Privacy policy

Privacy policy

I.         Name and address of the institution responsible  

The institution responsible for data processing:

JULIA STOSCHEK FOUNDATION
Leipziger Strasse 60
10117 Berlin
Germany

E-Mail: info@julia-stoschek-collection.net
Tel.: +49-211-5858840
Fax +49-211-58588419

(Subsequently referred to as “we
)

II.        Name and address of the data protection officer

A data protection officer has not been appointed.

III.       Preparation of the website and creation of log files

1.        Description and scope of data processing
When someone visits our website data are automatically collected and information from the computer system visiting our site is stored.

This involves the following data:

          the IP address
          the browser type and browser version
          the operating system used
          the referrer URL
          the hostname of the computer accessing the website
          the time when the server request was sent

These data are also stored to our log files. However, these data are not stored together with other personal data.

Our website is hosted on our servers and on our behalf within the EU. We ensure that all data protection requirements are observed and complied with.

2.        The legal basis for data processing
The legal basis for the temporary storage of data in log files is art. 6 para. 1 lit. f) GDPR.

3.        The purpose of data processing
The temporary storage of the IP address is necessary to enable the website to be delivered to the user’s computer. To this end, the user’s IP address must be stored for the duration of the session.

Storage in log files occurs in order to ensure the functionality of the website. The data serve to help us optimize the website and ensure the security of our IT systems. In this context, the data are not evaluated for marketing purposes.

We have a justified interest in data processing for these purposes as per art. 6 para. 1 lit. f) GDPR.

4.        Duration of data storage
The data are deleted once they are no longer required to achieve the purpose of their collection. When data is collected to make a website available this is the case when the respective session is over.

Data stored in log files are deleted at the latest after seven days. Storage for longer than this is possible. However, in this case the users’ IP addresses are deleted or masked so it possible to assign a particular address to the client computer accessing our site.

5.        Right to revoke consent and have data erased
Data collection is absolutely necessary for the delivery of the website and the storage of data in log files is required for the operation of the website. As such users are not able to revoke their consent to data collection.

IV.       Use of cookies

1.        Description and scope of data processing
Our website uses cookies. Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. If a user visits a website, a cookie can be stored on the user’s operating system. This cookie contains a
typical character string that enables a unique identification of the browser when the website is accessed again.
We use cookies to make our website more user-friendly. Some elements of our website require that we identify the browser accessing the site even after a page change.

The following data are stored and transmitted in the cookies:

(1)      Language settings
(2)      Log-in information

We also use cookies on our website to analyze users’ surfing behavior (including targeting). As a result, the following data can be transmitted:

(1)      Search terms inputted
(2)      The frequency with which web pages are called up
(3)      Use of website functions
(4)      Time spent on sub-pages
(5)      Click paths

We use technical precautions to anonymize the user data collected in this way. This means it is no longer possible to assign data to the user accessing the website. Moreover the data are not stored together with other personal data.

When accessing our website users are informed about the use of cookies for analytical purposes and their consent obtained that the personal data collected be processed in this connection. In this context, reference is also made to this privacy policy.

2.        Legal basis for data processing
The legal basis for processing personal data by using the cookies that are technically necessary is art. 6 para. 1 lit. f) GDPR.

Provided the user has given his/her consent, the legal basis for using cookies to process personal data for analytical purposes is art. 6 para. 1 lit. f) GDPR.

3.        Purpose of data processing

The purpose of using the cookies technically necessary is to simplify use of the website for users.
Some functions of our website cannot be offered without the use of cookies. These functions require that the browser in question can be recognized even after a page change.
We need cookies for the following applications:

(1)      Saving language settings
(2)      Automatic login after returning

The user data collected by using the cookies technically necessary are not utilized in order to compile user profiles.

We use analytical and targeting cookies for the purpose of improving the quality of our website and its content. The analytical cookies allow us to see how the website is used and to constantly optimize our content.

This is the basis for our justified interest in processing personal data as per art. 6 para. 1 lit. f) GDPR.

You can also find further information on analytical cookies under item IX below.

4.        Duration of storage, right to revoke consent and insist data be erased
Cookies are stored on the user’s computer and from there transmitted to our page. For this reason, you as the user have full control over the use of cookies. You can deactivate or restrict the transmission of cookies by changing the settings in your Internet browser. Cookies that have already been stored can be deleted at any time. This can also be done automatically.
If cookies are deactivated for our website, it may no longer be possible to use all the website’s functions in full.

