The controller for the collection, processing, and use of your personal data within the meaning of Art. 4 no. 7 of the General Data Protection Regulation (GDPR) is:
Museum Reinhard Ernst
Wilhelmstraße 1
65185 Wiesbaden
Germany
Phone: +49 (0)611 763 888 0
E-mail: info@museum-re.de
Data Protection Officer
Below you will find the e-mail address of our data protection officer:
datenschutz@museum-re.de
If you would like to receive the newsletter offered on our website, or subscribe to our press and media mailing list, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided, and that you consent to receiving the newsletter.
We use the so-called double opt-in procedure to ensure that the newsletter is sent to you with your consent. In this process, potential recipients can be added to a mailing list. Users are then sent a confirmation e-mail giving them the opportunity to confirm their registration in a legally secure manner. The address is only actively added to the mailing list if confirmation is received.
We use this data exclusively for sending the requested information and offers.
We use HubSpot as our marketing software. Your data will be transmitted to HubSpot. HubSpot is prohibited from selling your data and using it for purposes other than sending newsletters and other information mailings from our organisation. HubSpot is a certified provider that has been selected in accordance with the requirements of the General Data Protection Regulation and the German Federal Data Protection Act (BDSG). You can read Hubspot’s privacy policy here.
You can revoke your consent to your data or e-mail address being stored and used for sending the newsletter and information mailings at any time, for instance by clicking on the “Unsubscribe” link in the newsletter or information mailing, or by sending a message to the following e-mail address social@museum-re.de.
When contacting us (e.g. by contact form, e-mail, telephone, business card, or via social networks), the user’s details are used to process the contact enquiry and handle it pursuant to Art. 6 para. 1 lit. b of the GDPR. The user’s details are stored in a customer relationship management system (CRM system). Your data will not be processed in any other way.
If you wish to place an order in our online shop, provided by Amepheas, in order to conclude a contract, you are required to provide the personal data that we need to process your order. Mandatory information required for the processing of contracts is marked separately; other information is voluntary. We process the data you provide to fulfil your order. We use Hubspot as a customer management system for orders received in the online shop. The legal basis for this is the legitimate interest pursuant to Art. 6 para. 1 lit. f. GDPR. For this purpose, we may pass on your payment details to our bank. The legal basis for this is Art. 6 para. 1 sentence 1 lit. b of the GDPR. You are not required to create a customer account.
The personal data transmitted to Novalnet generally includes first name, surname, address, gender, e-mail address, IP address and, if applicable, date of birth, telephone number, mobile telephone number as well as other data required to process a payment. Personal data relating to the respective order is also required to process the purchase contract. In particular, there may be a mutual exchange of payment information, such as bank details, card number, expiry date and Card Validation Code (CVC), data on goods and services as well as prices.
The transfer of data is aimed, in particular, at identity verification, payment administration, and fraud prevention. Museum Reinhard Ernst gGmbH will transfer personal data to Novalnet AG in particular if there is a legitimate interest in the transfer. Novalnet AG may transmit the personal data exchanged between Novalnet AG and the controller to credit reference agencies. The purpose of this transfer is to check identity and creditworthiness.
Novalnet AG also passes on personal data to service providers or subcontractors if this is necessary for the fulfilment of contractual obligations, or if the data is to be processed.
The data subject may withdraw their consent to the handling of personal data with respect to Novalnet AG at any time. A withdrawal does not affect personal data that must be processed, used, or transmitted for (contractual) payment processing.
The digital artworks created at the digital stations in the colour laboratory are the property of the mre. All artworks created in the colour laboratory may be digitally displayed and shown in the mre on all channels, including social media.
The ‘PinselstrICH’ station uses a photographic image of the person working with it; this image is captured at the respective station. The station is programmed in such a way that the biometric image is rendered unrecognisable during the painting process. Only the image modified and made unrecognisable by the filter is stored on the server, not the original photo.
Data recorded in the colour laboratory includes the name of the educational institution and a freely selectable group name (e.g. group X) when used by a group. The group’s image data is assigned to the corresponding group names, and can be retrieved using a personalised code. This data is stored anonymously and is not personalised.
The data is currently stored on the mre server in the education cloud, our digital learning platform of the colour laboratory, without any time limit. An additional backup copy is stored on the Fluxguide server.
The data privacy principles of the Fluxguide server, which is part of the Linode network, can be found here from 23.6.24.
Data recipients
The recipients of the data collected are listed below.
Purposes of data processing
This list shows the purposes of data collection and processing.
Technologies used
This list contains all technologies with which HubSpot collects data. Typical technologies include cookies and pixels, which are stored in your browser.
Cookies: HubSpot uses cookies to track mre website visits and contacts. A cookie is a small text file that is stored in a visitor’s browser when that person accesses our mre website. When the HubSpot software is executed on our website, it leaves a cookie in the visitor’s browser, which allows the HubSpot software to recognise them on subsequent visits. For further information on our HubSpot solution, please click here.
Data collected
This list contains all (personal) data collected by, or through, the use of our website.
Legal basis
The necessary legal basis for the processing of data is provided below.
