Privacy policy

1 DATA PROTECTION AT A GLANCE

General information
The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can be used to identify you personally. For detailed information on the subject of data protection, please refer to our privacy policy below.

Data collection on this website
Who is responsible for data collection on this website? Data processing on this website is carried out by the website operator. You can find the operator’s contact details in the legal notice of this website.

How do we collect your data?
On the one hand, your data is collected when you provide it to us. This may, for example, be data you enter in a contact form. Other data is collected automatically or with your consent by our IT systems when you visit the website. This is primarily technical data (e.g. internet browser, operating system or time of page view). This data is collected automatically as soon as you enter this website.

What do we use your data for?
Some of the data is collected to ensure that the website is provided without errors. Other data may be used to analyse your user behaviour.

What rights do you have regarding your data?
You have the right to receive information about the origin, recipient, and purpose of your stored personal data free of charge at any time. You also have the right to request the correction or deletion of this data. If you have given your consent to data processing, you can revoke this consent at any time for the future. You also have the right to request the restriction of the processing of your personal data under certain circumstances. You also have the right to lodge a complaint with the competent supervisory authority. You can contact us at any time at the address given in the legal notice if you have any further questions on the subject of data protection.

Analysis tools and tools from third-party providers
When you visit this website, your browsing habits may be statistically evaluated. This is primarily done using so-called analysis programmes.
Detailed information on these analysis programmes can be found in the following privacy policy.

If you have any questions about this privacy policy, you can contact us at any time. Please send us an e-mail to besucherdienst@zollverein.de.

2 HOSTING AND CONTENT DELIVERY NETWORKS (CDN)

External hosting
This website is hosted by an external hosting service provider (HSP). The personal data collected on this website is stored on the host’s servers. This may include IP addresses, contact requests, meta and communication data, contract data, contact details, names, website accesses, and other data generated via a website. The HSP is used for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast, and efficient provision of our online offer by a professional provider (Art. 6 para. 1 lit. f GDPR).

Our HSP will only process your data to the extent necessary to fulfil its performance obligations and follow our instructions with regard to this data.
We use the following HSP:
STRATO AG
Pascalstraße 10
10587 Berlin

Conclusion of a contract for order processing
In order to ensure data protection-compliant processing, we have concluded an order processing contract with our HSP.

3 GENERAL NOTES AND MANDATORY INFORMATION

Data protection
The operators of these pages take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy. When you use this website, various personal data is collected. Personal data is data that can be used to identify you personally. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done. We would like to point out that data transmission over the Internet (e.g. when communicating by e-mail) may be subject to security vulnerabilities. Complete protection of data against access by third parties is not possible.

Note on the responsible body
The controller responsible for data processing on this website is
Zollverein Foundation – foundation with legal capacity under civil law
Zollverein UNESCO World Heritage Site
Bullmannaue 11
45327 Essen
Phone: +49 201 246810
E-mail: info@zollverein.de
The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data (e.g. names, e-mail addresses, etc.).

Storage period
Unless a more specific storage period has been specified in this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you assert a justified request for deletion or revoke your consent to data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, deletion will take place after these reasons no longer apply.

Data protection officer required by law
We have appointed a data protection officer for our company.
Aulinger Datenschutz & Consulting GmbH
Dr. Ralf Heine
Frankenstraße 348
45133 Essen
Phone: +49 201 9598662
E-mail: r.heine@aulinger-dc.eu

Note on data transfer to the USA
Among other things, tools from companies based in the USA are integrated on our website. If these tools are active, your personal data may be transferred to US servers of the respective companies. We would like to point out that the USA is not a safe third country within the meaning of EU data protection law. US companies are obliged to disclose personal data to security authorities without you as the data subject being able to take legal action against this. It can therefore not be ruled out that US authorities (e.g. secret services) may process, analyse, and permanently store your data on US servers for surveillance purposes. We have no influence on these processing activities.

Revocation of your consent to data processing
Many data processing operations are only possible with your express consent. You can withdraw any consent you have already given at any time. The lawfulness of the data processing carried out until the revocation remains unaffected by the revocation.

Right to Object to Data Processing in Specific Cases and to Direct Marketing (Article 21 GDPR)
IF DATA PROCESSING IS BASED ON ARTICLE 6(1)(E) OR (F) GDPR, YOU HAVE THE RIGHT TO OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA AT ANY TIME ON GROUNDS RELATING TO YOUR PARTICULAR SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. THE LEGAL BASIS FOR THE PROCESSING CAN BE FOUND IN THIS PRIVACY POLICY.