V.        Newsletter / information mailing list

1.         Description and scope of the data processing
On our website it is possible to subscribe to a newsletter and/or be included on a mailing list for press releases; both services are free of charge. When users register for the newsletter or to be included on the mailing list we collect data from the input mask (email address, name and other data).

In addition, the following data are collected during registration:

(1)       IP address of the computer accessing the website
(2)       Date and time of registration

As part of the registration procedure we request your consent to the data being processed and refer you to this privacy policy.

2.         Legal basis for data processing

Providing the user has given their consent to the data collected during registration for the newsletter/information mailing list being processed, the legal basis for this is art. 6, para. 1, lit. a) GDPR.

3.         Purpose of data processing
The user’s email address is collected in order to be able to deliver the newsletter/press releases.

4.         Duration of storage
The data will be blocked once they are no longer needed in order to achieve the purpose for which they were originally collected. This means the user’s email address is stored as long as the subscription to the newsletter/press releases is active. Storage of the blocked data serves merely to ensure that no further newsletters/press releases are sent.

5.         Right to revoke consent and have data erased
Users can cancel their subscription to the newsletter/press releases at any time. Every newsletter/press release email contains an “unsubscribe” link. This also amounts to a revocation of the user’s consent to allow personal data to be stored that is collected during the registration procedure.

VI.      Press login

1.         Description and scope of the data processing
Users of our website have the option to register in the press section by providing their personal data.

For every registered representative of the press we create a customer account that provides them with password-protected access to our special press releases. Users remain registered until they log off. This allows members of the press to use our press section without needing to log on again every time.

2.         Legal basis for the data processing
Data processing in connection with such registrations serves to fulfil a contract (whereby the user is the contracting party) or to implement pre-contractual measures. The legal basis for processing the data is art. 6 para. 1 lit. b GDPR.

3.         Purpose of data processing
Data are collected and processed solely for the purpose of making information available to the press.

4.         Duration of storage
The data are deleted once they are no longer needed to fulfil the contract and the retention periods stipulated under fiscal and/or commercial law have expired. This can amount to up to ten years.

5.         Right to revoke consent and have data erased
Needless to say, as a user you are entitled to revoke your registration at any time. However, we will then no longer be able to offer you access to the press login. You can have the personal data we store on you altered at any time.

VII.    Registration for guided tours

1.         Description and scope of data processing
On our website we offer users the option of registering for guided tours of our art gallery. This includes their providing personal information.

2.         Legal basis for the data processing
Data processing in connection with such registrations serves to fulfil a contract (whereby the user is the contracting party) or to implement pre-contractual measures. The legal basis for processing the data is art. 6 para. 1 lit. b GDPR.

3.         Purpose of data processing
Data are collected and processed solely for the purpose of conducting the guided tour.

4.         Duration of storage
The data are deleted once they are no longer needed to fulfil the contract and the retention periods stipulated under fiscal and/or commercial law have expired. This can amount to up to ten years. However, in the event of accidents in connection with a guided tour it can take up to 30 years.

5.         Right to revoke consent and have data erased
As a user you can at any time inform us that you wish to cancel your registration, but we will then no longer be able to grant you access to the guided tour.

VIII.   Email contact

1.         Description and scope of data processing
Visitors to the site can contact us via the email address provided. In this case all of the user’s personal data that are transmitted with the email will be stored.

This data will not be passed on to third parties.

2.         Legal basis for data processing
The legal basis for processing data that are conveyed during the transmission of an email is art. 6 para. 1 lit. f GDPR. If the aim of the email is to conclude a contract, then the additional legal basis for data processing is art. 6 para. 1 lit. b GDPR.

3.         Purpose of data processing
Data are used exclusively for the processing of the correspondence.

4.         Duration of storage
The data are deleted once they are no longer necessary to achieve the purpose of their collection. For the personal data transmitted email this is the case when the correspondence with the user is ended. The correspondence can be considered over when it can be deduced that the matter in hand has been sufficiently clarified.

5.         Right to revoke consent and have data erased
If the user contacts us by email they can revoke their consent to the storage of their personal data at any time. In this event the correspondence cannot be continued.

In order to perform the revocation the user can reach us via the contact data given under I. Revocation performed by phone requires an ID be sent to guarantee the identity of the person revoking consent.

In this event all personal data stored in connection with the email correspondence will be deleted.

