Data Privacy

The protection of your privacy is of the utmost importance to us. Furthermore, it is important to us for you to always know when we store data and how we use it.

The information below informs you about the pages on our website where we receive information from you during your visit and how we process it.

As a matter of principle, you can use the Kunst- und Ausstellungshalle der Bundesrepublik Deutschland GmbH ("Bundeskunsthalle") website without providing any personal data about yourself. If it is necessary to process personal data and no legal basis exists for doing do, we generally seek the consent of the data subject.

Data Controller

Who is responsible for data processing and who can I contact?
Kunst- und Ausstellungshalle der Bundesrepublik Deutschland GmbH
Our data protection officer can be reached at the address specified in the Legal Notice and under the following email address: datenschutz@bundeskunsthalle.de

Purpose and Scope of Data Processing when visiting our Website

How do we process personal data when you visit our website?
Every time a user accesses a page on our website and retrieves a file, access data about this process is stored in a log file on our server.

Ever record is comprised of:

  • The name of the file
  • The date and time of the request (time stamp)
  • The volume of data transferred
  • The access status (file transfer, file not found etc.)
  • The website where the request came from (referrer URL)
  • The sub-pages accessed on our website via an accessing system
  • The operating system used by the accessing system
  • The Internet service provider for the accessing system
  • A description of the type of web browser used; e.g. Mozilla Firefox, Google Chrome or Microsoft Internet Explorer, Apple Safari, Opera etc.)
  • An internet protocol address (IP address)

We store IP addresses in server log files for a period of seven days.
Storage takes place for data security reasons, in order to guarantee the stability and operational security of our Internet presence.
The legal basis for this is formed by Sec 6. (1) (f) GDPR.
As a matter of principle, we do not share your data with third parties unless you have consented to this. In certain areas, however, (e.g. hosting our website), we rely on the use of service providers who we usually place under obligation by way of a data processing commission agreement to ensure compliance with the legal requirements.

Collection of additional data over the website

Contact Options over the Website

When you use the contact form, we only collect your personal data (name, email address, message text) to the extent you provide it to us. Data processing serves for the purpose of establishing contact. Processing takes place in accordance with Sec. 6 (1) (f) GDPR.
We only use your email address to process your enquiry. You data is deleted as soon as it is no longer required for the purpose it was collected. This is usually the case once it can be inferred from the circumstances that the matter in question has been clarified.

Newsletter

On our website, you can subscribe to newsletters containing general and specific information if you have expressly consented to do so. Processing takes place in accordance with Sec. 6 (1) (a) GDPR with your consent. 
On subscribing to the newsletter, the data from the input mask is transmitted to us here. Indicating an email address is sufficient to receive our newsletter.
Your consent is provided within the scope of what is known as the "double opt-in" procedure. The confirmation email address you provide serves to verify whether the owner of the address as the data subject has authorised the receipt of the newsletter. The IP address of the computer accessing the website and the date and time of registration are also logged in order to document your consent.
The option is available to you to revoke your consent at any time with effect for the future and unsubscribe from our newsletter, for example, by using the opt-out option provided in the newsletter.

Your data will be disclosed to a service provider for email marketing purposes here within the scope of a data processing commission agreement. Disclosure to any other third parties does not take place.

Newsletter Tracking

Each "Bundeskunsthalle" newsletter contains what are known as tracking pixels or web bugs. A tracking pixel is a miniature graphic that is embedded into emails sent in HTML format to facilitate the recording and analysis of log files. Based on the embedded pixel, the "Bundeskunsthalle" can determine whether and when a data subject opened an email and which links he accessed in the email. This is solely for the purpose of statistically evaluating the success or failure of the newsletter.

The data controller stores and evaluates the personal data collected using tracking pixels in the newsletters to optimise the delivery of the newsletter and better adapt the contents of future newsletters to the interests of the data subject. This personal data is not disclosed to third parties. Data subjects are entitled to revoke the declaration of consent they provided through the double-opt-in procedure at any time. Following revocation, the data controller deletes this personal data. The "Bundeskunsthalle" automatically interprets a data subject unsubscribing from receiving the newsletter as a revocation of consent.

Orders and Bookings

We offer you the chance to order our annual tickets (ArtCard) and book guided tours/workshops directly on our website.

What data do we use and where does it come from?
As a matter of principle, we collect your data directly from you. As a rule, you provide us with this data when placing your order and within the framework of the business relationship. As a part of this, we only collect that data which is necessary for the respective contract purpose. The provision of additional information on your part takes places voluntarily.

