Privacy Policy

When you use the website and its functionalities, contact us or submit an enquiry, you provide us with personal data that we process for the purpose of dealing with your enquiry. In this data protection notice, we would like to inform you about the processing of personal data when you use the website.

I. The controller within the meaning of the data protection laws is

Bavarian State Office for the Preservation of Monuments

Landesstelle für die nichtstaatlichen Museen in Bayern
Hofgraben 4
80539 Munich
Postal address: Postfach 10 02 03
80076 Munich
Telephone: 0892114-275
Fax no.: 089 2114-403

II. data protection officer

If you have any questions about the processing of your personal data by us, please contact our data protection officer in writing or by e-mail:

Bavarian State Office for the Preservation of Monuments

Landesstelle für die nichtstaatlichen Museen in Bayern (State Office for the Non-State Museums in Bavaria)

For the attention of the Data Protection Officer

P.O. Box 10 02 03
80076 Munich

III General information on data processing by us

Scope of the processing of personal data in general

In principle, we only process personal data via our website insofar as this is necessary to provide a functional website and to fulfil our public tasks.
As part of our data protection information, we inform you in accordance with Art. 12, 13 GDPR about the processing of personal data when you visit our website and when you interact with us via this website.

Legal basis

As the Landesstelle für die nichtstaatlichen Museen in Bayern (State Office for the Non-State Museums in Bavaria), providing a website with up-to-date information on the Bavarian museum world is part of our educational mandate under public law. The legal basis for all processing is, unless other legal bases are mentioned in detail below, Art. 6 para. 1 lit. e) GDPR, Art. 4 para. 1 BayDSG in conjunction with Art. 12 para. 2 sentence 1 no. 7 BayDSchG.

If we require your consent for processing, this consent will be requested directly before the start of processing/collection of the personal data. The legal basis for this is Art. 6 para. 1 lit. a) GDPR. Consent can be revoked at any time with effect for the future.

IV Automatic data processing when accessing the website

Personal data is processed as soon as you access the website. This happens automatically without you having to take any further action.

These automated processing operations concern

Processing of the IP address

1. description and scope of data processing
When you access this page, requests are sent to the server, which it must answer. For this purpose, your IP address must be collected and processed in order to be able to answer the corresponding server requests.

2. legal basis for data processing
The legal basis for the processing of this data is Art. 6 para. 1 lit. e) GDPR, Art. 4 para. 1 BayDSG in conjunction with Art. 12 para. 2 sentence 1 no. 7 BayDSchG.

3. purpose of data processing
The purpose of processing your IP address is the functionality of the website and the provision of the technical retrieval option.

4. duration of storage
The data will be deleted as soon as further storage is no longer necessary due to the fulfilment of the purpose.

When data is collected to provide the website, this is the case when the retrieval process has ended.

5. recipients of personal data
The IP address is processed by the following hosting provider on the basis of an order processing agreement in accordance with Art. 28 para. 2 - para. 4 GDPR:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Processing in the context of hosting

1. description and scope of data processing
We use the services of our hosting service provider for the technical realisation of the website and its retrievability as well as its technical maintenance.

This includes the provision of storage and database services as well as their maintenance and care.

3. purpose of data processing
The purpose of the processing is the realisation of the online offer as well as the provision of data of the website in order to be able to make all functionalities available for retrieval at any time.

4. recipients of personal data and data categories:
The following hosting provider acts on our behalf on the basis of an order processing agreement pursuant to Art. 28 para. 2 - para. 4 GDPR:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Data categories affected are:

User data/ IP address
Communication data
Contact data

Processing of server log files

1. description and scope of data processing
The IP addresses collected when this website is accessed are also stored in so-called server log files in order to detect and rectify technical faults and/or attempts to manipulate or break into the server structure.

In addition, the hosting provider of this website automatically processes information in so-called server log files, which are automatically transmitted by your browser.

This information is
- IP address
- the date and time of access to our website
- time zone difference to Greenwich Mean Time (GMT)
- access status (HTTP status)
- the amount of data transferred
- the Internet service provider of the accessing browserthe Internet service provider of the accessing system
- the browser type and version you are using
- the operating system you are using
- the website from which you may have reached our website
- the pages or sub-pages you have visited on our website subpages that you visit on our website.
However, this information is not merged with other data sources.

