Data Protection Policy

I. Name and Address of the Responsible Party
The responsible party in the sense of the EU General Data Protection Regulation and other national data protection legislation of member states as well as other legal data protection regulations is the:

Annette von Droste zu Hülshoff-Stiftung
Schonebeck 6
D-48329 Havixbeck
Tel.: 02534 1052
Email: info@burg-huelshoff.de
Website: www.burg-huelshoff.de

II. A General Statement on Data Processing

  1. Scope of the Processing of Personal Data
    We generally only process personal data of our users insofar as this is necessary in order to be able to provide a functional website as well as our content and services. The processing of the personal data of users takes place on a regular basis only with the consent of the respective user. An exception is made in such cases where the prior obtaining of such consent is not possible due to the current circumstances and the processing of the data is allowed in accordance with the legal regulations.

  2. Legal Basis for the Processing of Personal Data
    Insofar as we obtain the consent of the person in question for the processing of personal data, article 6, paragraph 1, letter a of the EU General Data Protection Regulation (GDPR) serves as the legal basis. When processing personal data that is necessary in order to fulfill a contract whose contractual partner is the person in question, article 6, paragraph 1, letter b of the GDPR serves as the legal basis. This also applies to processing steps that are necessary in order to implement the contractual measures.

Insofar as the processing of personal data is necessary in order to fulfill a legal obligation that our company is subject to, article 6, paragraph 1, letter c of the GDPR serves as the legal basis. In the event that vital interests of the person in question or another natural person make the processing of personal data necessary, article 6, paragraph 1, letter d of the GDPR serves as the legal basis.

If the processing is necessary in order to safeguard a justified interest of our company or a third party and the interests, basic rights and basic freedoms of the person in question do not outweigh the interest previously named, article 6, paragraph 1, letter f of the GDPR serves as the legal basis for the processing.

  1. Deletion of Data and Storage Duration
    The personal data of the person in question shall be deleted or locked as soon as the reason for the storage is no longer valid. Data can also be stored if this is intended by the European or national legislators in EU Directives, laws or other regulations under which the responsible party is subject to. The locking or deletion of the data shall also take place when a proscribed storage duration through one of the norms named expires, unless there is the necessity of additional storage of the data in order to conclude a contract or fulfill a contract.

III. Provision of the Website and Generation of Log Files

  1. Description and Scope of the Data Processing
    Each time our website is accessed, our system automatically collected data and information from the computer accessing our website.
    In doing so, the following data is collected:
    Information about the browser type and the version used
    The operating system of the user
    The IP address of the user
    The date and time of the access
    The data is also stored in log files on our system. This data is not stored together with other personal data of the user.

  2. Legal Basis for the Data Processing
    The legal basis for the temporary storage of the data and log files is article 6, paragraph 1, letter f of the GDPR.

  3. Purpose of the Data Processing
    The temporary storage of the IP address by the system is necessary in order to provide the website to the computer of the user. To do so, the IP address of the user must be stored for the duration of the session.
    The storage in log files takes place in order to ensure the functionality of the website. In addition, the data allows us to optimize our website and ensure the security of technical information systems. An evaluation of the data for marketing purposes does not take place in this context.

We also have a justified interest in these purposes in accordance with article 6, paragraph 1, letter of the GDPR.

  1. Duration of the Storage
    The data will be deleted as soon as it is no longer necessary in order to achieve the purpose for which it was stored in the first place. In the case of the recording data in order to provide the website, this is the case when the respective session has ended.
    In the event of the storage of the data in log files, this is the case after seven days, at the latest. Storage that extends beyond this is possible. In this case, the IP addresses of the users will be deleted or distorted so that it is no longer to associate these with the client requesting the website.
  1. Option for Revocation and Removal
    The recording of the data in order to provide the website and the storage of the data in log files is urgently necessary for the operation of the website. As a result, the user has no right of revocation.