What do we process your data for (purpose of processing) and on what legal basis?
We collect and process your data for the following purposes in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG), as well as all other pertinent laws (e.g. Unfair Competition Act (UWG), German Art Copyright Act (KUG), etc.):

  • For the purpose of concluding and performing the contract (Sec. 6 (1) (b) GDPR). In this context, the purposes of data processing are primarily based on the specific product and service. Further details of the purposes of data processing result from the relevant respective contract documents and terms and conditions of business/terms of use.
  • If you choose to purchase an annual pass from us, we collect and use your portrait photo for identification purposes.
  • Insofar as you have expressly consented to it, we also use your data to provide sales and marketing information about our products and services, as well as products and services from our partner museums and cooperation partners, which we send to you through electronic channels (e.g. email, telephone, fax, text message, messenger etc.). (Sec. 6 (1) (a) GDPR, Sec. 7 Unfair Competition Act (UWG)). You will find a list of cooperation partners we have established permanent business relationships with in the current ArtCard Info Brochure and/or under www.bundeskunsthalle.de > "Annual Passes". In connection with projects (e.g. exhibitions), we may establish new and temporary cooperation agreements with third parties, during the course of which and from whom you will receive sales and marketing information over digital channels concerning their products and/or services. You have option of having a list of these current cooperations sent to you by email.
  • For fulfilling legal obligations or regulatory requirements. Processing takes place according to the legal regulations, among other things, to fulfil regulations concerning commercial law, tax regulations, control and reporting obligations and identity checks. (Sec. 6 (1) (c) and (e) GDPR)

Insofar as required, we process your data to safeguard our legitimate interests or those of a third party (Sec. 6 (1) (f) GDPR):

  • To provide information about our products and services (advertising or market research and opinion polls)
  • To assert legal claims and defend against legal disputes
  • To prevent and investigate criminal offences
  • To instigate access control measures and safeguard our right to determine who shall be allowed or denied access
  • For video surveillance purposes to safeguard our right to determine who shall be allowed or denied access and to gather evidence in the event of robbery and fraud
  • To make credit checks before entering into a contractual relationship

Who receives personal partner data?
The entity that collects personal data is Kunst und Ausstellungshalle der Bundesrepublik Deutschland GmbH. This entity stores in its IT systems all the data required for contract fulfilment and for providing partner support.
Only those offices inside the "Bundeskunsthalle" receive access to your data that require it to fulfil the aforementioned purposes and, in particular, our contractual obligations.
In order to provide our contractual services, we use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders.
Any further data transfer to recipients outside the "Kunst und Ausstellungshalle" only takes place if the statutory provisions require or permit it, or if you have given your consent.
Under these conditions, recipients of your data can, for example be:

  • Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies),
  • Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
    -    IT services and consulting companies
    -    IT services
    -    (Legal) advisory and consulting 
    -    File and data destruction companies
    -    Logistics
    -    Print shops
    -    Telephony and Internet telecommunication service providers
    -    Financial institutions, payment transactions 
    -    Sales and marketing
    -    Management consultancies and auditors and tax auditors
    -    Document processing companies, factoring companies
    -    Payment card processing (debit cards/credit cards)
    -    Direct mail shops
    -    Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)
    - Credit bureaus that check creditworthiness for the purpose of performing credit checks, or for obtaining information in the course of the business relationship insofar as the transfer of your data is required.

How long do you store my personal data?
We process and store your data for as long as it is required to fulfil the aforementioned purposes, and, in particular, our contractual and statutory obligations as an employer. We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties, unless its temporary further processing is required for the following purposes:

  • Complying with retention periods under commercial and tax law: Of particular note here are the German Commercial Code (HGB) and the German Tax Code (AO). The deadlines for storage and documentation specified by these laws are six to ten years.
  • Preservation of evidence within the statutory limitation period. According to Sec. 195 ff Germany Civil Code (BGB), these limitation periods can be up to 30 years, while the regular limitation period is three years.

Am I obliged to provide my personal data?
Within the framework of our business relationship, you are obliged to provide us with the data required for entering into a business relationship and perform the related contractual obligations, or provide the data we are required to collect by law. Generally, we will not be able to conclude or execute the contract without this data.

The provision of further data is voluntary.

 

 

Contact per Email

If you contact us by email, we will only use your personal data (name, email address, message text) to contact you. Processing takes place in accordance with Sec. 6 (1) (f) GDPR. We only use your email address to process your enquiry. You data is deleted as soon as it is no longer required for the purpose it was collected. This is usually the case once it can be inferred from the circumstances that the matter in question has been clarified.

Comment Function in the Bundeskunsthalle Magazine

On its website, the "Bundeskunsthalle" offers its online magazine where visitors have the opportunity to leave personal comments about individual contributions. Within the framework of our Terms of Use, information on the time the comment was made and the username (pseudonym) chosen by the data subject is stored and published in addition to the comments left behind when commenting on an article or contribution. Furthermore, the data subject's IP address assigned by the Internet service provider (ISP) is also logged. The IP address is stored for security reasons and in the event that the data subject violates the rights of third parties or posts unlawful contents by submitting a comment. Processing serves the purpose of allowing comments to be made and displaying comments based on Sec 6. (1) (f) GDPR. 
Under our Terms of Use, your personal data is deleted as soon as it is no longer required for the purpose it was collected.

Competitions

Within the scope of competitions, data is collected in order to process the competition. The details of this, such as which data is collected and for which purpose, can be found on the respective competition page.

Cookies

The "Bundeskunsthalle" website uses cookies. Cookies are text files that are deposited and stored on a computer system over an Internet browser.

