Source: https://www.kuma.art/en/data-protection
Timestamp: 2019-04-18 16:40:45+00:00

Document:
In general, our website can be used without providing personal data. When it is necessary to gather personal data through our website, this occurs as far as possible on a purely consensual basis. This data will not be forwarded to third parties without the express consent of the user. We would like to draw the user’s attention to the fact that transmission of data via the internet can expose security vulnerabilities. It is not possible to guarantee that data will never become accessible to third parties. The use of the contact data published within the framework of the imprint obligations by third parties for the purpose of sending advertisements and information materials not expressly demanded by the user is hereby explicitly forbidden. We reserve the right to take legal action in case of unsolicited sending of advertising materials, e.g. in the form of spam mail.
Collection and disclosure of information: The Google +1 button allows you to publish information worldwide. The Google +1 button gives you and other users personalized content from Google and our partners. Google stores both the information that you have given +1 to access this content and information about the page that you viewed when you clicked +1. Your +1 can appear in Google services such as in search results or your Google profile, or elsewhere on websites and advertisements, along with your profile name and picture. Google records information about your +1 activity to improve Google services for you and others. To use the Google +1 button, you need a public Google profile that is visible worldwide and must contain at least the name chosen for the profile. This name is used in all Google services. In some cases, this name may also replace another name you used when sharing content through your Google Account. The identity of your Google profile may be displayed to users who know your email address or have other identifying information about you.
Our website pages include functions for Instagram services. These functions are provided by Instagram Inc., 1601 Willow Road, Menlo Park, CA 94025, USA. If you are logged into your Instagram account you can link the contents of our website pages to your Instagram profile by clicking the Instagram button. This allows Instagram to associate your visit to our website with your user account. We would like to point out that we as the website provider have no knowledge of the content of the data transmitted or of how it is used by Instagram.
In the following, information is provided about the contents of our newsletter and about our registration, dispatch, and statistical evaluation procedures, as well as your rights of objection. By subscribing to our newsletter, you agree to the receipt of the newsletter and the procedures described below.
Content of the newsletter: We send newsletters, e-mails, and other electronic notifications containing advertising information (hereinafter “newsletters”) exclusively with the recipients’ consent or with legal permission. If when subscribing to the newsletter its content is concretely described, this is to provide the user with the information necessary for their consent. In addition, our newsletters contain information about our services and our institution.
Double opt-in and logging: Subscription to our newsletter takes place via a so-called double opt-in procedure. This means that after registering you will receive an e-mail asking you to confirm your subscription. This confirmation is necessary so that no one can subscribe with an e-mail address not belonging to them. Subscriptions to the newsletter are logged in order to be able to prove that the subscription process operates in accordance with legal requirements. Data logged includes the subscription and confirmation time, as well as the IP address. The changes to your data stored with the email marketing service provider are also logged.
Credentials: To subscribe to the newsletter, simply enter your e-mail address. We also ask for the optional provision of a name, to enable us to address you personally in the newsletter.
The dispatch of the newsletter and the associated performance measurement is based on the recipient’s consent pursuant to Art. 6 para. 1 a, Art. 7 of the GDPR in conjunction with § 7 para. 2 no. 3 of the UWG (Act Against Unfair Competition) or on the basis of the legal permission pursuant to § 7 para. 3 of the UWG (Act Against Unfair Competition) .
The registration procedure is logged on the basis of our legitimate interests pursuant to Art. 6 para. 1 letter f GDPR. We are committed to providing a user-friendly and secure newsletter system that serves both our business interests and the expectations of users and also allows us to provide proof of consent.
Cancellation/Revocation: You can cancel the receipt of our newsletter at any time, i.e. revoke your consent. You will find a link to unsubscribe from the newsletter at the end of each newsletter. We may store the e-mail addresses that have unsubscribed for up to three years on the basis of our legitimate interests before we delete them, in order to be able to prove a previously given consent. The processing of this data is limited to the purpose of defense against putative claims. An individual application for cancellation is possible at any time, provided that at the same time the former existence of consent is confirmed.
The newsletter is sent via the mail service provider “MailChimp,” a newsletter delivery platform offered by the US provider Rocket Science Group, LLC, 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA. The data protection regulations of the email marketing service provider can be viewed here: https://mailchimp.com/legal/privacy/. The Rocket Science Group LLC d/b/a MailChimp is certified under the Privacy Shield Agreement and thus offers a guarantee to comply with European data protection regulations (https://www.privacyshield.gov/participant?id=a2zt0000000TO6hAAG&status=A...). The dispatch service provider is used on the basis of our legitimate interests according to Art. 6 para. 1 letter f GDPR and an order processing contract according to Art. 28 para. 3 s. 1 GDPR.
The email marketing service provider can use the recipient’s data in pseudonymous form, i.e. without assignment to a user, to optimize or improve its own services, e.g. for the technical optimization of the dispatch and presentation of the newsletter or for statistical purposes. However, the email marketing service does not use the data of our newsletter recipients to contact the recipients themselves or to pass the data on to third parties.
The newsletters contain a so-called “web-beacon,” i.e. a pixel-sized file which is downloaded from our server when the newsletter is opened or, if we use a email marketing service provider, from their server. Within the framework of this retrieval, technical information, such as information about the browser and your system, as well as your IP address and time of retrieval are initially collected.
This information is used for the technical optimization of the services based on the technical data or the target groups and their reading behavior based on their retrieval locations (which can be determined using the IP address) or access times. The statistical surveys also include determining whether the newsletters are opened, when they are opened, and which links are clicked. For technical reasons, this information can be assigned to the individual newsletter recipients. However, it is neither our intention, nor, if involved, that of the email marketing service provider, to observe individual users. Rather, the analyses help us to understand the reading habits of our users and to adapt our contents to them or to send different content according to our users’ interests.

References: Art. 6
 Art. 7
 § 7
 § 7
 Art. 6
 Art. 6
 Art. 28