Das fliegende Künstlerzimmer

Privacy notice

General information on the processing of your data

We are obliged by law to inform you of the processing of your personal data (hereinafter referred to as “data”) when our website is used or our profile in the social media visited. The following data privacy notification informs you of details of the processing of your data and on your relevant legal rights. For terminology such as “personal data” or “processing”, the legal definitions laid down in Art. 4 GDPR shall be decisive. We reserve the right to adapt the privacy notice effective for the future, in particular in the event of the further development of the website, the use of new technologies or the amendment of the statutory basis or the corresponding case law. We recommend reading the privacy notice from time to time and filing a print-out or a copy.

Scope

The privacy notice is intended for all users of the website www.crespo-foundation.de (Item I). Furthermore, the privacy notice contains information on the processing of personal data in the context of our presence in social networks (Item II). It does not extend to any linked websites or internet presence of us or other providers.

Responsible provider

Responsibility for the processing of personal data within the scope of this privacy notice lies with:

Crespo Foundation
Haus des Buches
Braubachstraße 16
60311 Frankfurt am Main
Germany

Telephone: +49 (0)69 27107950
Telefax: +49 (0)69 271079510
info@crespo-foundation.de

Questions on Data Protection

Should you have questions on the topic of data protection with regard to our Foundation or our website or our presence on social media, please contact our data protection offficer:

SPIRIT LEGAL Fuhrmann Hense Partnerschaft von Rechtsanwälten
Rechtsanwalt und Datenschutzbeauftragter
Peter Hense

Postal Address:
Datenschutzbeauftragter
c/o Crespo Foundation
Haus des Buches
Braubachstraße 16
60311 Frankfurt am Main

Security

We have taken comprehensive technical and organisational measures to protect your personal data from unauthorised access, misuse, loss and other external disruptions. In this context, we regularly examine our security measures and adapt them to the state of the art.

Your rights

You have the following rights with regard to your personal data which you can assert vis-a-vis us:

Right to access: You can request information pursuant to Art. 15 GDPR regarding your personal data processed by us.
Right to rectification: Should your personal data be inaccurate (or no longer be accurate) you can demand rectification pursuant to Art. 16 GDPR. Should your data be incomplete, you can demand to have it completed.
Right to erasure: Pursuant to Art. 17 GDPR, you can demand the erasure of your personal data.
Right to restriction of processing: Pursuant to Art. 18 GDPR, you have the right to demand a restriction of the processing of your personal data.
Right to object to the processing: Pursuant to Art. 21(1) GDPR, you have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data which ensues on the basis of Art. 6(1)(e) or (f) GDPR. In this case, we will no longer process your data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims (Art. 21(1) GDPR). Furthermore, pursuant to Art. 21(2) GDPR, you have the right, at any time, to object to the processing of your personal data for the purpose of direct advertising; this shall also apply for any profiling where it is related to direct advertising of this kind. We draw your attention to the right to object in this privacy notice in the context of the respective processing.
Right to withdraw your consent: Where you have consented to the processing, you have the right to withdraw under Art. 7(3) GDPR.
Right to data portability: You have the right to receive the personal data which you have provided to us in a structured, commonly used and machine-readable format (“data portability”) and the right to transmit those data to another controller when the prerequisites of Art. 20(1) (a, b) GDPR have been met (Art. 20 GDPR).

You can assert your right by making notification to the contact data stipulated in the section “Responsible provider”

If you are of the opinion that the processing of your personal data infringes your data protection rights, you also have the right, pursuant to Art. 77 GDPR, to lodge a complaint with a data protection authority of your choice. This also includes the data protection supervisory authority responsible for the provider: Hessische Beauftragte für Datenschutz und Informationsfreiheit, Postfach 3163, 65021 Wiesbaden, Telephone: 0611 14 08 0, Telefax: 0611 14 08 900, E-mail: poststelle@datenschutz.hessen.de.