3. purpose of data processing
The purpose of processing your IP address and the above information is to detect malfunctions and intrusion attempts. It also ensures that the website can be displayed correctly on the various mobile devices.

4. duration of storage
The data will be deleted within 7 days.

5. recipients of personal data
The IP address and the above-mentioned information are processed by the following hosting provider on the basis of an order processing agreement in accordance with Art. 28 para. 2 - para. 4 GDPR:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

Use of first party cookies

1. description and scope of data processing
This website uses so-called "cookies". Cookies are text files that are stored in the memory and/or on a data carrier of your terminal device used to visit the site and that are processed by your Internet browser in accordance with the settings stored there.

We use cookies with purely technical content in order to technically realise the use of the website. These cookies have the following content:

Typo3 is our content management system and forms the technical basis of this website. Typo3 sets the following cookie to determine that a registered user is still on our website when logging in and using the internal area:

fe_typo_user

Our Consent Manager must process the selection you have made. Our Consent Manager uses the following cookie for this purpose:

cookie_consent

2. legal basis for data processing
If the user has given consent, the legal basis for data processing is Art. 6 para. 1 lit. a), Art. 7 GDPR and § 25 para. 1 TDDDG.

Otherwise, the legal basis for data processing is Art. 6 para. 1 lit. e) GDPR, Art. 4 para. 1 BayDSG in conjunction with Art. 12 para. 2 sentence 1 no. 7 BayDSchG and § 25 para. 2 TDDDG.

3. purpose of data processing
These cookies contain technical information for the provision of website functionalities in the context of use. This enables the technical realisation of the website.

4. duration of storage as well as objection and removal options
The cookies used on this site are so-called "session cookies". These are automatically deleted from your computer's browser cache/memory at the end of your visit to the website and/or when you close your browser, provided you have activated this functionality in your browser.
If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website to their full extent.

You can use the following setting options to manage your personal cookie options at any time and change or revoke your selection with effect for the future.

The settings management for the individual cookies or functionalities can be found at the bottom of this page.

V. Processing of personal data via the contact form of the regional office and the museum portal

1. description and scope of data processing
You will find contact forms on our websites that can be used to contact us electronically. We process your personal data in order to respond to your enquiry.

The following data is processed for enquiries via the contact form:

First name and surname*
Museum/institution
E-mail address*
Subject
Your message*

The fields marked with an "*" symbol are mandatory fields, without the completion of which no enquiry can be sent to us via the contact forms.

Simply entering the data in the forms does not transmit any data to us. After entering your data, you can click on the "Check details" button and you will be taken to an overview page of your data. No data will be transmitted to us during this process either. Only when you click on the " Send" button on the overview page will data transmission be initiated.

The following data is also processed when the message is sent

Date and time of the enquiry

2. legal basis for data processing
The legal basis for the processing of personal data for processing and answering your enquiries is Art. 6 para. 1 lit. e) GDPR, Art. 4 para. 1 BayDSG in conjunction with Art. 12 para. 2 sentence 1 no. 7 BayDSchG.

3. purpose of data processing
The processing of personal data via the contact form serves the sole purpose of establishing contact and enabling users to be contacted for information purposes (answering the enquiry).

4. duration of storage
The data will be deleted after it is no longer required for the purpose for which it was collected or is not subject to any further statutory retention obligations. For your data entered in the contact form, this is the case when the respective conversation with the user has ended.

The conversation is ended when it is clear from the circumstances that the matter in question has been conclusively clarified and there are no further retention obligations/rights.

5. recipients of personal data
Enquiries via the contact form are processed by the following hosting provider on behalf of the following hosting provider on the basis of an order processing agreement pursuant to Art. 28 para. 2 - para. 4 GDPR:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

IT service provider for administrative access

VI Processing of personal data via the "Registration Museum Practice" form of the regional office

1. description and scope of data processing
There is a form on our website that you can use to register for events and seminars as part of the Museumspraxis seminar series.

The following data is processed for enquiries via the registration form:

Title
First name*
Surname*
Museum/institution*
Street, house number*
Postcode/city*
Telephone*
E-mail address*
Comments/special requirements

The fields marked with an "*" symbol are mandatory fields, without which no enquiry can be sent to us via this registration form.