Numerous websites and servers use cookies. Many cookies contain what is known as a cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a character string which allows web pages and servers to be assigned to the specific Internet browser in which the cookie was stored. This allows the websites and servers visited to distinguish the individual's browser from other Internet browsers that contain other cookies. The unique cookie ID can be used to recognise and identify a particular Internet browser.

By using cookies, the "Bundeskunsthalle" can provide its website users with more user-friendly services which would not be possible without setting the cookie. As already mentioned, cookies allow us recognise our website users. The purpose of this is to facilitate their use of our website. For example, the user of a website that uses cookies does not have to re-enter their credentials every time they visit the website, because the website and the cookie stored on the user's computer system does this for them.

The data subject can prevent cookies being set through our website at any time by make a corresponding setting in the respective Internet browser, thus permanently rejecting cookies being set. The user can also delete cookies at any time that have already been set through an internet browser or other software programs. This is possible in all standard Internet browsers. However, it may not be possible to use all the functions of our website in full if the data subject deactivates cookies being the set in the Internet browser used.

Matomo for Web Analysis (Formerly Piwik)

We have embedded the Matomo plugin into the "Bundeskunsthalle" website. Matomo is an open-source software tool for web analysis. Web analysis involves the recording, collection and analysis of data concerning the behaviour of website visitors. One of the jobs a web analysis tool performs is to collect data about which website a data subject came from (referrer website), which sub-pages on the website he accessed and how often, and the length of time a sub-page was viewed. Web analysis is mainly used to optimise a website and perform cost-benefit analysis in relation to Internet advertising.

The software is operated on the data controller's server and log files sensitive to privacy are stored exclusively on this server.

The purpose of the Matomo plugin is to analyse visitor flows on our website. We use the data and information obtained, among other things, to evaluate the use of our website in order to compile online reports showing the activities on our web pages.

Matomo sets a cookie on the user's IT system. What cookies are, has already been explained above. Setting the cookie allows us to analyse the use of our website. Each time an individual page on this website is called up, the Matomo plugin automatically causes the Internet browser on the data subject's IT system to transmit data to our server for online analysis purposes. In the course of this technical process, we gain knowledge of personal data, such as the data subject's IP address, which, among other things, serves to help us understand where visitors originate from and their clicks.

The cookie stores personal information, such as access time, the location from where access was made and the frequency of visits to our website. Each time a data subject visits our website, this personal information, including the IP address for the Internet connection used by the data subject, is transmitted to our server. We store this personal data. We do not disclose this personal data to third parties.

The data subject can prevent cookies being set through our website at any time as described above by making a corresponding setting in the respective Internet browser and thus permanently rejecting cookies being set. Making this setting in the Internet browser used also prevents Matomo from setting a cookie on the data subject's IT system. The data subject can also delete at any time a cookie that Matomo has already set over an Internet browser or other software programs.

Furthermore, the data subject can object to the data generated by Matomo relating to the use of this website being collected and also prevent its collection. To do so, the data subject needs to set an opt-out cookie. The data subject will need to set the opt-out cookie again if his IT system is deleted, formatted or reinstalled at a later date.

Setting the opt-out cookie may result in the data subject no longer being able to use the data controller's website in full.

Further information and the currently valid Matomo privacy policy can be viewed under: matomo.org/privacy/.

Shariff

We have embedded the Shariff plugin into the "Bundeskunsthalle" magazine web pages. The Shariff plugin provides social media buttons that are privacy compliant. Shariff was developed for the German computer magazine c't and is published by GitHub, Inc.

Developer of the component is GitHub, Inc. 88 Colin P. Kelly Junior Street, San Francisco, CA 94107, USA.

Usually, the button solutions provided by social networks already transfer personal data to the respective social network when a user visits a website on which a social media button is embedded. The Shariff plugin allows personal data to only be transmitted to social networks when the website visitor actively enables one of the social media buttons. Further information on the Shariff component is available from c't computer magazine under www.heise.de/newsticker/meldung/Datenschutz-und-Social-Media-Der-c-t-Shariff-ist-im-Einsatz-2470103.html (In German only). The purpose of using the Shariff plugin is to protect our website visitors' personal data while allowing us to embed a button solution for social networks on our website at the same time.

Further information and the currently valid GitHub privacy policy can be viewed under help.github.com/articles/github-privacy-policy/.

Facebook

We have embedded plugins from Facebook on the "Bundeskunsthalle" website. Facebook is a social network. A social network is an Internet-based social meeting place, an online community that usually allows users to communicate with one another and interact in virtual space. A social network can serve as a platform for sharing views and experiences and also allows the Internet community to provide personal or business information. Facebook allows social network users to create private profiles, upload photos and socialise using friend requests.

The company that operates Facebook is Facebook, Inc., 1 Hacker way, Menlo Park, CA 94025, USA. The entity responsible for processing personal data if a data subject lives outside the USA or Canada is Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.