IX.      Analysis

We use the Google Analytics of Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA; “Google”) web analysis services on our website. The purpose of such data processing is to analyze this website and its users. Specifically, on behalf of the operator of this website Google uses the information gained to analyze your use of the website in order to prepare reports for the website operator about website activities and provide additional services connected with the use of the website and Internet. Google does not combine the IP address transmitted by your browser with other data.

Google Analytics uses cookies to help analyze how the website is used. Generally, the information generated by the cookies without the use of this website are transmitted to a Google server in the United States and stored there. The website uses IP anonymization. Specifically, Google shortens your IP address in advance within EU member states or in other states party to the Agreement of the European Economic Area. Only in exceptional cases is the full IP address conveyed to a Google server in the United States and shortened there. Your data may also be transmitted to the United States. The transmission of data to the United States is covered by an adequacy decision of the European Commission. The legal basis for data processing is art. 6 (1) lit. f GDPR which arises from the justified interest in a user-friendly and meaningful design of the website.

For reasons relating to your special situation you are entitled at any time to revoke the processing of data relating to your person based on art. 6 (1) f GDPR.

In order to do this you can alter the settings of your browser software to prevent the storage of cookies; however, we would point out that this may result in you no longer being able to use all the functions of this website fully. In addition, you can prevent the collection of the data by Google generated by the cookie on your use of the website (including your IP address) and the processing of this data by Google, by downloading and installing the browser plug-in available via the following link [https://tools.google.com/dlpage/gaoptout?hl=de]. In order to prevent data collection by Google Analytics on all your devices you can set an opt-out cookie. Opt-out cookies prevent the future collection of your data on visiting this website. For this to function properly you have to conduct the opt-out on all the systems and devices that you use. You can set the opt-out cookie by clicking here: Deactivate Google Analytics.

For further information on terms of use and data protection please click https://www.google.com/analytics/terms/de.html or https://www.google.de/intl/de/policies/.

X.        Rights of the user

If personal data of yours (the user) is processed, for the purposes of the GDPR you are considered the impacted person and have the following rights vis-à-vis us (the controller):

1.         Right to be informed
You can demand confirmation from us whether personal data impacting on you was processed by us.

If this is the case, you can demand information from us about the following:

(1)       The purposes for which the personal data was processed;
(2)       The categories of personal data that were processed;
(3)       The recipients or categories of recipients to whom the personal data impacting on you was or will be revealed;
(4)       The planned duration of storage of the personal data impacting on you; if specific information on this is not available then the criteria for determining the duration of storage;
(5)       The existence of your right to have personal data impacting on you rectified or deleted, your rights to limit processing by us, as well as the right to revoke your consent to processing;
(6)       The right to complain to a supervisory authority;
(7)       All available information about the origin of the data, if the personal data was not collected from the person impacted;
(8)       The existence of automated decision-making including profiling pursuant with art. 22 para. 1 and 4 GDPR and – at least in these cases – extensive information on the logic involved as well as the implications and desired impact of such processing for the impacted person.

You are entitled to demand information on whether the personal data impacting you will be forwarded to a third-party country or an international organization. Furthermore, you can demand to be informed about the guarantees in place as per art. 46 GDPR.

2.         Right to have information rectified
You have a right to demand of the controller that in the event of the personal data impacting you being incorrect or incomplete this data be rectified immediately.

3.         Right to restrict processing
You can demand the processing of the personal data impacting on you is restricted under the following circumstances:

(1)       If you contest the accuracy of the personal data impacting you for a period of time that then enables the controller to check the accuracy of that data;
(2)       The processing is unlawful and you reject the personal data be deleted, and instead demand that use of the personal data be restricted;
(3)       The controller no longer needs the personal data for the purposes of processing, but you do need them for the assertion, exercise, or defense of legal claims, or
(4)       If you have entered an objection against their processing pursuant to art. 21 para. 1 GDPR and it has not yet been determined whether the justifiable grounds of the controller outweigh your reasons.

If the processing of the personal data impacting on you was restricted, these data may be stored only and only be processed with your consent or for the establishment, exercise, or defense of legal claims, or to protect the rights of another natural persons or legal entities, or for reasons of important public interest of the EU or a member state.

If the limitation of data processing was restricted owing to the conditions mentioned above you will be informed by the controller before this limitation is cancelled.

