Thank you fro your interest in our Website available under las-art.foundation (hereinafter "Website") and our services provided on it (hereinafter "Services").
The protection of your personal data in the context of the use of the Website and the Services is very important to us. We respect your privacy. This is why we only collect and process your personal data in accordance with the applicable statutory provisions.
The controller within the scope of the General Data Protection Regulation (Art. 4 no. 7 GDPR) is the Light Art Space gGmbH, Caroline-von-Humboldt-Weg 34, 10117 Berlin, Germany, phone: +49 30 21 48 02 346 (hereinafter "LAS," "we," "our," "us" etc.)
2. What is personal data
Personal data is all information that can be associated with you individually (cf. Art. 4 no. 1 GDPR). This includes e.g. your name, your address, your phone number and your email address. On the other hand, general information by means of which you cannot be identified does not constitute personal data. Such information includes e.g. the number of users of the Website.
3. What types of personal data do we collect and process for which purposes
3.1. Web server protocols (Including the IP address)
When you visit our Website, due to technical requirements, our web server will automatically record your full IP address, the date and the time at which you are visiting the Website, the sections you access on the Website, the website you visited before accessing the Website, the browser you use (e.g. Mozilla Firefox, Google Chrome etc.), the operating system you use (e.g. Windows 10, MacOS etc.), and the domain name and address of your Internet provider (e.g. Deutsche Telekom). This information is required for the technical transmission of the Website and the secure operation of the server. This information is not merged with other data sources.
We process this information in order to observe and monitor the stability, functionality, and technical performance of the Website and the Services and in order to detect, identify, eliminate and solve any potential problems and errors on the Website and within the Services. The legal basis for the processing of this information is our legitimate interests (Art. 6 (1) lit. f GDPR), which consist in ensuring and improving the integrity, stability, and functionality of the Website and the Services – as far as this is technically possible and reasonable.
Furthermore, for reasons of technical security, in particular, to ward off attempted attacks or other abuse of the Website, the Services and/or our web server, this information is stored for a short period of time. We are not able to directly associate this information with individual persons. After seven days at the latest, this information will be anonymized through the shortening of the IP address to the domain level, so that it will no longer be possible to connect this information to an individual person. However, in the period of time until the shortening of the IP address, we may process this information in case of a security incident (attempted attack or abuse etc.) in cooperation with your internet provider and/or the local authorities in order to identify the party that caused the security incident. The legal basis for this is our legitimate interests (Art. 6 (1) lit. f GDPR) which consist in protecting the integrity of the Website, the Services, our system and of our users.
This information will only be processed for statistical, market research and/or advertising purposes in anonymized form, i.e. after the IP address has been shortened to the domain level.
3.2. Personal data that you provide in the context of your use of the services on the website
(a) Contacting us
If you wish to contact us, e.g. by using the contact form or email, the data you provide when doing so will be used to process your request and to get in contact with you. Providing that data is necessary to handle and answer your request; without those data, we cannot answer your request completely or at all.
The legal basis for the processing of your personal data is the fulfilment of our contractual obligations (Art. 6 (1) lit. b GDPR) as well as safeguarding our legitimate interests, which include, but are not limited to, contacting you and communicating with you about any concerns you have contacted us about (Art. 6 (1) lit. f GDPR).
We use the service provider MailChimp for sending our newsletters. More information on MailChimp is available in section 4.2.
We use the so-called double opt-in procedure for the registration of our newsletter, i.e. once you have registered for the newsletter, we will first of all send you an email that includes a confirmation link. Only once you have clicked on the confirmation link and we have received the confirmation, will we activate the delivery of the newsletter.
You may withdraw your consent at any time with future effect. You can declare such a withdrawal of consent at any time by following our withdrawal instructions that are included in each newsletter or by sending your withdrawal request to the contact details specified in section 1.
