1     Controller, area of applicability, data protection officer

1.1 The controller as defined in the GDPR and national data protection laws of the Member States, as well as in other provisions under data protection laws relating to the processing of your personal data is us, Hochschule für Bildende Künste Dresden (HfBK Dresden), Brühlsche Terrasse 1, D-01067 Dresden, Germany. We take data protection seriously.

1.2 This data protection policy applies to the artists’ portal www.artemak.art, including all sub-pages.

1.3 Our data protection officer is Ms Karin Armbruster. You can contact her at the Dresden Institute for Data Protection (Dresdner Institut für Datenschutz), Hospitalstraße 4, D-01097 Dresden, email: datenschutz@hfbk-dresden.de, telephone: +49-(0)351.6557720, fax: +49-(0)351.65577222.

2     Meaning of the individual terms used in this data protection policy

The following terms are used in this data protection policy:

1. Profile - The personal account which allows you, as the user, to use all of the functions of the artists’ portal (uploading content data, in particular interviews, questionnaires and material analysis);
2. Order processor -  The natural or legal person, authority, institution or other body which processes personal data on our behalf;
3. Browser data related personal data - Data which your browser transmits to our web server when you visit our website and which is stored by our web server at least for the duration of your visit, namely your IP address, date and time of your visit, time zone difference to Greenwich Mean Time (GMT), pages visited on our website, access status/HTTP status code, the website via which you arrived at our website (referrer URL), the operating system used by you, the browser used by you (including version and language), the respective quantity of data transferred and, if JavaScript is activated in your browser, also your screen resolution, colour depth and the size of the browser window;
4. Cookie - A text file which is temporarily (“session cookie”) or permanently (“permanent cookie”) saved on your device and which enables us (our “own cookies”) or other recipients (“third-party cookies”) to receive certain information. This text file cannot launch any programs or place viruses on your computer;
5. Double opt-in procedure - A procedure by means of which you must expressly confirm your consent by clicking on a link contained in an email which is sent to you for this purpose.
6. Third-party - A natural or legal person, authority, institution or other body apart from you, us, the order processor and the persons who are authorised to process the personal data under the direct responsibility of us or the order processor;
7. Third country - A country outside of the European Union or a country which is not a member of the European Economic Area;
8. Recipient - A natural or legal person, authority, institution or other body to whom personal data is disclosed, regardless of whether this is a third-party or not;  However, authorities which may receive personal data in the course of a specific investigation order under EU law or the laws of the Member States are not deemed to be recipients. The processing of this data by the named authorities takes place in accordance with the applicable data protection regulations in line with the purposes of the processing;
9. Voluntary information - Personal data which we request from you which is not mandatory but which makes the performance of the processing easier;
10. Content data - Data which you upload when using the artists’ portal on our server and which is published by us in the artists’ portal, in particular interviews, questionnaires or material analysis;
11. Contact and query data - Personal data which you provide when getting in touch by email or otherwise when making contact or sending a query outside of the conclusion of a contract;
12. Artists’ portal - A platform for the publishing of content data which is operated under www.artemak.art ;
13. Logfile - A file which is saved on a web server in which browser data is recorded;
14. Usage data - Personal data relating to your use of our website which is gathered in automated form when using the website, in particular as browser data and by means of cookies;
15. Personal data - All information which relates to you as an identified or identifiable natural person;
16. Mandatory information - Personal data which we request from you and which is absolutely necessary in order to fulfil the purposes of the processing. Mandatory information is labelled with a * during the data collection;
17. Registration data - Personal data which you provide during the registration process and to create a profile, in order to establish the contractual relationship with us, to determine its content and to alter or terminate it.

3     General information concerning the handling of personal data

3.1 We generally only use your personal data in order to enable you to use our services.

3.2 Should we obtain your consent for the processing procedures relating to personal data, Article 6 Paragraph 1 Sentence 1 Letter a) GDPR serves as the legal basis for the processing of personal data.

3.3 During the processing of personal data which is necessary for the fulfilment of a contract to which you are a contracting party, Article 6 Paragraph 1 Sentence 1 Letter b) GDPR serves as the legal basis. This also applies to processing procedures which are necessary in order to carry out pre-contractual measures.

