Data Protection

The data protection declaration also applies to our social media accounts:

https://www.facebook.com/kunsthallebad
https://www.instagram.com/kunsthallebadenbaden/
https://www.youtube.com/user/kunsthallebadenbaden

1. Data Protection at a Glance

General Notes

The following notes provide a simple overview of what happens to your personal data when you visit our website. Personal data are all data with which you can be personally identified. Detailed information on the subject of data protection can be found in our data protection declaration listed below this text.

Data Collection on This Website

Who is responsible for data collection on this website?

Data processing on this website is carried out by the website operator. You can find their contact details in the "Information about the Responsible Party" section of this privacy policy.

How do we collect your data?

Your data is collected, on the one hand, by you providing it to us. This can be, for example, data that you enter in a contact form.

Other data is collected automatically when you visit the website by our IT systems. These are primarily technical data (e.g., internet browser, operating system, or time of page access). This data is collected automatically as soon as you enter this website.

What do we use your data for?

Part of the data is collected to ensure the error-free provision of the website. Other data may be used to analyze your user behavior. If contracts are concluded or initiated via the website, the data transmitted will also be used for contract processing, orders, or other requests.

What rights do you have regarding your data?

You have the right at any time to receive free information about the origin, recipient, and purpose of your stored personal data. You also have the right to demand correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time for the future. Additionally, under certain circumstances, you have the right to restrict the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.

For this and other questions regarding data protection, you can contact us at any time.

Analysis Tools and Third-Party Tools

When visiting this website, your browsing behavior can be statistically evaluated. This is mainly done with so-called analysis programs.

Detailed information about these analysis programs can be found in the following privacy policy.

2. Hosting

We host the content of our website with the following provider:

External Hosting

This website is externally hosted. The personal data collected on this website is stored on the servers of the hoster. This can mainly be IP addresses, contact requests, meta and communication data, contract data, contact details, names, website visits, and other data generated via a website.

External hosting is carried out to fulfill a task in the public interest and to ensure a secure, fast, and efficient provision of our online offering by a professional provider (Art. 6(1)(e) GDPR). If a corresponding consent has been requested, the processing is carried out exclusively on the basis of Art. 6(1)(a) GDPR and § 25(1) TDDDG, insofar as the consent includes the storage of cookies or access to information in the user's terminal device (e.g., device fingerprinting) in the sense of the TDDDG. Consent can be revoked at any time.

Our hoster will process your data only to the extent necessary to fulfill their service obligations and will follow our instructions regarding this data.

We use the following hoster:

Prolog AG
Hammerstrasse 44
4058 Basel
Switzerland

Data Processing Agreement

We have concluded a data processing agreement (AVV) for the use of the above-mentioned service. This is a legally required contract that ensures that the service provider processes the personal data of our website visitors only according to our instructions and in compliance with GDPR.

3. General Notes and Mandatory Information

Data Protection

The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the legal data protection regulations as well as this privacy policy.

When you use this website, various personal data will be collected. Personal data are data with which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this happens.

We would like to point out that data transmission on the internet (e.g., when communicating by email) can have security gaps. Complete protection of data against third-party access is not possible.

Information about the Responsible Party

The responsible party for data processing on this website is:

Staatliche Kunsthalle Baden-Baden
Lichtentaler Allee 8 a
76530 Baden-Baden

Phone: +49 7221-30076-400
E-Mail: kunsthalle-baden-baden@dacuro.de

The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of the processing of personal data (e.g., names, email addresses, etc.).

Duration of Storage

Unless a more specific storage period is specified in this data protection declaration, your personal data will remain with us until the purpose for the data processing no longer applies. If you assert a legitimate request for deletion or revoke your consent to data processing, your data will be deleted, provided we have no other legally permissible reasons for storing your personal data (e.g., tax or commercial law retention periods); in the latter case, the deletion will take place after these reasons no longer apply.