IV. Newsletter

  1. Description and Scope of the Data Processing
    Our website offers the option of subscribed to a free newsletter. To do so, we use the newsletter service provided by the company Mail Chimp.

We only use your email address to keep you up-to-date about the newest developments at the Center for Literature. Before we can provide you with current information via email, a so-called double opt-in procedure must be conducted. In order to prevent the abusive use of email addresses, you will receive an email after registration in which you are asked to confirm your email address.
This process is logged by us for your security and in order to conform with legal requirements. These include the storage of the registration and confirmation times as well as the IP address. Changes to your data stored by MailChimp are also logged.
The sending of the emails is conducted by the newsletter application MailChimp, which is offered by the U.S. service provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. The email addresses of our users as well as their additional data, described in this statement, will be stored on the servers of MailChimp in the USA. MailChimp uses this information to send and evaluate emails on our behalf. In addition, MailChimp can use this data to optimize or improve its own services, e.g. to technically optimize the shipment and display of the emails or to determine the countries of the recipients. MailChimp does not, however, use the data of our users to write to them on its own behalf or provide this data to third parties. We have concluded a Data Processing Agreement with MailChimp. This is an agreement in which MailChimp is obligated to protect the data of our users, process the data on our behalf in accordance with our data privacy policy and especially not to make this data accessible to third parties. If there are display problems in your email program, our emails can also be opened via MailChimp's website. In addition, you can subsequently correct your email address on the MailChimp website. If you visit the website of Mailchimp, we inform you that MailChimp may use cookies and that your personal data may be collected and processed by MailChimp.
You can find additional information in the privacy statement of MailChimp.

  1. Legal Basis for the Data Processing
    The legal basis for the processing of the data after subscription to the newsletter by the user is article 6, paragraph 1, letter a of the GDPR when the consent of the user exists.

  2. Purpose of the Data Processing
    The collection of the email address of the user is used to deliver the newsletter.
    The collection of other personal data over the course of the subscription process is to prevent the abuse of the services or the email address used.

  3. Duration of the Storage
    The data will be deleted as soon as it is no longer necessary in order to achieve the purpose for which it was stored in the first place. The email address of the user will continue to be stored for as long as the subscription to the newsletter is active. The other personal data collected over the course of the registration process is generally deleted after a period of seven days.

  4. Option for Revocation and Removal
    The subscription to the newsletter can be cancelled by the user in question at any time. A corresponding link for this purpose is included in every newsletter. This also makes possible the revocation of the consent provided to store the personal data stored over the course of the registration process.

V. Email Contact

  1. Description and Scope of the Data Processing
    Our website offers the option of contacting us via the email address provided. In this case, the email is stored along with the personal data provided by the user.
    In this context, this data will not be passed on to third parties. The data will be used exclusively in order to process the conversation.

  2. Legal Basis for the Data Processing
    The legal basis for the processing of data that is transmitted over the course of sending an email is article 6, paragraph 1, letter f of the GDPR. If the email contact is intended to conclude an agreement, the additional legal basis for this processing is article 6, paragraph 1, letter b of the GDPR.

  3. Purpose of the Data Processing
    The processing of personal data in the case of making contact via email is conducted by us solely for the purpose of processing the contact.

  4. Duration of the Storage
    The data will be deleted as soon as it is no longer necessary in order to achieve the purpose for which it was stored in the first place. In the event of personal data that is sent via email, this will be the case when the respective conversation with the user has ended. The conversation is deemed as ended when the circumstances allow it to be recognized that the issue in question has been sufficiently clarified.
    The personal data additionally collected during the sending process will be deleted at latest after a period of seven days.

  5. Option for Revocation and Removal
    The user has the option at all times of revoking their consent to the processing of their personal data. If the user contacts us via email, they can revoke their consent to the storing of their personal data at any time. In such an event, the conversation will not be able to be continued. Revoking consent and/or objecting to storage can also be made via email or postal mail to the address provided above.
    In this case, all personal data that was stored over the course of the contact will be deleted.