3.4 Should the processing of personal data be necessary in order to fulfil a legal obligation to which we are subject, Article 6 Paragraph 1 Sentence 1 Letter c) GDPR serves as the legal basis.

3.5 In case that your vital interests or those of another natural person make the processing of personal data necessary, Article 6 Paragraph 1 Sentence 1 Letter d) GDPR serves as the legal basis.

3.6 Should the processing be necessary in order to safeguard a legitimate interest of us or of a third-party and should your interests, basic rights and basic freedoms not outweigh the first-mentioned interest, Article 6 Paragraph 1 Sentence 1 Letter f) GDPR serves as the legal basis.

3.7 The personal data will be deleted or blocked, once the purpose of the saving no longer applies. Saving can also take place if this is provided for by the European or national legislator in ordinances, laws or other regulations under EU law to which we are subject as the controller. The data will then be blocked or deleted once a saving period prescribed by the named norms expires, unless it is necessary to continue to save the data in order to conclude or fulfil a contract.

3.8 Should we pass your data on to recipients for individual functions and services, we will inform you below of the respective processes in detail. We have carefully selected and engaged our order processors, they are bound by our instructions and are regularly monitored. The order processors will not pass this data on to third-parties, rather they will delete this after fulfilment of the contract and following the expiry of the legal saving periods, unless you have consented to the continued saving of this data. Should the recipients maintain their place of business in a third country, we will inform you of the consequences of this situation in the description of the respective data processing. As an exception, your personal data will be passed on to other third-parties if we are legally obliged to surrender this personal data. However, in such a case, we will inform you immediately.

3.9 Our employees are obliged to maintain secrecy in relation to personal data.

4     Your rights

4.1 Should you have issued us with your consent to use your personal data, you can issue us with full or partial revocation of this at any time with effect for the future.

4.2 Should the processing of personal data take place in order to fulfil tasks which are in the public interest (Article 6 Paragraph 1 Sentence 1 Letter e) GDPR) or to safeguard legitimate interests (Article 6 Paragraph 1 Sentence 1 Letter f) GDPR), you can object to the processing of personal data relating to you for reasons connected to your specific situation at any time with effect for the future. In case of an objection, we must refrain from any further processing of your data for the purposes referred to above, except in the following cases:

• Mandatory protectable reasons exist for the processing which outweigh your interests, rights and freedoms;
• The processing is necessary in order to assert, exercise or defend legal claims.

4.3 You also have the right to complain to a data protection supervisory authority for data protection law matters.

4.4 In addition, you have the following rights in relation to your personal data:

• Right of information
• Right of rectification or erasure
• Right to have the processing restricted
• Right of data portability

5     Browser data

5.1 Each time you visit our website, we gather browser data. We do not combine the browser data with your other personal data.

5.2 We use the browser data in order to display our website to you and to guarantee its stability and security. In particular, we require the browser data in order to recognise and deal with / prevent disruptions and attacks. The legal basis for the use of browser data is stated in Section 3.6

5.3 The browser data is not passed on to any recipients and in particular not to any third-parties. Should investigation measures be initiated due to an attack against our IT systems, the browser data may however be passed on to state investigation authorities. The same applies if relevant authorities or courts contact us with requests and we are obliged to comply with these. It is not planned to transfer your browser data to a third country or international organisation.

5.4 The browser data, including the IP address where applicable is saved in a logfile. The logfile is deleted after seven days. Any further saving of the logfile only takes place once the IP address has been deleted or shortened, which means that the logfile is anonymised.

6     Registration data

6.1 In order to use all of the functions of the artists’ portal, it is necessary to create a profile.  When creating a profile, we use the so-called double opt-in procedure for the authentication of your email address. Should your confirmation not take place within 24 hours, your registration will be automatically deleted from our database after one month.

6.2 We process your registration data which includes both mandatory information and voluntary information (for example in order to be able to address you personally and better clarify any follow-up queries) and in order to enter into, perform and alter the contractual relationship in accordance with the legal basis referred to in Section 3.3.