General Information on the Legal Basis for Data Processing on This Website

If you have consented to data processing, we process your personal data on the basis of Art. 6(1)(a) GDPR or Art. 9(2)(a) GDPR, if special categories of data according to Art. 9(1) GDPR are processed. In the case of explicit consent to the transfer of personal data to third countries, the data processing also takes place on the basis of Art. 49(1)(a) GDPR. If you have consented to the storage of cookies or access to information in your terminal device (e.g., via device fingerprinting), the data processing also takes place on the basis of § 25(1) TDDDG. Consent can be revoked at any time. If your data is required for the fulfillment of a contract or for the implementation of pre-contractual measures, we process your data on the basis of Art. 6(1)(b) GDPR. Furthermore, we process your data if this is necessary for the fulfillment of a legal obligation on the basis of Art. 6(1)(c) GDPR. Data processing can also take place on the basis of Art. 6(1)(e) GDPR if it is necessary for the performance of a task in the public interest.

The respective legal basis applicable in each individual case will be explained in the following sections of this privacy policy.

Data Protection Officer

We have appointed a data protection officer.

dacuro GmbH
Heinrich-Hertz-Straße 11
69190 Walldorf

Email: kunsthalle-baden-baden@dacuro.de

Website: https://www.dacuro.de/

Recipients of Personal Data

In the course of our business activities, we cooperate with various external parties. In some cases, this also involves the transmission of personal data to these external parties. We only pass on personal data to external parties if this is necessary for the fulfillment of a contract, if we are legally obliged to do so (e.g., handing over data to tax authorities), if the transmission is necessary for the performance of a task in the public interest (Art. 6(1)(e) GDPR), or if another legal basis permits the data transfer. When using processors, we only pass on personal data of our customers on the basis of a valid data processing agreement. In the case of joint processing, a joint processing agreement is concluded.

Revocation of Your Consent to Data Processing

Many data processing operations are only possible with your express consent. You can revoke your consent at any time. The legality of the data processing that took place up to the revocation remains unaffected.

Right to Object to Data Collection in Certain Cases and to Direct Marketing (Art. 21 GDPR)

IF THE DATA PROCESSING IS BASED ON ART. 6(1)(E) GDPR, YOU HAVE THE RIGHT AT ANY TIME TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA FOR REASONS ARISING FROM YOUR PARTICULAR SITUATION; THIS ALSO APPLIES TO PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS FOR THE PROCESSING CAN BE FOUND IN THIS PRIVACY POLICY. IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPULSORY LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENSE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ART. 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR THE PURPOSE OF DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF PERSONAL DATA CONCERNING YOU FOR THE PURPOSE OF SUCH ADVERTISING; THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS CONNECTED WITH SUCH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ART. 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, place of work, or the location where the alleged violation occurred. The right to lodge a complaint is without prejudice to other administrative or judicial remedies.

Right to Data Portability

You have the right to have data that we process automatically on the basis of your consent or in fulfillment of a contract handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another responsible party, this will only be done to the extent technically feasible.

Information, Correction, and Deletion

You have the right, within the framework of the applicable legal provisions, to receive free information about your stored personal data, its origin and recipients, the purpose of data processing, and, if applicable, the right to have this data corrected or deleted. For this and other questions on the subject of personal data, you can contact us at any time.

Right to Restrict Processing

You have the right to demand the restriction of the processing of your personal data. To do this, you can contact us at any time. The right to restrict processing exists in the following cases:

If you contest the accuracy of your personal data stored with us, we generally need time to verify this. For the duration of the verification, you have the right to demand the restriction of the processing of your personal data.
If the processing of your personal data was unlawful, you can demand the restriction of data processing instead of deletion.
If we no longer need your personal data, but you need it to exercise, defend, or assert legal claims, you have the right to demand the restriction of the processing of your personal data instead of deletion.
If you have lodged an objection pursuant to Art. 21(1) GDPR, it will be examined whether compelling legitimate grounds for processing exist that override your interests, rights, and freedoms, or whether the processing serves the establishment, exercise, or defense of legal claims. For the duration of the examination, you have the right to demand the restriction of the processing of your personal data.

If you have restricted the processing of your personal data, these data may - apart from their storage - only be processed with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or of a Member State.

SSL or TLS Encryption

This page uses SSL or TLS encryption for security reasons and to protect the transmission of confidential content, such as orders or inquiries that you send to us as the page operator. You can recognize an encrypted connection by the fact that the address line of the browser changes from "http://" to "https://" and by the lock symbol in your browser line.

If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Objection to Advertising Emails

We hereby object to the use of contact data published in accordance with the legal requirements for the transmission of unsolicited advertising and information materials. The operators of the pages expressly reserve the right to take legal action in the event of the unsolicited sending of advertising information, such as spam emails.

