Privacy policy
Last updated 30 October 2026
This policy explains what personal data The Restaurant collects, why, who else handles it, how long we keep it and what rights you have. It covers this website, the guest app and the emails we send. We only collect what we need to run the evenings.
1. Who is responsible
The controller under the GDPR is Hatch Community Events UG (haftungsbeschränkt), Rheinsberger Str. 76/77, 10115 Berlin, Germany, represented by Damian Martone. Email: team@hatchconference.com.
For anything about your data, write to team@hatchconference.com.
2. Visiting the website
When you open a page, our host stores technical data in server logs: your IP address, the date and time, the page requested, the referring page and your browser type. We need this to deliver the site and keep it secure (Art. 6 (1) (f) GDPR). The host deletes the logs after a short period.
Our fonts are stored on our own server, so opening the site sends nothing to font providers such as Google. We do not use analytics, advertising pixels or social media plugins.
4. Your account and profile
You log in with your email address and a 6-digit code we email you. The code works for 10 minutes and once, and we store it only as a hash.
Your profile holds your photo, name, company, role and LinkedIn URL. Other signed-in guests can see it, and so can visitors to an evening page if you are featured on its programme. Your email address is only seen by the organizers. We need this to run invite-only evenings where guests know who they will sit with (Art. 6 (1) (b) GDPR).
5. How you got in: invites, lists and access requests
- Invites and plus ones. A guest or organizer can give us your email address to invite you or bring you as a plus one. We use it only to send you that invite and the emails that follow (Art. 6 (1) (f) GDPR: our interest, and the inviter's, in letting you join). The first email says who invited you; reply to it and we delete your address.
- Hatch 2026 and Ateliers lists. If you took part in Hatch Conference 2026 or Ateliers, we use your email address from that event to let you in without an invite (Art. 6 (1) (f) GDPR). This is a closely related use of data you already gave Hatch Conference. You can object any time.
- The application list. If you join without an invite, we store your answers and your place in line. On the 1st of each month the oldest 20 requests get an invite. An organizer reads every request and can decline one that does not fit the evenings; we keep the decision and its reason so you can ask about it (Art. 6 (1) (b) GDPR).
6. Tickets, standby lists, check-in and strikes
For each evening we store your ticket or standby place, your plus one, your answers to the evening's questions, whether you confirmed, cancelled or were checked in at the door, and the emails we sent you about it (Art. 6 (1) (b) GDPR). Answers to the evening's questions are only seen by the organizers.
These records decide two rules you agree to when you request a ticket: a strike if you hold a ticket and do not come without cancelling at least 12 hours before, which pauses requests for the next evening, or the next 3 after a second strike; and a standby place for your request after 3 evenings in a row. A strike is never automatic: an organizer reviews each no-show before it applies, so this is not a solely automated decision under Art. 22 GDPR. You can contest a strike by writing to team@hatchconference.com.
To get you into the building, we give the host company of an evening (for example Doctolib) the names and companies of confirmed guests. They use the list only for access on that night.
7. Photos at the evenings
We take photos at the evenings to report on them, for example in recap posts (Art. 6 (1) (f) GDPR). We say so at the door. Tell the photographer or write to us if you do not want to appear, and we remove photos of you.
8. Who else handles your data
We use these service providers. Each processes data only on our instructions under a data processing agreement (Art. 28 GDPR).
| Provider | What for | Where |
|---|---|---|
| Netlify, Inc., San Francisco, USA | Hosting the website and app | USA and worldwide edge servers |
| Convex, Inc., San Francisco, USA | The database and the app's timers and emails | Data stored in the EU (Ireland) |
| Resend, Inc., San Francisco, USA | Sending emails. We do not track opens or clicks. | USA |
Where data reaches the USA, the transfer is covered by the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified, and otherwise by the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).
9. How long we keep data
- Your profile, tickets and history: as long as the evening series runs, or until you ask us to delete your account.
- Strikes: as long as your profile, because whether a strike is your first or second depends on the ones before it; attending an evening clears them for this count.
- Emails we sent you: as long as your account, so a disputed strike can be checked against what was sent and when.
- Invites and access requests that did not lead to a profile: deleted when you ask, and at the latest when the series ends.
- Lists from Hatch 2026 and Ateliers: addresses that never log in are deleted when the series ends.
Where tax or commercial law requires us to keep records longer, we keep only those records, and only for that period.
10. Your rights
You have the right to access your data (Art. 15 GDPR), to correct it (Art. 16), to have it deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), and to withdraw any consent you gave, with effect for the future (Art. 7 (3)). You can edit your profile yourself in the app; for everything else write to team@hatchconference.com and we answer within one month.
Right to object (Art. 21 GDPR). Where we rely on our legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time for reasons arising from your situation. We then stop, unless we have compelling grounds that outweigh your interests.
You can also complain to a data protection authority, in particular in the EU country where you live or work (Art. 77 GDPR). The authority responsible for us is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (www.datenschutz-berlin.de).
11. Do you have to give us your data?
No law requires it. Without an email address you cannot log in, and without a complete profile you cannot request a ticket, because the evenings are small and guests sit together.
12. Changes
We update this policy when the site or the law changes. The date at the top shows the current version; if a change affects how we use data you already gave us, we tell you by email first.