VI. Rights of the Person in Question

If your personal data is processed, then you are the person in question in the sense of the GDPR and you have the following rights with regard to the responsible party:

  1. Right of Information
    You can request a confirmation from the responsible party whether personal data that concerns you has been processed by us.
    If such processing has occurred, you can request the following information from the responsible party:
    (1) The purpose for which the personal data was processed;
    (2) The categories of the personal data that was processed;
    (3) The planned duration of the storage of the personal data that concerns you or, if specific information is not possible here, the criteria for the determination of the storage duration;
    (4) Whether a right exists to correct or delete personal data that concerns you, a right to restrict the processing by the responsible party or a right of objection to this processing;
    (5) Whether a right exists to appeal to a supervisory authority.

  2. Right of Correction
    You have a right of correction and/or completion with regard to the responsible party insofar as the processed personal data that concerns you is incorrect or incomplete. The responsible party must undertake this correction immediately.

  3. Right to Limitation of the Processing
    You can request the limitation of the personal data that concerns you under the following prerequisites:
    (1) If you dispute the correctness of the personal data concerning you for a period which allows the responsible party to inspect the correctness of the personal data;
    (2) The processing is illegal and you reject the deletion of the personal data and instead request the limitation of the use of the personal data;
    (3) The responsible party no longer needs the personal data for the purpose of processing but you need them in order to enforce, exercise or defend legal claims, or
    (4) If you have submitted a revocation of the consent provided for processing in accordance with article 21, paragraph 1 of the GDPR and it has not yet been determined whether the justified reasons of the responsible party outweigh your reasons.

    1. Right to Deletion
      You can request that the responsible party immediately delete personal data concerning you insofar as one of the following reasons applies:
      (1) The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
      (2) You revoke your consent upon which the processing is based in accordance with article 6, paragraph 1, letter a or article 9, paragraph 2, letter a of the GDPR and there is no other legal basis for the processing.
      (3) In accordance with article 21, paragraph 1 of the GDPR, you revoke your consent to the processing and there are no other justified reasons with greater priority for the processing or, in accordance with article 2, paragraph 2 of the GDPR, you revoke your consent to the processing.
      (4) The personal data concerning you with illegally processed.
      (5) The deletion of the personal data concerning you is necessary in order fulfill a legal obligation according to European Union law or the law of the member states to which the responsible party is subject.
      (6) The personal data concerning you was collected over the course of information society services in accordance with article 8, paragraph 1 of the GDPR.
  4. Right to Information
    If you have enforced the right to correction, deletion or restriction of the processing on the part of the responsible party, the responsible party is obligated to disclose to all recipients to whom the personal data concerning you is disclosed of the correction or deletion of the data or the restriction of the processing unless this proves impossible or is associated with a disproportionate amount of effort.
    You have the right to request that the responsible party inform you of these recipients.

  5. Right to Data Portability
    You have the right to receive the personal data concerning you that you have provided to the responsible party in structured, standard and machine-readable format. In addition, you have the right to provide this data to another responsible party without being prevented by the responsible party to whom the data was provided insofar as
    (1) the processing is based on consent in accordance with article 6, paragraph 1, letter a of the GDPR or article 9, paragraph 2, letter a of the GDPR or an agreement in accordance with article 6, paragraph 1, letter b of the GDPR and
    (2) the processing is conducted with the help of automated processes.
    By exercising this right, you have the additional right to cause the personal data concerning you to be transmitted directly by one responsible party to another responsible party, insofar as this is technically possible. The freedoms and rights of other persons may not be affected by this.
    The right to the transfer of data does not apply for the processing of data that is necessary in order to conduct a task that rests in the public interest or which takes place in exercising official authority that is vested in the responsible party.