4. Disclosure of personal data
4.1. General information
Please note that we are entitled to outsource the processing of personal data in the context of data protection law provisions fully or partially to external service providers working on our behalf as data processors (Art. 4 no. 8 GDPR).
In general, our external service providers process your personal data within the European Union (EU) or the signatory states of the Agreement on the European Economic Area (EEA). However, in the event that your personal data is transferred to a service provider located in the third country outside of the EU or EEA, LAS ensures the protection of your personal data by means of adequate safeguards in accordance with legal and regulatory requirements, e.g. EU Standard Contractual Clauses.
For further information, in particular what adequate safeguards we have taken in specific individual cases when transferring your personal data to third countries, as well as to obtain a copy thereof, please contact us via the contact details specified in section 1.
4.2. Use of the newsletter deliver service provider MailChimp
For the delivery of our newsletter, we use the service “MailChimp” of the service provider Rocket Science Group LLC, 675 Ponce De Leon Ave. NE #5000, Atlanta, GA 30308, United States of America, which works as a data processor (Art. 4 no.8 GDPR) on behalf of LAS.
If you have signed up for our newsletter, your name and email address will be stored on the servers of MailChimp in the context of the use of the services. MailChimp processes and uses this personal data on our behalf for the delivery and evaluation of our newsletter.
To this end, the newsletters are provided with a so-called tracking pixel from MailChimp. Said tracking pixel is a pixel-sized file that is accessed by the MailChimp server when our newsletter is opened and via which the technical browser and system information (including your IP address) is collected in order to make technical improvements to the Services. Furthermore, information is collected on whether and when you have opened the newsletter and which links in the newsletter you clicked on. This serves the purpose of evaluating the reading habits of our newsletter recipients in general in order to allow us to customize and optimize our content accordingly.
In addition to your consent for the registration of our newsletter (cf. in this regard section 3.2 lit. b and section 7 lit. f, the legitimate interests of LAS and MailChimp (Art. 6 (1) lit. f GDPR) form the legal basis for the processing of personal data in connection with the analytics of the newsletter. Said legitimate interests consists in our goal to provide a user-friendly newsletter system to you that meets your expectations and needs and serves our business interests.
If you do not consent to the delivery of the newsletter by MailChimp or the statistical evaluation of the newsletter by MailChimp, you can only withdraw your consent to the receipt of our newsletter in its entirety (cf. section 3.2 lit b). Unfortunately, the withdrawal of individual components is not possible.
4.3 Use of TikTok Pixel
We use so-called "TikTok Pixel" ofTikTok Technology Limited (10 Earlsfort Terrace, Dublin, D02 T380, Ireland) (hereinafter "TikTok") on our website to integrate advertising services.
Scope and purposes of data processing
We use the TikTok Pixel to integrate the advertising services offered by TikTok, the so-called "TikTok Advertiser Tools". These advertising services allow us to identify visitors of our website as potential customer groups for the placement of advertisements, the so-called "TikTok Ads", such as in particular by targeting our advertisements and for the improvement of ad delivery and personalised advertising. These customers groups then receive TikTok Ads within the feed of the TikTok social network that are adapted to their interests, i.e. advertisements related to certain keywords.
If you are logged into your TikTok account, you also enable TikTok to associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your TikTok account.
Insofar as the data processing in the context of the provision and use of the "TikTok Advertiser Tools" is carried out on the basis of joint responsibility of LAS and TikTok pursuant to Art. 26 para. 1 GDPR, such as in particular the data transfer to TikTok for use in accordance with the applicable product terms of TikTok, we have concluded an agreement between joint controllers (so-called "Joint Controller Terms") with TikTok in accordance with the legal requirements, which you can view here. Please note that further processing following the data transfer is the sole responsibility of TikTok.
The data stored by TikTok can also be accessed and processed by other TikTok companies worldwide.
Transfer to third countries
A transfer of personal data to third countries, such as TikTok based in the People's Republic of China, cannot be ruled out by LAS.