As part of our website, the plugins are identified by the Facebook logo and/or the addition "Like" or "Share”. You can find an overview of Facebook plugins here: developers.facebook.com/docs/plugins/

These plugins (social media buttons) are disabled by default. Only when you activate them and by doing so declare your consent to communicating with Facebook, are buttons activated and connect to the servers from Facebook. Only then can you transfer data with a second click. If you are already signed into Facebook, this takes place without another window opening. A click on one of the Facebook buttons therefore means that you give your consent to the transfer of your data to the social network operator – but only for this one page. The deactivated button reappears when you call up further pages on the "Bundeskunsthalle" website. No complete surfing profiles are created in this way.

Please refer to the privacy policy of Facebook for information on the further processing and use of your data by Facebook, as well as your rights in this regard, and settings options for protecting your privacy: https://www.facebook.com/privacy/explanation

The purpose of embedding the Facebook plugin is to allow our users to redistribute the contents of our website, to promote the contents of our website in the digital world and to increase the number of visitors to our website. 

Fan Page on Facebook

The "Bundeskunsthalle" runs a fan page on the "Facebook" social network (operated by: Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland).

Since, in terms of data protection law, running the fan page represents a joint responsibility (Sec. 26 GDPR) between Facebook Ireland Ltd. and our company, an agreement has been reached with Facebook Ireland Ltd., which you can view under the following link: https://www.facebook.com/legal/terms/page_controller_addendum.

If you use Facebook products, such as our fan page, Facebook collects and uses the information described in its "Data Policy" under "What kinds of information do we collect?".

The Facebook "Data Policy" is available online under: https://www.facebook.com/about/privacy/update

Information about the cookies Facebook uses can be found in the Facebook Cookie Policy: https://www.facebook.com/policies/cookies/

Facebook supplies fan page operators with statistics and insights for their fan pages that help them understand the types of actions that people take on their pages (Page Insights).

The "Bundeskunsthalle" has no influence over the fact that Facebook collects these statistics and insights. According to Facebook, Page Insights are designed to show important trends without revealing details about you that could identify you.

According to Facebook, fan page operators may be able to associate "Like" info for the fan page if you like their fan page and have set your "Like" info for pages to "Public".

Information used for Page Insights

Viewing a page or post or video from a page

  • Subscribing to a page or cancelling a subscription
  • Flagging a page or posting with a "Like" or "Dislike"
  • Recommending a page in a post or comment
  • Commenting on, sharing or responding to a post on a page (including the type of response)
  • Hiding a post on a page or reporting it as spam
  • Clicking on a link from another page on Facebook or from a website outside of Facebook that takes the user to the page
  • Moving the mouse over the name or the profile picture on a page to preview the page content
  • Clicking on the web page, phone number or "Plan Route" button or another button on a page
  • Information about whether you are logged in to a computer or a mobile device while visiting a page or interacting with it or its content

Responsibility for your personal data that is used to create Page Insights

Page Insights provided for a page may require personal data to be processed which is subject to protection under the European General Data Protection Regulation (GDPR). The GDPR applies to processing this data, if you, for instance, live in an area where Facebook Ireland provides Facebook products. In this case, Facebook Ireland and the "Bundeskunsthalle" may share responsibility for your personal data that is collected in connection with a visit or interaction with a page (including its contents) as long as the data is being processed for Page Insights. In this event, the following applies to processing you data under joint responsibility:

  • Facebook Ireland and the "Bundeskunsthalle" have reached an agreement in which their respective obligations are governed by the GDPR. www.facebook.com/legal/terms/page_controller_addendum.
  • Facebook Ireland and the "Bundeskunsthalle" have reached an agreement that Facebook is primarily responsible for providing you with information about joint processing and making it possible for you to exercise your rights under the GDPR. According to the GDPR, you are entitled to information about, the correction of, the transfer of and the deletion of your data and to object to its processing and to restrict its processing. You can find out more about these rights in your Facebook Settings
  • Facebook Ireland and the “Bundeskunsthalle” have agreed that the Irish Data Protection Commission should be the authority that oversees the supervision of processing under joint responsibility. You have the right to file a complaint with the Irish Data Protection Commission (see www.dataprotection.ie) or submit a complaint to your local supervisory authority.

This data protection information is based on the text provided by Facebook Ireland.

 

 

Twitter

We have embedded plugins from the Twitter on the "Bundeskunsthalle" website. Twitter is a multilingual micro-blogging service that is available to the public where users can post and distribute what are referred to as tweets, or short messages, which are limited to 280 characters. These short messages can be accessed by anyone, including non-Twitter subscribers. The tweets are also displayed to what are referred to as the followers of the respective user. Followers are other Twitter users who follow a user's tweets. Twitter also allows you to address a broad audience using hash tags, links or re-tweets.

The company that operates Twitter is Twitter Inc., 1355 Market Street., Suite 900, San Francisco, CA 94103, USA.

The plugins are marked on of our website by the Twitter logo and/or the word "tweet". These plugins (social media buttons) are disabled by default. Only when you activate them and by doing so declare your consent to communicate with Twitter, do buttons get activated and connect to the servers from Twitter. Only then can you transfer data with a second click. A pop-up window will appear on Twitter where you can still edit your tweet text. A click on one of the Twitter buttons therefore means that you give your consent to the transfer of your data to the social network operator – but only for this one page. The deactivated button reappears when you call up further pages on the "Bundeskunsthalle" website. No complete surfing profiles are created in this way. For more information about Twitter buttons, please refer to: about.twitter.com/de/resources/buttons.