4. Data Collection on This Website

Cookies

Our website uses so-called "cookies." Cookies are small data packets that do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted at the end of your visit. Persistent cookies remain stored on your device until you delete them yourself or until an automatic deletion by your web browser takes place.

Cookies can come from us (first-party cookies) or from third parties (so-called third-party cookies). Third-party cookies enable the integration of specific third-party services within websites (e.g., cookies for processing payment services).

Cookies have various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g., the shopping cart function or the display of videos). Other cookies can be used to evaluate user behavior or for advertising purposes.

Cookies that are necessary for the execution of the electronic communication process, for providing certain functions that you have requested (e.g., for the shopping cart function), or for optimizing the website (e.g., cookies for measuring the web audience) are stored based on Art. 6(1)(e) GDPR, unless another legal basis is specified. The storage of necessary cookies is carried out because they are necessary for the performance of a task in the public interest and for the technically error-free and optimized provision of the online service. If a consent to the storage of cookies and comparable recognition technologies has been requested, the processing is carried out exclusively on the basis of this consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG); the consent can be revoked at any time.

You can configure your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. When disabling cookies, the functionality of this website may be limited.

If other cookies and services are used on this website, you can find out about them in this privacy policy.

Server-Log Files

The provider of the pages automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These are:

Browser type and browser version
Operating system used
Referrer URL
Hostname of the accessing computer
Time of the server request
IP address

This data is not merged with other data sources.

The collection of this data is based on Art. 6(1)(e) GDPR. The collection of server log files is necessary for the operation of the website. It is also used to ensure the security and stability of our website.

Contact by Email, Phone, or Fax

If you contact us by email, phone, or fax, your request, including all personal data derived from it (name, request), will be stored and processed by us for the purpose of processing your request. We do not pass this data on without your consent.

The processing of this data is based on Art. 6(1)(b) GDPR if your request is related to the fulfillment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the requests sent to us (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR) if it has been requested; the consent can be revoked at any time.

The data you send us via contact requests will remain with us until you request deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g., after your request has been processed). Mandatory legal provisions - in particular legal retention periods - remain unaffected.

5. Social Media

We have publicly accessible profiles on social networks. Social networks such as Facebook, Instagram, X (Twitter), etc., can generally analyze your user behavior comprehensively when you visit their website or a website with integrated social media content (e.g., Like buttons or advertising banners). When visiting our social media presences, numerous data protection-relevant processes are triggered.

If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. Your personal data can also be collected even if you are not logged in or do not have an account with the respective social media portal. This data collection takes place, for example, via cookies that are stored on your device or by collecting your IP address.

With the help of the data collected in this way, the operators of social media portals can create user profiles in which your preferences and interests are stored. This way, you can be shown interest-based advertising inside and outside the respective social media presence. If you have an account with the respective social network, interest-based advertising can be displayed on all devices on which you are logged in or were logged in.

Please also note that we cannot track all processing operations on the social media portals. Depending on the provider, further processing operations may be carried out by the operators of the social media portals. For details, please refer to the terms of use and privacy policies of the respective social media portals.

Legal Basis

Our social media appearances should provide a comprehensive presence in the internet. They serve the public relations and public relations purposes. The processing of personal data in this context is carried out on the basis of Art. 6(1)(e) GDPR (performance of a task in the public interest).

The analysis processes initiated by the social networks may be based on different legal bases, which are specified by the operators of the social networks (e.g., consent within the meaning of Art. 6(1)(a) GDPR).

Responsible Party and Enforcement of Rights

If you visit one of our social media presences (e.g., Facebook), we, together with the operator of the social media platform, are responsible for the data processing triggered during this visit. You can assert your rights (information, correction, deletion, restriction of processing, data portability, and complaint) generally both against us and against the operator of the respective social media portal (e.g., against Facebook).

Please note that we, despite the shared responsibility with the operators of the social media portals, cannot fully influence the data processing operations of the social media portals. Our possibilities are largely determined by the company policy of the respective provider.

Storage Duration

The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for their storage no longer applies, you request deletion, or you revoke your consent to storage. Stored cookies remain on your device until you delete them. Mandatory legal provisions - in particular retention periods - remain unaffected.

We have no influence on the storage period of your data stored by the operators of the social networks for their own purposes. For details, please refer directly to the operators of the social networks (e.g., in their privacy policy).