Simply entering the data in the forms does not transmit any data to us. After entering your data, you can click on the "Send" buttonand your registration will be sent to us.

The following data is also processed when the message is sent:

Date and time of the enquiry

3. purpose of data processing
The processing of personal data via the form serves the sole purpose of processing registrations and coordinating events. In addition, questions about the event or registration can be answered via the contact form.

4. duration of storage
The data will be deleted within 6 months after they are no longer required to fulfil the purpose for which they were collected or are not subject to any further statutory retention obligations. For your data entered in the registration form, this is the case when the respective event has been held.

5. recipients of personal data
Enquiries via the registration form are processed by the following hosting provider on the basis of an order processing agreement in accordance with Art. 28 para. 2 - para. 4 GDPR:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

IT service provider for administrative access

VII Processing of personal data in the context of registration by e-mail to create a museum profile on the museum portal

1. description and scope of data processing
Museums and exhibition centres are given the opportunity to create a museum profile, present or manage exhibitions and participate in object exchanges via the internal area of the website.

Registration by e-mail is required to use these services.

The following data is processed as part of the registration process:

- Self-selected user name*
- Self-selected password*
- Museum/institution*
- Surname, first name contact person*
- Address museum
- City museum*
- Telephone museum
- E-mail museum*

Please only enter a telephone number if you wish to be contacted by telephone.

2. legal basis for data processing
The legal basis for the processing of personal data in the context of registration is Art. 6 para. 1 lit. e) GDPR, Art. 4 para. 1 BayDSG in conjunction with Art. 12 para. 2 sentence 1 no. 7 BayDSchG.

3. purpose of data processing
The processing of personal data as part of the registration process serves to manage access authorisations and the security of the internal area. The provision of a portal for museums fulfils our duty of care under Art. 12 para. 2 sentence 1 no. 7 BayDSchG, as it provides non-state museums with an opportunity to manage and present their own museum. This serves to promote and develop the museum landscape in Bavaria.

4. duration of storage
The data you entered during registration will be deleted if you request us to delete your access authorisations. You can also delete your profile via a function in the internal area.

5. recipients of personal data
The data transmitted by you during registration will be processed by our hosting provider on the basis of an order processing agreement in accordance with Art. 28 para. 2 - para. 4 GDPR:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

IT service provider for administrative access

VIII Processing of personal data in the internal area - Dashboard of the museum portal

1. description and scope of data processing
The "Internal Area - Dashboard" function provides registered users with the opportunity to manage their own museum and to post special exhibitions.

We process the following data when you register for the internal area:

- Time of registration
- Login data used

Administration of museums, exhibitions and events

In this area, registered users can enter or change details about the museum as well as create/edit events and exhibitions.

- Description of the museum
- Address details of the museum
- Opening hours
- Facilities and accessibility
- Contact details
- Cover picture, image data (image file, copyright notice, photographer)

- Digital offers
- Create exhibition with description of the exhibition and images used

2. legal basis for data processing
The legal basis for the processing of personal data for the provision of the login and as part of the registration process is Art. 6 para. 1 lit. e) GDPR, Art. 4 para. 1 BayDSG in conjunction with Art. 12 para. 2 sentence 1 no. 7 BayDSchG.

3. purpose of data processing
The processing of personal data via the internal area serves to manage access authorisations and the security of the internal area. The provision of a portal for museums fulfils our duty of care under Art. 12 para. 2 sentence 1 no. 7 BayDSchG, as it provides non-state museums with an opportunity to manage and present their own museum. This serves to promote and develop the museum landscape in Bavaria.

4. duration of storage
The entries you have made will only be deleted when you either delete this data yourself or request deletion from the State Office.
The log files for the log-in to the internal area are deleted after 7 days.

5. recipients of personal data
The data entered by you as well as the registration data (time) are processed by our hosting provider on the basis of an order processing agreement in accordance with Art. 28 para. 2 - para. 4 GDPR:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

IT service provider for administrative access

IX Processing of personal data when you make general contact via e-mail and for special topics for registrations for events/events, the job exchange, the exchange for objects and museum equipment, the press distribution list and information, for consulting topics

1. description and scope of data processing
In the case of enquiries by email, personal data is processed depending on the content of your email.

