Imprint & Privacy

Data protection

Privacy notice

Last updated: 12 October 2026

Controller and contact

M24 Labs GmbH is responsible for personal data processed through M24 INNO. Our address and contact details are listed above. For privacy questions, account closure or data rights requests, use the contact form or the email address above.

Visiting the website and security

The web server processes your IP address, request time, requested page and technical connection information to deliver the website and investigate errors or abuse. Authentication protection also uses hashed identifiers derived from IP addresses or email addresses and attempt counters. For basic site statistics, we store daily page-view counts by page, an aggregate count of browser sessions that viewed a public page each day, and daily counts by referring website or platform. We use only the referring hostname from the browser's Referer header, not the full URL, path or query. Missing or unusable referrers are grouped as Direct / unknown. The existing session counts a browser session once per day. No IP address, session ID or other visitor identifier is stored in the statistics tables, and no separate analytics cookie is set. Our legitimate interest is understanding basic site usage and operating a reliable, secure service (Article 6(1)(f) GDPR).

We use the session cookie m24inno to maintain sign-in state and protect forms against unauthorised requests. The server-side session also prevents repeat views in one day from increasing the aggregate visitor count. It is a session cookie, not an advertising identifier. The underlying processing relies on Article 6(1)(b) GDPR for requested member functions and Article 6(1)(f) GDPR for protecting the service and basic site statistics. Session storage needed for sign-in and form protection falls under Section 25(2) TDDDG.

The current website has no advertising pixels or third-party analytics services. Images, partner logos and styling are delivered locally rather than loaded from partner websites. External links and online meeting links lead to services with their own privacy notices.

Membership and email

Creating an account requires your name, email address and password. We store a password hash, not the password itself. We also store account status, email verification and authentication records. Administrators may create an account for an existing event client and invite that person by email to set a password. One-time email codes expire after ten minutes; invitation links expire after 24 hours and password reset links after one hour. Each link can be used only once.

You may add your country and institution to your profile. These details are optional for joining but required for certain event applications or presentation proposals. We use this information to provide the membership and activities you request (Article 6(1)(b) GDPR).

Active, verified members receive club and exhibition announcements, in addition to authentication emails. Please contact us if you wish to stop event announcements or end your membership. Inquiries sent through the contact form or by email are processed to answer you, under Article 6(1)(b) GDPR for requested services or Article 6(1)(f) GDPR for other correspondence. Contact form messages are sent by email to our team; the form uses a hidden anti-spam field and short-lived rate limits.

Innovations, authors and events

We process innovation submissions, named authors, descriptions, images, privately stored print posters and links, together with event registrations, presentation proposals, attendance choices and participation offers or discounts. Administrators may add innovations previously presented by a client to that client's account. This lets us review submissions and administer the activities you request (Article 6(1)(b) GDPR). The website does not currently collect payment-card or bank-account details.

Submissions remain private until reviewed and published. Administrator-added innovations also require documented publication permission or confirmation from the account holder before publication. Print posters remain private to administrators for event printing and are not shown in the public gallery. Publication can make the submitted content and authors' names accessible worldwide. Authors may be different from the account holder; permission to publish their names and work must be obtained and they should be informed of this notice. Where publication is based on consent (Article 6(1)(a) GDPR), that consent can be withdrawn at any time.

Event recaps may contain photographs, achievements and authors' names supplied by organisers, photographers, participants or publicly available event reports. Our interest in documenting innovation events and their results is the basis under Article 6(1)(f) GDPR where it is not outweighed by the rights of the people concerned. Where consent is required for a photograph or publication, it must be obtained before publication. Contact us about any photograph or author listing that concerns you.

Access, recipients and international participation

Private account and application data is available to authorised club administrators and, where necessary, hosting and email service providers acting for us. Approved gallery entries and event recaps are available to the public. Clicking a partner logo does not send your membership or application records to that partner.

The website does not automatically forward nominations to exhibition organisers. If you proceed with international representation, we will provide event-specific information before sharing personal data, including the recipient, country and any applicable international-transfer safeguards or legal basis. The same applies when an external meeting service is used.

Retention

Account and submission records remain stored while needed for membership, an open application or a requested publication. Account closure or erasure requests are handled by our team. Information may need to be retained for legal recordkeeping, an existing event commitment or the establishment, exercise or defence of legal claims; access is limited accordingly.

Published recaps are maintained as an event archive while the publication remains justified. Technical and authentication records may remain after their active security window and are kept only while needed for security or legal claims. Expiry of a sign-in code or rate-limit window is not, by itself, deletion of the associated record.

Your rights

Subject to the GDPR's conditions, you can request access, correction, erasure, restriction and data portability. You can withdraw consent at any time without affecting the lawfulness of earlier processing. You may object to processing based on legitimate interests for reasons relating to your situation, and to direct marketing at any time. Send requests to the contact email above.

You may also complain to a data protection supervisory authority, including the authority where you live or work. For private-sector organisations in Bavaria, this is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA).

We do not use solely automated decision-making with legal or similarly significant effects. Innovation reviews and participation offers are handled by our team.