Source: https://www.schafhof-kuenstlerhaus.de/Quicknavigation/Data-protection?La=2
Timestamp: 2019-05-20 11:46:26
Document Index: 578491368

Matched Legal Cases: ['art. 6', 'art. 6', 'art. 6', 'art. 6', 'art. 6', 'art. 6', 'art. 15', 'art. 22', 'art. 46', 'art. 16', 'art. 18', 'art. 21', 'art. 17', 'art. 17', 'art. 19', 'art. 20', 'art. 21', 'art. 6', 'art. 7', 'art. 77']

Data protection / Schafhof
Home /	Data protection
Statement of Online Data Protection Policy in accordance with the GDPR
1. Name and address of the controller and the data protection officer
Bezirk Oberbayern (District Council of Upper Bavaria)
Phone.: 0049 89 2198-01
The District of Upper Bavaria’s data protection officer can be reached at:
Tel.: 0049 89 2198-93001
2.1. Extent of personal data processing
2.2. Legal basis for processing personal data
Where we need to process personal data for the purposes of fulfilling a contract, and the data subject is party to the contract, art. 6 paragraph 1 point b GDPR serves as the legal basis. This also applies to processing necessary to accommodate preparations for entering into a contract.
Where processing of personal data is necessary for the District of Upper Bavaria to fulfill a legal obligation, art. 6 paragraph 1 point c GDPR serves as the legal basis.
Where processing of personal data is necessary for protecting the vital interests of the data subject, or those of another individual, art. 6 paragraph 1 point d GDPR serves as the legal basis.
Where processing is necessary to protect the District of Upper Bavaria’s or a third party’s legitimate interests, and such interests are not overridden by the interests, fundamental rights and freedoms of the data subject, art. 6 paragraph 1 point f GDPR serves as the legal basis.
2.3. Deletion of data and data storage period
The data subject’s personal data will be deleted or blocked as soon as the purpose for which it has been collected has been fulfilled. Data may remain on record beyond this period if such is specified in European or national legislation from European Union Regulations, laws or other provisions to which the District of Upper Bavaria is subject. Data will also be deleted if a storage period specified in the above standards expires unless conclusion or fulfillment of a contract requires the data to remain on record further.
3. Provision of website and creation of log files
3.1. Details and extent of data processing
Any time our website bezirk-oberbayern.de is accessed, our system automatically records data and information concerning the accessing computer.
The user’s IP address (partially anonymized)
URL accessed when accessing
Recording the data in log files is necessary to ensure that the website operates correctly. The data further helps us optimize the website and ensure that our computer systems remain secure. No data is processed for marketing purposes in this context.
3.4. Data storage period
With respect to data being recorded in log files, the data is no longer required after seven days at the latest. Data may remain on record for longer. If so, the users’ IP addresses are deleted or rendered untraceable to make identification of the accessing client impossible.
3.5. Right to object and options for avoidance
4.1. Details and extent of data processing
The following data is recorded and transfer in these technically required cookies:
ReadSpeaker text-to-speech software configuration settings
Our website also employs cookies that facilitate analysis of the users’ web-surfing behavior.
The user’s IP address (anonymized)
Geolocational data (country, region, city, approximate longitude and latitude)
The user’s default language (Accept-Language header field)
Name of the program used (User-Agent header field)
Depending on the browser used, it is also possible to determine:
Device class information (desktop, tablet, smartphone, etc.)
Information on the device brand and model
Page title of the request
Previous URL (which referred to the retrieved page)
Files that were clicked and loaded
Clicks for referrals from targets outside the URL domain
Time to load and generate the page
Certain information is stored in cookies and collected by Matomo (more details under point 8):
Random one-time visitor ID
Time of the first visit
When accessing our website, the user is informed about the use of cookies for analysis purposes. In this context, reference is also made to this privacy policy.
The purpose of using technically necessary cookies is to make using our website easier for users. Several of our website’s functions will not work without using cookies. These functions require the browser to be recognized again after leaving and returning to our website.
4.4. Data storage period, right to object and options for avoidance
6.1. Details and extent of data processing
On our website you have the option to contact us under various email addresses provided. If you do so, we will store the personal user data included in the email. We will not give this data to anybody else. The data will be used solely for handling our conversation.
In this context, however, we would like to point out that information you send to us unencrypted by email could potentially be read by third parties during transfer.
We process the personal data obtained from users contacting us via email solely for the purposes of handling contact.
6.4. Data storage period
6.5. Right to object and options for avoidance
All users can at any time withdraw their consent to our processing their personal data. If a user contacts us by email, they can object at any time to our storing their personal data.