I. Website

Use of our website

You can always use our website without revealing your identity for purely informative purposes. When the individual pages of the website are called up in this way, only access data are transferred to our webspace provider so that you can be shown the website. The following data are processed:

Browser type/ browser version,
Operating system used,
Language and version of the browser software,
Date and time of access,
Host name of the accessing terminal,
IP address,
Content of the inquiry (specific website),
Access status/HTTP status code,
Websites called up via the website,
Referrer URL (the website previously visited),
Notification of whether the call-up was successful and
Data volume transferred.

The temporary processing of this data is necessary to technically facilitate the process of a website visit and the provision of the website to your terminal. The access data are not used to identify individual users and not collated with other data sources. A further storage in logfiles ensues to ensure the functionality of the website and the security of the IT systems. The legal basis for the processing is Art.6(1)(1)(f) GDPR. Our legitimate interests lie in securing the functionality of the website as well as the integrity and security of the website. Storing access data, in particular the IP address, in logfiles over a longer period makes it possible for us to be able to recognise and counteract misuse. This includes defending against inquiries which would overload the service or any bot use. The access data are deleted as soon as they are no longer required to achieve the purpose of their processing. In the case of the collection of data for the provision of the website, this applies when you have terminated your visit to the website. The logfiles are always stored directly and for the exclusive access of administrators and deleted after seven days at the latest. Thereafter, they are available only indirectly by means of reconstruction of the backups and are deleted finally after a maximum of four weeks.

You can object to the processing. Your right to object applies for grounds relating to your particular situation. You can lodge your objection by making notification to the contact data stipulated in the section “Responsible provider”.

Cookies and other functions

Our websites uses cookies and other functions to process terminal information and personal data of our users. Some of these are absolutely necessary (“essential cookies”), while others serve to facilitate the inclusion of external elements or for statistical analysis.

2.1 Data protection settings

Our website features a consent management tool to request consent to the use of cookies or comparable functions. Using the “data protection settings” you have the possibility to issue or withhold your consent for certain functionalities of our website, e.g. for the purpose of embedding external elements and statistical analysis. You can issue your consent for all functions in the “data protection settings” (“accept all”) or reject them (“accept only essential cookies”) or give your consent for individual purposes or individual functions. You can subsequently change the settings you have selected. The purpose of the embedding of the tool is to leave the decision on the setting of cookies and similar functionalities up to our users and to offer them the option of changing already-selected settings in the context of the future use of our website. In the course of the use of the consent management tool, personal data as well as information on terminal devices used are processed. The legal basis for the processing is Art. 6(1)(1)(f) GDPR. Our legitimate interests in the processing lies in the storage of user settings and preferences in relation to the use of cookies and further functionalities. The storage of user settings ensues by means of a cookie with a storage time of 120 days. Following expiry of the storage time, a further request for consent ensues. The selected user settings are then stored once again for this time period.

ou can object to the processing. Your right to object applies for grounds relating to your particular situation. You can prevent the cookie-based data processing as follows: by deactivating or restricting or deleting cookies in the settings of your browser software or by opening the browser you are using in “private mode”.

2.2 Essential cookies

Essential cookies are required for fundamental functions of the website. This ensures that the website can function without disruption. Our website stores essential cookies for the following purposes:

Data protection settings
Contains the selected data protection settings. Storage time 120 days.

The legal basis for the processing is Art. 6(1)(1)(f) GDPR. Our legitimate interest in the processing lies in providing the special functionalities thus making the use of the website more attractive and effective.

You can object to the processing. Your right to object applies for grounds relating to your particular situation. You can prevent the cookie-based data processing as follows: by deactivating or restricting or deleting cookies in the settings of your browser software or by opening the browser you are using in “private mode”.

2.3 Statistical analysis

Matomo

We use the web analysis service Matomo. Matomo is an open-source software which permits the statistical analysis of our website, in particular relating to visitor views, site call-ups, downloads, previously-visited websites and for measuring the success of entries in search engines. The information and statistics analysed are processed exclusively on our own web servers or data bases. With the aid of such technologies as “tracking bugs” and fingerprinting, the Matomo tool collects, analyses and categorises information received from the user terminal regarding the use of our website and interaction with our website as well as access data, in particular IP address, browser information, the website previously visited as well as the date and time of the server request, for the purpose of statistical analysis and range measurement of ads in search engines. We use Matomo with the addition AnonymizeIP, so that the IP address is used in shortened form, in order to prevent direct identifiability. The legal basis for the processing is your consent pursuant to Art. 6(1)(1)( a) GDPR. The storage time for your data is two years. Further information on data protection and the function of Matomo can be called up under https://matomo.org/privacy/ and https://matomo.org/faq/new-to-piwik/#faq_14.