This is always your e-mail address, date and time and the content of the message. Depending on the content of your email, the following personal data may also be processed:

First name, surname of the contact person
Telephone number

The data is used to process the conversation and/or your enquiry and/or to carry out our official tasks.

2. legal basis for data processing
In the case of enquiries via email, the legal basis for processing the data is Art. 6 para. 1 lit. e) GDPR, Art. 4 para. 1 BayDSG in conjunction with Art. 12 para. 2 sentence 1 no. 7 BayDSchG. Responding to enquiries submitted to the regional office is part of our duty of care for local history museums and other non-governmental collections.

3. purpose of data processing
Non-state museums and those interested in our services are given the opportunity to make enquiries about our services and/or to receive information and answers to questions and concerns by email. This is part of our duty of care for non-governmental museums.

4. duration of storage
The data will be deleted once it is no longer required to fulfil the purpose for which it was collected or is not subject to any further statutory retention obligations. For your e-mail, this is the case when the respective conversation with the user has ended. The conversation has ended when it is clear from the circumstances that the matter in question has been conclusively clarified and there are no further retention obligations/rights.

X. Processing of personal data of project and cooperation partners, service providers and when handing over business cards

1. description and scope of data processing
We process personal data of the contact persons and employees involved when contacting us, communicating by email, providing business cards or carrying out project and cooperation work as well as a business relationship. In most cases, this involves the contact details of the internal contact persons provided to us.

This data is processed in our contact database.

This data can be
Surname, first name
Company
E-mail address
Telephone number, mobile number
Position in the museum or company

2. legal basis for data processing
The legal basis for the processing of personal data for processing is Art. 6 para. 1 lit. e) GDPR, Art. 4 para. 1 BayDSG in conjunction with Art. 12 para. 2 sentence 1 no. 7 BayDSchG.

3. purpose of data processing
This data is processed exclusively for the purpose for which the data was provided to us (by handing over the business card, by naming the responsible contact person, etc.).

5. recipients of personal data
The data provided to us for the purpose of establishing contact will not be passed on.

XI Newsletter on topics of the regional office and the museum portal

1. description and scope of data processing
We offer you various newsletters with current information and topics relating to the world of museums. Topics for museums may include: financial funding lines, current conferences or changes to the legal framework. For those interested in the museum world, we offer selected topics on the latest highlights and insider tips for the best experiences, art, culture and history in Bavaria's museums and exhibitions.

The registration for our newsletter services uses the double opt-in procedure to verify your registration.

You register with your e-mail address via the newsletter form and, after clicking the registration button, you will receive an e-mail with a link that you can click to confirm and complete the newsletter registration process. If you click on this confirmation link, you will receive newsletters at regular intervals in the form of the email with the specific content described when you registered for the newsletter. You can revoke your consent at any time with effect for the future by clicking on the unsubscribe link contained in each newsletter.

Alternatively, you can also unsubscribe via the website

under Insert links (link Museum world) (link Highlights and insider tips)

to unsubscribe from our newsletters.

We log every subscription to our newsletter so that we can provide proof of the relevant subscription in accordance with legal requirements.

The time of subscription and confirmation as well as your IP address are stored.

At the same time, your data is also logged and stored by our dispatch service provider.

2. legal basis for data processing
The legal basis for the processing of your personal data for sending the newsletter is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

The legal basis for the processing and logging of the registration procedure is Art. 6 para. 1 lit. e) GDPR, Art. 4 para. 1 BayDSG in conjunction with Art. 12 para. 2 sentence 1 no. 7 BayDSchG

3. purpose of data processing
The sole purpose of data processing is to send our newsletter and to document your registration in a legally secure manner, as well as to fulfil our public tasks in order to be able to send you current information about the museum world on your initiative.

4. duration of storage
The data you provide when registering for the newsletter will be deleted by us no later than 6 months after you unsubscribe from the newsletter.

5. recipients of personal data
Our newsletter is realised by the mailing service provider CleverReach.
CleverReach GmbH & Co KG, Mühlenstr. 43, 26180 Rastede, Germany

Our mailing service provider acts on our behalf and on the basis of an order processing agreement in accordance with Art. 28 para. 2 - 4 GDPR.

Our mailing service provider will not use your data to write to you itself or use the data for its own purposes.

