Data privacy

Bei der Nutzung des Kontaktformulars erheben wir Ihre personenbezogenen Daten (Name, E-Mail-Adresse, NaWhen you use the contact form, we only collect your personal data (name, email address, message text) to the extent you provide it to us. Data processing serves for the purpose of establishing contact. Processing takes place in accordance with Sec. 6 (1) (f) GDPR. 
We only use your email address to process your enquiry. You data is deleted as soon as it is no longer required for the purpose it was collected. This is usually the case once it can be inferred from the circumstances that the matter in question has been clarified.

On our website, you can subscribe to newsletters containing general and specific information if you have expressly consented to do so. Processing takes place in accordance with Sec. 6 (1) (a) GDPR with your consent.  
On subscribing to the newsletter, the data from the input mask is transmitted to us here. Indicating an email address is sufficient to receive our newsletter.
Your consent is provided within the scope of what is known as the “double opt-in” procedure. The confirmation email address you provide serves to verify whether the owner of the address as the data subject has authorised the receipt of the newsletter. The IP address of the computer accessing the website and the date and time of registration are also logged in order to document your consent.
The option is available to you to revoke your consent at any time with effect for the future and unsubscribe from our newsletter, for example, by using the opt-out option provided in the newsletter.

Your data will be disclosed to a service provider for email marketing purposes here within the scope of a data processing commission agreement. Disclosure to any other third parties does not take place.

Newsletter-Tracking

Each “Bundeskunsthalle” newsletter contains what are known as tracking pixels or web bugs. A tracking pixel is a miniature graphic that is embedded into emails sent in HTML format to facilitate the recording and analysis of log files. Based on the embedded pixel, the “Bundeskunsthalle” can determine whether and when a data subject opened an email and which links he accessed in the email. This is solely for the purpose of statistically evaluating the success or failure of the newsletter.

The data controller stores and evaluates the personal data collected using tracking pixels in the newsletters to optimise the delivery of the newsletter and better adapt the contents of future newsletters to the interests of the data subject. This personal data is not disclosed to third parties. Data subjects are entitled to revoke the declaration of consent they provided through the double-opt-in procedure at any time. Following revocation, the data controller deletes this personal data. The “Bundeskunsthalle” automatically interprets a data subject unsubscribing from receiving the newsletter as a revocation of consent.

We offer you the chance to order our annual tickets (ArtCard) and book guided tours/workshops directly on our website.

What data do we use and where does it come from?
As a matter of principle, we collect your data directly from you. As a rule, you provide us with this data when placing your order and within the framework of the business relationship. As a part of this, we only collect that data which is necessary for the respective contract purpose. The provision of additional information on your part takes places voluntarily.

What do we process your data for (purpose of processing) and on what legal basis?
We collect and process your data for the following purposes in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), as well as all other pertinent laws (e.g. Unfair Competition Act (UWG), German Art Copyright Act (KUG), etc.):

• For the purpose of concluding and performing the contract (Sec. 6 (1) (b) GDPR). In this context, the purposes of data processing are primarily based on the specific product and service. Further details of the purposes of data processing result from the relevant respective contract documents and terms and conditions of business/terms of use.
• If you choose to purchase an annual pass from us, we collect and use your portrait photo for identification purposes.
• Insofar as you have expressly consented to it, we also use your data to provide sales and marketing information about our products and services, as well as products and services from our partner museums and cooperation partners, which we send to you through electronic channels (e.g. email, telephone, fax, text message, messenger etc.). (Sec. 6 (1) (a) GDPR, Sec. 7 Unfair Competition Act (UWG)). You will find a list of cooperation partners we have established permanent business relationships with in the current ArtCard Info Brochure and/or under www.bundeskunsthalle.de > “Annual Passes”. In connection with projects (e.g. exhibitions), we may establish new and temporary cooperation agreements with third parties, during the course of which and from whom you will receive sales and marketing information over digital channels concerning their products and/or services. You have option of having a list of these current cooperations sent to you by email.
• For fulfilling legal obligations or regulatory requirements. Processing takes place according to the legal regulations, among other things, to fulfil regulations concerning commercial law, tax regulations, control and reporting obligations and identity checks. (Sec. 6 (1) (c) and (e) GDPR)

Insofar as required, we process your data to safeguard our legitimate interests or those of a third party (Sec. 6 (1) (f) GDPR):

• To provide information about our products and services (advertising or market research and opinion polls)
• To assert legal claims and defend against legal disputes
• To prevent and investigate criminal offences
• To instigate access control measures and safeguard our right to determine who shall be allowed or denied access
• For video surveillance purposes to safeguard our right to determine who shall be allowed or denied access and to gather evidence in the event of robbery and fraud
• To make credit checks before entering into a contractual relationship

Who receives personal partner data?
The entity that collects personal data is Kunst und Ausstellungshalle der Bundesrepublik Deutschland GmbH. This entity stores in its IT systems all the data required for contract fulfilment and for providing partner support. 
Only those offices inside the “Bundeskunsthalle” receive access to your data that require it to fulfil the aforementioned purposes and, in particular, our contractual obligations. 
In order to provide our contractual services, we use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders. 
Any further data transfer to recipients outside the “Kunst und Ausstellungshalle” only takes place if the statutory provisions require or permit it, or if you have given your consent.
Under these conditions, recipients of your data can, for example be:

• Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies),
• Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
• IT services and consulting companies
• IT services
• (Legal) advisory and consulting 
• File and data destruction companies
• Logistics
• Print shops
• Telephony and Internet telecommunication service providers
• Financial institutions, payment transactions 
• Sales and marketing
• Management consultancies and auditors and tax auditors
• Document processing companies, factoring companies
• Payment card processing (debit cards/credit cards)
• Direct mail shops
• Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)
• Credit bureaus that check creditworthiness for the purpose of performing credit checks, or for obtaining information in the course of the business relationship insofar as the transfer of your data is required.

How long do you store my personal data?
We process and store your data for as long as it is required to fulfil the aforementioned purposes, and, in particular, our contractual and statutory obligations as an employer. We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties, unless its temporary further processing is required for the following purposes:

• Complying with retention periods under commercial and tax law: Of particular note here are the German Commercial Code (HGB) and the German Tax Code (AO). The deadlines for storage and documentation specified by these laws are six to ten years. 
• Preservation of evidence within the statutory limitation period. According to Sec. 195 ff Germany Civil Code (BGB), these limitation periods can be up to 30 years, while the regular limitation period is three years.

Am I obliged to provide my personal data?
Within the framework of our business relationship, you are obliged to provide us with the data required for entering into a business relationship and perform the related contractual obligations, or provide the data we are required to collect by law. Generally, we will not be able to conclude or execute the contract without this data.

The provision of further data is voluntary.

If you contact us by email, we will only use your personal data (name, email address, message text) to contact you. Processing takes place in accordance with Sec. 6 (1) (f) GDPR. We only use your email address to process your enquiry. You data is deleted as soon as it is no longer required for the purpose it was collected. This is usually the case once it can be inferred from the circumstances that the matter in question has been clarified.

On its website, the “Bundeskunsthalle” offers its online magazine where visitors have the opportunity to leave personal comments about individual contributions. Within the framework of our Terms of Use, information on the time the comment was made and the username (pseudonym) chosen by the data subject is stored and published in addition to the comments left behind when commenting on an article or contribution. Furthermore, the data subject’s IP address assigned by the Internet service provider (ISP) is also logged. The IP address is stored for security reasons and in the event that the data subject violates the rights of third parties or posts unlawful contents by submitting a comment. Processing serves the purpose of allowing comments to be made and displaying comments based on Sec 6. (1) (f) GDPR. 
Under our Terms of Use, your personal data is deleted as soon as it is no longer required for the purpose it was collected.

The “Bundeskunsthalle” website uses cookies. Cookies are text files that are deposited and stored on a computer system over an Internet browser.

Numerous websites and servers use cookies. Many cookies contain what is known as a cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a character string which allows web pages and servers to be assigned to the specific Internet browser in which the cookie was stored. This allows the websites and servers visited to distinguish the individual’s browser from other Internet browsers that contain other cookies. The unique cookie ID can be used to recognise and identify a particular Internet browser.

By using cookies, the “Bundeskunsthalle” can provide its website users with more user-friendly services which would not be possible without setting the cookie. As already mentioned, cookies allow us recognise our website users. The purpose of this is to facilitate their use of our website. For example, the user of a website that uses cookies does not have to re-enter their credentials every time they visit the website, because the website and the cookie stored on the user’s computer system does this for them.

The data subject can prevent cookies being set through our website at any time by make a corresponding setting in the respective Internet browser, thus permanently rejecting cookies being set. The user can also delete cookies at any time that have already been set through an internet browser or other software programs. This is possible in all standard Internet browsers. However, it may not be possible to use all the functions of our website in full if the data subject deactivates cookies being the set in the Internet browser used.

Wir haben auf der Internetseite der Bundeskunsthalle die Komponente Matomo integriert. Matomo ist ein Open-Source-Softwaretool zur Web-Analyse. Web-Analyse ist die Erhebung, Sammlung und Auswertung von Daten über das Verhalten von BeWe have embedded the Matomo plugin into the “Bundeskunsthalle” website. Matomo is an open-source software tool for web analysis. Web analysis involves the recording, collection and analysis of data concerning the behaviour of website visitors. One of the jobs a web analysis tool performs is to collect data about which website a data subject came from (referrer website), which sub-pages on the website he accessed and how often, and the length of time a sub-page was viewed. Web analysis is mainly used to optimise a website and perform cost-benefit analysis in relation to Internet advertising.

The software is operated on the data controller’s server and log files sensitive to privacy are stored exclusively on this server.

The purpose of the Matomo plugin is to analyse visitor flows on our website. We use the data and information obtained, among other things, to evaluate the use of our website in order to compile online reports showing the activities on our web pages.