Withdrawal of your consent to the processing is possible at any time by sliding back the controller in the bar of the data protection settings. This shall not affect the lawfulness of the processing based on the consent up to the time of withdrawal.

2.4 External content

Embedding of YouTube videos

The website uses plug-ins of the video platformYouTube.de or YouTube.com, a service of YouTube LLC (Official address 901 Cherry Avenue, San Bruno, CA 94066, USA; hereinafter referred to as YouTube), for which Google (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, Fax: +353 (1) 436 1001) is responsible within the meaning of the data protection legislation. With the embedding, we pursue the aim of being able to embed visual content (videos) which we have shown on Youtube.de or Youtube.com on our website as well. While the streaming function is being used, information is also processed which is stored on our terminal (e.g. IP address). The videos are embedded in privacy enhanced mode, i.e. no data about you as a user are transferred to YouTube unless you are playing the videos. While the videos are being played on our website, YouTube receives the information that you have called up the corresponding subpage on our website. In addition, some of the data mentioned in the section “Use of the website” are transferred to Google. This happens regardless of whether YouTube has provided a user account through which use have logged in or whether no account exists. When you are logged onto Google, your data is attributed directly to your account. If you do not want the assignment to your profile at Google, you must log out before activating the button. YouTube stores your data as a user profile and process them irrespective of the existence of a Google user account for the purpose of advertising, market research and/or tailored design of its website. The legal basis for the processing is Art. 6(1)(1)(a) GDPR. Google processes some of the data in the USA. For a data transfer to the USA, no EU Commission adequacy decision exists; the legal basis for the transfer of data to the USA is your consent pursuant to Art. 49(1)(1)(a) GDPR. Further information on the purpose and scope of the processing by YouTube and the storage time at YouTube can be found in the privacy notice under https://policies.google.com/privacy.

Withdrawal of your consent to the processing is possible at any time, either by notification to us (see the contact details in the section “Controller and Data Protection Officer”) or by sliding back the controller in the augmented settings of the consent tool. This shall not affect the lawfulness of the processing based on the consent up to the time of withdrawal.

Contacting the Crespo Foundation

When you contact our Foundation, for example, per e-mail or by using the contact form on the website, the personal data you provide will be processed by us in order to respond to your enquiry. Essential for the processing of inquiries via the contact form on the website are the provision of details on your name, or a pseudonym, as well as a valid e-mail address. At the time of sending your message to us, your IP address as well as the date and time of the registration will also be processed. The legal basis for the processing is Art. 6(1)(1)(f) GDPR resp. Art. 6(1)(1)(b) GDPR, if the establishment of contact is aimed at concluding a contract. Where the inquiry is aimed at the conclusion of a contract, the provision of your details is necessary and binding for the conclusion of a contract. Non-provision of the data makes the conclusion of a contract or the execution in the form of contact or the processing of the enquiry impossible. The processing of the personal data from the input mask serves only to allow the processing of the contact. In the event of contact being established, this is also the necessary legitimate interest in the processing of the data. The other data processed during the dispatch process serve to prevent misuse of the contact form and to ensure the security of our IT systems. In this context, no data are passed on to third parties. We delete the data received in this context when the processing is no longer necessary – as a rule, two years after termination of the communication – or restrict the processing, where applicable, to the observance of the existing legally mandatory record retention obligations.

You can object to the processing. Your right to object applies for grounds relating to your particular situation. You can notify us of your objection by using the contact data listed in the section “Responsible provider”.

