This data protection declaration clarifies the type, scope and purpose of the processing of personal data (hereinafter referred to as “data”) within my online offer and the websites, functions and contents connected with it as well as external online presences, such as my social media profiles (hereinafter referred to collectively as “online offer”). With regard to the terms used, e.g. “processing” or “person responsible”, I refer to the definitions in Art. 4 of the Basic Data Protection Regulation (DSGVO).
Person responsible
Kati Gausmann
Zwiestädter Straße 10
12055 Berlin, Germany
mail@kati-gausmann.de
+49 (0)163 638 38 35
Types of data processed
- inventory data (e.g. names, addresses)
- Contact details (e.g., e-mail, telephone numbers)
- Content data (e.g. text entries, photographs, videos)
- usage data (e.g. websites visited, interest in content, access times)
- Meta/communication data (e.g. device information, IP addresses)
Categories of data subjects
Visitors and users of the online offer (in the following I will also refer to the persons concerned collectively as “users”)Purpose of the processing
- Provision of the online offer, its functions and contents
- Answering contact requests and communication with users
- Security measures
- Reach Measurement/Marketing
Used terms
“Personal data” shall mean any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”); an identifiable person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person “Processing” means any operation or set of operations which is performed upon personal data, whether or not by automatic means. The term is broad and covers virtually all processing of data.
“pseudonymisation” means the processing of personal data in such a way that the personal data cannot be related to a specific data subject without the inclusion of supplementary information, provided that this supplementary information is kept separate and is subject to technical and organisational measures ensuring that the personal data is not related to an identified or identifiable natural person “profiling” shall mean any automated processing of personal data consisting in using such personal data to evaluate certain personal aspects relating to a natural person, in particular with a view to analysing or predicting aspects relating to the performance of work, the economic situation, health, personal preferences, interests, reliability, conduct, whereabouts or movements of that natural person.
“Controller” shall mean the natural or legal person, public authority, agency or any other body which alone or jointly with others determines the purposes and means of the processing of personal data. “Processor” means any natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller(s).
Relevant legal bases
In accordance with Art. 13 DSGVO, I hereby inform you of the legal basis of my data processing. If the legal basis is not stated in the data protection declaration, the following applies: The legal basis for obtaining consent is Art. 6 para. 1 lit. a and Art. 7 DSGVO, the legal basis for processing for the purpose of fulfilling my services and implementing contractual measures and answering enquiries is Art. 6 para. 1 lit. b DSGVO, the legal basis for processing for the purpose of fulfilling my legal obligations is Art. 6 para. 1 lit. c DSGVO, and the legal basis for processing for the purpose of safeguarding my legitimate interests is Art. 6 para. 1 lit. f DSGVO. In the event that vital interests of the data subject or another natural person make it necessary to process personal data, Article 6(1)(d) of the DPA serves as the legal basis.
Security measures
In accordance with Art. 32 DSGVO and taking into account the state of the art, the implementation costs and the nature, scope, circumstances and purposes of the processing as well as the varying degrees of probability and seriousness of the risk to the rights and freedoms of natural persons, I shall take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.
Such measures shall include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to data, as well as access, input, disclosure, safeguarding of availability and segregation of data relating to them. Furthermore, I have established procedures to ensure that data subjects’ rights are exercised, data is deleted and that data is responded to if it is compromised. Furthermore, I take the protection of personal data into account already during the development or selection of hardware, software and procedures, in accordance with the principle of data protection by designing technology and by using data protection-friendly presettings (Art. 25 DSGVO).
Cooperation with contract processors* and third parties
If, in the course of my processing, I disclose data to other persons and companies (processors or third parties), transfer it to them or otherwise grant them access to the data, this will only be done on the basis of a legal authorisation (e.g. if the data must be transferred to third parties, such as payment service providers, in accordance with Art. 6 Para. 1 letter b DSGVO for the fulfilment of the contract), if you have given your consent, if a legal obligation provides for this or on the basis of my legitimate interests (e.g. when using agents, web hosts, etc.). If I commission third parties to process data on the basis of a so-called “contract processing agreement”, this is done on the basis of Art. 28 DSGVO.
Transfers to third countries
If I process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)) or if this is done in the context of using the services of third parties or disclosure or transfer of data to third parties, this will only take place if it is done to fulfil my (pre-)contractual obligations, on the basis of your consent, on the basis of a legal obligation or on the basis of my legitimate interests. Subject to legal or contractual permissions, I process or allow the data to be processed or transferred in a third country only if the special requirements of Art. 44 ff. DSGVO. This means, for example, that the processing is carried out on the basis of special guarantees, such as the officially recognised determination of a level of data protection corresponding to that of the EU or compliance with officially recognised special contractual obligations (so-called “standard contractual clauses”).