The purpose of embedding the Twitter plugin is to allow our users to redistribute the contents of our website, to promote the contents of our website in the digital world and to increase the number of visitors to our website.

We would like to point out that the "Bundeskunsthalle" receives no information and has no knowledge of how the transmitted data in used. The privacy policies of Twitter that apply are available under: twitter.com/privacy.

Vimeo

We use Video to embed videos.

Vimeo is an Internet video portal that allows video publishers to post video clips free of charge while letting other users view, rate and comment on them. Vimeo allows all types of videos to be published, so that both complete film and television broadcasts, but also music videos, trailers or videos personally made by users can be called up over the Internet portal.

Vimeo is operated by Vimeo, LLC, based in 555 West 18th Street, New York, New York 10011, USA.
When you use a plugin from Vimeo, for instance, by clicking on the start button for a video, a connection to the Vimeo servers is established and which of our internet pages you have visited is transmitted to the servers. If you are signed in as a member of Vimeo at the same time, Vimeo assigns this information to your personal Vimeo user account. You can prevent this by signing out of your Vimeo user account before using our website. You can find further information on data processing and privacy statements from Vimeo under: vimeo.com/privacy.

YouTube

Occasionally, we also use YouTube as a provider to embed videos.

YouTube is an internet video portal that allows video publishers to post video clips free of charge while letting other users view, rate and comment on them for free. YouTube allows all types of videos to be published, so that both complete film and television broadcasts, but also music videos, trailers or videos personally made by users can be called up over the Internet portal.

The company that operates YouTube is YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube LLC is a subsidiary of Google Inc. 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA.

When you use a plugin from YouTube, for instance, by clicking on the start button for a video, a connection to the YouTube servers is established and which of our internet pages you have visited is also transmitted to the servers. If you are signed in as a member of YouTube at the same time, YouTube assigns this information to your personal YouTube user account. You can prevent this assignment taking place by logging out of your YouTube user account and other user accounts from YouTube LLC and Google Inc. before using our website and deleting the corresponding cookies from these companies.

The data privacy statements published by YouTube, which can be called up under www.google.de/intl/en/policies/privacy/ provide information on the collection, processing and use of personal data by YouTube and Google.

Further Data Processing by the Bundeskunsthalle

Receipt of Information and Advertising

You have option of being included in our mailing list to receive invitations, information and advertising.

What data do we use and where does it come from?
As a matter of principle, we collect your data directly from you. As a rule, you provide us with this data when placing your order and within the framework of the business relationship. As a part of this, we only collect that data which is necessary for the respective order purpose. The provision of additional information on your part takes places voluntarily.

What do we process your data for (purpose of processing) and on what legal basis?
If you wish to be included in our mailing list for the purpose of receiving information material or we have collected and processed your data in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other legal principles, such as the Telemedia Act (TMG) or the Unfair Competition Act (UWG) in the area of electronic communications for the following purposes:

To safeguard our legitimate interests or those of a third party (Sec. 6 (1) (f) GDPR)

  • To provide information about our products and services (advertising or market research and opinion polls)
  • For business control measures and to enhance our services and products
  • For statistical analyses to develop (marketing) measures

Insofar as you have expressly consented to it, we also use your data to provide sales and marketing information about our products and services, as well as products and services from our partner museums and cooperation partners, which we send to you through electronic channels (e.g. email, telephone, fax, text message, messenger etc.). (Sec. 6 (1) (a) GDPR, Sec. 7 Unfair Competition Act (UWG)). You will find a list of cooperation partners who we have established permanent business relationships with in the current ArtCard Info Brochure and/or under www.bundeskunsthalle.de > "Annual Passes". In connection with projects (e.g. exhibitions), we may establish new and temporary cooperations with third parties, during the course of which and from whom you will receive sales and marketing information concerning their products and/or services through digital channels. You have option of having a list of these current cooperations sent to you by email.

Who receives personal partner data?
The entity that collects personal data is Kunst und Ausstellungshalle der Bundesrepublik Deutschland GmbH. This entity stores all the data required for providing partner support in its IT systems.
Only those offices inside the "Bundeskunsthalle" receive access to your data that require it to fulfil the aforementioned purposes.
In order to provide our services, we use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders.
Any further data transfer to recipients outside the "Bundeskunsthalle" only takes place if the statutory provisions require or permit it, or if you have given your consent.
Under these conditions, recipients of your data can, for example, be:

  • Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies),
  • Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
    -    IT services and consulting companies
    -    IT services
    -    Legal advisory and consulting 
    -    File and data destruction companies
    -    Logistics
    -    Print shops
    -    Telephony and Internet telecommunication service providers
    -    Sales and marketing
    -    Management consultancies and auditors and tax auditors
    -    Direct mail shops
    -    Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)

How long do we store your personal data? We process and store your data for as long as it is required to fulfil the aforementioned purposes. We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties.