Hosting

We use external hosting services from the provider Mittwald CM Service GmbH & Co. KG, Königsberger Strasse 4-6, 32339 Espelkamp, https://www.mittwald.de, which serve to make the following available: infrastructure and platform services, computing capacity, storage resources and data base services, searches, security and technical maintenance work. For these purposes, all data – among them the access data listed under the point “Use of our website” – are processed which are necessary for the operation and use of our website. The legal basis for the processing is Art. 6(1)(1)(f) GDPR. With the use of external hosting services we pursue the aim of ensuring the efficient and secure availability of our web offer.

Website support by digital agency

We avail of the services of a digital agency virtualworx, Oranienstr. 19a, 10999 Berlin to support our website. In the context of this support, the digital agency may, in certain circumstances, (e.g. in the case of backups) process the access data listed in the section “Use of our website”, in particular your IP address, and the data stipulated on this website.

The legal basis for the processing is Art. 6(1)(1)(f) GDPR. With the use of the services we pursue the aim of ensuring the efficient and secure availability of our web offer.

II. Social Network Presence

General

We maintain publicly-accessible profiles in a variety of social networks (hereinafter referred to as: “our profiles”). Your visit to our profile triggers a number of data processing processes. In the following we provide an overview of which personal data are collected, used and stored by us when you visit our profile. You are not obliged to provide us with your personal data. However, this may be necessary for individual functions of our profiles in social networks. These functions are not available to you, or are restricted, if you do not provide us with your personal data.

When you visit our profile, your personal data are not only collected, used and stored by us but also by the operator of the respective social network. This happens regardless of whether or not you have a profile in the respective social network. The individual data processing processes and their scope differ from operator to operator of the respective social network and are not necessarily traceable for us. For individual details on the collection and storage of your personal data and on the type, scope and purpose of their use by the operator of the respective social network please see the privacy notice of same:

a) Facebook

The privacy notice for the social network Facebook, operated by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, can be viewed under https://www.facebook.com/about/privacy/update?ref=old_policy.

b) Instagram

The privacy notice for the social network Instagram, operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA, can be viewed under https://help.instagram.com/155833707900388.

c) YouTube

The privacy notice for the social network YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, can be viewed under https://policies.google.com/privacy.

Project presentation and communication with users

The use of our profile serves the purpose of presentation of our projects and the communication and contact with users.

In the context of the use of our profile, we process personal data such as your name, your profile image and your information which you have provided in the context of the interactive functions (e.g. comment, share and rate). The legal basis for the operation of our profile and the processing of the personal data is Art. 6(1)(1)(f) GDPR. Our legitimate interest lies in the presentation of our project via our profile and the communication with users.

When our profile is visited, data may be processed outside of the EU and, in particular, in the USA. For a data transfer to the USA, no EU Commission adequacy decision exists. Further information regarding any data transfer to third states and the relevant legal basis for same can be found in the privacy notices of the social networks.

We have no influence on the storage time for your personal data which you show on our profiles. We store your data until such time as the purpose of the processing has been achieved or restrict the processing where statutory retention obligations apply. Further information on data protection and the storage times can be found in the above linked privacy notices of the social networks.

Statistical information and general responsibility with social networks

The operators of the social networks on which we maintain our profiles provide us, in anonymised form, with statistical analysis of the interactions with our profiles. We use these data to improve the user experience on our profiles. Inferences to individual users and access to individual user profiles by us is not possible. Our legal basis for the processing of information for statistical evaluation is Art. 6(4) GDPR in conjunction with Art. 6(1)(1)(f) GDPR. Our legitimate interests in the statistical evaluation lies in the improvement and adaptation of our advertising measures based on the information collected and the opportunity to find out more on the interaction of users on our profiles.

According to case law of the European Court of Justice, the use of statistical analyses can, under certain circumstances, be considered data processing subject to the joint responsibility of the operator of the social network and the profile owner. Against this background, we have concluded an agreement on joint responsibility pursuant to Art. 26 GDPR with the following operators of social networks:

Facebook

The agreement on joint responsibility for Facebook site insights can be viewed under https://www.facebook.com/legal/terms/page_controller_addendum.