Matomo setzt ein Cookie auf dem informationstechnologischen System der User. Was Cookies sind, wurde oben bereits erläutert. Mit der Setzung des Cookies wird uns eine Matomo sets a cookie on the user’s IT system. What cookies are, has already been explained above. Setting the cookie allows us to analyse the use of our website. Each time an individual page on this website is called up, the Matomo plugin automatically causes the Internet browser on the data subject’s IT system to transmit data to our server for online analysis purposes. In the course of this technical process, we gain knowledge of personal data, such as the data subject’s IP address, which, among other things, serves to help us understand where visitors originate from and their clicks.

The cookie stores personal information, such as access time, the location from where access was made and the frequency of visits to our website. Each time a data subject visits our website, this personal information, including the IP address for the Internet connection used by the data subject, is transmitted to our server. We store this personal data. We do not disclose this personal data to third parties.

The data subject can prevent cookies being set through our website at any time as described above by making a corresponding setting in the respective Internet browser and thus permanently rejecting cookies being set. Making this setting in the Internet browser used also prevents Matomo from setting a cookie on the data subject’s IT system. The data subject can also delete at any time a cookie that Matomo has already set over an Internet browser or other software programs.

Furthermore, the data subject can object to the data generated by Matomo relating to the use of this website being collected and also prevent its collection. To do so, the data subject needs to set an opt-out cookie. The data subject will need to set the opt-out cookie again if his IT system is deleted, formatted or reinstalled at a later date.

Setting the opt-out cookie may result in the data subject no longer being able to use the data controller’s website in full.

Further information and the currently valid Matomo privacy policy can be viewed under: matomo.org/privacy/ 

We have embedded the Shariff plugin into the “Bundeskunsthalle” magazine web pages. The Shariff plugin provides social media buttons that are privacy compliant. Shariff was developed for the German computer magazine c’t and is published by GitHub, Inc.

Developer of the component is GitHub, Inc. 88 Colin P. Kelly Junior Street, San Francisco, CA 94107, USA.

Usually, the button solutions provided by social networks already transfer personal data to the respective social network when a user visits a website on which a social media button is embedded. The Shariff plugin allows personal data to only be transmitted to social networks when the website visitor actively enables one of the social media buttons. Further information on the Shariff component is available from c’t computer magazine under www.heise.de/newsticker/meldung/Datenschutz-und-Social-Media-Der-c-t-Shariff-ist-im-Einsatz-2470103.html (In German only). The purpose of using the Shariff plugin is to protect our website visitors’ personal data while allowing us to embed a button solution for social networks on our website at the same time.

Further information and the currently valid GitHub privacy policy can be viewed under  help.github.com/articles/github-privacy-policy/

We have embedded plugins from Facebook on the “Bundeskunsthalle” website. Facebook is a social network. A social network is an Internet-based social meeting place, an online community that usually allows users to communicate with one another and interact in virtual space. A social network can serve as a platform for sharing views and experiences and also allows the Internet community to provide personal or business information. Facebook allows social network users to create private profiles, upload photos and socialise using friend requests.

The company that operates Facebook is Facebook, Inc., 1 Hacker way, Menlo Park, CA 94025, USA. The entity responsible for processing personal data if a data subject lives outside the USA or Canada is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

As part of our website, the plugins are identified by the Facebook logo and/or the addition “Like” or “Share”. You can find an overview of Facebook plugins here: developers.facebook.com/docs/plugins/

These plugins (social media buttons) are disabled by default. Only when you activate them and by doing so declare your consent to communicating with Facebook, are buttons activated and connect to the servers from Facebook. Only then can you transfer data with a second click. If you are already signed into Facebook, this takes place without another window opening. A click on one of the Facebook buttons therefore means that you give your consent to the transfer of your data to the social network operator – but only for this one page. The deactivated button reappears when you call up further pages on the “Bundeskunsthalle” website. No complete surfing profiles are created in this way.

Please refer to the privacy policy of Facebook for information on the further processing and use of your data by Facebook, as well as your rights in this regard, and settings options for protecting your privacy: https://www.facebook.com/privacy/explanation

The purpose of embedding the Facebook plugin is to allow our users to redistribute the contents of our website, to promote the contents of our website in the digital world and to increase the number of visitors to our website. 

The “Bundeskunsthalle” runs a fan page on the “Facebook” social network (operated by: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).

Since, in terms of data protection law, running the fan page represents a joint responsibility (Sec. 26 GDPR) between Facebook Ireland Ltd. and our company, an agreement has been reached with Facebook Ireland Ltd., which you can view under the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

If you use Facebook products, such as our fan page, Facebook collects and uses the information described in its “Data Policy” under “What kinds of information do we collect?”.

The Facebook “Data Policy” is available online under: https://www.facebook.com/about/privacy/update

Information about the cookies Facebook uses can be found in the Facebook Cookie Policy: https://www.facebook.com/policies/cookies/

Facebook supplies fan page operators with statistics and insights for their fan pages that help them understand the types of actions that people take on their pages (Page Insights).

The “Bundeskunsthalle” has no influence over the fact that Facebook collects these statistics and insights. According to Facebook, Page Insights are designed to show important trends without revealing details about you that could identify you.