Individual Social Networks

Facebook

We have a profile on Facebook. The operator of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (hereinafter Meta). According to Meta, the data collected will also be transferred to the USA and other third countries.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum,
https://de-de.facebook.com/help/566994660333381 and https://www.facebook.com/policy.php.

The company has a certification according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that aims to ensure the observance of European data protection standards for data processing in the USA. Every company certified under the DPF commits to complying with these data protection standards. Further information can be obtained from the provider at the following link:
https://www.dataprivacyframework.gov/participant/4452

We have concluded a joint processing agreement (Controller Addendum) with Facebook. This agreement specifies which data processing operations we or Facebook are responsible for when you visit our Facebook page. From Facebook, we receive "Insights" data, i.e., data about user numbers. These "Insights" data are personal data under GDPR that are collected and processed in connection with a visit to or interaction with a page and its content. "Page Insights" are statistics that Facebook Ireland provides to the page administrator.

The agreement on joint responsibility can be viewed at the following link:
https://www.facebook.com/legal/terms/page_controller_addendum

Facebook also processes information about users of the Facebook platform in other ways, and you as a user of Facebook have a direct relationship with Facebook. In this regard, we refer to the privacy notices of Facebook. You can adjust your advertising settings independently in your user account. To do this, click on the following link and log in: https://www.facebook.com/settings?tab=ads.

Details can be found in Facebook's privacy policy:
https://de-de.facebook.com/privacy/explanation

Data Processing During Interactions on Our Facebook Page

On our Facebook page, you have the opportunity to get in touch with us by commenting on our posts, creating your own post, or sending us private messages. If you want to avoid Facebook from processing personal data transmitted by you to us, please contact us through another channel.

Instagram

We have a profile on Instagram. The operator of this service is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum, https://help.instagram.com/519522125107875, and
https://de-de.facebook.com/help/566994660333381.

Details about their handling of your personal data can be found in Instagram's privacy policy:
https://help.instagram.com/519522125107875.

Data Processing During Interactions on Our Instagram Profile

When using certain interactive functions on Instagram (e.g., the comment function or the "Like" button), comments or likes are visible to other users and us as the provider of the Instagram page. This allows direct user attribution based on the personal data disclosed.

You have a direct relationship with Instagram as a user of Instagram. In this regard, we refer to Instagram's privacy notices. We have no influence over interactive functionality and the visibility of comments, likes, or other activities on our Instagram page. The type, scope, and duration of the processing and storage of personal data in this regard are determined by Instagram, making Instagram also responsible for this. We explicitly point out that Instagram and thus Meta stores its users' data (e.g., personal information, IP address, etc.) and may use it for commercial purposes.
When visiting our Instagram page, Instagram and thus the associated company Meta also records your IP address and other information that are available in the form of cookies on your PC. This information is used to provide us as operators of the Instagram pages with statistical information about the use of the Instagram page.

Further information on data processing by Instagram can be found in Instagram's privacy policy at:
https://privacycenter.instagram.com/,
https://www.facebook.com/privacy/center and https://help.instagram.com/196883487377501?ref=dp

YouTube

We use the YouTube.com platform to upload and make our own videos publicly accessible. The operator of the website is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here:
https://business.safety.google/adscontrollerterms/sccs/

Our website contains links or references to YouTube's offering. In general, we are not responsible for the content of websites to which we link. We would like to point out that when you click on a YouTube link, your data (e.g., personal information, IP address) will be saved by YouTube according to its own data usage policies and used for business purposes.

If you access our YouTube channel, please note the following:

When using YouTube's service, data collected about you will be processed by the provider and possibly transmitted to countries outside the European Union.

Furthermore, we receive aggregated statistics ("Insights") from YouTube. These statistics provide information about the source of the YouTube channel access, the type of device used to access it, or the page views. We only receive anonymized information and statistics if the visitor to our YouTube channel is registered with YouTube.

Address and link to Google's privacy policy:
https://policies.google.com/privacy?hl=de

6. Analysis Tools and Advertising

Matomo

This website uses the open-source web analytics service Matomo.

With the help of Matomo, we can collect and analyze data on the use of our website by website visitors. This allows us, among other things, to determine when which page views occurred and from which region they come. In addition, we collect various log files (e.g., IP address, referrer, used browser, and operating systems) and can measure whether our website visitors carry out certain actions (e.g., clicks, purchases, etc.).

