Data Privacy Policy
Privacy Notice
1. Introduction
Protecting your data is an important responsibility that we take seriously
. When you visit our online services and
interaction with our museum, we may
process personal data relating to you. Below,
you about this processing in accordance with the legal requirements.
The primary legal basis is the European
General Data Protection Regulation (‘GDPR’).
2. Data controller
The data controller, within the meaning of data protection law, for the processing activities and procedures described in these
notices is:
Museum am Rothenbaum
Cultures and Arts of the World
Foundation under public law
Rothenbaumchaussee 64
20148 Hamburg
Email: info@markk-hamburg.de
You can contact our Data Protection Officer at:
Goalgetter GmbH
Willhoop 3
22453 Hamburg
Email: datenschutz@goalgetter.gmbh
3. Your rights as a data subject
Subject to any statutory restrictions,
the following rights, which you may exercise:
The right to access, rectification, erasure, restriction of processing, data portability and objection.
We would like to expressly point out here that, as
required by law, reserve the right to verify your identity and
, where necessary, take further measures to verify your identity
.
3.1. Right of access:
If you wish to obtain information about the personal data
, please inform us of this in writing.
For security reasons and in accordance with regulations, we may
we may pseudonymise certain data.
3.2. Right to rectification:
Should you discover, or believe, that incorrect
information relating to you has been processed, you may
notify us of this in writing. We will investigate the matter and
correct the data accordingly where necessary.
3.3. Right to erasure:
If you wish to have your data erased, please inform us of this
request in writing. We will review your request in accordance with the statutory
requirements and delete it accordingly.
However, we would like to point out at this stage that we
are obliged to retain data for periods specified by law
for longer periods; for example, the current retention period
for accounting records is currently 10 years (German Fiscal Code)
or, for reasons relating to warranties and limitation periods, for at least 3
years.
Furthermore, we would like to point out that, whilst we will block your data immediately
block your data immediately, it may take a few days
before we have permanently deleted the data.
3.4. Right to restriction of processing:
You have the right to restrict the processing of your data. To do so,
, please inform us in writing of the categories of data you believe are affected
and the grounds for your request in writing. We will
examine the matter immediately and inform you of the outcome.
3.5. Right to data portability:
Please inform us in writing which data you wish to transfer and to whom
. We will examine your request without delay and
of the outcome.
3.6. Right to object and right to withdraw consent
If you have given us your consent to specific data processing activities
, for example to receive our newsletter, you have
have the right at any time to withdraw this consent – in whole or in part
. Please notify us of this withdrawal in writing.
Should the processing of your data be based on a balancing of interests
pursuant to Article 6(1)(f) of the GDPR, you have the right to
object to the processing, provided there are grounds
arising from your particular situation or where
direct marketing is involved.
In the case of direct marketing, you have a general right to object without
needing to provide details of your specific situation. Please
notify us of your objection in writing.
3.7. Right to lodge a complaint:
If you are dissatisfied with our work in relation to data protection
, you have the right to lodge a complaint with the data protection supervisory authority
to the data protection supervisory authority responsible for your
.
4. Processing operations
4.1. Use of ‘tellme’
When you visit the ‘tellme subpage’ and use the editorial content provided there, the web server stores data relating to your enquiry and the information provided. This includes the IP address from which the page was accessed and information provided by your browser. Furthermore, data from the content you submit to us, such as text, images and videos, is processed.
| Purpose: | Provision of the requested service and related communication; use of the content for PR, marketing and research; legal certainty |
| Legal basis: | Article 6(1)(b) of the GDPR – (pre-contractual and contractual processing) |
| Recipients (categories): | Employees, IT service providers, website visitors |
| Transfers to third countries: | No |
| Retention period: | In accordance with statutory provisions |
| DATA COLLECTED DIRECTLY | |
| Personal data (categories): | Name details Content data (e.g. image data) |
| DATA NOT COLLECTED DIRECTLY | |
| Personal data (categories): | IP address, metadata |
4.2. Use of our website
When you visit our website, the web server collects data relating to your
request and the information provided. This includes the
IP address from which the request was made and information provided by your browser
.