According to Facebook, fan page operators may be able to associate “Like” info for the fan page if you like their fan page and have set your “Like” info for pages to “Public”.

Information used for Page Insights

Viewing a page or post or video from a page

• Subscribing to a page or cancelling a subscription
• Flagging a page or posting with a “Like” or “Dislike”
• Recommending a page in a post or comment
• Commenting on, sharing or responding to a post on a page (including the type of response)
• Hiding a post on a page or reporting it as spam
• Clicking on a link from another page on Facebook or from a website outside of Facebook that takes the user to the page
• Moving the mouse over the name or the profile picture on a page to preview the page content
• Clicking on the web page, phone number or “Plan Route” button or another button on a page
• Information about whether you are logged in to a computer or a mobile device while visiting a page or interacting with it or its content

Responsibility for your personal data that is used to create Page Insights

Page Insights provided for a page may require personal data to be processed which is subject to protection under the European General Data Protection Regulation (GDPR). The GDPR applies to processing this data, if you, for instance, live in an area where Facebook Ireland provides Facebook products. In this case, Facebook Ireland and the “Bundeskunsthalle” may share responsibility for your personal data that is collected in connection with a visit or interaction with a page (including its contents) as long as the data is being processed for Page Insights. In this event, the following applies to processing you data under joint responsibility:

• Facebook Ireland and the “Bundeskunsthalle” have reached an agreement in which their respective obligations are governed by the GDPR. www.facebook.com/legal/terms/page_controller_addendum.
• Facebook Ireland and the “Bundeskunsthalle” have reached an agreement that Facebook is primarily responsible for providing you with information about joint processing and making it possible for you to exercise your rights under the GDPR. According to the GDPR, you are entitled to information about, the correction of, the transfer of and the deletion of your data and to objectto its processing and to restrict its processing. You can find out more about these rights in your Facebook Settings 
• Facebook Ireland and the “Bundeskunsthalle” have agreed that the Irish Data Protection Commission should be the authority that oversees the supervision of processing under joint responsibility. You have the right to file a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or submit a complaint to your local supervisory authority.

This data protection information is based on the text provided by Facebook Ireland.

We have embedded plugins from the Twitter on the “Bundeskunsthalle” website. Twitter is a multilingual micro-blogging service that is available to the public where users can post and distribute what are referred to as tweets, or short messages, which are limited to 280 characters. These short messages can be accessed by anyone, including non-Twitter subscribers. The tweets are also displayed to what are referred to as the followers of the respective user. Followers are other Twitter users who follow a user’s tweets. Twitter also allows you to address a broad audience using hash tags, links or re-tweets.

The company that operates Twitter is Twitter Inc., 1355 Market Street., Suite 900, San Francisco, CA 94103, USA.

The plugins are marked on of our website by the Twitter logo and/or the word “tweet”. These plugins (social media buttons) are disabled by default. Only when you activate them and by doing so declare your consent to communicate with Twitter, do buttons get activated and connect to the servers from Twitter. Only then can you transfer data with a second click. A pop-up window will appear on Twitter where you can still edit your tweet text. A click on one of the Twitter buttons therefore means that you give your consent to the transfer of your data to the social network operator – but only for this one page. The deactivated button reappears when you call up further pages on the “Bundeskunsthalle” website. No complete surfing profiles are created in this way. For more information about Twitter buttons, please refer to: about.twitter.com/de/resources/buttons.

The purpose of embedding the Twitter plugin is to allow our users to redistribute the contents of our website, to promote the contents of our website in the digital world and to increase the number of visitors to our website.

We would like to point out that the “Bundeskunsthalle” receives no information and has no knowledge of how the transmitted data in used. The privacy policies of Twitter that apply are available under: twitter.com/privacy.

We use Video to embed videos.

Vimeo is an Internet video portal that allows video publishers to post video clips free of charge while letting other users view, rate and comment on them. Vimeo allows all types of videos to be published, so that both complete film and television broadcasts, but also music videos, trailers or videos personally made by users can be called up over the Internet portal.

Vimeo is operated by Vimeo, LLC, based in 555 West 18th Street, New York, New York 10011, USA.
When you use a plugin from Vimeo, for instance, by clicking on the start button for a video, a connection to the Vimeo servers is established and which of our internet pages you have visited is transmitted to the servers. If you are signed in as a member of Vimeo at the same time, Vimeo assigns this information to your personal Vimeo user account. You can prevent this by signing out of your Vimeo user account before using our website. You can find further information on data processing and privacy statements from Vimeo under: vimeo.com/privacy.

Occasionally, we also use YouTube as a provider to embed videos.

YouTube ist ein Internet-Videoportal, dass Video-Publishern das kostenlose Einstellen YouTube is an internet video portal that allows video publishers to post video clips free of charge while letting other users view, rate and comment on them for free. YouTube allows all types of videos to be published, so that both complete film and television broadcasts, but also music videos, trailers or videos personally made by users can be called up over the Internet portal.

Betreibergesellschaft von YouTube ist die YouTube, LLC, 901 Cherry Ave., San Bruno,

The company that operates YouTube is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube LLC is a subsidiary of Google Inc. 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA.