4.         Right to erasure (‘right to be forgotten’)

a)         Obligation to erase data
You can demand that the personal data impacting on you is deleted immediately, and we are obliged to delete these data immediately, provided one of the following reasons applies:
-
(1)       The personal data impacting on you are no longer necessary for the purposes for which they were collected or otherwise processed.
(2)       You revoke your consent in which the processing pursuant to art. 6 para. 1 lit. a or art. 9 para. 2 lit. a GDPR was based, and no other legal basis exists for their processing.
(3)       Pursuant to art. 21 para. 1 GDPR you file an objection against the processing, and there are no imperative justified reasons for the processing, or you object to the processing as per art. 21 para. 2 GDPR.
(4)       The personal data impacting on you were illegally processed.
(5)       The erasure of the personal data impacting on you is necessary for the fulfilment of a legal obligation according to EU legislation or the legislation of the member states to which the controller is subject.
(6)       The personal data impacting on you was collected in relation to services offered by the information company pursuant to art. 8 para. 1 GDPR.

b)        Information forwarded to third parties
If we have made personal data impacting on you public and if we are obliged as per art. 17 para. 1 GDPR to delete that data then taking into consideration the available technology and implementation costs we undertake suitable measures, also of a technical nature to inform those persons responsible for processing the personal data that you have demanded the erasure of all links to this personal data and copies or replications of this personal data.
 
c)         Exceptions
There is no such right to erasure if the processing is necessary

(1)       to exercise the right to freedom of expression and information;
(2)       to fulfil a legal obligation, which requires the processing in order to comply with EU legislation or the legislation of the member states, to which the controller is subject, or for the performance of the task, which is in the public interest or in the exercise of official authority, which was made over to the controller;
(3)       for reasons of public interest in the field of public health pursuant to art. 9 para. 2 lit. h and i as well as art. 9 para. 3 GDPR;
(4)       for archiving purposes in the public interest, scientific or historical research purposes, or for statistical purposes pursuant with art. 89 para. 1 or GDPR, as far as the legislation mentioned under section a) is likely to make impossible or seriously restrict the realization of these goals, or
(5)       to assert, exercise, or defend legal claims.

5.         Right to be informed
If you have exercised your right to rectification, erasure or restriction of the processing then the controller is obliged to inform all the recipients to whom the personal data impacting you was revealed about this rectification or erasure of data or the restricted processing of the data, unless this proves to be impossible or would involve a disproportionate effort.

You are entitled to be informed about the recipients in question.

6.         Right to data portability
You are entitled to receive the personal data impacting on you which you have made available to us in a standard, structured, and machine-readable format. In addition, you have the right to transfer these data to another responsible person without our interference, providing

(1)       there is a legal basis for the processing under the terms of art. 6 para. 1 lit. a GDPR or art. 9 para. 2 lit. a GDPR or a contract as per art. 6 para. 1 lit. b GDPR and
(2)       the processing is conducted through an automated procedure.

In exercising this right you also have the right to get us to have the personal data reflecting you directly forwarded to another responsible person as far as this is technically feasible. This may not impair the freedom and rights of other persons.

The right to data portability does not apply for processing of personal data that is necessary to perform a task which is in the public interest or occurs in the exercise of official authority that had been transferred to the controller.

7.         Right of objection
You have the right for reasons arising out of your special situation to file an objection at any time against the processing of the personal data impacting you which is collected as per art. 6 para. 1 lit. e or f GDPR; this also applies to profiling that has the same legal basis.

We will no longer process the personal data impacting you, unless there are demonstrably compelling grounds necessitating the processing which override the interests, rights and freedoms of the persons concerned, or the processing serves the purpose of asserting, exercising, or defending legal claims.

If the personal data impacting you are processed for the purposes of direct advertising, you have the right at any time to lodge a complaint against the processing of the personal data impacting you for the purpose of such advertising; this also applies to profiling in as far as it is connected with such direct advertising.

If you object to the processing of your data for the purposes of direct advertising then the data will no longer be processed for these purposes.
You have the option in connection with the use of services provided by the information for – irrespective of the directive 2002/58/EC – to exercise your rights to object using an automated procedure in which technical specifications are employed.

8.         Right to revoke the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. Your revocation of this consent will not affect the legality of the processing conducted on the basis of your prior consent.

9.         Right to lodge a complaint with a supervisory authority
Without prejudice to another administrative or judicial procedure you are entitled to lodge a complaint with a supervisory authority, in particular in the member state in which you normally reside, or place of work or the location of the presumed infringement, if you are of the opinion that the processing of the personal data impacting you contravenes the GDPR.

The supervisory authority to whom the complaint is submitted informs the person lodging the complaint about the status and outcome of the complaint including the possibility of judicial procedure under the terms of art. 78 GDPR.


[Status: May 2018]