| Purpose: | To ensure the website is displayed correctly and to optimise of the website Information security Analyses |
| Legal basis: | Article 6(1)(f) of the GDPR (legitimate interest) – Provision of our website and IT security |
| Recipients (categories): | Employees IT service providers |
| Transfers to third countries: | None |
| Retention period: | usually 7 days |
| DATA NOT COLLECTED DIRECTLY | |
| Personal data (cat.): | IP address |
| Source: | Internet service provider |
4.3. Newsletter
On our website, we offer you the option to subscribe, on a voluntary basis, to our
general newsletter. This keeps you informed about the specified
topics. You can withdraw your consent to receive the newsletter, which is based on your consent,
at any time with future effect. You can do this either via the function directly
in the email or as described under ‘Your rights as a data subject/right to object
and Right to Withdraw Consent”.
Please note that, as part of our newsletter distribution process, we also
conduct reach and usage analyses. This is also carried out
subject to your voluntary consent.
| Data processor: | Rocket Science Group LLC, 675 Ponce de Leon Ave NE, Suite 5000, Atlanta, GA 30308 USA |
| Purpose: | Provision of our newsletters Marketing and public relations Customer retention Analyses |
| Legal basis: | Article 6(1)(a) of the GDPR (consent) |
| Recipients (categories): | Employees IT service providers |
| Transfers to third countries: | USA – Safeguards: Standard contractual clauses of the European Commission |
| Retention period: | Until consent is withdrawn |
4.4. Online shop
We offer an online shop on our website where you
purchase various products. In this context, we
necessary data is processed.
| Data processor: | Giant Monkey GmbH, Brunnenstraße 39, 10115 Berlin |
| Purpose: | Provision of our online shop Generating revenue Customer retention Operational process Analyses |
| Legal basis: | Article 6(1)(b) of the GDPR (pre-contractual measures and performance) |
| Recipients (categories): | Employees IT service providers |
| Transfers to third countries: | None |
| Retention period: | In accordance with legal requirements |
4.4.1. Payment methods
You can pay by credit card in our online shop. We use
use the services of Stripe for this purpose.
| Data processor: | Stripe Technology Europe, Limited, 25–28 North Wall Quay, Dublin 1 D01 H104, Ireland |
| Purpose: | Payment processing Analyses |
| Legal basis: | Article 6(1)(b) of the GDPR (performance of a contract) |
| Recipients (categories): | Employees Payment service providers |
| Transfers to third countries: | USA – Safeguards: Standard contractual clauses of the European Commission |
| Retention period: | In accordance with legal requirements |
4.4.2 PayPal
| Provider: | PayPal (Europe) S.à.r.l. et Cie., S.C.A., 22–24 Boulevard Royal, L-2449, Luxembourg |
| Description: | PayPal is a payment service provider. |
| Purpose: | – Payment processing – Analysis |
| Legal basis: | Article 6(1)(b) of the GDPR (pre-contractual and contractual obligations) |
| Recipients (categories): | – Employees – Payment service providers |
| Retention period: | In accordance with statutory requirements |
| Transfers to third countries: | None |
| The provider’s privacy policy: | https://www.paypal.com/webapps/mpp/ua/privacy-full |
4.5. Monetary donations
We offer you the option to make a monetary donation via PayPal
.
| Payment processor: | PayPal (Europe) S.à.r.l. et Cie., S.C.A., 22–24 Boulevard Royal L-2449, Luxembourg |
| Purpose: | Payment processing Analyses |
| Legal basis: | Article 6(1)(b) of the GDPR (performance of a contract) |
| Recipients (categories): | Employees Payment service providers |
| Transfers to third countries: | None |
| Retention period: | In accordance with legal requirements |
| The provider’s privacy policy | https://www.paypal.com/webapps/mpp/ua/privacy-full |
4.6. Social media
We are active on various social media platforms.
4.6.1. Share button
Our websites feature buttons displaying the logos of
social media platforms, which you can use to access our content on the
respective platforms. When you click this button
, personal data, such as your IP address, will be
to these networks.
If you have an account yourself, there is a possibility
the social media provider may be able to identify you and
information.
The transfer of data from our website to the
social media platform, there is what is known as joint responsibility
. For all further processing on the platform, the
operator is solely responsible.