6.3 The registration data is not passed on to any recipients and in particular not to any third-parties. It is also not planned to transfer your registration data to a third country or international organisation.

6.4 Your registration data will be saved for the duration of the fulfilment of the contract, i.e. for as long as you hold a profile in the artists’ portal www.artemak.art. You can delete your profile in the customer area at any time. Further saving only takes place after deletion of the profile if legal regulations require the further processing (in particular retention), the retention is required for proof reasons (for example to assert claims or defend possible damages claims) or if express consent has been given by you or in the form of a legal authorisation.

7     Contact and query data

7.1 We process your contact and query data which includes both mandatory information and voluntary information (for example in order to be able to address you personally and better clarify any follow-up queries) in order to respond to your queries in accordance with the legal basis referred to in Sections 3.3 and 3.6.

7.2 The contact and query data is not passed on to any recipients and in particular not to any third-parties. It is also not planned to transfer your contact and query data to a third country or international organisation.

7.3 Your contact and query data will be immediately deleted after the processing of your query is complete, unless legal regulations require the further processing (in particular retention), the retention is required for proof reasons (for example to assert claims or defend possible damages claims) or if express consent has been given by you or in the form of a legal authorisation.

8     Content data

8.1 We process the content data (which may also be personal data) in order to enter into, perform and alter the contractual relationship in accordance with the legal basis referred to in Section 3.3.

8.2 The content data is only passed on in order to fulfil the contract. The content data is not passed on to any recipients and in particular not to any third-parties. It is not planned to transfer your content data to a third country or international organisation.

8.3 The content data will be saved for the duration of the fulfilment of the contract, unless legal regulations require the further processing (in particular retention), the retention is required for proof reasons (for example to assert claims or defend possible damages claims) or if express consent has been given by you or in the form of a legal authorisation.

9     Cookies

9.1 We use our own cookies. The purpose of our own cookies is to make our website more user-friendly and effective as a whole. These do not contain any personal information relating to you, rather only a number identifier which is not of any significance outside of our services. We use so-called session cookies in particular. These save a so-called “session ID”, by means of which various requests of your browser can be assigned to the joint session. Both during your visit to our Internet site and when redirecting to another site, your end device remains identifiable and the end of your visit is determined. We also use permanent cookies. These enable your browser to be recognised next time you return to our website. We use session cookies in order to enable you to seamlessly use our services. We use permanent cookies in order to identify you during subsequent visits and to enable you to seamlessly use our services. Otherwise, you would need to log in each time you visit. The legal basis for the use of our own cookies is stated in Section 3.6 Session cookies are automatically deleted once you log out or close the browser. Permanent cookies are automatically deleted after a prescribed period of time, which may differ depending on each individual cookie.

9.2 We use statistical cookies in order to analyse the use of our website. You can agree to or reject the use of statistical cookies in the footer of this website under "cookie settings”. 

9.3 We use marketing cookies in order to inform our social media and marketing partners of your use of our website. You can agree to or reject the use of marketing cookies in the footer of this website under "cookie settings”. 

9.4 You can delete the cookies at any time in your browser’s security settings. You can configure your browser settings in accordance with your wishes and reject certain or all cookies. We wish to inform you that if you reject our own cookies, you may not be able to use all of the functions of our website.

10     Data security

All information which you provide to us is saved on servers in the Federal Republic of Germany. We wish to inform you that the transfer of information via the Internet is not fully secure, which means that we are not able to guarantee the security of the data transferred to our website over the Internet. All data which is stored on our severs is protected against loss, destruction and access, alteration and distribution by unauthorised persons by means of technical and organisational measures (for example connected security systems). Our employees and system service providers regularly monitor the effectiveness of the protective measures. We use SSL encryption (secure socket layer) or TLS encryption (transport layer security), PFS (perfect forward secrecy), HTTPS for the communication between your end device and our servers.

11     Accessibility of the data protection provisions

You can access and print out these data protection provisions on any page of our website under the “data protection” rubric.

© esb Rechtsanwälte Dresden