI notice), location enquiries (being contacted, Privacy Policy, optional disclosure to MEG, optional lead), reviews (Privacy Policy) and the contact form (Privacy Policy). This makes it possible to determine which version of the texts was in force at the time consent was given.

You may withdraw your consent at any time with effect for the future; the lawfulness of processing carried out before withdrawal remains unaffected.

Disclosure to MEG Group

Your enquiry data are disclosed to MEG Group as the operator of the platform only if you have expressly indicated this in the enquiry form (disclosure to MEG, consent_meg). In this case, the information is sent to the MEG inbox (info@meg-online.eu) so that the services you requested can be handled. Within MEG Group, data may be transmitted to internal administrative systems (e.g. ERP) for contract and invoicing purposes; data are not transmitted to external third parties for advertising purposes. Without your consent, no disclosure to MEG Group takes place.

Email delivery

Emails from the platform (magic links, confirmations, notifications, enquiries, contact messages) are sent via the hosting provider's SMTP server (smtps.udag.de, encrypted) from no-reply@infinivent.eu; replies are addressed to hello@infinivent.eu. A mail log outside the web root records only the recipient, subject and status, not contents or tokens.

Payment processing via Stripe

Paid tariffs are booked through the external payment service provider Stripe. The platform does not integrate client-side Stripe scripts: the payment is prepared server-side as a checkout session, and you are redirected to Stripe's pages (checkout.stripe.com) to pay. The Stripe privacy policy applies there, including the transfers to third countries described therein.

The following are transmitted to Stripe: name, email address, billing address (country, postcode, city, street), VAT ID for EU reverse charge, and technical allocation data (provider identifier, tariff). Payment data (e.g. credit card details) are disclosed exclusively by Stripe as a PCI-DSS-certified service provider; the platform does not store any payment data, but only references (payment status) in the provider record. Payment confirmations are processed after signature verification (webhook). The data processing and third-country arrangements with Stripe must be reviewed legally before launch into production.

VAT ID verification via VIES

If you provide an EU VAT ID, it is verified server-side via the official EU service VIES (European Commission, SOAP over HTTPS). The country and VAT ID are transmitted. The input, verification status, time of verification and, where applicable, company and address details returned by the service are stored; for technical reasons, the result is cached for up to 24 hours. VAT IDs and verification results are not included in logs or notifications.

Rights of data subjects

Subject to the statutory requirements, you have the following rights: access to the personal data processed, rectification, erasure, restriction of processing, data portability and the right to object to processing. You may withdraw your consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority; for the controller's registered office in Lower Saxony, the State Commissioner for Data Protection of Lower Saxony (Landesbeauftragte für den Datenschutz Niedersachsen) (www.lfd.niedersachsen.de) is responsible.

No automated decision-making, including profiling, takes place technically.

Erasure and retention

The following retention periods have been technically verified: magic link and session tokens, 60 minutes; rate-limit counters, 1 hour; VIES verification result, 24 hours; form feedback, 60 seconds. Beyond this, data are stored only for as long as necessary for the relevant purpose and as long as statutory retention obligations apply; specific retention periods for individual data categories must be reviewed legally before launch into production.

You may request the erasure of your data unless statutory obligations prevent this. Data may also be included in backup copies (backups) and are retained there in accordance with the internal backup concept.

Data security

Data are transmitted in encrypted form (HTTPS/TLS). Access credentials and secrets are stored outside the web root and protected by file permissions. Tokens are stored only in hashed form. Forms are protected against abuse by nonces, honeypot fields, time checks and rate limits; payment notifications are processed after signature verification. No cookies are used.

WordPress core functions and REST API

The platform is based on WordPress. WordPress provides a public REST API by default; certain standard endpoints (e.g. the user list at /wp-json/wp/v2/users) may, for technical reasons, contain basic information such as usernames and profile picture URLs. We are currently reviewing whether to restrict these standard endpoints; the scope must be reviewed legally before launch into production. Other WordPress features (emoji support, xmlrpc.php) are blocked or loaded only when required by the browser. External fonts, content delivery networks and advertising networks are not integrated.

Changes to this Privacy Policy

This Privacy Policy is updated in the event of technical or legal changes. The current version (Textversion 2026-10-04) is published here; stored consents reference the text version in force at the relevant time.

Contact for data protection enquiries

If you have questions about data processing, exercising your rights or this statement, you can reach us by email at hello@infinivent.eu or by post at the address stated in the “Controller” section. Whether a data protection officer must be appointed must be reviewed legally before launch into production.