1. Name and contact details of Controller and Company Data Protection Officer
This privacy information pertains to data processing by:
Kunstverein in Hamburg
T +49 40 322157
F +49 40 322159
2. Collection, storage and deletion of personal data as well as type and purpose and data use
If you are member of the Kunstverein in Hamburg or if you contact us, because you are interested in the Kunstverein in Hamburg, we will collect the following information:
- Title, first name, last name
- Valid email address
- Postal address
- Phone number (landline and/or mobile phone)
- If applicable, information about your interest or your concern
- If applicable, the date of the beginning of your membership
Your account details, in case you sign a SEPA Direct Debit Mandate
If applicable, the proof for a reduced membership
This data is collected in order to inform you about association activities, to invite you to membership meetings, to issue donation receipts and for processing your membership.
Data is processed in response to your request and processing is required pursuant to Art. 6 (1), sentence 1, lit. a, GDPR for the above-listed purposes.
Data is processed to ensure adequate client service and for the mutual fulfillment of obligations arising from the client contract. The legal basis for this processing of personal data is Art. 6 (1), sentence 1, lit. b, GDPR.
We will also process your personal data based on our legitimate interest in the adequate defense of our legal position pursuant to Art. 6 (1), sentence 1, lit. f, GDPR. Our personal interest results from the above-listed purposes.
3. Visiting our website
When you access our website www.kunstverein.de, the browser deployed on your terminal device will automatically send information to our website server. This information is temporarily saved in a so-called log file. In this process, the following information will be collected without any action on your part and stored until its automated deletion, usually after one week:
- IP address of the computer sending the request,
- Date and time of website access,
- Name and URL of the retrieved file,
- Website from which our site was accessed (referral URL),
- Browser used and, if applicable, your computer’s operating system as well as the name of your access provider.
We will process the above-listed data for the following purposes:
- Ensuring a smooth connection setup to the website,
- Ensuring easy use of our website,
- Evaluation of system security and stability,
- Clarification of any improper page access (DoS/DDoS attacks, etc.), as well as
- Further administrative purposes.
The legal basis for the processing of personal data is Art. 6 (1), sentence 1, lit. f, GDPR. Our legitimate interest is derived from the above-listed purposes for data collection. We generally do not use collected data for the purpose of drawing conclusions about your person. However, we reserve the right to do so if required to investigate improper page access.
We may offer links to third-party services on our website. However, we are not responsible for the processing of your data by these services.
4. Making contact
If you have questions of any kind, we offer you the option to contact us by telephone or via email. If you make personal data available to us via these routes or through our website (e.g. via a contact form), we will only save and use this data on the basis of Art. 6 (1), sentence 1, lit. a, GDPR, to process your inquiries or on the basis of Art. 6 (1), sentence 1, lit. b, GDPR if the subject of your inquiry relates to (pre-) contractual information. You may revoke your consent to the processing of the provided data at any time by sending an email to firstname.lastname@example.org. In this case, we will delete your data, unless we have a legal retention obligation.
5. Routine deletion and blocking of personal data
If you are a member, we store your data electronically as long as your membership lasts. Upon termination of your membership, the data will be deleted from our directories. We keep any correspondence concerning your membership in accordance with the legal deadlines.
Otherwise, we will not process and store your personal data for longer than is necessary to achieve the storage purpose, or as long as the processing and storage are provided for by the European Directive and Regulation Body or another legislator in laws or regulations to which we are subject. If the storage purpose no longer applies or if a storage period prescribed by the European directive and regulation giver or another responsible legislator expires, the personal data will be blocked or deleted routinely and in accordance with the statutory provisions.
Data that we store on the basis of your consent will only be stored until you revoke your consent. Data that we require for the execution of a contract will be stored only for as long as the contractual relationship with you exists or statutory retention periods apply. Data that we use on the basis of a justified interest will be stored only as long as your interest in deletion or anonymisation does not prevail.
6. Rights of data subjects
You have the following rights:
- If we process personal data on the basis of consent according to Art. 7 sentence 3 GDPR, your once given consent for collecting, processing and using your personal data may be revoked at any time effective fort he future.
- To obtain information from us about the personal data we process according to Art. 15 GDPR. In particular, you may request information about the purposes of the processing, the categories of personal data, the categories of recipients to whom your personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, the existence of the right to request rectification, erasure, restriction of processing or to object, the right to lodge a complaint, the source of your data if they were not collected by us, as well as the existence of automated decision-making, including profiling, as well as meaningful information about the associated details;
- To request without delay the rectification of incorrect or incomplete personal data stored by us according to Art. 16 GDPR;
- To request, according to Art. 17 GDPR, the erasure of personal data stored with us, unless the processing is necessary for exercising the right of freedom of expression and information, full compliance with legal obligations, for reasons of public interest, or for the establishment, exercise or defense of legal claims;
- To request restriction of processing your personal data according to Art. 18 GDPR, if you contest the accuracy of the data, if the processing is unlawful but you oppose the erasure of the data, and if we no longer need the personal data but you require them for the establishment, exercise or defense of legal claims, or if you exercised your right to object to processing according to Art. 21 GDPR;
- To request your personal data, which you have provided to us, in a structured, commonly used and machine-readable format or to demand the transmission to another controller according to Art. 20 GDPR; and
- To lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR. You can generally contact the supervisory authority at your usual place of residence or workplace or at our seat for this purpose.
To exercise the rights of data subjects, it is sufficient to send an email to email@example.com
7. Right to object
To the extent your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1), sentence 1, lit. f, GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21, GDPR on grounds relating to your particular situation.
To exercise this right to object, it is sufficient to send an email to firstname.lastname@example.org