When you use a plugin from YouTube, for instance, by clicking on the start button for a video, a connection to the YouTube servers is established and which of our internet pages you have visited is also transmitted to the servers. If you are signed in as a member of YouTube at the same time, YouTube assigns this information to your personal YouTube user account. You can prevent this assignment taking place by logging out of your YouTube user account and other user accounts from YouTube LLC and Google Inc. before using our website and deleting the corresponding cookies from these companies.

The data privacy statements published by YouTube, which can be called up under www.google.de/intl/en/policies/privacy/ provide information on the collection, processing and use of personal data by YouTube and Google.

§ 1 INFORMATION ÜBER DIE ERHEBUNG PERSONENBEZOGENER DATEN

(1) Hiermit informieren wir Sie über die Erhebung personenbezogener Daten bei Nutzung unserer Apps im Google Play Store. Personenbezogene Daten sind alle Daten, die Rückschlüsse auf Ihre Person zulassen, z. B. Name, Adresse, E-Mail-Adresse, Nutzerverhalten.
(2) Betreiber dieser Apps und Verantwortlicher im Sinne des Art. 4 Abs. 7 der EU-Datenschutz-Grundverordnung (im Folgenden: DSGVO) ist:

Kunst- und Ausstellungshalle der Bundesrepublik Deutschland GmbH
Museumsmeile Bonn
Helmut-Kohl-Allee 4
53113 Bonn

Telefon +49 (0) 228 9171-200
Fax +49 (0) 228 234154
Email info@bundeskunsthalle.de

Unsere Datenschutzbeauftragte erreichen Sie unter datenschutz@bundeskunsthalle.de oder unter unserer Postadresse mit dem Zusatz „die Datenschutzbeauftragte“.

(3) Wenn Sie mit uns per E-Mail Kontakt aufnehmen, werden die von Ihnen mitgeteilten Daten (z.B. Ihre E-Mail-Adresse, ggf. Ihr Name und Ihre Telefonnummer) von uns gespeichert, um Ihr Anliegen zu bearbeiten bzw. Ihre Fragen zu beantworten. Die hierbei anfallenden Daten löschen wir, sobald die weitere Speicherung nicht mehr erforderlich ist, oder schränken die Verarbeitung ein, sofern gesetzliche Aufbewahrungspflichten bestehen.

§ 2 ERHEBUNG PERSONENBEZOGENER DATEN BEI DER NUTZUNG DIESER APP

(1) Beim Herunterladen der mobilen App werden die erforderlichen Informationen an den jeweiligen App Store übertragen, also insbesondere Nutzername, E-Mail-Adresse und Kundennummer Ihres Accounts, Zeitpunkt des Downloads, Zahlungsinformationen und die individuelle Gerätekennziffer. Auf diese Datenerhebung haben wir keinen Einfluss und sind nicht dafür verantwortlich.
(2) Diese Apps selbst erheben und verarbeiten darüber hinaus keinerlei personenbezogenen Daten.
(3) Diese Apps nutzen keine Analyse-Tools wie zum Beispiel Google Analytics. Sie können nach der Installation und dem Laden der Inhalte ohne Zugriff auf das Internet verwendet werden.
(4) An einigen Stellen in den Apps verlinken wir auf unsere Webseite. Für den Besuch der verlinkten Seiten ist eine bestehende Internetverbindung erforderlich. Beim Besuch dieser Seiten werden personenbezogene Daten erhoben. Bei der bloß informatorischen Nutzung der Webseite, also wenn Sie sich nicht registrieren oder uns anderweitig Informationen übermitteln, erheben wir automatisch nur diejenigen personenbezogenen Daten, die Ihr Browser an unseren Server übermittelt. Für weitere Informationen beachten Sie bitte die Datenschutzerklärung unserer Webseite.

§ 3 IHRE RECHTE

(1) Sie haben uns gegenüber folgende Rechte hinsichtlich der Sie betreffenden personenbezogenen Daten:
Recht auf Auskunft,
Recht auf Berichtigung oder Löschung,
Recht auf Einschränkung der Verarbeitung,
Recht auf Widerspruch gegen die Verarbeitung,
Recht auf Datenübertragbarkeit.
(2) Sie haben zudem das Recht, sich bei einer Datenschutz-Aufsichtsbehörde über die Verarbeitung Ihrer personenbezogenen Daten in unserem Unternehmen zu beschweren.

For the integration of music we occasionally use the provider Soundcloud The plugin of the social network SoundCloud (SoundCloud Limited, Berners House, 47-48 Berners Street, London W1T 3NF, UK.) can be integrated. You can recognize the SoundCloud plugins by the SoundCloud logo on the affected pages.

When you visit this page, a direct connection between your browser and the SoundCloud server is established after activating the plugin. SoundCloud thereby receives the information that you have visited my site with your IP address. If you click the “Like-Button” or “Share- Button” while logged in to your SoundCloud account, you can link and/or share the content of my pages with your SoundCloud profile. This allows SoundCloud to associate your account with visits to my pages. I would like to point out that I, as the site operator, have no knowledge of the content of the transmitted data and its use by SoundCloud. Further information on this can be found in the SoundCloud privacy policy at https://soundcloud.com/pages/privacy

If you do not want Soundcloud to associate your visit to this site with your SoundCloud account, please log out of your SoundCloud account before activating any content from the SoundCloud plugin.