IF YOU OBJECT, WE WILL NO LONGER PROCESS YOUR PERSONAL DATA UNLESS WE CAN DEMONSTRATE COMPELLING LEGITIMATE GROUNDS FOR THE PROCESSING THAT OVERRIDE YOUR INTERESTS, RIGHTS, AND FREEDOMS, OR IF THE PROCESSING SERVES THE ESTABLISHMENT, EXERCISE, OR DEFENCE OF LEGAL CLAIMS (OBJECTION PURSUANT TO ARTICLE 21(1) GDPR).

IF YOUR PERSONAL DATA IS PROCESSED FOR DIRECT MARKETING PURPOSES, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR PERSONAL DATA FOR SUCH MARKETING; THIS ALSO APPLIES TO PROFILING IN CONNECTION WITH DIRECT MARKETING. IF YOU OBJECT, YOUR PERSONAL DATA WILL NO LONGER BE USED FOR DIRECT MARKETING PURPOSES (OBJECTION PURSUANT TO ARTICLE 21(2) GDPR).

Right to Lodge a Complaint with the Competent Supervisory Authority
In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, particularly in the member state of their habitual residence, place of work, or the place of the alleged infringement. This right to lodge a complaint exists regardless of any other administrative or judicial remedies.

Right to Data Portability
You have the right to receive the personal data that we process based on your consent or in fulfilment of a contract in a commonly used, machine-readable format. If you request the direct transfer of data to another controller, this will only be carried out where it is technically feasible. 

SSL and TLS Encryption
For security reasons and to protect the transmission of confidential content, such as orders or inquiries sent to us as the website operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser bar. When SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

Encrypted Payment Transactions on This Website
If, after concluding a fee-based contract, you are required to provide us with your payment details (e.g. account number for direct debit), these data will be used exclusively for payment processing. Payment transactions using the common payment methods (Visa/MasterCard, direct debit) are processed exclusively via an encrypted SSL or TLS connection. You can recognise an encrypted connection by the fact that the browser’s address bar changes from “http://” to “https://” and by the padlock icon in your browser bar. With encrypted communication, the payment details you provide cannot be read by third parties.

Right to Access, Erasure, and Rectification
Within the framework of the applicable legal provisions, you have the right to obtain, free of charge, information about your stored personal data, their origin, recipients, and the purpose of processing. You also have the right to request the correction or deletion of this data. For any queries regarding personal data, you may contact us at any time using the details provided in the legal notice (imprint).

Right to Restrict Processing
You have the right to request the restriction of the processing of your personal data. You can exercise this right at any time by contacting us at the address given in the legal notice (imprint).

The right to restriction of processing applies in the following cases:

• If you contest the accuracy of your personal data stored with us, we usually need time to verify this claim. During the review period, you have the right to request the restriction of the processing of your personal data.
• If the processing of your personal data is unlawful, you may request the restriction of data processing instead of deletion.
• If we no longer need your personal data, but you require them for the establishment, exercise, or defence of legal claims, you may request the restriction of processing instead of deletion.
• If you have objected to the processing under Article 21(1) GDPR, a balancing of your interests and our legitimate interests must be carried out. As long as it has not been determined whose interests prevail, you have the right to request the restriction of the processing of your personal data.

If the processing of your personal data has been restricted, these data – apart from being stored – may only be processed with your consent, for the establishment, exercise, or defence of legal claims, for the protection of the rights of another natural or legal person, or for important public interest reasons of the European Union or a member state.

Objection to Marketing E-mails
The use of contact details published in the legal notice (imprint) for the purpose of sending unsolicited advertising and informational materials is hereby expressly prohibited. The operators of this website expressly reserve the right to take legal action in the event of unsolicited promotional information being sent, such as spam e-mails.

4 DATA COLLECTION ON THIS WEBSITE

Cookies
Our website uses so-called “cookies”. Cookies are small text files that do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (persistent cookies) on your device. Session cookies are automatically deleted at the end of your visit, while persistent cookies remain stored on your device until you delete them yourself or your browser automatically removes them. Some third-party cookies may also be stored on your device when you visit our website. These enable us or you to use certain services provided by third parties (e.g. cookies for processing payment transactions).

Cookies serve various functions. Many cookies are technically necessary, as certain website functions would not work without them (e.g. shopping cart functionality or video display). Other cookies help analyse user behaviour or display advertisements.

