Data protection information according to Art. 12 ff. GDPR

Carsten Förster
Bayerische Staatsgemäldesammlungen –
Zentrale Dienste der Staatl. Museen und Sammlungen
Landshuter Allee 8
80637 München
Tel: +49 (0)89 23805 136
E-Mail: zd.datenschutz@pinakothek.de

1) Joint controllers

We operate our Facebook Fanpage https://www.facebook.com/AegyptischesMuseum jointly with Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, (hereinafter Facebook) in accordance with the decision of the ECJ, as personal data are processed by Facebook and us in connection with our Fanpage or with its content and we contribute to the decision on the purposes and means of this processing.
For this reason, we have concluded a separate agreement with Facebook and divided which of us fulfills which obligations under the GDPR.
 
You can read the most important contents of this agreement under the following link: 
https://www.facebook.com/legal/terms/page_controller_addendum
 
If you would like to know how Facebook generally processes your personal data, you can find information on this at: 
https://www.facebook.com/legal/terms/information_about_page_insights_data

2) Legal basis

Our legal basis for the processing of your personal data in the context of the Facebook Fanpage is our public duty (Art. 4 para. 1 Bavarian Data Protection Act – BayDSG in conjunction with. Art. 6 para. 1 lit. e in conjunction with. Art. 6 para. 3 p. 1 General Data Protection Regulation (GDPR).

3) Purpose

In order to fill our Facebook fan page with content that is of interest to you, we depend on learning about your user behavior. This is supported by the processing of your personal data, which is collected during the use of our Facebook fan page and evaluated by Facebook. For this purpose, Facebook provides us with page statistics that give us information about visitors and their interactions with our page. Furthermore, our Facebook fan page allows you to communicate directly with us and to respond to our posts and content.

4) Origin of the data

The data collected from you during your use of our Facebook Fanpage will be evaluated by Facebook and made available to us afterwards.

5) Duration of Storage

Your personal data will be deleted by us as far as they are no longer necessary to achieve the purpose. The deletion of your personal data takes place, as far as we are able, at the latest with the discontinuation of our Facebook-Fanpage page.

6) Possibility of objection and removal

If you do not want Facebook to collect your data, you can object at any time for the future. If you object to the processing of your personal data by Facebook, we will forward this objection request to Facebook.

II) Instagram

1) Joint controllers

We operate our Instagram page https://www.instagram.com/aegyptisches_museum_muenchen/ jointly with Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, (hereinafter Facebook) in accordance with the decision of the ECJ, as personal data are processed by Facebook and us in connection with our fan page or with its content and we contribute to the decision on the purposes and means of this processing.
For this reason, we have concluded a separate agreement with Facebook and divided which of us fulfills which obligations under the GDPR.
 
You can read the most important contents of this agreement under the following link: 
https://help.instagram.com/519522125107875
 
If you would like to know how Facebook generally processes your personal data, you can find information on this at: 
https://www.facebook.com/legal/terms/information_about_page_insights_data

2) Legal basis

Our legal basis for processing your personal data within the framework of our Instagram page is our public duty (Art. 4 para. 1 Bavarian Data Protection Act – BayDSG in conjunction with. Art. 6 para. 1 lit. e in conjunction with. Art. 6 para. 3 p. 1 General Data Protection Regulation (GDPR).

3) Purpose

Our Instagram page allows you to react to our posts, comment on them and send us private messages. The evaluation of this data is essential for us to improve the user experience for the future and to make the content more attractive. Furthermore, we receive anonymized or pseudonymized statistics from Facebook, which provide us with insights into the visitors to our Instagram page and their interactions with our Instagram page and its content.

4) Origin of the data

The data collected from you during your use of our Instagram page will be evaluated by Facebook and made available to us afterwards.

5) Duration of Storage

Your personal data will be deleted by us as far as they are no longer necessary to achieve the purpose. The deletion of your personal data takes place, as far as we are able, at the latest with the discontinuation of our Instagram page.

6) Possibility of objection and removal

If you do not want Facebook to collect your data, you can object at any time for the future. If you object to the processing of your personal data by Facebook, we will forward this objection request to Facebook.

III) YouTube channel

1) Extent of processing

In order to provide artistic impressions to as many people as possible, we operate our own YouTube channel https://www.youtube.com/@smaek_muc, which is operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland (hereinafter “Google”). YouTube is a video platform where users can post videos and make them publicly available.
 
We expressly point out that YouTube stores the data of its users (e.g. personal information, IP address, etc.) in accordance with its data usage guidelines and uses it for business purposes. We have no influence on this data collection and the further use of the data by YouTube.
 
Information about which data is processed by the YouTube company and for which purposes can be found in the terms of use and privacy statements of YouTube and Google respectively.
 
https://www.youtube.com/static?gl=GB&template=terms as well as in general
 
https://support.google.com/youtube/topic/2803240?visit_id=637248885594456664-1434476429&hl=en&rd=1
 
Our use of YouTube does not imply an unqualified endorsement of that medium or the company or Google LLC’s privacy policy.

