Data Protection Policy

The protection of your personal data and thereby your privacy are very important to us. In the following, we would like to explain to you what happens to your data when using this website and how we protect your privacy.
 

Definitions

This data protection policy uses, inter alia, the following terminology of the Regulation of the European Parliament and of the Council from 27 April 2016 pertaining to the protection of natural persons with regard to the processing of personal data, the free movement of data traffic, and the repeal of Directive 95/46/EC (General Data Protection Regulation – Regulation (EU) 2016/679):

  1. Personal data
    Any information relating to an identified or identifiable natural person (hereinafter referred to as “data subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (such as a cookie), or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.
     
  2. Processing
    Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.
     
  3. Controller
    The natural or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
     
  4. Recipient
    A natural or legal person, public authority, agency, or another body, to which the personal data are disclosed, whether a third party or not.
     
  5. Processor
    A natural or legal person, public authority, agency, or other body which processes personal data on behalf of the controller.
     
  6. Consent
    Consent of the data subject means any freely given, specific, informed, and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
     
  7. Pseudonymisation
    Pseudonymisation is the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person.
     
  8. Profiling
    Profiling is any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location, or movements.

 

Controller

ALM GbR
represented by the Director of the managing State Media Authority, Dr. Eva Flecken
Friedrichstraße 60
10117 Berlin
Phone: +49 30 2064690-0
Fax: +49 30 2064690-99
Email: vorsitz@die-medienanstalten.de
 

Data protection officer

For any questions or suggestions regarding data protection or possible complaints, please contact our data protection officer:

Franziska Halbhübner
c/o ALM GbR
Friedrichstraße 60
10117 Berlin
Phone: +49 30 2064690-17
Fax: +49 30 2064690-99
Email: halbhuebner@die-medienanstalten.de

Processing of your data when you access our website

Our website is available to anyone without prior registration. When you access our website, your Internet browser or mobile device automatically transmits the following data, which are recorded in access log files, to our web server for technical reasons: IP, directory protection user, date, time, webpages accessed, logs, status code, quantity of data, referrer, user agent, hostname retrieved.

Storing these data together with other personal data does not take place.

The legal basis for the storage of these data is Art. 6 para. 1 (e) GDPR.

We use these data to enable the use of our website and its technical administration, to ensure the security of our information technology systems, to prevent the misuse of our website, and to optimise our website. The collection and storage of these data are required for the operation of the website, to ensure the functionality of the website, and to deliver our websites’ content correctly. This processing is necessary for the performance of a task carried out in the public interest in accordance with Art. 6 para. 1 (e) GDPR.

We will delete the data as soon as they are no longer required for the achievement of the aforementioned purposes of their collection.

IP addresses are stored anonymously. To do so, the last three digits are removed, i.e., 127.0.0.1 becomes 127.0.0.*. IPv6 addresses are also anonymised. The anonymised IP addresses are stored for 60 days. Information about the used directory protection user are anonymised after one day.
Error logs, which log erroneous page views, are deleted after seven days. In addition to the error notifications, these contain the accessing IP address and, depending on the error, the website accessed.
 

Cookies

When using our website, cookies are stored on your computer. Cookies are small text files that are stored on your hard drive and that give us certain information. Cookies cannot run programs or transmit viruses onto your computer. They generally serve to make websites more user-friendly and effective.
The legal basis for the use of cookies is Art. 6 para. 1 (e) GDPR.

We exclusively use cookies to optimise our internet presence. This processing is necessary for the performance of a task carried out in the public interest in accordance with Art. 6 para. 1 (e) GDPR.
This website uses the following types of cookies; the scope and operation thereof are explained below:
 

Session cookies

Session cookies are automatically deleted when you log out or when you close the browser. These store a so-called session ID, with which various requests from your browser can be assigned to the specific session. This allows your computer to be recognised upon return to our website.

You can configure your browser’s settings according to your wishes and can thereby refuse to accept cookies. In this case, however, it may be possible that not all the functions of this website can be used.
 

Website analysis using Matomo (previously known as Piwik)

In order to continually improve our service offer, ALM GbR uses the web analytics service software Matomo from the provider InnoCraft Ltd., 150 Willis St, 6011 Wellington, New Zealand, to analyse the use of our website. Matomo is only used if you have given your consent.

The legal basis for the processing of your data is then Art. 6 para. 1 (a) GDPR.