Am I obliged to provide my personal data?
To fulfil the aforementioned purposes, you need to provide us with the data required for the purpose of commencing and performing the service we offer. Generally, we will not be able to perform these services without this data.
The provision of further data is voluntary.

Receipt of VIP Invitations

Some interested parties receive VIP invitations from us to special events.

What data do we use and where does it come from?
As a matter of principle, we collect your data directly from you. As a rule, you provide us with this data when placing your order and within the framework of our business relationship. As a part of this, we only collect that data which is necessary for the respective order purpose. The provision of additional information on your part takes places voluntarily.

In certain cases, however, we may legitimately obtain data to perform this task.
Your data comes from the following sources here: from our donors, other contract partners or other third parties (e.g. (advertising) agencies, galleries, museums)

The data we collect and process specifically comprises:

  • Master data, such as name, address, place of residence, company name, functional title in a company
  • Communications data for establishing and maintaining corporate communications through electronic communications channels, e.g. email address, phone number, mobile phone number
  • Voluntary information concerning special service requests
  • Information about your consent to advertising, the use of your email address or phone number for advertising purposes
  • Customer contact information: in the course of the business start-up phase and during the business relationship, in particular by way of personal, telephone or written contact initiated by you, further data arises, e.g. information about the contact channel, date, occasion and result of the contact; (electronic) copies of correspondence and information about your participation in direct marketing activities.

What do we process your data for (purpose of processing) and on what legal basis?
If you wish to be included in our mailing list for the purpose of receiving information material or we have collected and processed your data in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other legal principles, such as the Telemedia Act (TMG) or the Unfair Competition Act (UWG) in the area of electronic communications for the following purposes:

To safeguard our legitimate interests or those of a third party (Sec. 6 (1) (f) GDPR)

  • To provide information about our products and services (advertising or market research and opinion polls)
  • For business control measures and to enhance our services and products
  • For statistical analyses to develop (marketing) measures

Insofar as you have expressly consented to it, we also use your data to provide sales and marketing information about our products and services, as well as products and services from our partner museums and cooperation partners, which we send to you through electronic channels (e.g. email, telephone, fax, text message, messenger etc.). (Sec. 6 (1) (a) GDPR, Sec. 7 Unfair Competition Act (UWG)). You will find a list of cooperation partners who we have established permanent business relationships with in the current ArtCard Info Brochure and/or under www.bundeskunsthalle.de > "Annual Passes". In connection with projects (e.g. exhibitions), we may establish new and temporary cooperation agreements with third parties, during the course of which and from whom you will receive sales and marketing information concerning their products and/or services over digital channels. You have option of having a list of these current cooperations sent to you by email.

Who receives personal partner data?
The entity that collects personal data is Kunst und Ausstellungshalle der Bundesrepublik Deutschland GmbH. This entity stores all the data required for providing partner support in its IT systems.
Only those offices inside the "Bundeskunsthalle" receive access to your data that require it to fulfil the aforementioned purposes.
In order to provide our services, we use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders.
Any further data transfer to recipients outside the "Bundeskunsthalle" only takes place if the statutory provisions require or permit it, or if you have given your consent.
Under these conditions, recipients of your data can be, for example:

  • Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies),
  • Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
    -    IT services and consulting companies
    -    IT services
    -    (Legal) advisory and consulting 
    -    File and data destruction companies
    -    Logistics
    -    Print shops
    -    Telephony and Internet telecommunication service providers
    -    Sales and marketing
    -    Management consultancies and auditors and tax auditors
    -    Direct mail shops
    -    Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)

How long do we store your personal data? We process and store your data for as long as it is required to fulfil the aforementioned purposes. We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties.

Am I obliged to provide my personal data?
To fulfil the aforementioned purposes, you need to provide us with the data required for the purpose of commencing and performing the service we offer. Generally, we will not be able to perform these services without this data.
The provision of further data is voluntary.

Photographic Images, Film and Sound Recordings

The following information provides you with an overview of how we handle your personal data (hereinafter: Data) and your privacy rights in respect of photographic images, film and sound recordings made during events staged by Kunst- und Ausstellungshalle der Bundesrepublik Deutschland GmbH (Bundeskunsthalle)
All the following offerings by the "Bundeskunsthalle" in all of its rooms and its grounds (outdoor) with or without individual registration count as events:

  • Exhibition openings and events that accompany exhibitions, such as talks, guided tours, performances, hands-on activities and similar;
  • Concerts, film screenings, performing arts performances, lounge evenings, parties and similar.
  • Art education offerings, such as guided tours, workshops, family celebrations, hands-on activities and similar.

What data do we use and where does it come from?
Within the framework of our events, we take photographs or even make film and sound recordings of the respective event that are created by our own employees and/or involving professional photographers or cameramen. It may occur that you are shown as an accessory on the photographic images or film recordings. In some cases, shots of individuals and/or groups of people are taken. In other cases (e.g. workshops), photo shots, film and/or sound recordings are made as part of the programme on our behalf and/or by the participants themselves for their own use and/or for the following purposes.