You can withdraw your consent and object to our storing data by sending an email to info@schafhof-kuenstlerhaus.de or by post to Schafhof – European Center for Art Upper Bavaria, Am Schafhof 1, 85354 Freising. If the revocation concerns the storing of data as part of the email contact with us, it should be directed to the previous email recipient.
In case of revocation of consent or storage the conversation cannot be pursued further. All personal data stored in the course of contacting will be deleted in this case.
7.1. Extent of personal data processing
We use the open-source tool Matomo (formerly PIWIK) on our website to analyze our users’ surfing behavior. The software stores a cookie on the user’s computer (see above for more on cookies). When any part of our website is accessed, the following data is stored: The user’s IP address (anonymized)
7.2. Legal basis for processing personal data
Processing the users’ personal data allows us to analyze their surfing behavior. By analyzing the obtained data, we can compile information on how the various components of our website are used. This helps us keep on improving our website and its user experience. The above purposes also constitute our legitimate interests in processing the data under art. 6 paragraph 1 point f GDPR. Anonymizing the IP addresses adequately satisfies the users’ interests in protecting their personal data.
7.4. Data storage period
The data is deleted as soon as we no longer need them for our records. In our cases, this corresponds to eighteen months later.
7.5. Right to object and options for avoidance
We offer our users the option to opt out of the analysis process. To do so, follow the corresponding link at the top of the screen when you first visit our website. This will save another cookie to your system that tells our system not to store your user data. If you delete this cookie from your system later, you will need to set the opt-out cookie again.
For more details on privacy settings in Matomo, follow the link: https://matomo.org/docs/privacy/
8. Use of the ReadSpeaker text-to-speech service
8.1. Extent of personal data processing
We offer use of the ReadSpeaker text-to-speech service for all text content on our website. By clicking on the “Listen to article” button, the relevant text is transferred to the ReadSpeaker server via the user’s IP address, where an audio file is generated and sent back to the user IP in a streaming process. Immediately after delivering the audio file to the user IP, the operation and the user’s IP address will be deleted from the ReadSpeaker server. ReadSpeaker does not store any personal data. All services are performed in Europe (Sweden and Ireland).
When using the ReadSpeaker function, technical cookies are stored on the terminal device in order to retain the user-selected settings (highlighting, text size, volume, etc.) and deleted after the session or a corresponding period (up to thirty days) in accordance with the function. If the ReadSpeaker function is not activated, no cookies are stored on the device when visiting the website.
8.2. Legal basis for the processing of personal data
The legal basis for processing users’ personal data is art. 6 paragraph 1 point f GDPR.
The processing of personal data occurs in order to make the text-to-speech function using ReadSpeaker technically possible. This increases our website’s degree of accessibility, which is also our legitimate interest.
8.4. Data storage period
The data is deleted as soon as it is no longer required for achieving the purpose for which it was recorded. The user’s IP address is deleted immediately after the audio file is sent from the ReadSpeaker server. The technical cookies will be deleted from the user’s browser after thirty days at the latest.
8.5. Right to object and options for avoidance
When using ReadSpeaker, cookies are stored on the user’s computer and transferred to us by that computer. As the user, you therefore have complete control over the use of cookies. You can restrict or prevent your computer from sending cookies by adjusting your Internet browser’s settings. You can delete any saved cookies at any time. You can even automate deletion. If you disable cookies for our website, you may no longer be able to use the ReadSpeaker text-to-speech service’s full range of functions.
The user’s IP address is only transferred when using the ReadSpeaker text-to-speech service and deleted immediately after the sending of the audio file. If the software is not used, this transfer will not take place.
Upper Bavaria corrects and/or completes the personal data relating to yourself if this data is incorrect or incomplete.
You are entitled to request information from the District of Upper Bavaria on whether we are processing any personal data related to yourself.
If we do, you can further request information from the District of Upper Bavaria in accordance with art. 15 GDPR regarding the following information:
(3) the recipients or categories of recipients to whom the personal data relating to you or yourself is or will be disclosed;
(8) whether there was any automated decision-making and profiling as per art. 22 paragraphs 1 and 4 GDPR and—at least where such was the case—useful information on the underlying logic and the impact and pursued effects of this processing on the data subject.
You are entitled to request information on whether the personal data relating to yourself will be transmitted to a non-EU member state or international organization. You are entitled in this context to request information on suitable safeguards according to art. 46 GDPR related to the transmission.
You are entitled in accordance with art. 16 GDPR to request that the District of Upper Bavaria corrects and/or completes the personal data relating to yourself if this data is incorrect or incomplete.