Insofar as you have given your consent, a cookie is then set. The data generated by this cookie about your use of this website (including your IP address, date, time, duration of visit, browser, operating system, visited pages) are transmitted to a server in Germany and stored there. However, as IP anonymisation is activated, your IP address is shortened by Matomo beforehand. Matomo will use this information to evaluate your use of the website and to compile reports on website activity. The collected, pseudonymous usage data are used for long-term evaluation purposes and are only deleted at the end of the evaluation phase.

You can prevent said evaluation by deleting existing cookies and by preventing the storage of new cookies. If you prevent the storage of cookies, we would like to point out that you may not be able to use this website to the full extent. Preventing the storage of cookies is possible by changing the settings in your browser. If you do not want your navigation to be evaluated anonymously by Matomo, you can disable this function.
 

Further information and Matomo's applicable data protection policy can be found at: https://matomo.org/privacy/

Alternatively, you can generally prevent the use of web analysis programs via a setting in your browser called the "do-not-track function". When activated, cookies are not set.

Press and event mailing list

By entering your details into our mailing list, you will receive press releases as well as information on publications and events of the Media Authorities.

We use the so-called double-opt-in process for registration. This means that after you have registered, we will send you an email to the specified e-mail address, in which we ask you to confirm that you wish to be entered into our email mailing list. If you do not confirm your registration within 48 hours, your information will automatically be deleted. Furthermore, we store your IP addresses as well as the times of registration and confirmation. The purpose of the process is to confirm your registration and, if necessary, to inform you about possible misuse of your personal data. Your email address is the only mandatory information you must disclose.

The legal basis for processing your data after admission to our email mailing list is Art. 6 para. 1 (a) GDPR.

The data will be used exclusively to send press releases and notifications about publications and events of the Media Authorities; these data will not be passed on to third parties. We will delete the data as soon as they are no longer required for the achievement of the aforementioned purposes of their collection. Accordingly, these will be stored for as long as you want to be on our email mailing list.

You can revoke your consent at any time. Please use the “Unsubscribe” function to do so: click on the link at the end of the received emails or send a message to the email address mitteilungen@die-medienanstalten.de  or to the email address specified in the imprint under “Contact”. The revocation of your consent does not affect the lawfulness of the data processing up to the point at which you revoked your consent to be on our email list.

Social media buttons

We offer the possibility to share content via Facebook, Twitter, or Google+ at the bottom of some webpages. We do not set any social media buttons that collect data, but limit ourselves to links that only transfer data to the respective service providers once the link has been clicked on.

YouTube

We include YouTube content on our website, an offer from YouTube LLC, Cherry Avenue, San Bruno, CA 94066, USA, represented by Google LLC, 1600 Amphitheater Parkway, Mountain View, CA 94043, USA ("YouTube"). This may include content such as videos, texts, and buttons. We only use YouTube if you have given your consent.

The legal basis for the processing of your data is then Art. 6 para. 1 (a) GDPR.

If you have given your consent, your browser will connect your video content directly to the YouTube servers and transmit your information to YouTube. The video content is transmitted directly by YouTube to your browser and incorporated into the website by it.

For more information on Terms of Use and data protection, please see:

https://www.youtube.com/t/terms/

and

https://www.google.com/policies/privacy/

Facebook

We include Facebook content on our website, an offer from Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. The processor of personal data, if a data subject lives outside the USA or Canada, is Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Facebook"). This may include content such as images, videos or text and buttons. We only use Facebook if you have given your consent.

The legal basis for the processing of your data is then Art. 6 para. 1 (a) GDPR.

If you have given your consent, to deliver the content to your browser, your browser will create a direct link to the Facebook servers and transmit your data to Facebook. The content is transmitted directly by Facebook to your browser and incorporated into the website by it.

For more information on Terms of Use and data protection, please see:

https://www.facebook.com/legal/terms/https://www.facebook.com/about/privacy/

Twitter

We include Twitter content on our website, an offer from Twitter, Inc., 1355 Market Street, Suite 900, San Francisco, CA 94103, USA. The processor of personal data, if a data subject lives outside the USA or Canada, is the Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, Ireland ("Twitter"). This may include content such as images, videos or text and buttons. We only use Twitter if you have given your consent.

The legal basis for the processing of your data is then Art. 6 para. 1 (a) GDPR.

If you have given your consent to deliver the content to your browser, your browser will create a direct link to the Twitter servers and transmit your data to Twitter. The content is transmitted directly by Twitter to your browser and incorporated into the website by it.

For more information on Terms of Use and data protection, please see:

twitter.com/tos/

twitter.com/privacy/ 

Instagram

We include Instagram content on our website, an offer from Facebook, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA. The processor of personal data, if a data subject lives outside the USA or Canada, is Facebook Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland ("Instagram"). This may include content such as images, videos, or text and buttons. We only use Instagram if you have given your consent.