What do we process your data for (purpose of processing) and on what legal basis?
We collect and process your data in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other legal principles, for the following purposes:

  • To safeguard our legitimate interests (Sec 6. (1) (f) GDPR) as well as with your explicit consent in the clear representation of your person (Sec 6. (1) (a) GDPR) for public relations purposes and for presenting the activities of the "Bundeskunsthalle". This implies a publication in print as well as online media.
  • For executing the contract (Sec 6, (1) (b) GDPR) in the implementation of programmes by the "Bundeskunsthalle" (e.g. workshops), which explicitly include photo images and film and/or sound recordings as an integral part. In this context, the purposes of data processing are primarily based on the specific programme contents. Further details on the purposes of the data processing are given in the respective relevant descriptions of the programmes.

Who receives personal partner data?
The collecting entity is regularly a photographer or a cameraman/camerawoman acting on behalf of the "Bundeskunsthalle". The photo images and the film and sound recordings are stored in the "Bundeskunsthalle" IT systems.
Only those offices inside the "Bundeskunsthalle" receive access to your data that require it to fulfil the aforementioned purposes. These include, for example, the Marketing and Press department.
We use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders.
Any further data disclosure to recipients outside the "Bundeskunsthalle" only takes place if the statutory provisions require or permit it, or if you have given your consent.
Under these conditions, recipients of your data can be, for example:

  • Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies)
  • Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
    -    IT services and consulting companies 
    -    IT services
    -    (Legal) advisory and consulting 
    -    Data destruction
    -    Print shops and graphics houses
    -    Telephony and Internet telecommunication service providers
    -    Sales and marketing
    -    Management consultancies and auditors and tax auditors
    -    Direct mail shops
    -    Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)

How long do you store my personal data?
We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties.
Please note that photographic images and film and sound recordings used for marketing purposes are stored for a long period of time.

Is my data transferred to a third country or international organisation?
We use the photographic images and film and sound recordings for presentation on the "Bundeskunsthalle" social media channels (vimeo.com, youtube.com, instagram.com, facebook.com, twitter.com), where they are available for sharing within the corresponding functions implemented there.
Further data transfer to entities, offices and agencies in countries outside the European Union (so-called third countries) does not take place.

Am I obliged to provide my personal data?
You are not obliged to provide your personal data. This takes place voluntarily. In some cases, you also have to opportunity to remain in the marked zones where no photographic, film and sound recordings are made that are directed at persons. Please take into account that this may restrict your ability to participate in events.

Bundeskunsthalle Contract Partners

The following information provides you with an overview of how we handle your personal data (hereinafter: Data) and your privacy rights. Which of your data we process specifically depends on the respective business relationship.

Please also pass this information on to persons involved in the implementation of the contractual relationship on your side, such as employees, family members or covenantees.

What data do we use and where does it come from?

As a matter of principle, we collect your data directly from you. As a rule, you provide us with this data when placing your order and within the framework of the business relationship. As a part of this, we only collect that data which is necessary for the respective contract purpose. The provision of additional information on your part takes places voluntarily.
In certain cases, however, we may receive your information from third parties insofar as it is required within the framework of the business relationship:
Permitted by other companies, museums, co-operation partners (e.g. for undertaking loan requests, request for quotations, fulfilling contracts or on the basis of your consent)
The data we collect and process specifically comprises:

  • Master data such as name, address, place of residence
  • Data for invoicing (different billing address, consumption data), bank details for payment processing 
    Contract/performance data (e.g. order, different delivery address)
  • Communication data for establishing and maintaining a contractual relationship through electronic communication channels, e.g. email address
  • Voluntary information on special service requests
  • Data that arises from fulfilling our contractual obligations (e.g. payment transaction data)
  • Contact information: in the course of the business start-up phase and during the business relationship, in particular by way of personal, telephone or written contact initiated by you or third-parties, further data arises, e.g. information about the contact channel, date, occasion and result of the contact; (electronic) copies of correspondence and information about your participation in direct marketing activities.

What do we process your data for (purpose of processing) and on what legal basis?
We collect and process your data in accordance with the statutory provisions, specifically, the EU General Data Protection Regulation (GDPR), the Federal Data Protection Act (BDSG) and other legal principles, for the following purposes:

  • For the purpose of concluding and performing the contract (Sec. 6 (1) (b) GDPR). In this context, the purposes of data processing are primarily based on the specific product and specific service. Further details of the purposes of data processing result from the relevant respective contract documents and terms and conditions of business/terms of use.
  • Insofar as you have expressly consented to it, we also use your data to provide sales and marketing information about our products and services, which we send to you through electronic channels (e.g. email, telephone, fax, text message, messenger etc) (Sec. 6 (1) a GDPR, Sec. 7 Unfair Competition Act (UWG)).
  • For fulfilling legal obligations or regulatory requirements. Processing takes place according to the legal regulations, among other things to fulfil regulations concerning commercial law, tax regulations, control and reporting obligations and identity checks) (Sec 6 (1) (c) and (e) GDPR).

