The Stiftung Preussischer Kulturbesitz (Prussian Cultural Heritage Foundation) is committed to handling your personal data in a responsible way and to maintaining transparency about its use. The following sections therefore explain
- who is responsible for the website under data protection law
- what forms personal data are processed in, with a description of the purpose and a statement of the legal basis in each case and
- what rights you have as a user of this website.
I. Who is responsible for the website and data privacy protection?
Stiftung Preussischer Kulturbesitz, legally represented by the president, Prof. Dr. hc. mult. Hermann Parzinger, is responsible for this website in terms of data protection.
For questions regarding data protection, the Stiftung Preussischer Kulturbesitz has a data protection officer as a contact person. You can contact him/her at our postal address, addressed to “data protection officer,” or via this e-mail address:
II. What forms are personal data processed in?
1. Provision of the website and creation of log files
When you visit our website, the browser used on your device automatically sends information to the server on our website. This information is temporarily stored in a file called a "log file."
a. Data categories
The following information is recorded without your active involvement and is stored until it is automatically deleted:
- IP address of the computer requesting access,
- date and time of access,
- name and URL of the file accessed,
- web page from which access has taken place (referrer URL),
- browser used and, if applicable, the operating system of your computer as well as the name of your internet service provider (ISP).
The aforementioned data are processed by us for the following purposes:
- ensuring a smooth connection to the website
- ensuring the comfortable use of our website
- evaluating system security and stability as well as other administrative purposes.
The website is operated as part of public relations work of the Foundation.
c. Legal basis
The legal basis for data processing lies in the protection of legitimate interests in accordance with Art. 6 para. 1 (e) GDPR in connection with Section 3 of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The website is provided as part of our public relations work.
d. Recipient categories
Our website is located on a server owned by the Mittwald company. The operator of our website, graphodata AG, also has access to the aforementioned data.
The Stiftung Preussischer Kulturbesitz has exercised due diligence in selecting graphodata AG as its web agency and Mittwald as its server host. Both graphodata AG and Mittwald are bound by instructions given by the Stiftung Preussischer Kulturbesitz and are regularly checked.
e. Storage period
The Mittwald company stores data for the following periods.
Anonymized IP addresses are retained for seven weeks.
Error logs, which record faulty page views, are deleted after seven days. In addition to the respective error message, they list the IP address from which access was attempted and, depending on the error, the web page that was accessed.
Access via FTP is logged anonymously and the records are kept for seven weeks.
Cookies are used on this website. These are small text packets that are sent from a website to a browser, are saved by the browser and then sent back as and when requested.
a. Data categories
The Stiftung Preussischer Kulturbesitz stores the following information from the data that is transmitted when you visit this website:
- browser type/version
- operating system
- referrer URL (the redirect page)
- date, time, and duration of the server request
- page(s) and file(s) accessed
- pseudonymized IP address
- country of origin
- frequency of access to the website
c. Legal basis
Technically necessary cookies are processed in accordance with Art. 6 para. 1 (e) GDPR in conjunction with Section 3 of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). All other cookies are processed only if you grant your consent, in accordance with Art. 6 para. 1 (a) GDPR.
d. Recipient categories
The Stiftung Preussischer Kulturbesitz uses the usage analysis software Matomo (formerly Piwik), which is recommended for web analysis by data protection experts. Processing the personal data of individual users enables us to analyze the surfing behavior of our users in general. The data obtained is evaluated in order to provide us with information about the usage of the individual components of our website. This helps us to keep on improving our website and its ease of use. The users' IP addresses are automatically anonymized so that the data collected can no longer be assigned to specific people. This makes it impossible for the usage data or usage profiles to be matched with the personal data. The software runs exclusively on the servers of our service provider. The personal data of users is only stored there. The data is not shared with third parties.
e. Storage period
The technically necessary cookies are usually deleted when the browser is closed.