You have option of being included in our mailing list to receive invitations, information and advertising.

What data do we use and where does it come from?
As a matter of principle, we collect your data directly from you. As a rule, you provide us with this data when placing your order and within the framework of the business relationship. As a part of this, we only collect that data which is necessary for the respective order purpose. The provision of additional information on your part takes places voluntarily.

What do we process your data for (purpose of processing) and on what legal basis?
If you wish to be included in our mailing list for the purpose of receiving information material or we have collected and processed your data in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other legal principles, such as the Telemedia Act (TMG) or the Unfair Competition Act (UWG) in the area of electronic communications for the following purposes:

To safeguard our legitimate interests or those of a third party (Sec. 6 (1) (f) GDPR)

• To provide information about our products and services (advertising or market research and opinion polls)
• For business control measures and to enhance our services and products
• For statistical analyses to develop (marketing) measures

Insofar as you have expressly consented to it, we also use your data to provide sales and marketing information about our products and services, as well as products and services from our partner museums and cooperation partners, which we send to you through electronic channels (e.g. email, telephone, fax, text message, messenger etc.). (Sec. 6 (1) (a) GDPR, Sec. 7 Unfair Competition Act (UWG)). You will find a list of cooperation partners who we have established permanent business relationships with in the current ArtCard Info Brochure and/or under www.bundeskunsthalle.de > “Annual Passes”. In connection with projects (e.g. exhibitions), we may establish new and temporary cooperations with third parties, during the course of which and from whom you will receive sales and marketing information concerning their products and/or services through digital channels. You have option of having a list of these current cooperations sent to you by email.

Who receives personal partner data?
The entity that collects personal data is Kunst und Ausstellungshalle der Bundesrepublik Deutschland GmbH. This entity stores all the data required for providing partner support in its IT systems.
Only those offices inside the “Bundeskunsthalle” receive access to your data that require it to fulfil the aforementioned purposes.
In order to provide our services, we use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders.
Any further data transfer to recipients outside the “Bundeskunsthalle” only takes place if the statutory provisions require or permit it, or if you have given your consent.
Under these conditions, recipients of your data can, for example, be:

• Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies), 
• Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
  –    IT services and consulting companies
  –    IT services
  –    Legal advisory and consulting 
  –    File and data destruction companies
  –    Logistics
  –    Print shops
  –    Telephony and Internet telecommunication service providers
  –    Sales and marketing
  –    Management consultancies and auditors and tax auditors
  –    Direct mail shops
  –    Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)

How long do we store your personal data? We process and store your data for as long as it is required to fulfil the aforementioned purposes. We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties.

Am I obliged to provide my personal data?
To fulfil the aforementioned purposes, you need to provide us with the data required for the purpose of commencing and performing the service we offer. Generally, we will not be able to perform these services without this data.
The provision of further data is voluntary.

Some interested parties receive VIP invitations from us to special events.

What data do we use and where does it come from?
As a matter of principle, we collect your data directly from you. As a rule, you provide us with this data when placing your order and within the framework of our business relationship. As a part of this, we only collect that data which is necessary for the respective order purpose. The provision of additional information on your part takes places voluntarily.

In certain cases, however, we may legitimately obtain data to perform this task.
Your data comes from the following sources here: from our donors, other contract partners or other third parties (e.g. (advertising) agencies, galleries, museums) 

The data we collect and process specifically comprises:

• Master data, such as name, address, place of residence, company name, functional title in a company
• Communications data for establishing and maintaining corporate communications through electronic communications channels, e.g. email address, phone number, mobile phone number
• Voluntary information concerning special service requests
• Information about your consent to advertising, the use of your email address or phone number for advertising purposes
• Customer contact information: in the course of the business start-up phase and during the business relationship, in particular by way of personal, telephone or written contact initiated by you, further data arises, e.g. information about the contact channel, date, occasion and result of the contact; (electronic) copies of correspondence and information about your participation in direct marketing activities.

What do we process your data for (purpose of processing) and on what legal basis?
If you wish to be included in our mailing list for the purpose of receiving information material or we have collected and processed your data in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other legal principles, such as the Telemedia Act (TMG) or the Unfair Competition Act (UWG) in the area of electronic communications for the following purposes: 

To safeguard our legitimate interests or those of a third party (Sec. 6 (1) (f) GDPR)

• To provide information about our products and services (advertising or market research and opinion polls)
• For business control measures and to enhance our services and products
• For statistical analyses to develop (marketing) measures

Insofar as you have expressly consented to it, we also use your data to provide sales and marketing information about our products and services, as well as products and services from our partner museums and cooperation partners, which we send to you through electronic channels (e.g. email, telephone, fax, text message, messenger etc.). (Sec. 6 (1) (a) GDPR, Sec. 7 Unfair Competition Act (UWG)). You will find a list of cooperation partners who we have established permanent business relationships with in the current ArtCard Info Brochure and/or under www.bundeskunsthalle.de > “Annual Passes”. In connection with projects (e.g. exhibitions), we may establish new and temporary cooperation agreements with third parties, during the course of which and from whom you will receive sales and marketing information concerning their products and/or services over digital channels. You have option of having a list of these current cooperations sent to you by email.