Rights of data subjects
You have the right to obtain confirmation as to whether or not data in question is being processed and to obtain information on such data, as well as further information and a copy of the data in accordance with Article 15 of the DPA. You have accordingly. Art. 16 DPA, you have the right to request the completion of data concerning you or the correction of incorrect data concerning you. In accordance with Art. 17 DSGVO, you have the right to demand that data concerning you be deleted immediately, or alternatively, in accordance with Art. 18 DSGVO, to demand that the processing of the data be restricted. You have the right to demand that the data concerning you which you have made available to us be received in accordance with Art. 20 DSGVO and to demand that it be passed on to other responsible parties. You also have the right to lodge a complaint with the competent supervisory authority in accordance with Art. 77 DSGVO.
Right of withdrawal
You have the right to revoke consents granted in accordance with Art. 7 Para. 3 DSGVO with effect for the future
Right of objection
You can object to the future processing of data concerning you at any time in accordance with Art. 21 DSGVO. The objection may in particular be made against processing for the purposes of direct advertising.
Cookies and right of objection for direct advertising
Cookies” are small files that are stored on the user’s computer. Different information can be stored within the cookies. A cookie is primarily used to store information about users (or the device on which the cookie is stored) during or after a visit to an online service. Temporary cookies, or “session cookies” or “transient cookies”, are cookies that are deleted after users leave online offers and close the browser. In such a cookie, for example, the contents of a shopping cart in an online shop or a login status can be stored. Cookies are described as “permanent” or “persistent” if they remain stored even after the browser is closed. For example, the login status can be saved if the user visits the site after several days. The interests of the users can also be stored in such a cookie, which is used for coverage measurement or marketing purposes. Third-party cookies are cookies offered by providers other than the person responsible for the online service (otherwise, if it is only their cookies, it is called “first-party cookies”). I can use temporary and permanent cookies and I will inform you about this in my privacy policy. If users do not want cookies to be stored on their computer, they are asked to deactivate the corresponding option in the system settings of their browser. Stored cookies can be deleted in the system settings of the browser. The exclusion of cookies can lead to functional restrictions of this online offer.
A general objection to the use of cookies used for online marketing purposes can be declared for many of the services, especially in the case of tracking, via the US site http://www.aboutads.info/choices/ or the EU site http://www.youronlinechoices.com/. Furthermore, the storage of cookies can be achieved by deactivating them in the browser settings. Please note that in this case not all functions of this online offer can be used.
Deletion of data
The data processed by me will be deleted or limited in their processing in accordance with articles 17 and 18 DSGVO. Unless expressly stated in this data protection declaration, the data stored by me will be deleted as soon as they are no longer required for their intended purpose and the deletion does not conflict with any statutory storage obligations. If the data are not deleted because they are required for other and legally permissible purposes, their processing will be restricted. This means that the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.
According to legal requirements in Germany, the storage is in particular for 10 years in accordance with §§ 147 para. 1 AO, 257 para. 1 nos. 1 and 4, para. 4 HGB (books, records, management reports, accounting vouchers, trading books, documents relevant for taxation, etc.) and 6 years in accordance with § 257 para. 1 nos. 2 and 3, para. 4 HGB (commercial letters).
Newsletter
With the following notes I would like to inform you about the contents of my newsletter as well as the registration, dispatch and statistical evaluation procedure and your rights of objection. By subscribing to my newsletter, you agree to receive it and to the described procedures.
Content of the newsletter: I send newsletters, e-mails and other electronic notifications containing advertising information (hereinafter “newsletter”) only with the consent of the recipients* or with a legal permission. If the contents of the newsletter are specifically described in the context of a registration for the newsletter, they are decisive for the consent of the users. Furthermore, my newsletters contain information about my services and my art. Registering in the list of recipients and logging: The registration to my newsletter is done by hand by the recipient(s) in the list of recipients or by expressing a corresponding wish. The registrations for the newsletter will be logged in order to be able to prove the registration process according to the legal requirements. Changes to your data stored by the dispatch service provider are also logged.
Registration data: To subscribe to the newsletter, it is sufficient to enter your e-mail address. Optionally, I would like to ask you to enter a name for personal contact in the newsletter.