In addition, performance/web analysis cookies or a Matomo deactivation cookie are stored on your computer. These are called "persistent cookies" and are automatically deleted after two years. You can delete these cookies yourself at any time by using the security settings of your browser.
f. Right to revoke
If you consented to the statistical evaluation of your cookies on the start page, you can revoke your consent at any time by clicking the “I decline” button.
PLEASE NOTE: If you have activated the automatic deletion of cookies in your browser, the deactivation cookie will also be deleted when you exit the program. In this case, you will have to object again to data collection the next time you visit this website. Also, if you use another computer or another web browser, you must again object to the collection of your data.
More information on the privacy settings of the Matomo software can be found on the Matomo website
3. Contact, subscriptions
The personal data that you provide us with by e-mail, on the press distribution contact form, when ordering the SPK magazine, or in other ways is processed by us (in the interest of fast and cheap communication) to answer or deal with any inquiries you make or orders you place.
b. Legal basis
If you have expressly granted your consent for us to process your data, Art. 6 para. 1 (a) GDPR is the legal basis for this processing.
If we process your data in order to carry out pre-contractual measures, Art. 6 para. 1 (b) GDPR is the legal basis.
In all other cases, Art. 6 para. 1 (e) GDPR in connection with Section 3 of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG) is the legal basis. In such cases, data processing is necessary for our public relations work.
c. Storage period
Personal data are deleted as soon as it is certain that they no longer serve the purpose for which they were collected.
a. Data categories
The following data are collected when you register:
- e-mail address
- date and time of registration and activation
When you register for the newsletter, your e-mail address is used for the purpose of advertising. So that the Stiftung Preussischer Kulturbesitz can adapt the newsletter to reflect the interests of its readers, the links that you click on are recorded in an anonymized form. We cannot find out which links a specific person has clicked on.
c. Legal basis
The legal basis for this processing is the granting of consent in accordance with Art. 6 para. 1 (a) GDPR. Registration takes the form of a double opt-in. As part of the registration process, we obtain your consent and refer to our data privacy notice. You can terminate your registered status at any time afterwards, effective from then onward. To unsubscribe, click on the link at the end of the newsletter.
d. Recipient categories
The Stiftung Preussischer Kulturbesitz uses the services of CleverReach GmbH & Co. KG to distribute the newsletter. The Stiftung Preussischer Kulturbesitz has exercised due diligence in selecting CleverReach GmbH & Co. KG. It is bound by the instructions given by the Stiftung Preussischer Kulturbesitz and is regularly checked. Your data is encrypted and stored on servers in Germany and other EU countries.
e. Storage period
Your e-mail address will only be saved for sending the newsletter for the period stated during your registration, or until you cancel it.
To unsubscribe, click on the link at the end of the newsletter. Your data will then be deleted. In this connection, you should bear in mind that CleverReach, as a data processor, is obliged under the GDPR to ensure data security and must regularly perform backups for this purpose. These backups are deleted after thirty days.
5. Facebook & Instagram
The Stiftung Preussischer Kulturbesitz maintains a Facebook page and an Instagram page, for which it is jointly responsible, in terms of data protection rights, with Facebook Ireland Ltd. (4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland; hereinafter Facebook Ireland) according to Art. 26 GDPR.
The material posted on the pages consists of current information, videos and images, which users can comment on and mark with emojis.
Users of Facebook can also post so-called visitor contributions on our page. The comments, emojis and contributions are publicly visible and thus the identity of the user who has posted them is publicly recognizable. Users can also send us messages that are not publicly visible.
With Facebook Page Insights, we have the option of calling up certain statistical, anonymized data on user behavior.
These show, for example, the total number of page views, “Likes”, page activity, contribution interactions, reach, video views, and contribution reach.
This feature also provides data on the Facebook groups linked to our Facebook page. Facebook creates and provides the Insights data using cookies. We can only change the period for which we want to see an evaluation.
In addition, we can choose certain settings for the target group for our posts, and these have a corresponding effect on the statistical analysis. The Insights function cannot be turned off by us.