Who receives personal partner data?
The entity that collects personal data is Kunst und Ausstellungshalle der Bundesrepublik Deutschland GmbH. This entity stores all the data required for providing partner support in its IT systems.
Only those offices inside the “Bundeskunsthalle” receive access to your data that require it to fulfil the aforementioned purposes.
In order to provide our services, we use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders.
Any further data transfer to recipients outside the “Bundeskunsthalle” only takes place if the statutory provisions require or permit it, or if you have given your consent.
Under these conditions, recipients of your data can be, for example:

• Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies),
• Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
  –    IT services and consulting companies
  –    IT services
  –    (Legal) advisory and consulting 
  –    File and data destruction companies
  –    Logistics
  –    Print shops
  –    Telephony and Internet telecommunication service providers
  –    Sales and marketing
  –    Management consultancies and auditors and tax auditors
  –    Direct mail shops
  –    Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)

How long do we store your personal data? We process and store your data for as long as it is required to fulfil the aforementioned purposes. We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties.

Am I obliged to provide my personal data?
To fulfil the aforementioned purposes, you need to provide us with the data required for the purpose of commencing and performing the service we offer. Generally, we will not be able to perform these services without this data.
The provision of further data is voluntary.

The following information provides you with an overview of how we handle your personal data (hereinafter: Data) and your privacy rights in respect of photographic images, film and sound recordings made during events staged by Kunst- und Ausstellungshalle der Bundesrepublik Deutschland GmbH (Bundeskunsthalle) 
All the following offerings by the “Bundeskunsthalle” in all of its rooms and its grounds (outdoor) with or without individual registration count as events:

• Exhibition openings and events that accompany exhibitions, such as talks, guided tours, performances, hands-on activities and similar;
• Concerts, film screenings, performing arts performances, lounge evenings, parties and similar.
• Art education offerings, such as guided tours, workshops, family celebrations, hands-on activities and similar.

What data do we use and where does it come from?
Within the framework of our events, we take photographs or even make film and sound recordings of the respective event that are created by our own employees and/or involving professional photographers or cameramen. It may occur that you are shown as an accessory on the photographic images or film recordings. In some cases, shots of individuals and/or groups of people are taken. In other cases (e.g. workshops), photo shots, film and/or sound recordings are made as part of the programme on our behalf and/or by the participants themselves for their own use and/or for the following purposes. 

What do we process your data for (purpose of processing) and on what legal basis?
We collect and process your data in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other legal principles, for the following purposes: 

• To safeguard our legitimate interests (Sec 6. (1) (f) GDPR) as well as with your explicit consent in the clear representation of your person (Sec 6. (1) (a) GDPR) for public relations purposes and for presenting the activities of the “Bundeskunsthalle”. This implies a publication in print as well as online media.
• For executing the contract (Sec 6, (1) (b) GDPR) in the implementation of programmes by the “Bundeskunsthalle” (e.g. workshops), which explicitly include photo images and film and/or sound recordings as an integral part. In this context, the purposes of data processing are primarily based on the specific programme contents. Further details on the purposes of the data processing are given in the respective relevant descriptions of the programmes.

Who receives personal partner data?
The collecting entity is regularly a photographer or a cameraman/camerawoman acting on behalf of the “Bundeskunsthalle”. The photo images and the film and sound recordings are stored in the “Bundeskunsthalle” IT systems.
Only those offices inside the “Bundeskunsthalle” receive access to your data that require it to fulfil the aforementioned purposes. These include, for example, the Marketing and Press department.
We use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders. 
Any further data disclosure to recipients outside the “Bundeskunsthalle” only takes place if the statutory provisions require or permit it, or if you have given your consent. 
Under these conditions, recipients of your data can be, for example:

• Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies)
• Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
  –    IT services and consulting companies 
  –    IT services
  –    (Legal) advisory and consulting 
  –    Data destruction
  –    Print shops and graphics houses
  –    Telephony and Internet telecommunication service providers
  –    Sales and marketing
  –    Management consultancies and auditors and tax auditors
  –    Direct mail shops
  –    Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)

How long do you store my personal data?
We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties.
Please note that photographic images and film and sound recordings used for marketing purposes are stored for a long period of time.

Is my data transferred to a third country or international organisation?
We use the photographic images and film and sound recordings for presentation on the “Bundeskunsthalle” social media channels (vimeo.com, youtube.com, instagram.com, facebook.com, twitter.com), where they are available for sharing within the corresponding functions implemented there.
Further data transfer to entities, offices and agencies in countries outside the European Union (so-called third countries) does not take place.

Am I obliged to provide my personal data?
You are not obliged to provide your personal data. This takes place voluntarily. In some cases, you also have to opportunity to remain in the marked zones where no photographic, film and sound recordings are made that are directed at persons. Please take into account that this may restrict your ability to participate in events.