The use of this analysis tool is based on your consent according to Art. 6(1)(a) GDPR and, if the consent includes the storage of cookies or access to information in the user's terminal device (e.g., device fingerprinting) in the sense of the TDDDG, on the basis of § 25(1) TDDDG. Consent can be revoked at any time.

IP Anonymization

When analyzing with Matomo, we use IP anonymization. Your IP address is shortened before analysis so that it can no longer be uniquely assigned to you.

Hosting

We host Matomo with the following third-party provider:

InnoCraft Ltd.
150 Willis St
Wellington 6011
New Zealand

EU Representative pursuant to Art. 27 GDPR:
ePrivacy Holding GmbH
Burchardstraße 14
20095 Hamburg

E-Mail: eu.rep[at]eprivacy.eu

Data Processing Agreement

We have concluded a data processing agreement (AVV) for the use of the above-mentioned service. This is a legally required contract that ensures that this service processes the personal data of our website visitors only according to our instructions and in compliance with GDPR.

7. Newsletter

Newsletter Data

If you would like to receive the newsletter offered on the website, we need an email address from you as well as information that allows us to verify that you are the owner of the email address and that you agree to receive the newsletter. Further data will not be collected or only on a voluntary basis. For the processing of the newsletter, we use the newsletter service providers described below.

Mailchimp

This website uses the services of Mailchimp for sending newsletters. The provider is Rocket Science Group LLC, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, GA 30308, USA.

Mailchimp is a service that, among other things, allows the organization and analysis of newsletter mailings. If you enter data for the purpose of subscribing to the newsletter (e.g., email address), this data will be stored on Mailchimp's servers in the USA.

With the help of Mailchimp, we can analyze our newsletter campaigns. If you open a Mailchimp-sent email, a file contained in the email (so-called web beacon) connects to Mailchimp's servers in the USA. This allows us to determine whether a newsletter message has been opened and which links have been clicked, if applicable. In addition, technical information (e.g., time of retrieval, IP address, browser type, and operating system) is recorded. This information cannot be assigned to the respective newsletter recipient. It is used exclusively for the statistical analysis of newsletter campaigns. The results of these analyses can be used to better adapt future newsletters to the interests of the recipients.

If you do not want an analysis by Mailchimp, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message.

The data processing is based on your consent (Art. 6(1)(a) GDPR). You can revoke this consent at any time by unsubscribing from the newsletter. The legality of the data processing operations already carried out remains unaffected by the revocation.

The data you provide us for the purpose of subscribing to the newsletter will be stored by us until you unsubscribe from the newsletter with us or with the newsletter service provider and deleted from the newsletter distribution list after unsubscribing from the newsletter. Data stored by us for other purposes remain unaffected.

The data transfer to the USA is based on the standard contractual clauses of the EU Commission. Details can be found here: https://mailchimp.com/eu-us-data-transfer-statement/ and https://mailchimp.com/legal/data-processing-addendum/#Annex_C_-_Standard_Contractual_Clauses.

After unsubscribing from the newsletter distribution list, your email address may be stored by us or the newsletter service provider in a blacklist, if necessary, to prevent future mailings. The data from the blacklist are used only for this purpose and are not merged with other data. This serves to comply with the legal requirements for sending newsletters based on Art. 6(1)(e) GDPR in conjunction with Art. 7(3) GDPR. The storage in the blacklist is not time-limited.

Further details can be found in Mailchimp's privacy policy at: https://mailchimp.com/legal/terms/.

The company has a certification according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that aims to ensure the observance of European data protection standards for data processing in the USA. Every company certified under the DPF commits to complying with these data protection standards. Further information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/7693.

Data Processing Agreement

Sending Newsletters to Existing Customers

If you order goods or services from us and provide your email address in connection with this, we may use this email address in the future to send you newsletters, provided we inform you about this beforehand. In such a case, the newsletter will only contain direct advertising for similar goods or services offered by us. You can unsubscribe from this newsletter at any time. For this purpose, there is a corresponding link in every newsletter. The legal basis for sending the newsletter is Art. 6(1)(e) GDPR in conjunction with § 7(3) UWG.