Please note that the People's Republic of China is a so-called third country that does not have an adequacy decision of the European Commission pursuant to Art. 45 GDPR, and therefore there is no guarantee that TikTok can ensure an adequate level of protection in accordance with the requirements of the GDPR. Therefore, it cannot be ruled out that Chinese authorities may be able to access this data and that EU citizens may not have effective legal remedies.
Legal basis and possibility of withdrawal
The use of the TikTok Pixel and the associated data processing for advertising purposes are based on your consent (Art. 6 para. 1 lit. a GDPR). Your consent can be withdrawn at any time with effect for the future. To withdraw a previously given consent, please use the link "Manage cookies" in the cookie banner on our website.
You can also prevent the collection of data generated by the cookie and related to your use of our website (including your IP address) and the processing of this data by TikTok by not giving your consent to the setting of the TikTok Pixel.
4.4 Use of YouTube Plugins
We use so-called "YouTube plugins" from YouTube LLC (901 Cherry Ave., San Bruno, CA 94066, USA) on our website. Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) is responsible for the European region. YouTube is a company affiliated with Google LCC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) (hereinafter collectively "Google").
Scope and purposes of data processing
We use YouTube plugins to embed videos stored on the "YouTube" platform (hereinafter "YouTube Videos") on our website so that they can be played directly.
To ensure data protection on our website, YouTube plugins are deactivated when you first enter our website. A direct connection to Google's servers is only established when you independently activate YouTube plugins (consent according to Art. 6 para. 1 lit. a GDPR). Activation takes place when you agree to allow YouTube to be used in the data protection settings in the consent banner or you activate a single YouTube Video on our website individually by clicking on a video placeholder. This prevents your data from being transferred to Google when you first enter our website.
After activation, a connection to Google's servers is established and cookies are exchanged. These cookies tell Google which of our websites you have visited. Google also obtains your IP address. This also applies if you are not logged in to Google or do not have a Google-account. The information collected by Google is transferred to the Google server in the USA.
If you are logged into your Google account, you enable Google to associate your browsing behaviour directly with your personal profile. You can prevent this by logging out of your Google account.
The data stored by Google may also be accessed by other Google companies, such as Google LLC, based in California, USA, and processed in the USA and other locations worldwide.
Transfer to third countries
A transfer of personal data to third countries, such as Google LLC, which is based in California, USA, cannot be ruled out by LAS.
Please note that the USA is a so-called third country that does not have an adequacy decision by the European Commission pursuant to Article 45 GDPR, and therefore there is no guarantee that Google can ensure an adequate level of protection in accordance with the requirements of the GDPR. Therefore, it cannot be ruled out that US authorities may be able to access this data and that EU citizens may not have effective legal remedies.
Legal basis and possibility of withdrawal
The use of YouTube and the associated data processing are based on your consent (Art. 6 para. 1 lit. a GDPR). Your consent can be withdrawn at any time with effect for the future. To withdraw a previously given consent, please use the link "Manage cookies" in the cookie banner on our website.
Furthermore, you can prevent the collection of the data generated by the cookie and related to your use of our website (including your IP address) as well as the processing of this data by Google by not giving your consent to the cookie being set.
5. Storage Period
We will only store your personal data for as long as its storage is required for the achievement of the purposes for which it was collected or for the duration of the statutory retention periods, if the law dictates longer retention periods (e.g. Sec. 147 AO [German Fiscal Code] and Sec. 257 HGB [German Commercial Code]). Afterwards, your personal data will be deleted.
6. Cookies and web analytics
Cookies help us to make your visit to the Website and your use of the Services more comfortable, efficient, and meaningful.
Instructions for how to delete cookies in the most common browsers are provided below:
6.2. Web analytics
If you have given your consent, we use the service "Google Analytics" provided by Google LLC on our website. The responsible service provider in the EU is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter "Google").