Insofar as required, we process your data to safeguard our legitimate interests or those of a third party (Sec. 6 (1) (f) GDPR):

  • To provide information about our products and services (advertising or market research and opinion polls)
  • To assert legal claims and defend against legal disputes
  • To prevent and investigate criminal offences
  • To instigate access control measures and safeguard our right to determine who shall be allowed or denied access
  • For video surveillance purposes to safeguard our right to determine who shall be allowed or denied access and to gather evidence in the event of robbery and fraud
  • To make credit checks before entering into a contractual relationship

Who receives personal partner data?
The entity that collects personal data is Kunst und Ausstellungshalle der Bundesrepublik Deutschland GmbH. This entity stores in its IT systems all the data required for contract fulfilment and for providing partner support. Only those offices inside the "Bundeskunsthalle" receive access to your data that require it to fulfil the aforementioned purposes and, in particular, our contractual obligations.

In order to provide our contractual services, we use selected service providers (data processing companies) and vicarious agents in the categories listed below that may obtain access to your data to the extent required and use it to fulfil our orders.

Any further data transfer to recipients outside the "Bundeskunsthalle" only takes place if the statutory provisions require or permit it, or if you have given your consent.

Under these conditions, recipients of your data can be, for example:

  • Public authorities and institutions when a legal or regulatory obligation exists (e.g. law enforcement agencies)
  • Other companies and service providers (commissioned data processing companies)/vicarious agents in the following areas:
    -    IT services and consulting companies
    -    IT services
    -    (Legal) advisory and consulting 
    -    File and data destruction companies
    -    Logistics
    -    Print shops
    -    Telephony and Internet telecommunication service providers
    -    Financial institutions, payment transactions
    -    Sales and marketing
    -    Management consultancies and auditors and tax auditors
    -    Document processing companies, factoring companies
    -    Payment card processing (debit cards/credit cards)
    -    Direct mail shops
    -    Internet service providers for website management and social media services (Internet provider, web design, newsletter mailing)
    -    Credit bureaus that check creditworthiness for the purpose of performing credit checks, or for obtaining information in the course of the business relationship insofar as the transfer of your data is required.

How long do you store my personal data?
We process and store your data for as long as it is required to fulfil the aforementioned purposes, and, in particular, our contractual and statutory obligations as an employer. We delete your data on a regular basis if it is no longer required to fulfil these purposes and our duties, unless its temporary further processing is required for the following purposes:

  • Complying with retention periods under commercial and tax law: of particular note here are the German Commercial law book (HGB) and the German Tax Code (AO). The limits for storage and documentation specified by these laws are six to ten years.
  • Preservation of evidence within the statutory limitation period. According to Sec. 195 ff of the Germany Civil Code (BGB), these limitation periods can be up to 30 years, while the regular limitation period is three years.

Am I obliged to provide my personal data?
Within the framework of our business relationship, you are obliged to provide us with the data required for entering into a business relationship and perform the related contractual obligations, or the data we are required to collect by law. Generally, we will not be able to conclude or execute the contract without this data.

The provision of further data is voluntary.

Basic Information under Sec 13/14 GDPR

What data protection rights exist?
Each data subject has the right to information pursuant to Sec. 15 GDPR, the right to correction pursuant to Sec. 16 GDPR, the right to cancellation pursuant to Sec. 17 GDPR, the right to restrict processing pursuant to Sec. 18 GDPR, the right to object pursuant to Sec. 21 GDPR and the right to data transfer pursuant to Sec. 20 GDPR, insofar as no legal provisions preclude this (in particular pursuant to Sec. 15, 17 GDPR, Sec. 34 and 35 Federal Data Protection Act (BDSG)).

If you believe that your personal data is being processed unlawfully, you may refer your complaint to a supervisory authority responsible for data protection (Sec. 77 GDPR in conjunction with Sec. 19 Federal Data Protection Act (BDSG)).

Is my data transferred to a third country or international organisation?
Data transfer to entities, offices and agencies in countries outside the European Union (so-called third countries) does not take place.

To what extent does automated decision-making or profiling take place?
As a matter of principle, we do not use fully automated decision-making or profiling pursuant to Sec. 22 GDPR. If we use these procedures in individual cases, we will inform you about this separately if so required by law.

Information about your right to object pursuant to Sec. 21 GDPR
Right to object in individual cases
For reasons arising from your particular situation, you are entitled at any time to object to data on your person being processed, which takes place based on Sec. 6 (1) (f) GDPR (data processing based on a balance of interests).

How up to date is this Privacy Policy?
This Privacy Policy is currently valid and was last updated in 07/2018.

Show bibliography

Kunst- und Ausstellungshalle der Bundesrepublik Deutschland

Museumsmeile Bonn
Helmut-Kohl-Allee 4
53113 Bonn
T +49 228 9171–200

Opening hours

Mondays closed
Tuesdays and Wednesdays, 10 a.m.–9 p.m.
Thursdays–Sundays, 10 a.m.–7 p.m.
(including public holidays even those which fall on Mondays)

Gefördert durch