The dispatch of the newsletter and the measurement of success associated with it are based on the consent of the recipients according to Art. 6 para. 1 lit. a, Art. 7 DSGVO in conjunction with § 7 para. 2 no. 3 UWG or, if consent is not required, on my legitimate interests in direct marketing according to Art. 6 para. 1 lt. f. DSGVO in conjunction with § Art. 7 Para. 3 UWG.
The registration procedure is recorded on the basis of my legitimate interests pursuant to Art. 6 para. 1 lit. f DSGVO. I am interested in the use of a user-friendly and secure newsletter system that serves my business interests as well as the expectations of the users and also allows me to prove my consent.
Termination/Cancellation
You can cancel the receipt of my newsletter at any time, i.e. revoke your consent. You will find a link to cancel the newsletter at the end of each newsletter. I may store the unsubscribed e-mail addresses for up to three years on the basis of my legitimate interests before I delete them in order to be able to prove that I have previously given my consent. The processing of this data is limited to the purpose of a possible defence against claims. An individual request for deletion is possible at any time, provided that the former existence of a consent is confirmed at the same time.
Newsletter – E-Mail
Newsletters are sent by group or serial e-mail.
Hosting and e-mail dispatch
The hosting services I use serve to provide the following services: Infrastructure and platform services, computing capacity, storage space and database services, e-mail dispatch, security services as well as technical maintenance services which I use for the purpose of operating this online offer.
In doing so, I, or my hosting provider, process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interests and visitors to this website on the basis of my legitimate interests in an efficient and secure provision of this website in accordance with Art. 6 Para. 1 letter f DSGVO in conjunction with Art. 6 Para. 1 letter f DSGVO. Art. 28 DSGVO (conclusion of contract processing agreement).
Collection of access data and log files
I, or my hosting provider, on the basis of my legitimate interests as defined in Art. 6 Par. 1 lit. f. DSGVO data about every access to the server on which this service is located (so-called server log files). The access data includes the name of the website accessed, file, date and time of access, amount of data transferred, notification of successful access, browser type and version, the user’s operating system, referrer URL (the previously visited site), IP address and the requesting provider.
For security reasons (e.g. to clarify misuse or fraud), log file information is stored for a maximum of 7 days and then deleted. Data whose further storage is required for evidence purposes is excluded from deletion until the respective incident has been finally clarified.
Online presence in social media (social media)
I maintain online presences within social networks and process user data in this context in order to communicate with the users active there or to offer information about me.
I would like to point out that data of the referrer URL can be processed outside the European Union. This can result in risks for the users, because the enforcement of the users’ rights could be made more difficult.
Furthermore, the data of users within social networks are usually processed for market research and advertising purposes. For example, user profiles can be created on the basis of user behaviour and the resulting interests of the users. The user profiles can in turn be used, for example, to place advertisements within and outside the networks which presumably correspond to the interests of the users. For these purposes, cookies are usually stored on the users’ computers, in which the usage behaviour and interests of the users are stored. Furthermore, data may also be stored in the user profiles regardless of the devices used by the users (especially if the users are members of the respective platforms and are logged in to them).
For a detailed description of the respective forms of processing and the possibilities of objection (opt-out), please refer to the data protection declarations and information provided by the operators of the respective networks. In the case of requests for information and the assertion of rights of data subjects, we would also like to point out that these can most effectively be asserted with the providers. Only the providers have access to the users’ data and can take appropriate measures and provide information directly. Should you nevertheless require assistance, please contact us.
Data types processed: inventory data (e.g. names, addresses), contact data (e.g. e-mail, telephone numbers), content data (e.g. entries in online forms), usage data (e.g. websites visited, interest in content, access times), meta/communication data (e.g. device information, IP addresses).
Affected persons: Users (e.g. website visitors, users of online services). Processing purposes: contact requests and communication, tracking (e.g. interest/behavioural profiling, use of cookies), remarketing, reach measurement (e.g. access statistics, recognition of returning visitors).
Legal basis: legitimate interests (Art. 6 para. 1 sentence 1 lit. f. DSGVO).
Used services and service providers: Facebook
The data controller has integrated components of the company Facebook on this website. Facebook is a social network. A social network is a social meeting place operated on the Internet, an online community that generally allows users to communicate with each other and interact in virtual space. A social network can serve as a platform for the exchange of opinions and experiences or enables the Internet community to provide personal or company-related information. Facebook enables users of the social network to create private profiles, upload photos and network via friend requests, among other things.