The following information provides you with an overview of how we handle your personal data (hereinafter: Data) and your privacy rights. Which of your data we process specifically depends on the respective business relationship.

Please also pass this information on to persons involved in the implementation of the contractual relationship on your side, such as employees, family members or covenantees. 

What data do we use and where does it come from?

As a matter of principle, we collect your data directly from you. As a rule, you provide us with this data when placing your order and within the framework of the business relationship. As a part of this, we only collect that data which is necessary for the respective contract purpose. The provision of additional information on your part takes places voluntarily.
In certain cases, however, we may receive your information from third parties insofar as it is required within the framework of the business relationship:
Permitted by other companies, museums, co-operation partners (e.g. for undertaking loan requests, request for quotations, fulfilling contracts or on the basis of your consent) 
The data we collect and process specifically comprises:

• Master data such as name, address, place of residence
• Data for invoicing (different billing address, consumption data), bank details for payment processing 
  Contract/performance data (e.g. order, different delivery address)
• Communication data for establishing and maintaining a contractual relationship through electronic communication channels, e.g. email address
• Voluntary information on special service requests
• Data that arises from fulfilling our contractual obligations (e.g. payment transaction data) 
• Contact information: in the course of the business start-up phase and during the business relationship, in particular by way of personal, telephone or written contact initiated by you or third-parties, further data arises, e.g. information about the contact channel, date, occasion and result of the contact; (electronic) copies of correspondence and information about your participation in direct marketing activities.

What do we process your data for (purpose of processing) and on what legal basis?
We collect and process your data in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other legal principles, for the following purposes:

• For the purpose of concluding and performing the contract (Sec. 6 (1) (b) GDPR). In this context, the purposes of data processing are primarily based on the specific product and specific service. Further details of the purposes of data processing result from the relevant respective contract documents and terms and conditions of business/terms of use.
• Insofar as you have expressly consented to it, we also use your data to provide sales and marketing information about our products and services, which we send to you through electronic channels (e.g. email, telephone, fax, text message, messenger etc) (Sec. 6 (1) a GDPR, Sec. 7 Unfair Competition Act (UWG)).
• For fulfilling legal obligations or regulatory requirements. Processing takes place according to the legal regulations, among other things to fulfil regulations concerning commercial law, tax regulations, control and reporting obligations and identity checks) (Sec 6 (1) (c) and (e) GDPR).

Insofar as required, we process your data to safeguard our legitimate interests or those of a third party (Sec. 6 (1) (f) GDPR):

• To provide information about our products and services (advertising or market research and opinion polls)
• To assert legal claims and defend against legal disputes
• To prevent and investigate criminal offences
• To instigate access control measures and safeguard our right to determine who shall be allowed or denied access
• For video surveillance purposes to safeguard our right to determine who shall be allowed or denied access and to gather evidence in the event of robbery and fraud
• To make credit checks before entering into a contractual relationship

Who receives personal partner data?
The entity that collects personal data is Kunst und Ausstellungshalle der Bundesrepublik Deutschland GmbH. This entity stores in its IT systems all the data required for contract fulfilment and for providing partner support. Only those offices inside the “Bundeskunsthalle” receive access to your data that require it to fulfil the aforementioned purposes and, in particular, our contractual obligations.

In order to provide our contractual services, we use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders.

Any further data transfer to recipients outside the “Bundeskunsthalle” only takes place if the statutory provisions require or permit it, or if you have given your consent. 

Under these conditions, recipients of your data can be, for example:

• Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies)
• Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
  –    IT services and consulting companies
  –    IT services
  –    (Legal) advisory and consulting 
  –    File and data destruction companies
  –    Logistics
  –    Print shops
  –    Telephony and Internet telecommunication service providers
  –    Financial institutions, payment transactions
  –    Sales and marketing
  –    Management consultancies and auditors and tax auditors
  –    Document processing companies, factoring companies
  –    Payment card processing (debit cards/credit cards)
  –    Direct mail shops
  –    Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)
  –    Credit bureaus that check creditworthiness for the purpose of performing credit checks, or for obtaining information in the course of the business relationship insofar as the transfer of your data is required.

How long do you store my personal data?
We process and store your data for as long as it is required to fulfil the aforementioned purposes, and, in particular, our contractual and statutory obligations as an employer. We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties, unless its temporary further processing is required for the following purposes:

• Complying with retention periods under commercial and tax law: of particular note here are the German Commercial law book (HGB) and the German Tax Code (AO). The limits for storage and documentation specified by these laws are six to ten years.
• Preservation of evidence within the statutory limitation period. According to Sec. 195 ff of the Germany Civil Code (BGB), these limitation periods can be up to 30 years, while the regular limitation period is three years.

Am I obliged to provide my personal data?
Within the framework of our business relationship, you are obliged to provide us with the data required for entering into a business relationship and perform the related contractual obligations, or the data we are required to collect by law. Generally, we will not be able to conclude or execute the contract without this data.

The provision of further data is voluntary.