4.6.2. Fan pages
On some of these social media platforms, we operate so-called
‘fan pages’, for which we may be jointly responsible with the operator
. In this context, our responsibility is limited to providing you with
information and, as a result, data relating to your visit to our page is
service provider. In some cases, it is possible
we may receive an analysis of user behaviour. We have no control over
we have no
control over this and are therefore not jointly responsible.
4.6.3. Facebook
| Provider: | Meta Platforms Ireland, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland |
| Purpose: | Marketing and public relations Customer retention Revenue generation Analyses |
| Legal basis: | Article 6(1)(f) of the GDPR – Legitimate interest: Provision of the content you have requested (Link) |
| Recipients (category): | Employees IT service providers Social media platform |
| Transfers to third countries: | USA – Safeguards: Standard contractual clauses of the European Commission |
| Retention period: | In accordance with legal requirements |
The provider’s privacy policy: | https://de-de.facebook.com/policy.php |
4.6.4. Instagram
| Provider: | Meta Platforms Ireland, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland |
| Purpose: | Marketing and public relations Customer retention Revenue generation Analyses |
| Legal basis: | Article 6(1)(f) of the GDPR – Legitimate interests: Provision of the content you have requested (link) |
| Recipients (cat.): | Employees IT service providers Social media platform |
| Transfers to third countries: | USA – Safeguards: Standard contractual clauses of the European Commission |
| Retention period: | In accordance with legal requirements |
The provider’s privacy policy: | Instagram Privacy Policy | Instagram Help Centre |
4.6.5. YouTube
| Provider: | Google Ireland Ltd., Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland |
| Purpose: | Marketing and public relations Customer retention Revenue generation Analyses |
| Legal basis: | Article 6(1)(f) of the GDPR – Legitimate interest: Provision of the content you have requested (Link) |
| Recipients (category): | Employees IT service providers Social media platform |
| Transfers to third countries: | USA – Safeguards: Standard contractual clauses of the European Commission |
| Retention period: | In accordance with legal requirements |
The provider’s privacy policy: | https://policies.google.com/?hl=de&gl=de |
5. Other service providers
5.1. Google CDN
As part of our online shop, Google CDN is used to provide
image data.
| Provider: | Google Ireland Ltd., Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland |
| Purpose: | Revenue generation Provision of the service Analyses |
| Legal basis: | Article 6(1)(b) of the GDPR – Pre-contractual steps in the online shop |
| Recipients (categories): | Employees IT service providers |
| Transfers to third countries: | USA – Safeguards: Standard contractual clauses of the European Commission |
| Retention period: | In accordance with legal requirements |
The provider’s privacy policy: | https://cloud.google.com/privacy/gdpr?skip_cache=true |
5.2. Google Maps
| Provider: | Google Ireland Ltd., Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland |
| Purpose: | Marketing and public relations Customer service Analyses |
| Legal basis: | Article 6(1)(f) of the GDPR – Legitimate interest: Provision of the content you have requested (Link) |
| Recipients (category): | Employees IT service providers |
| Transfers to third countries: | USA – Safeguards: Standard contractual clauses of the European Commission |
| Retention period: | In accordance with legal requirements |
The provider’s privacy policy: | https://policies.google.com/?hl=de&gl=de |
5.3 HubSpot
| Provider | HubSpot, Inc., 25 First Street, Cambridge, MA 02141, USA |
| Description | We use HubSpot to manage our customer relationships and contact details |
| Purpose | Business process Mailings Communication / PR Analyses |
| Legal basis | Article 6(1)(a) of the GDPR (Consent) Article 6(1)(f) of the GDPR (Legitimate interest: Operational processes |
| Recipients (cat.) | Employees IT service providers |
| Retention period | In accordance with statutory requirements |
| Transfers to third countries | USA, guarantee: Standard contractual clauses of the European Commission |
5.4. University of Hamburg
For our library catalogue, we use the services of the
University of Hamburg.