The operating company of Facebook is Facebook, Inc. 1 Hacker Way, Menlo Park, CA 94025, USA. The person responsible for processing personal data is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, if a data subject lives outside the USA or Canada. Each time a user accesses one of the individual pages of this website, which is operated by the data controller and on which a Facebook component (Facebook plug-in) has been integrated, the Internet browser on the information technology system of the data subject is automatically prompted by the respective Facebook component to download a display of the corresponding Facebook component from Facebook. A complete overview of all Facebook plug-ins can be found at https://developers.facebook.com/docs/plugins/?locale=de_DE. As part of this technical process, Facebook is informed which specific subpage of our website is visited by the person concerned. If the person concerned is logged on to Facebook at the same time, Facebook recognizes which specific subpage of our website the person concerned is visiting each time the person concerned calls up our website and for the entire duration of their stay on our website.
This information is collected by the Facebook component and assigned by Facebook to the respective Facebook account of the person concerned. If the data subject clicks on one of the Facebook buttons integrated on our website, for example the “Like” button, or if the data subject makes a comment, Facebook assigns this information to the personal Facebook user account of the data subject and stores this personal data. Facebook receives information via the Facebook component that the data subject has visited our website whenever the data subject is logged in to Facebook at the same time when he or she accesses our website; this occurs regardless of whether the data subject clicks on the Facebook component or not. If the data subject does not want this information to be transmitted to Facebook, he or she can prevent the transmission by logging out of his or her Facebook account before accessing our website. The data policy published by Facebook, which is available at https://de-de.facebook.com/about/privacy/, provides information about the collection, processing and use of personal data by Facebook. It also explains which setting options Facebook offers to protect the privacy of the person concerned. In addition, various applications are available that make it possible to suppress data transmission to Facebook. Such applications can be used by the data subject to suppress data transfer to Facebook.
The data controller has integrated components of the Instagram service on this website. Instagram is a service that qualifies as an audiovisual platform and allows users to share photos and videos and also to disseminate such data in other social networks. The operating company of the Instagram service is Facebook Ireland Ltd, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 Ireland. Each time a user accesses any of the individual pages of this website operated by the data controller and on which an Instagram component (Insta Button) has been integrated, the Internet browser on the information technology system of the data subject is automatically prompted by the relevant Instagram component to download a representation of the relevant Instagram component. As part of this technical process, Instagram is informed which specific page of our website is visited by the data subject. If the person concerned is logged on to Instagram at the same time, Instagram recognizes which specific subpage is visited by the person concerned each time the person calls up our website and for the entire duration of their stay on our website.
This information is collected by the Instagram component and assigned by Instagram to the respective Instagram account of the person concerned. If the person concerned clicks on one of the Instagram buttons integrated on our website, the data and information transferred with it is assigned to the personal Instagram user account of the person concerned and stored and processed by Instagram. Instagram will receive information through the Instagram component that the person has visited our website if the person is logged in to Instagram at the same time as he or she visits our website, regardless of whether the person clicks on the Instagram component or not. If the data subject does not want this information to be sent to Instagram, the data subject can prevent this information from being sent by logging out of his/her Instagram account before accessing our website. Further information and Instagram’s applicable privacy policy can be found at https://help.instagram.com/155833707900388 and https://www.instagram.com/about/legal/privacy/.
YouTube
The data controller has integrated YouTube components into this website. YouTube is an Internet video portal that allows video publishers to post video clips free of charge and other users to view, rate and comment on them free of charge. YouTube allows the publication of all types of videos, which is why complete film and television broadcasts, but also music videos, trailers or videos created by users themselves can be accessed via the Internet portal. YouTube is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin, D04 E5W5, Ireland. Each time the data subject accesses any of the individual pages of this website operated by the data controller on which a YouTube component (YouTube video) has been integrated, the Internet browser on the data subject’s IT system is automatically prompted by the relevant YouTube component to download a representation of the relevant YouTube component from YouTube. Further information about YouTube can be found at https://www.youtube.com/yt/about/de/. In the course of this technical procedure, YouTube and Google are informed which specific subpage of our website is visited by the person concerned. If the person concerned is logged on to YouTube at the same time, YouTube recognizes which specific subpage of our website the person concerned is visiting by calling up a subpage containing a YouTube video.
This information is collected by YouTube and Google and assigned to the respective YouTube account of the person concerned. YouTube and Google receive information via the YouTube component that the data subject has visited our website whenever the data subject is logged on to YouTube at the same time when he or she visits our website, regardless of whether or not the data subject clicks on a YouTube video. If the data subject does not wish this information to be transmitted to YouTube and Google, he or she can prevent the transmission by logging out of his or her YouTube account before visiting our website. The privacy policy published by YouTube, which can be found at https://www.google.de/intl/de/policies/privacy/, provides information about the collection, processing and use of personal data by YouTube and Google.