  6. Right of Revocation
    You have the right, for reasons arising from your special situation, to revoke your consent for the processing of the personal data concerning which takes place due to article 6, paragraph 1, letters e and f of the GDPR; this also applies for profiling based on these conditions.
    The responsible party will no longer process the personal data concerning you unless it can present urgent reasons worthy of protection for this that outweigh your interests, rights and freedoms or if the process serves the purpose of enforcing, exercising or defending legal claims.

  7. Right of Revocation of the Privacy Policy Declaration of Consent
    You have the right to revoke the privacy policy declaration of consent at any time. The revocation of the consent will not affect the legality of the processing that has already taken place due to the consent up to the point of the revocation.

  8. Right of Appeal to a Supervisory Authority
    Regardless of any other administrative or judicial legal remedies, you have the right to appeal to a supervisory authority, especially within the member state of your place of residence, your workplace or the place of the suspected violation if you are of the opinion that the processing of the data concerning you violates the GDPR.
    The supervisory authority to which the appeal is submitted will inform the appellant regarding the status and results of the appeal including the possibility of legal redress in accordance with article 78 of the GDPR.

VII. Data Privacy Policy for the Use of the Ticket Shop of Reservix GmbH

Our website provides links to the ticket shop of the Center for Literature operated by Reservix GmbH. Over the course of purchasing a ticket, the necessary personal data of the person booking the ticket such as their name, address, email address, telephone and fax number as well as the booking details and the data required for payment will be stored b Reservix or by third parties operating on behalf of Reservix for the necessary time period. The Center for Literature can access the customer data collected by Reservix during the ticket purchasing process for its own marketing purposes. Reservix ensures that the regulations of the GDPR are complied with.

VIII. Data Privacy Policy for the Use of Facebook Plugins

Plugins from the social network Facebook, 1601 South California Avenue, Palo Alto, CA 94304, USA, are integrated within our website. You can recognize the Facebook plugins by the Facebook logo or the "like" button on our website. You can find an overview of the Facebook plugins here: http://developers.facebook.com/docs/plugins/ When you visit our website, the plugin makes a direct connection between your browser and the Facebook server. Through this, Facebook receives the information that you have visited our website with your IP address. If you click the Facebook "like" button while you are logged in to your Facebook account, you can link the content of our website to your Facebook profile. This allows Facebook to associate the visit to our website with your user account. We emphasize that, as the provider of the website, we have no knowledge of the content of the data transmitted nor of its use by Facebook. You can find more information in Facebook's privacy policy at: https://de-de.facebook.com/policy.php.
If you do not want Facebook to associate the visit to our website with your Facebook user account, please log out of your Facebook user account before visiting our website.

IX. Privacy Statement for the Use of Instagram Plugins

Functions of the service Instagram have been integrated throughout our website. These functions are offered in an integrated manner by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. When you are logged into your Instagram account, you can link the content of our website with your Instagram profile by clicking the Instagram button. This allows Instagram to associate the visit to our website with your user account. We inform you that as the provide of this website, we have no knowledge regarding the content of the data provided to Instagram or its usage there.
You can find more information about this in the privacy statement of Instagram:http://instagram.com/about/legal/privacy/.

X. Privacy Statement for the Use of Vimeo Plugins
We use the provider Vimeo, amongst others, in order to incorporate videos on our website. Vimeo is operated by Vimeo, LLC, with headquarters at 555 West 18th Street, New York, New York 10011.

We use plugins by the provided Vimeo on some of our webpages. When you visit webpages of our website that feature such a plugin, for example, our media library, a connection to the Vimeo servers is made and the plugin is used. This informs the Vimeo server which of our webpages you have visited. If you are logged in as a member of Vimeo, Vimeo will associate this information with your personal user account. When using the plugin, e.g. by clicking on the start button of a video, this information will also be associated with your user account. You can prevent this association by logging out of your Vimeo account and deleting the corresponding cookies from Vimeo before using our website.

You can find more information about the data processing as well as Vimeo's privacy policy athttps://vimeo.com/privacy.