XII. Web analysis - Matomo

1. description and scope of data processing

We use the web analysis tool Matomo. Matomo is operated locally on our servers in a configuration without the use of cookies and with an anonymised IP address. Matomo enables us to obtain an overview of the use of this website.

The following data is processed:

Anonymised IP address
Browser information
Date and time of the visit
Device information
Files clicked on or downloaded
Geographical location
Clicked links to external domains
Number of visits
Page title
Referrer URL
Screen resolution
Time of the user's first visit
Time of the user's previous visit
Time zone
Usage data
User agent
User ID
Page URL

2. legal basis

The legal basis for the processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR.

3. purpose of the data processing

The purpose of data processing is to analyse the user actions taking place on our website in order to improve the services we provide. The data processing is carried out in order to design our website in line with requirements. The web analysis service is used exclusively to record and analyse the use of our website and to improve our services.

4. duration of storage
The data is deleted within 24 hours, unless it is statistical cross-sectional data. We continue to use purely anonymised data without personal reference.

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

XIII YouTube

1. description and scope of data processing

We have integrated videos that are hosted on the video platform "YouTube". We use the "extended privacy" configuration. Nevertheless, due to the technical design of the Internet, it is necessary for YouTube to receive your IP address when you access a video in order to send the video data to the device you are using to access it. This also applies to a preview image of a video.

The technical platform and services of YouTube are operated by Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland.

The contact details of the data protection officer and other relevant data protection information from Google can be found in the data protection information at https://policies.google.com/privacy (external link, opens in a new window) and the form at https://support.google.com/policies/contact/general_privacy_form (external link, opens in a new window).

2 Legal basis

The legal basis for the processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1 TDDDG as well as Art. 49 para. 1 sentence 1 a) GDPR.

3 Purpose of the data processing

The purpose of the processing is to display videos for information and visualisation of content.

4. duration of storage

Detailed information on the storage period can be found in Google's privacy policy: https://policies.google.com/privacy?hl=de (external link, opens in a new window)

5. recipient of personal data

The data will be processed by the following controller on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR and Art. 49 para. 1 sentence 1 a) GDPR:

Google Ireland Limited, Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland

6. objection and removal options

Your consent can be revoked at any time for the future. You can revoke your consent at any time in the respective cookie settings. You can also find the respective settings and the associated detailed information there at any time.

XIV OpenStreetMap

1. description and scope of data processing

We have integrated the OpenStreetMap service. All map data "tiles" are hosted in the European Union/EEA/UK. The German operator of www.openstreetmap.de (external link, opens in a new window) is FOSSGIS e.V., Bundesallee 23, 10717 Berlin. The general operator of OpenStreetMap is the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS United Kingdom.

Due to the technical design of the Internet, it is necessary for the requested server to receive your IP address in order to send the map data to the device you are using to access it. This also applies to a preview image of a map.

The technical platform and the services of OpenStreetMap.de are operated by FOSSGIS e.V., Bundesallee 23, D-10717 Berlin.

The contact details of the data protection officer and other relevant data protection information can be found in the data protection information at wiki.osmfoundation.org/wiki/Privacy_Policy.

2 Legal basis

The legal basis for the processing is your consent in accordance with Art. 6 para. 1 lit. a) GDPR and § 25 para. 1.

3 Purpose of the data processing

The purpose of the processing is to display maps for information and visualisation of directions.

4. duration of storage

Detailed information on the storage period can be found in the OpenStreetMap Foundation's privacy policy https://wiki.osmfoundation.org/wiki/Privacy_Policy (external link, opens in a new window)

5. recipients of personal data

The data is processed by the following controllers on the basis of your consent in accordance with Art. 6 para. 1 lit. a) GDPR

FOSSGIS e.V., Bundesallee 23, 10717 Berlin and OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS United Kingdom.

6. objection and cancellation options

XV. Rights of the data subject

If your personal data is processed, you are the data subject within the meaning of the General Data Protection Regulation. You therefore have the following rights vis-à-vis the controller.

To exercise your data subject rights against us as the controller, please contact the following email address:

1. right to information - Art. 15 GDPR

You have the right to request confirmation from the controller as to whether personal data concerning you is being processed.