The legal basis for the processing of your data is then Art. 6 para. 1 (a) GDPR.

If you have given your consent to deliver the content to your browser, your browser will create a direct link to the Instagram servers and transmit your data to Instagram. The content is transmitted directly by Instagram to your browser and incorporated into the website by it.

Further information on data protection can be found at:

instagram.com/about/legal/privacy/

Google Maps

We use the services of Google Maps on our website, a map service of Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, USA ("Google"). We use Google's map service to display interactive maps, especially to determine directions so that you can find us. We only use Google Maps if you have given your consent.

The legal basis for the processing of your data is then Art. 6 para. 1 (a) GDPR.

If you have given your consent to deliver the map content to your browser, your browser will create a direct link to the Google servers and transmit your data to Google. The content is transmitted directly by Google to your browser and incorporated into the website by it.

For more information on Terms of Use and data protection, please see:

https://www.google.com/intl/en_gb/help/terms_maps.html

and

https://policies.google.com/?hl=en&gl=en

Processing of your data when you get in touch with us via email or contact/complaint form

We offer you the opportunity to contact us and send us a message to the following addresses: via our email address (info@die-medienanstalten.de), our employees’ email addresses, or via our contact/complaint form.

In this case, your electronically transmitted personal data will be collected and stored by us.

The legal basis for the processing of your data is Art. 6 para. 1 (e) GDPR.

We only use your data to process your specific request or complaint and to contact you; transmission of your data to other authorities or institutions is only done to the extent as this is necessary to fulfil the task. This processing is necessary for the performance of a task carried out in the public interest in accordance with Art. 6 para. 1 (e) GDPR. We delete your data as soon as they are no longer necessary for the achievement of the aforementioned purposes that they were collected for; particularly as soon as the circumstances, which caused you to take up electronic contact with us, have been completely clarified and no legal obligations preclude erasure.

You may object to the use of your personal at any time without incurring any costs other than the transmission costs. In such a case, your personal data will no longer be processed, unless there is compelling public interest in the processing that outweighs your interests as a data subject, or a legal requirement for processing.

Disclosure of your personal data

We only disclose your personal data to third parties (for example, to the State Media Authorities, jugendschutz.net) within the scope permitted by the law or based on your consent, which is revocable at any time for future effect, and only to the extent necessary for the fulfilment of our contractual obligations. Any other transmission, sale or other transfer of your personal data to third parties does not take place.

Our service providers (e.g. hosting service providers) need your personal data and process them exclusively on our behalf in the context of a processing order, which is expressly provided for in accordance with Art. 28 para. 3 GDPR. These service providers are obligated to comply with data protection regulations to the same extent as we are, and are not regarded as external third parties in terms of data protection law.

Your rights

As a user, you have the following rights vis-à-vis ALM GbR:

  • Right to information
  • Right to rectification
  • Right to restriction of processing
  • Right to erasure (“right to be forgotten”)
  • Right to data portability
  • Right to objection
  • Right to withdraw consent
  • Right to lodge a complaint with the supervisory authority

Right to information

You have the right to request information from us at any time and free of charge if personal data concerning you are processed by us. If this is the case, you have a right to information about these personal data, as well as the following information:

  • the purposes for which your personal data are being processed;
  • the categories of personal data being processed;
  • the recipients or categories of recipients to whom your personal data have already been disclosed to or will be disclosed to;
  • the planned duration of the storage of your personal data, or, if this is not possible, the criteria for determining the duration of storage;
  • the right to rectification or erasure of your personal data, a right to restriction of processing by us, as the controller, and a right to object to processing;
  • the right to lodge a complaint with a supervisory authority;
  • all available information about the origin of the data, if the personal data are not collected directly from you;
  • automated decision-making including profiling under Article 22 para. 1 and 4 GDPR and – at least in these cases – meaningful information about the logic involved, as well as the scope and intended effect of this type of processing on the data subject.

You also have a right to request information from us as to whether your personal data are being transferred to a third country or to an international organisation. In this context, you may demand to be informed of the respective guarantees pursuant to Art. 46 GDPR.To protect your privacy, we reserve the right to require proof of identity. Data protection information can be provided in a common electronic format.

Right to rectification

You also have the right to demand rectification of incorrect personal data. Furthermore, considering the purposes for processing your personal data, you have the right to ask us to complete incomplete personal data.Right to restriction of processingYou have the right to demand that we restrict the processing of your personal data if any of the following conditions apply:

  • if you contest the accuracy of your personal data, for a duration that enables us to verify the accuracy of your personal data;
  • if the processing is illegitimate and you reject the erasure of your personal data, and instead request the restriction of the use of your personal data;
  • if we no longer need your personal data for processing purposes, but you require these for assertion, exercise, or the defence of your rights;
  • or if you have objected to the processing in accordance with Art. 21 para. 1 GDPR and it is not yet certain whether our legitimate reasons outweigh yours.

