Privacy Policy | Crossing Currents

I. Scope of the Privacy Policy

Raum für Kunst e.V., Admiralitätstraße 71, 20459 Hamburg (hereinafter referred to as “Raum für Kunst” or “Hamburg Art Week” or “we”) operates the website accessible at www.hamburgartweek.com and its associated subdirectories (hereinafter also referred to as the “Website”), including the respective project pages (collectively, “Websites”) as well as social media profiles (hereinafter also referred to as “social networks”).

With this Privacy Policy, we would like to inform you about what data is processed and in what form when you use our web pages, including the project pages, or our social media profiles, as well as when you subscribe to our newsletter. In doing so, we are also fulfilling our obligations to provide you with information pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR).

II. Information About the Data Controller

Crossing Currents | Hamburg Art Week
Raum für Kunst e.V.
Admiralistätstraße 71
20459 Hamburg
Chair of the Board: Luise Nagel
Project Manager: Jessica Nupen
Project Manager’s contact information: jessica.nupen@hamburgartweek.com

III. Information on the Data Protection Officer
Fanny Roy
fanny.roy@hamburgartweek.com

IV. Purposes, Legal Bases, and Duration of Data Processing

1. Data Processing on This Website

Hamburg Art Week automatically collects and stores information in its server log files that your browser transmits to us. This information includes:

User Agent (browser type/version)
Hostname of the accessing computer (IP address)
Time of the server request
File requested

Hamburg Art Week cannot associate this data with specific individuals.

To the extent that a connection established using the IP address is recorded, this is based on Article 6(1)(f) of the GDPR. Our legitimate interest lies in making our website available to you, enabling you to use the site, and being able to investigate unauthorized access attempts and unlawful use of the website or portal.

We store our log files for 24 hours.

2. Newsletter

We offer you the opportunity to subscribe to an email newsletter. To make this possible, we collect and use your email address. We also analyze our newsletter service by collecting certain usage data. To do this, we use tracking pixels and link tracking. When tracking pixels are used, your device establishes a connection to the newsletter service when you open the email, allowing us to detect that the email has been opened. With link tracking, we are able to track when you click on a link using links created specifically for you.

For newsletter distribution and analysis, we use the Mailchimp service provided by The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave NE, Atlanta, GA 30308, USA. The Rocket Science Group also processes personal data in countries outside the EU, particularly in the United States. However, The Rocket Science Group is certified under the Data Privacy Framework, ensuring an adequate level of protection for the processing of personal data. To the extent that data is transferred to third countries for which no Commission decision exists, such transfers are made solely on the basis of standard contractual clauses, which you can access here.

The processing of data for the purpose of sending the newsletter is based on Article 6(1)(a) of the GDPR. The analysis of usage data is based on Article 6(1)(a) of the GDPR, provided that we have obtained your explicit consent to perform tracking, and on Article 6(1)(f) of the GDPR, if we base the tracking solely on a legitimate interest. Our legitimate interest lies in optimizing our newsletter service. The use of tracking pixels and link tracking—to the extent that this requires the storage of information on your device or access to information stored on it—is carried out with your consent pursuant to Section 25(1) of the German Telemedia Act (TDDDG).

We store the data processed for the email newsletter until you revoke your consent. The analyzed usage data is stored for a maximum of one year.

V. Duration of Processing

Unless a retention period is expressly specified elsewhere in this Privacy Policy, we process your data until it is no longer needed for the purpose of processing. In addition, we may store your data to assert, exercise, or defend legal claims or to comply with statutory retention periods. The legal basis for this is Article 6(1)(c) of the GDPR in conjunction with Sections 147 and 257 of the German Fiscal Code (AO) and Article 17(3) of the GDPR. We will delete your data as soon as we no longer need it for these purposes.

VI. Recipients of Your Data

Internally, your data is processed by the employees responsible for the specific matter concerning you. We also use external service providers when we are unable to perform certain services ourselves or when it is not practical for us to do so. These external service providers are primarily IT service providers, such as our web hosting provider, email provider, or telecommunications provider.

VII. Data Transfer to a Third Country

Unless expressly stated elsewhere in this Privacy Policy, we do not intend to transfer your personal data to a third country outside the EU or EEA.

Data Subject Rights: The General Data Protection Regulation grants you certain rights that you may exercise against us—provided the legal requirements are met.

Art. 15 GDPR – Right of Access: You have the right to request confirmation from us as to whether personal data concerning you is being processed and, if so, what data is being processed and the specific circumstances of the data processing.

Art. 16 GDPR – Right to Rectification: You have the right to request that we rectify any inaccurate personal data concerning you without delay. Taking into account the purposes of the processing, you also have the right to request that incomplete personal data be completed—including by means of a supplementary statement.