2) Legal basis

The legal basis for the processing of your personal data is our public duty (Art. 4 para. 1 Bavarian Data Protection Act – BayDSG in conjunction with. Art. 6 para. 1 lit. e in conjunction with. Art. 6 para. 3 p. 1 General Data Protection Regulation (GDPR).

3) Purpose

We process your personal data in order to best tailor our YouTube channel to the interests of our users. The processing of your data is therefore only carried out for this purpose. In particular, your data will not be combined and evaluated with other data sets for other purposes. In addition, we process your data if you contact us within the framework of our YouTube channel or comment on our videos.

4) Origin of the data

The personal data you provide when using our YouTube channel is not collected by us directly, but is rather provided to us by Google.

5) Duration of Storage

We delete your personal data as soon as they are no longer required for our previously named purposes. Your data will be deleted at the latest – insofar as we can influence this – when we discontinue our YouTube channel.

6) Possibility of objection and removal

If you do not want Google to collect your data, you can object at any time for the future. If you object to the processing of your personal data by Google, we will forward this objection request to Google.

Furthermore, a transfer to third countries will only take place if an adequacy decision has been issued by the European Commission for that third country (see the current list of adequacy decisions here) or, in the absence of such a decision, on the basis of standard contractual clauses and if we have provided appropriate safeguards, such as standard contractual clauses, and enforceable rights and effective remedies are available to you

Please note: If you use our social media channels on Facebook, Instagram or YouTube, personal data will be transmitted to Meta or Google in the USA. Access to your personal data by US authorities cannot be ruled out

I) Right of access

You can request access to your personal data processed by us in accordance with Art. 15 DS-GVO. In your request for access, you should specify your request in order to make it easier for us to compile the necessary data. Please note that your right to access information may be restricted under certain circumstances in accordance with the statutory provisions (in particular Section 34 BDSG and Art. 10 BayDSG).

If a right to access exists, we will inform you about:

• the purposes of the processing
• the categories of personal data concerned;
• the recipients or categories of recipient to whom the personal data have been or will be disclosed
• the envisaged period for which the personal data will be stored
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing as well as the right to lodge a complaint with a supervisory authority
• where the personal data are not collected from you, any available information as to their source
• the existence of automated decision-making, including profiling and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you

II) Right to rectification

If the information concerning you is not (or no longer) accurate, you may request a rectification in accordance with Art. 16 GDPR. If your data is incomplete, you can request that it be completed.

III) Right to restriction of processing

Within the framework of the specifications of Art. 18 GDPR, you have the right to demand a restriction of the processing of the data concerning you if one of the following conditions is met:

• If you contest the accuracy of your data, for a period of time that allows us to verify the accuracy of the personal data
• the processing of your personal data is unlawful
• Our purpose has ceased to exist, but you need the data to assert, exercise or defend legal claims
• You have objected to the processing pursuant to Art. 21 para 1 GDPR and we are reviewing it

IV) Right to erasure

You can request the erasure of your personal data under the conditions of Art. 17 GDPR. Your right to erasure depends, among other things, on whether the data concerning you is still needed by us to fulfill our legal duties.

Your claim exists in particular if

• the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed
• you have withdrawn your consent on which the processing was based and we lack any other legal basis for the processing
• you have objected to the processing and there are no overriding legitimate grounds for the processing
• the personal data have been unlawfully processed
• the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are a subject
• the data was collected from you as a minor under the age of 16 for offers of information society services

V) Right to notice

If you have exercised one of the aforementioned rights, we will also inform other recipients of your personal data in this regard.

VI) Right to data portability

You have the right to receive the personal data concerning you that you have provided to us in a structured, commonly used and machine-readable format, and you have the right to transfer this data to another controller without hindrance from us, provided that the legal requirements of Art. 20 GDPR are met.

VII)  Right to object

According to Art. 21 GDPR, you have the right to object to the processing of data relating to you at any time for reasons arising from your particular situation. However, we are not always able to comply with this, e.g. if legal provisions oblige us to process data within the scope of our official task fulfillment.

If we process your personal data for the purpose of direct marketing, you have the right to object at any time.

VIII) Right to revocation

You have the right to revoke any consent given to us at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

IX) Right to complain to a supervisory authority

If you are of the opinion that we have not complied with data protection regulations when processing your data, you may, without prejudice to any other administrative or judicial remedy, lodge a complaint with the supervisory authority responsible for us.

The supervisory authority responsible for us is:
Bavarian State Commissioner for Data Protection
(Bayerischer Landesbeauftragter für den Datenschutz)
Wagmüllerstr. 18
80538 München
Tel.: 089/2126720
E-Mail: poststelle@datenschutz-bayern.de