After unsubscribing from the newsletter distribution list, your email address may be stored by us in a blacklist to prevent future mailings to you. The data from the blacklist are used only for this purpose and are not merged with other data. This serves to comply with the legal requirements for sending newsletters based on Art. 6(1)(e) GDPR in conjunction with Art. 7(3) GDPR. The storage in the blacklist is not time-limited.

8. Plugins and Tools

YouTube with Enhanced Privacy

This website embeds videos from the website YouTube. The operator of the website is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

If you visit one of our pages that embeds YouTube, a connection to YouTube's servers is established. The YouTube server is informed which of our pages you have visited.

If you are logged into your YouTube account, you enable YouTube to associate your surfing behavior directly with your personal profile. You can prevent this by logging out of your YouTube account.

We use YouTube in extended privacy mode. According to YouTube, videos played in extended privacy mode are not used to personalize browsing on YouTube. Ads that are displayed in extended privacy mode are also not personalized. In extended privacy mode, no cookies are set, but so-called Local Storage elements are stored in the user's browser, which can contain personal data and can be used for recognition purposes. Further details can be found here: https://support.google.com/youtube/answer/171780.

After activating a YouTube video, other data processing operations may be triggered over which we have no control.

The use of YouTube is based exclusively on your consent according to Art. 6(1)(a) GDPR and, if access to information in the terminal device or the storage of information occurs (e.g., device fingerprinting), also on the basis of § 25(1) TDDDG. Consent can be revoked at any time.

Further information on data protection at YouTube can be found in their privacy policy at: https://policies.google.com/privacy?hl=de.

The company has a certification according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that aims to ensure the observance of European data protection standards for data processing in the USA. Every company certified under the DPF commits to complying with these data protection standards. Further information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/5780.

Webfonts by Hoefler & Co.

This page uses fonts from Hoefler & Co. (The Hoefler Type Foundry, Inc.) for consistent display. The provider belongs to Monotype Imaging Holdings Inc. (600 Unicorn Park Drive, Woburn, Massachusetts 01801, USA). When you call up a page, your browser loads the required fonts into your browser cache to display texts and fonts correctly.

The use of externally loaded web fonts from Hoefler & Co. is based exclusively on your consent pursuant to Art. 6(1)(a) GDPR and, insofar as access to information in the terminal device or the storage of information occurs, on the basis of § 25(1) TDDDG.

For this purpose, the browser you are using must connect to the servers of Monotype. This way, Monotype becomes aware that your IP address has been used to access this website. Consent can be revoked at any time.

If your browser does not support Hoefler & Co. web fonts, a standard font from your computer will be used.

Further information about Hoefler & Co. web fonts or Monotype Imaging Holdings Inc. can be found at:
https://www.typography.com/policies/privacy and at
https://www.monotype.com/de/rechtshinweise/datenschutzrichtlinie/datenschutzrichtlinie-fuer-die-website-nutzung,
https://www.monotype.com/de/rechtshinweise/datenschutzrichtlinie

The company has a certification according to the "EU-US Data Privacy Framework" (DPF). The DPF is an agreement between the European Union and the USA that aims to ensure the observance of European data protection standards for data processing in the USA. Every company certified under the DPF commits to complying with these data protection standards. Further information can be obtained from the provider at the following link: https://www.dataprivacyframework.gov/participant/6347.

9. eCommerce and Payment Providers

Processing of Customer and Contract Data

We collect, process, and use personal customer and contract data to establish, shape, and change our contractual relationships. Personal data about the use of this website (usage data) is collected, processed, and used only to the extent necessary to enable the user to use the service or to bill for it. The legal basis for this is Art. 6(1)(b) GDPR.

The collected customer data is deleted after completion of the order or termination of the business relationship and expiration of the applicable statutory retention periods. Statutory retention periods remain unaffected.

Data Transmission When Contracts Are Entered into for Online Shops and Goods Dispatch

Orders via our online shop are currently made exclusively by email, which you send to us. The payments associated with this are made exclusively by advance payment. For the dispatch of your order, we will pass on your personal data to the transport company entrusted with delivery. Only those data that the respective service provider needs to fulfill its task will be disclosed. The legal basis for this is Art. 6(1)(b) GDPR, which permits the processing of data for the fulfillment of a contract or pre-contractual measures. If you have given your consent according to Art. 6(1)(a) GDPR, we will pass on your email address to the transport company entrusted with delivery so that it can inform you by email about the shipping status of your order; you can revoke this consent at any time.