If the processing of your personal data was restricted, these data – apart from their storage – may only be processed with your consent or to assert, exercise, or defend legal claims, or to protect the rights of another natural or legal person, or for reasons of important public interest of the Union or a Member State.

If you have obtained a restriction on the processing of your personal data, we will inform you before the restriction is repealed.

Right to erasure (“right to be forgotten”)

You have the right to demand immediate erasure of your personal data if any of the following apply:

  • your personal data are no longer required for the purposes for which they were collected or otherwise processed;
  • you revoke your consent, which processing pursuant to Art. 6 para. 1 (a) GDPR or Art. 9 para. 2 (a) GDPR was based on, and there is no other legal basis for the processing;
  • you object to the processing pursuant to Art. 21 para. 1 GDPR and there are no legitimate reasons for the processing, or you object to the processing pursuant to Art. 21 para. 2 GDPR;
  • your personal data were processed unlawfully;
  • the erasure of your personal data is required to fulfil a legal obligation under Union or national law, to which we are subject;
  • or your personal data were collected in relation to services offered by the information society pursuant to Art. 8 para. 1 GDPR.

If we have made personal data public and if we are obligated to erase said data in accordance with Art. 17 para. 1 GDPR, we will take appropriate measures, including technical ones, to inform data controllers who are responsible for the processing of your personal data, considering the available technology and the implementation costs, that you have requested erasure of any links to your personal data or copies or replications of your personal data.

The right to have your personal data erased does not exist, insofar as processing is necessary

  • to exercise the right to freedom of expression and information;
  • to fulfil a legal obligation that requires processing under the law of the Union or the Member States to which we are subject, or to perform a task of public interest or in the exercise of official authority assigned to us;
  • for reasons of public interest in the area of public health pursuant to Art. 9 para. 2 (h) and (i) and Art. 9 para. 3 GDPR;
  • for archival purposes of public interest, for scientific or historical research purposes, or for statistical purposes pursuant to Art. 89 para. 1 GDPR, insofar as the right to erasure is likely to render impossible or seriously affect the realisation of the objectives of such processing;
  • or to assert, exercise, or defend legal claims.

If you have asserted your right to rectification, deletion, or restriction of the processing of your personal data, we are obligated to notify all recipients of your data about the rectification, erasure, or restriction of the processing of your personal data, except if this proves to be impossible or is associated with a disproportionate amount of effort. You have the right to receive information from us about the recipients of your personal data.

Right to data portability

You have the right to receive the personal data, which you provide to us, in a structured, conventional, and machine-readable format. Furthermore, you have the right to transfer these data – without hindrance from us – to another processor, provided that

  • processing is based on consent in accordance with Art. 6 para. 1 (a) GDPR or Art. 9 para. 2 (a) GDPR or on an agreement pursuant to Art. 6 para. 1 (b) GDPR; and
  • the processing is done using automated procedures.

In exercising your right to data portability, you also have the right to have your personal data transmitted – without hindrance from us – directly from us to another processor, as far as this is technically feasible. Freedoms and rights of other individuals may not be affected by this.

The right to data portability does not apply to the processing of your personal data if said data are required to perform a task of public interest or in the exercise of official authority assigned to us.

Right to objection

You have the right to object to the processing of your personal data at any time, for reasons arising from your particular situation, which takes place based on Art. 6 para. 1 (e) or (f) GDPR; this also applies to profiling based on these provisions.

We will no longer process your personal data after your objection, unless we can establish compelling, legitimate reasons for the further processing that outweigh your interests, rights, and freedoms, or if the further processing of your personal data serves for the assertion, exercise, or defence of legal claims.The right to objection to a public authority does not exist if there is compelling public interest in the processing, which outweighs the interests of the data subject, or if processing requires a legal provision.

Right to withdraw consent

You have the right to withdraw your consent at any time. Your revocation does not affect the legality of your personal data processed up until you revoked your consent.

Lodging a complaint with the supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, particularly in the Member State of your abode, place of work, or place of alleged infringement, if you are of the opinion that the processing of your personal data violates the provisions of the GDPR. The supervisory authority with which you have lodged your complaint will inform you about the status and results of the complaint, including the possibility of judicial remedial pursuant to Art. 78 GDPR.

Dated: September 2018