You can request limits to the processing of personal data relating to yourself in accordance with art. 18 GDPR if the following applies:
(1) if you contest the correctness of the personal data relating to yourself for a period that allows the District of Upper Bavaria to check the data’s correctness;
(2) processing of the data is illegal and you object to deletion of the data in favor of restricting the personal data’s use;
(3) the District of Upper Bavaria no longer requires the personal data for the purposes of processing, but you need them to legitimize, exercise or defend a legal claim, or
(4) you have objected to processing in accordance with art. 21 paragraph 1 GDPR and it has not yet been established whether the District of Upper Bavaria’s legitimate interests outweigh your own.
If processing the personal data relating to yourself has been limited, the data can without your consent be used neither to assert, exercise or defend legal claims nor to enforce protection of another individual’s or legal entity’s rights nor can it be processed in the public interest of the European Union or one of its member states.
If processing has been restricted in accordance with the above conditions, you will be notified by the District of Upper Bavaria before any restrictions are lifted.
9.4.1. Obligation to delete
You can in accordance with art. 17 GDPR request that the District of Upper Bavaria delete the personal data relating to yourself immediately; the District of Upper Bavaria is then obliged to delete the data immediately, provided one of the following conditions applies:
(5) Deletion of the personal data relating to yourself is necessary to fulfill a legal obligation imposed by European Union law or German law.
9.4.2. Notification of third parties
If the District of Upper Bavaria has published personal data relating to yourself and has become obliged to delete it as per art. 17 paragraph 1 GDPR, it will take action, including technical measures, using the available technology and at appropriate expense with the aim of notifying any controllers processing your personal data that you as the data subject have requested deletion of all links to said personal data or to copies or reproductions thereof.
(2) to fulfill a legal obligation requiring the controller to process the data imposed upon them by European Union law or the national laws of a European Union member state, or to complete a duty in the public interest or to perform executive duties appointed to the controller;
9.5. Notification Obligation
If you have asserted your right to rectification, erasure or restriction of processing against the District of Upper Bavaria, then it is under obligation to notify all recipients to whom the personal data relating to yourself has been disclosed of the corresponding rectification or erasure of data or of the restriction of their processing, except where such notification proves impossible or unreasonable.
You have the right to be informed of who these recipients are by the District of Upper Bavaria in accordance with art. 19 GPDR.
In accordance with art. 20 GPDR, you have the right to receive the personal data concerning yourself that you have provided to the District of Upper Bavaria in a structured, commonly used and machine-readable format. You are also entitled to transmit this data to another controller without the District of Upper Bavaria hindering you from doing so and if
(2) the processing occurs by automated methods.
When exercising this right, you can further request the District of Upper Bavaria to send the personal data relating to yourself directly to another controller, provided this is technically feasible. This must not adversely affect the liberties and rights of others.
The right to data portability does not extend to the processing of personal data where such processing is necessary for fulfilling a duty in the public interest or for exercising executive duties appointed to the District of Upper Bavaria.
In accordance with art. 21 GDPR, you are entitled to object for reasons arising from your own personal situation at any time against processing of personal data relating to yourself where processing is legitimized by art. 6 paragraph 1 points e or f GDPR; this applies in equal measure to profiling legitimized by these provisions.
The district of Upper Bavaria will cease to process your personal data unless they can prove compelling legitimate reasons for processing that override your interests, rights and liberties or processing pursues the assertion, exercise or defense of legal claims.
You may, in connection with the use of information society services—Directive 2002/58/EC notwithstanding—exercise your right to object by means of automated methods that are subject to technical specifications.
9.8. Right to withdraw your consent under data protection law
In accordance with art. 7 paragraph 3 GDPR, you are entitled to withdraw your consent under data protection law at any time. Your withdrawing consent does not affect legitimacy of any processing that has occurred with your consent prior to withdrawal.
(1) is necessary to allow conclusion or fulfillment of a contract between yourself and the controller,
9.10. Right to complain with a supervisory authority
If you believe that processing of personal data relating to yourself is in breach of the GDPR, you have the right in accordance with art. 77 GDPR to lodge a complaint with a supervisory authority, particularly in the EU member state you, your place of work or the locale of the alleged infringement are in. In this case, the right of appeal exists with the Bayerische Landesbeauftragte für den Datenschutz (BayLfD).
10. Transferal of personal data to third parties
Your personal data will be transferred to Advantic Systemhaus GmbH, Gutenbergstrasse 15, 23566 Lübeck, which acts as our processor. Advantic Systemhaus GmbH operates the server hosting our website and is the provider of iKiss, the content management system on which our website is technically based. In this context, Advantic Systemhaus GmbH’s responsibilities include, in particular, the maintenance and support of the content management system.
11. Timeliness
This statement of online data protection policy is effective beginning May 25, 2018.
Latest version: May 2018.