Art. 6 para. 1 sentence 1 lit. a and f of the GDPR, i.e. the data is processed both based on your consent and our legitimate interest.
Place of processing the data
This is the primary location where the collected data is processed. If the data is also processed in other countries, you will be duly informed.
Germany / European Union
All postings on social networks are processed by Meta (Facebook, Instagram) and LinkedIn. Further information is available in the ‘Social networks’ section.
Retention period
The retention period is the period of time during which the collected data is stored for processing. The data must be deleted as soon as it is no longer required for the processing purposes specified. The data is stored in accordance with the statutory retention period.
Data recipients
The recipients of the data collected are listed below:
The mre’s use of Google, Facebook, Instagram, LinkedIn, and YouTube is not tantamount to an endorsement of these media, the operating companies, or their respective privacy policies.
The mre recommends that all users familiarise themselves with the processing of their data by Meta, Google, and LinkedIn, and protect their privacy to the best of their ability: this includes reading the privacy policies of the above-mentioned media.
Facebook: https://www.facebook.com/about/privacy
Instagram: http://instagram.com/about/legal/privacy/
Google: https://policies.google.com/privacy hl=en-gb&gl=uk
LinkedIn: https://www.linkedin.com/legal/privacy-policy
We receive your applications either by sending them to our e-mail address bewerbung@museum-re.de or via one of the known application portals.
We treat your data as strictly confidential and do not pass it on to third parties. The data will be processed exclusively for the purpose of the application process and deleted after completion in accordance with statutory retention periods (currently six months). We will also retain your documents if you have given us your explicit consent to do so (for a maximum of two years).
The exhibition and other areas of the museum are partially monitored using a closed circuit television (CCTV) system. By entering the museum, you accept, and agree to, the CCTV installation being in use. CCTV and the handling of the corresponding data are carried out in accordance with legal regulations.
Purposes and basis of data processing:
Duration of storage or criteria for determining the duration
The video recordings will be deleted when they are no longer necessary to fulfil the above-mentioned purposes, or if the interests of the data subjects worthy of protection prevent further storage; at the latest, however, after 72 hours. If video recordings are stored as evidence for criminal and/or civil prosecution, they will be deleted in accordance with the statute of limitations. Legal basis: Section 4 of the German Federal Data Protection Act (BDSG) ‘Video surveillance of publicly accessible areas’; Art. 6 para. 1 lit. 1 of the GDPR.
Pursuant to Section 22 (1) of the German Art Copyright Act (KUG), ‘images may only be distributed or publicly displayed if the person depicted has given their consent’. The persons depicted on the mre website have given their consent.
Any photography and filming of visitors when the museum is open and during events shall solely be used for the purpose of public relations and for coverage of the event on the website, in publications, and press releases of the mre. Your consent will be requested for photographs or film recordings that do not show persons of contemporary history, or people as accessories next to landscapes or other locations, and are not photographs or film recordings of meetings, parades, or similar events. The legal bases arise from Art. 6 para. 1 lit. e of the GDPR in conjunction with Section 3 of the German Federal Data Protection Act (BDSG) as well as Art. 6 para. 1 lit. a of the GDPR. If necessary, photographs may be passed on to service providers for publication for the purpose of creating print products. This includes, for instance, agencies and printers involved in the production process.
The recordings for which consent was obtained because it was required shall be deleted immediately upon withdrawal of consent. Otherwise, recordings shall be stored until their purpose no longer applies.
If, despite careful checking of the content, an image has been published that violates this principle, or if you wish the published photo to be removed (revocation of consent), you may give us written notice of this. It is sufficient to send us an e-mail. Please describe the image in detail and state on which page it is displayed.
If you withdraw your consent, we shall delete the image, or images, immediately and shall no longer use them in future. Please contact us by e-mail at social@museum-re.de.
Right to Information
Under Art. 15 of the GDPR, you may request information about your personal data that we process.
Right to rectification
If the information concerning you is not (or no longer) correct, you can request rectification under Art. 16 of the GDPR. If your data is incomplete, you can request to have it completed.
Right to erasure
You can request the erasure of your personal data under Art. 17 of the GDPR. In addition to the exceptions mentioned in Art. 17 para. 3 of the GDPR, the right to erasure does not apply if erasure is not possible, or only possible with disproportionate effort due to the special type of storage. In these cases, the restriction of processing under Art. 18 of the GDPR shall take the place of erasure.
Right to restriction of processing
Under Art. 18 of the GDPR, you have the right to request that the processing of your personal data be restricted.
Right to Data Portability
Provided that the requirements of Art. 20 para. 1 of the GDPR are met, you have the right to have data transmitted to yourself or to third parties.
Right to object
You have the right to object on particular grounds under Art. 21 of the GDPR.
These rights can be restricted under Art. 23 of the GDPR. Federal and state legislators have made use of the possibility of restricting the rights of the data subject. If you wish to exercise the above-mentioned rights, the Reinhard and Sonja Ernst foundation, as the organisation operating the museum, will check whether the legal requirements are met in each individual case.
You also have the right to complain to the State Commissioner for Data Protection and Freedom of Information of the State of Hesse about how we process your personal data.