Facebook uses the data in particular for advertising (creating personalized advertising), creating user profiles, and for market research. If a visitor to our page has a user account for the Facebook network and is logged into it when our page is accessed, the information provided by the cookies is saved on all that person’s registered devices. We have no influence over the fact that Facebook shares data with third parties, including Facebook Inc., the U.S. parent company of Facebook Ireland. This procedure is certified under the EU-US Privacy Shield and is therefore considered to be compliant with data protection requirements within the meaning of the GDPR.
Details of data processing by Facebook can be found here: https://www.facebook.com/policy.php
Data processing takes place on the basis of an agreement between the jointly responsible parties in accordance with Article 26 GDPR; Facebook Ireland is the primary entity responsible within the meaning of the GDPR (Art. 26) for the Insights data: https://www.facebook.com/legal/terms/page_controller_addendum
You can assert your rights as a data subject both against us and against Facebook Ireland.
The processing of personal data is undertaken to protect legitimate interests on the basis of Art. 6 para. 1 (e) GDPR in connection with Section 3 of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).
Data processing is carried out for the purpose of effective communication with users in the context of public relations work.
The Stiftung Preussischer Kulturbesitz processes personal data itself via its Twitter account (see clause b. below). At the same time, personal data is processed by Twitter (see clause a. below).
a. Data processed by Twitter
For the short message service offered under this brand, the Stiftung Preussischer Kulturbesitz uses the technical platform and services of Twitter Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103 U.S.A.
The entity responsible for processing the data of persons living outside the United States is: Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2 D02 AX07, Ireland.
Information about the data that are processed by Twitter and the purposes that this serves can be found in Twitter’s data privacy notice.
Twitter Inc. has made a commitment to uphold the principles of the EU-US Privacy Shield.
b. Data processed by us
The data that you enter on Twitter, in particular your user name and the content published on your account, can be processed by us to the extent that we may retweet or reply to your tweets, and we may write tweets that refer to your account. The data freely published and distributed by you on Twitter may thus be included in our content and made accessible to our followers.
This processing serves public relations purposes, on the legal basis of Art. 6 para. 1 (e) GDPR in connection with Section 3 of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG).
The Stiftung Preussischer Kulturbesitz Vimeo channel is run by Vimeo Inc. (Vimeo, Inc. 555 West 18th Street, New York, New York 10011).
Vimeo collects the data without informing SPK and SPK cannot influence Vimeo’s data collection process. The following user data is collected by Vimeo:
- Profile information
- Transactions: Payment method
- Contents: Video, text, image, etc. along with information and metadata; communication, interaction with third party users
- Technical data Information in the course of Vimeo support: IP address, device information, search history, cookies
- Third party information: Transaction data, data from analysis tools
For details on how Vimeo handles user data, see the company's data protection declaration .
The Stiftung Preussischer Kulturbesitz manages its social media channels with the editing tool from Hootsuite Inc. (5 East 8th Avenue Vancouver, BC; Canada V5T 1R6).
The data is collected without us gaining knowledge of it or being able to exert any influence on it. Hootsuite collects user data as follows:
Hootsuite imports the data from the SPK’s social media accounts on Facebook and Twitter. The data stored there are described in detail in the sections on Facebook and Twitter in this document.
Detailed information on the processing of user data can be found in Hootsuite’s data privacy notice.
9. Images and videos of people on the website
It might be possible to recognize individual people in the pictures or videos on our website, In this case, the legal basis for data processing is Art. 6 para. 1 (e) GDPR in connection with Section 3 of the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). If you are affected in this way, you have the right to object to the use of your image.
III. The rights users of this website have
Regarding your personal data, you have the following rights:
- Right of access (Art. 15 GDPR)
- Right of rectification and erasure (Art. 16+17 GDPR)
- Right to restriction of processing (Art. 18 GDPR)
- Right to object (Art. 21 GDPR)
- Right to data portability (Art. 20)
You also have the right to complain to a data protection supervisory authority about the way the Foundation processes of your personal data (Art. 77 GDPR). The Federal Commissioner for Data Protection and Freedom of Information (BfDI) is responsible for the Stiftung Preussischer Kulturbesitz.