10. Own Services

Handling of Applicant Data

We offer you the opportunity to apply to us (e.g., by email, by post, or via an online application form). Below, we inform you about the scope, purpose, and use of your personal data collected as part of the application process. We assure you that the collection, processing, and use of your data are in compliance with applicable data protection regulations and all other legal provisions, and your data will be treated strictly confidentially.

Scope and Purpose of Data Collection

If you submit an application to us, we will process the personal data associated with it (e.g., contact and communication data, application documents, notes from application interviews, etc.) to the extent necessary for deciding whether to establish an employment relationship. The legal basis for processing during the application process is Art. 6(1)(e) GDPR in conjunction with § 15 LDSG Baden-Württemberg (processing of personal data of employees). If you have given your consent, the processing will additionally be based on Art. 6(1)(a) GDPR. Consent can be revoked at any time. Your personal data will only be passed on within our company to persons involved in processing your application.

If the application is successful, the personal data you provided during the application process will be processed in our data processing systems based on Art. 6(1)(e) GDPR in conjunction with § 15 LDSG Baden-Württemberg for the purpose of establishing and carrying out the employment relationship.

During the application process, it may be necessary to process publicly accessible information about your person (e.g., from publicly accessible professional networks such as LinkedIn or XING). The legal basis for this is Art. 6(1)(e) GDPR in conjunction with § 15 LDSG Baden-Württemberg, if this is necessary for a well-founded decision on establishing an employment relationship.

Duration of Data Storage

If the application process does not result in your employment, your personal data will be stored based on Art. 6(1)(e) GDPR in conjunction with § 15 LDSG Baden-Württemberg for a period of up to six months after the completion of the application process. The storage serves, among other things, to fulfill documentation and evidentiary obligations and to ward off possible legal claims. After this period, the data will be deleted, and the physical application documents will be destroyed. The storage also serves as evidence in case of legal disputes. If it is apparent that the data will be required after the six-month period (e.g., due to an impending or pending legal dispute), deletion will only take place once the purpose for continued storage no longer applies.

Further storage will only take place if you have expressly consented pursuant to Art. 6(1)(a) GDPR or if legal retention or documentation obligations prevent deletion.

11. Additional Mandatory Information

The information required pursuant to Art. 12 and 13 GDPR regarding your rights as a data subject, the responsible party, and the contact details of the data protection officer can be found in the general section of this privacy policy under point 3.

Photographs and Film Recordings at Events

The Staatliche Kunsthalle Baden-Baden creates photographs and film recordings of speakers, participants, and guests at events, which are processed for documentation, follow-up reporting, and the promotion of museum-relevant content.

Scope and Purpose of Data Collection

The recordings are used, among other things, in posts on our homepage, in newsletters, publications, print media, and our social media channels such as Facebook, YouTube, and Instagram. You will be informed about this on the website and in the invitations to the events.

The photographs and film recordings may also be passed on to media representatives as part of press work.

Legal Basis and Storage

The data processing is based on Art. 6(1)(e) GDPR (performance of a task in the public interest). It serves public relations, the presentation of the activities of the Staatliche Kunsthalle Baden-Baden, and the information of the public about museum-relevant content.

Video Surveillance on the Premises of the Staatliche Kunsthalle Baden-Baden

The properties of the Staatliche Kunsthalle Baden-Baden are video-surveilled indoors for the preservation of house rules and for the purposes of danger prevention and criminal prosecution. All areas within the properties that are video-surveilled are marked with corresponding pictograms indicating the responsible party and contact options.

Legal Basis and Storage

The processing of personal data is based on Art. 6(1)(e) GDPR in conjunction with § 4 LDSG Baden-Württemberg.

The image recording is fully automated and continuous (24/7). The video stream is stored on internal file servers with special access restrictions until the available storage capacity is reached; subsequently, the oldest recordings are automatically overwritten. Due to the recording quality, this overwrite cycle usually begins after about 30 days.

The collected data will only be transmitted to law enforcement authorities if this is necessary within the framework of a justified police measure or by court order for the aforementioned purposes. The disclosure of data will be documented. The transmission is usually made to the State Police of Baden-Württemberg. Further transmission to third parties or an automated comparison with other police information systems does not take place.