Scope of processing
We use the function 'anonymizeIP' (so-called IP-Masking): Due to the activation of the IP-anonymization on this website, your IP-address will be abbreviated by Google within the Member States of the European Union or in other contracting states of the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to a Google server in the USA and shortened there.
During your website visit, the following data, among others, is collected:
- The pages you have visited on our website, i.e. your "click path”
- Achievement of "website goals" (conversions, e.g. newsletter registrations, downloads, purchases)
- Your user behaviour (e.g. clicks, dwell time, bounce rates)
- Your approximate location (region)
- Your IP address (in abbreviated form)
- Technical information about your browser and the end devices you use (e.g. language settings, screen resolution)
- Your internet provider
- The referrer URL (via which website/advertising medium you came to this website)
Purpose of processing
Google uses this information on behalf of LAS to evaluate your (pseudonymous) use of the website and to compile reports on website activities. The reports provided by Google Analytics serve to analyse the performance of our website and the success of our marketing campaigns.
The recipient of the data we send and which is linked to cookies is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which acts as processor on behalf of LAS. We have entered into a data processing agreement with Google for this purpose.
The data stored by Google may also be accessed and processed by other Google group companies, including Google LLC, based in California, USA. The United States are a so-called third country, which does not guarantees for an adequate level of protection in accordance with the requirements of the GDPR based on an adequacy decision by the European Commission pursuant to Art. 45 GDPR. It can therefore not be ruled out that US authorities may have access to this data.
Transfer to third countries
A transfer of data to third countries by Google cannot be excluded by LAS.
The data sent by us and linked to cookies are automatically deleted after 14 months. Data whose retention period has been reached is automatically deleted once a month.
You can also prevent the collection of data related to your use of our website which is linked to cookies (including your IP address) and the processing of this data by Google by
- not give your consent to the setting of the cookie or
- download and install the browser add-on for deactivating Google Analytics here.
You can also prevent the storage of cookies by setting your browser software accordingly. However, if you configure your browser to refuse all cookies, this may limit the functionality of this and other websites.
Legal basis and possibility of revocation
The legal basis for this data processing is your consent, Art.6 para.1 S.1 lit. a GDPR. You can revoke your consent at any time with future effect by calling up the cookie settings and changing your selection there.
7. Your data protection rights as a data subject
According to applicable data protection law, you are, in particular, entitled to the following rights. For this purpose, please contact us via the contact details specified in section 1.
(a) Right to information: You have the right to request at any time information on your personal data stored by us.
(b) Right to rectification: When processing your personal data, we attempt to ensure through appropriate measures that your personal data is correct and up to date for the purposes for which it has been collected. If your personal data is incorrect or incomplete, you may request the rectification of the respective data.
(d) Right to data portability: You may have the right to receive the respective personal data you provided to us in a structured, commonly used, and machine-readable format or to transmit those data to another controller.
(e) Right to object: You may have the right to object, on grounds relating to your particular situation, to the processing of your personal data. Further, you have the right at any time to object to the processing of your personal data for the purposes of direct marketing without any reasons.
(f) Right to withdraw your consent: If you have given consent to the collection and processing of your personal data, you may withdraw your consent at any time with effect for the future; however, the lawfulness of the processing performed based on the consent until its withdrawal shall not be affected by such a withdrawal. In addition, you have the option to object to the use of your personal data for market and opinion research and advertising purposes. Further information on the withdrawal of your consent to receiving our newsletter is available in section 3.2 lit.b.
(g) The competent supervisory authority in case of complaints: Furthermore, you may contact the Commissioner for Data Protection and Freedom of Information of Berlin, Friedrichstraße 219, 10969 Berlin, Germany, phone: 030 13889-0, fax: 030 2155050, email: [email protected], as LAS's competent supervisory authority in case of complaints. A list of other supervisory authorities that you may consider contacting (e.g. the one competent at your place of business) is available here.
8. Links to other websites
9. Right to make changes
Last Update: September 2022