Art. 18 GDPR – Right to Restriction of Processing: You have the right to request that we restrict the processing of your personal data.

Art. 20 GDPR – Right to Data Portability: Where processing is based on consent or on the performance of a contract, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance from us, or to have the data transmitted directly to the other controller, to the extent that this is technically feasible.

Art. 20 GDPR – Right to Data Portability: If the processing is based on consent or is necessary for the performance of a contract, you have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used, and machine-readable format, and to transmit this data to another controller without hindrance from us, or to have the data transmitted directly to the other controller, to the extent that this is technically feasible.

Art. 21 GDPR – Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is necessary for the purposes of our legitimate interests or for the performance of a task carried out in the public interest, or that is carried out in the exercise of official authority. If you object, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. To the extent that we process your personal data for direct marketing purposes, you have the right to object to such processing at any time. If you object to processing for direct marketing purposes, we will no longer process your personal data for those purposes.

Art. 77 GDPR in conjunction with § 19 BDSG – Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority at any time—in particular in the Member State of your residence, your workplace, or the location of the alleged infringement—if you believe that the processing of your personal data violates applicable law.

Withdrawal of Consent: If you have given us your consent, you have the right to withdraw your consent at any time. In this case, all data processing we have carried out up until your withdrawal remains lawful. To do so, you may send us a message to one of the addresses listed above.

IX. Obligation to Provide Data

You have no contractual or legal obligation to provide us with personal data. However, without the data you provide, we may not be able to offer you our services.

X. Use of Automated Decision-Making (Including Profiling)

We do not use automated decision-making that has legal effects on you or adversely affects you.

XI. Use of Technologies and Integration of External Services

1. Cookies and Other Technologies

Our websites use so-called cookies and other technologies. They serve to make our website more user-friendly, effective, and secure. Cookies do not cause any damage to your computer and do not contain viruses. Cookies are small text files that are stored on your computer and saved by your browser.

Most of the cookies we use are so-called “session cookies.” They are automatically deleted at the end of your visit. Other cookies remain stored on your device until you delete them. These cookies enable us to recognize your browser the next time you visit.

You can generally configure your browser to notify you when cookies are set and to allow cookies only on a case-by-case basis, to block cookies in specific cases or generally, and to enable the automatic deletion of cookies when you close your browser. Disabling cookies may limit the functionality of these websites.

The legal basis for the processing of personal data in connection with this is Article 6(1)(f) of the GDPR, provided that the cookies are used to provide the services you have requested. Our legitimate interest is to provide you with the best possible user experience. If the cookies are not necessary, their use is based on your consent pursuant to Article 6(1)(a) of the GDPR, which you may revoke at any time with future effect.

2. Social Networks

We have profiles on social networks. Our social media accounts complement our website and offer you the opportunity to interact with us. As soon as you access our social media profiles on these networks, the terms and conditions and data processing policies of the respective operators apply.

We generally have no influence over data processing on social media platforms. The data collected about you when you use these services is processed by the platforms and may be transferred to countries outside the European Union. Information about what data is processed by the social media platforms and for what purposes it is used can be found in the privacy policy of the respective platform listed below. We use the following social media platforms:

Instagram
Meta Platforms Ireland Limited, ATTN: Privacy Operations, Merrion Road, Dublin 4, D04 X2K5, Irland
Datenschutzerklärung / Opt-Out-Optionen: https://privacycenter.instagram.com/policy/

YouTube
YouTube LLC als Tochtergesellschaft von Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Irland.
Datenschutzerklärung: https://policies.google.com/privacy?hl=de&gl=de
Opt-Out-Optionen: https://adssettings.google.com/authenticated

LinkedIn
LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
Privacy policy: www.linkedin.com/legal/privacy-policy
Opt-out options: www.linkedin.com/psettings/?trk=nav_account_sub_nav_settings

We process personal data as the data controller when you send us inquiries via our social media profiles. We process this data to respond to your inquiries, which also constitutes our legitimate interest (Art. 6(1)(f) GDPR).

In addition, we are joint controllers with the following networks and share responsibility for the following processing activities (Art. 26 GDPR).

When you visit our profiles on Instagram, the platform collects aggregated statistics (“Insights data”) generated from specific events logged by its servers when you interact with our profile and the associated content. We receive these aggregated and anonymous statistics from the platform regarding the use of our respective profile. We are generally unable to link the data to specific users. To a certain extent, we can specify the criteria according to which the respective network compiles these statistics for us. We use these statistics to make our profiles more interesting and informative for you. This also constitutes our legitimate interest (Art. 6(1)(f) GDPR) in the data collection carried out by the respective social network to provide us with statistics.

Further information on this data processing can be found in the Controller Agreement at: https://www.facebook.com/legal/terms/page_controller_addendum