| Data processor: | University of Hamburg, Mittelweg 177, 20148 Hamburg |
| Purpose: | Operational procedures Documentation Analysis |
| Legal basis: | Article 6(1)(f) of the GDPR – Legitimate interest: Provision of the service you have requested |
| Recipients (categories): | Employees IT service providers |
| Transfers to third countries: | None |
| Retention period: | In accordance with legal requirements |
The provider’s privacy policy: | https://www.uni-hamburg.de/datenschutz.html |
5.5 Matterport
We use a virtual tour hosted online by Matterport, Inc., 352 E. Java Dr., Sunnyvale, CA 94089, USA. Matterport’s privacy programme is designed to comply with applicable data protection laws and regulations and takes into account many of the world’s most important data protection frameworks:
International Privacy Policy: https://matterport.com/privacy-policy
Data Processing Addendum (‘DPA’): https://matterport.com/legal/data-processing-addendum
5.6 Mpskin
We use the MPskin software to enhance and present our 3D tours. The provider is MPskin GmbH, Via Bolzano Str. 40, 39057 Appiano (BZ), Italy. For details on data processing by MPskin, please refer to the provider’s privacy policy and Data Processing Agreement (“DPA”): https://www.mpskin.com/de/dpa
6. The use of tracking tools
In order to optimise our website from our perspective,
we also use cookies, amongst other things. These are small text files
which are loaded into your browser or stored on your device
. Cookies can perform various functions,
such as adapting the website to your screen,
browser and language settings, as well as providing many
features relating to our online shop.
In addition, the term ‘cookie’ is used as a synonym for tracking tools
. Tracking tools help us to tailor our website even better
to your needs.
6.1. Google Tag Manager
Google Tag Manager enables us to manage the use of
cookies and other tracking tools centrally.
| Provider: | Google Ireland Ltd., Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland |
| Purpose: | Operational processes Provision of the website and its functionality Analyses |
| Legal basis: | Article 6(1)(a) of the GDPR – Consent |
| Recipients (categories): | Employees SaaS providers |
| Transfers to third countries: | USA – Safeguards: Standard contractual clauses of the European Commission |
| Retention period: | In accordance with legal requirements |
The provider’s privacy policy: | https://policies.google.com/?hl=de&gl=de |
6.2. Google Analytics
We use the Google
Analytics to analyse the use of our website. We have configured the tool to use a privacy-friendly, data-minimising
configuration; this means that the IP address is immediately
.
| Provider: | Google Ireland Ltd., Google Building Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland |
| Purpose: | Website optimisation Revenue generation Analyses |
| Legal basis: | Article 6(1)(a) of the GDPR – Consent |
| Recipients (categories): | Employees SaaS providers |
| Transfers to third countries: | USA – Safeguards: Standard contractual clauses of the European Commission |
| Retention period: | In accordance with legal requirements |
The provider’s privacy policy: | https://policies.google.com/?hl=de&gl=de |
6.3. Simple Analytics
To analyse the use of our online shop, we use the solution provided by
Simple Analytics to analyse usage of our online shop. No personal data is collected in the process.
The data collected does not allow the data subject to be identified
.
| Provider: | Simple Analytics, Hooftlaan 4, 1401 ED Bussum, Netherlands |
| Purpose: | Website optimisation Revenue generation Analyses |
| Legal basis: | None, as no personal data is processed . |
| Recipients (cat.): | Employees SaaS providers |
| Transfers to third countries: | None |
| Retention period: | In accordance with legal requirements |
The provider’s privacy policy: | https://docs.simpleanalytics.com/ |
7. Protection of your data
To protect your personal data, we have implemented measures
which comply with data protection legislation and the state of the art in our industry
. These are continuously reviewed and updated where necessary.
The aim is to protect your data against accidental or deliberate
manipulation, partial or complete loss,
destruction or unauthorised access by third parties.
To transfer data between our website and our
back-end systems, communication is encrypted using the TLS
(Transport Layer Security).
We protect our systems and data processing operations through a range of
technical and organisational measures. These include, amongst other things,
data encryption, pseudonymisation and anonymisation, logical and
physical access restrictions and controls, firewalls and
recovery systems and integrity tests.
Our staff receive regular training on the appropriate handling of
personal data and, in accordance with the
legal requirements to uphold data confidentiality
.
8. Processing of data relating to minors
Our products and services must not be used by young people
under the age of 16.
9. Amendments to this privacy notice
This privacy notice is revised from time to time
to bring them into line with current developments within the company,
our products and services, legal requirements and
societal developments.
Date:
3 July 2026