If such processing is taking place, you have a right to information about this personal data and to the following information

- the purposes for which the personal data are processed;
- the categories of personal data that are processed;
- the recipients or the categories of recipients to whom the personal data have been or will be disclosed;
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject; andthe existence of a right to rectification or erasure of personal data concerning you, a right to restriction of processing by the controller or a right to object to such processing;
- the existence of a right to lodge a complaint with a supervisory authority;
- any available information as to the source of the data if the personal data are not collected from the data subject;
- the existence of automated decision-making, including profiling, referred to in Art. 22 (1) and (4) GDPR and - at least in these cases - meaningful information on the logic involved and the scope and intended effects of such processing for the data subject.

You also have the right to request information as to whether the personal data concerning you is transferred to a third country or to an international organisation. In this context, you may also request to be informed of the appropriate safeguards pursuant to Art. 46 GDPR in connection with the transfer.

2. right to rectification - Art. 16 GDPR
You have the right to obtain from the controller without undue delay the rectification and/or completion of personal data concerning you if the processed personal data are inaccurate or incomplete.

3. right to erasure - Art. 17 GDPR

Obligation to erase:

You have the right to request the erasure of your personal data at any time without undue delay if one of the following reasons applies:

- the personal data concerning you are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- you have withdrawn your consent on which the processing is based according to Art. 6 para. 1 lit. a) or Art. 9 para. 2 lit. a) GDPR and there is no other legal basis for the processing;
- you have objected to the processing pursuant to Art. 21 para. 1 and there are no overriding legitimate grounds for the processing, or you have objected to the processing pursuant to Art. 21 (2) GDPR;
- the personal data concerning you have been unlawfully processed;
- the erasure of the personal data concerning you is necessary for compliance with a legal obligation in Union or Member State law to which the controller is subject;
- the personal data concerning you have been collected in relation to the offer of information society services referred to in Art. 8 (1) GDPR.

Exceptions:
There is no right to erasure if the processing is necessary

to exercise the right to freedom of expression and information
for compliance with a legal obligation which requires processing by Union or Member State law to which the controller is subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) and Article 9(3)
for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) GDPR, insofar as

(1) GDPR, insofar as the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of that processing, or

for the establishment, exercise or defence of legal claims.

4. right to restriction of processing - Art. 18 GDPR

You have the right to demand the restriction of the processing of your personal data under the following conditions

- if you contest the accuracy of the personal data concerning you for a period enabling the controller to verify the accuracy of the personal data;
- if the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
- if the controller no longer needs the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims; or
- if you have objected to processing pursuant to Art. 21 (1) GDPR and it is not yet certain whether the legitimate grounds of the controller override your grounds.

If the processing of personal data concerning you has been restricted, this data - apart from being stored - may only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the restriction of processing has been restricted on the basis of the aforementioned conditions, you will be informed by the controller before the restriction is lifted.

5. right to information - Art. 19 GDPR

If you have exercised your right to rectification, erasure or restriction of processing, we are obliged to communicate any rectification or erasure of personal data or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort.

You also have the right to be informed about these recipients.

6. right to data portability - Art. 20 GDPR

You have the right to receive the personal data concerning you, which you have provided to the controller, in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from the controller to which the personal data has been provided, where

a) the processing is based on consent pursuant to Art. 6 para. 1 lit. a) GDPR or Art. 9 para. 2 lit. a) GDPR or on a contract pursuant to Art. 6 para. 1 lit. b) GDPR and
b) the processing is carried out by automated means.

In exercising this right to data portability, you also have the right to have the personal data concerning you transmitted directly from one controller to another, where technically feasible.

7 Right to object - Art. 21 GDPR

You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on point (e) or (f) of Article 6(1) GDPR, including profiling based on those provisions.

The controller shall no longer process the personal data concerning you unless the controller demonstrates compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to object at any time to processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for these purposes.

You have the option of exercising your right to object in connection with the use of information society services - notwithstanding Directive 2002/58/EC - by means of automated procedures that use technical specifications.

8. right to revoke the declaration of consent under data protection law

You have the right to withdraw your declaration of consent under data protection law at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9. right to lodge a complaint with a supervisory authority - Art. 77 GDPR

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the General Data Protection Regulation.

The supervisory authority to which you lodge a complaint must inform you as the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy pursuant to Art. 78 GDPR.

You can find our additional data protection information for our social media platforms here

Supplementary data protection information for the Facebook fan page
Supplementary data protection information for the Instagram fan page