Cookies required for the electronic communication process (essential cookies) or for the provision of certain functions you requested (functional cookies, e.g. shopping cart functionality) or for website optimisation (e.g. cookies to measure web audience) are stored based on Article 6(1)(f) GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing cookies for the technically error-free and optimised provision of its services. Where consent for storing cookies has been requested, storage of the respective cookies will be based solely on this consent (Article 6(1)(a) GDPR); consent may be revoked at any time.
You can set your browser to inform you about the use of cookies and allow cookies only in specific cases, exclude cookies in certain cases or completely, and enable automatic deletion of cookies when closing your browser. Disabling cookies may limit the functionality of this website.

Where third-party cookies or cookies for analysis purposes are used, we will provide specific information about this in our privacy policy and, where necessary, request your consent.

Server Log Files
The website provider automatically collects and stores information in so-called server log files, which your browser automatically transmits to us. These include:

• Browser type and version
• Operating system used
• Referrer URL
• Hostname of the accessing device
• Time of server request
• IP address

This data is not combined with other data sources. Data collection is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in ensuring the technically error-free presentation and optimisation of its website. To achieve this, server log files must be recorded.

Contact Form
If you send us inquiries via the contact form, the information you provide in the inquiry form, including the contact details you provide, will be stored by us for the purpose of processing the inquiry and in case of follow-up questions. We do not share this data without your consent. Processing of this data is based on Article 6(1)(b) GDPR, if your inquiry is related to the performance of a contract or is required for pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of inquiries (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR) if requested.

Any data you enter into the contact form will remain with us until you request its deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory legal provisions – especially retention periods – remain unaffected.

Inquiries via E-mail, Phone, or Fax
If you contact us via e-mail, phone, or fax, your inquiry, including all personal data resulting from it (name, request), will be stored and processed by us for the purpose of handling your request. We do not share this data without your consent. Processing of this data is based on Article 6(1)(b) GDPR, if your inquiry is related to the performance of a contract or is required for pre-contractual measures. In all other cases, processing is based on our legitimate interest in effectively handling inquiries (Article 6(1)(f) GDPR) or on your consent (Article 6(1)(a) GDPR) if requested. 

The data you send us via contact requests will remain with us until you request its deletion, revoke your consent to storage, or the purpose for data storage no longer applies (e.g. after your request has been processed). Mandatory legal provisions – especially statutory retention periods – remain unaffected.

Registration on This Website
You may register on this website to access additional features offered on the site. The data entered during registration will only be used for the purpose of using the respective offer or service for which you have registered. The mandatory details requested during registration must be fully provided, otherwise, we will reject the registration. For important changes such as modifications to the scope of our services or necessary technical adjustments, we use the e-mail address provided during registration to inform you accordingly.

Processing of the data entered during registration is based on Article 6(1)(b) GDPR (performance of a contract or pre-contractual measures).
The data collected during registration is stored by us as long as you remain registered on this website and will be deleted afterwards. Legal retention periods remain unaffected.

5 ANALYTICS TOOLS AND ADVERTISING

Google Analytics
This website uses features of the Google Analytics web analytics service. The provider is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics enables the website operator to analyse the behaviour of website visitors. The website operator receives various user data, such as page views, session duration, operating system used, and user origin. Google may compile this data into a profile, which is then linked to the respective user or their device. Google Analytics uses technologies that enable user recognition for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transferred to a Google server in the USA and stored there.

 The use of this analytics tool is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour in order to optimise both its website and advertising. If consent has been requested (e.g. consent to store cookies), processing is based exclusively on Article 6(1)(a) GDPR; consent may be revoked at any time.
Data transfer to the USA is based on the EU Commission’s standard contractual clauses. Details can be found here: https://privacy.google.com/businesses/controllerterms/mccs/. 

IP Anonymisation
We have enabled the IP anonymisation feature on this website. As a result, your IP address is shortened by Google within the European Union or in other contracting states of the Agreement on the European Economic Area (EEA) before being transmitted to the USA. Only in exceptional cases is the full IP address sent to a Google server in the USA and shortened there. On behalf of the website operator, Google uses this information to analyse your use of the website, to compile reports on website activities, and to provide other services related to website activity and internet usage. The IP address transmitted by your browser within Google Analytics is not merged with other Google data.

Browser Plugin (Opt-Out)
You can prevent Google from collecting and processing your data by downloading and installing the following browser plugin: https://tools.google.com/dlpage/gaoptout?hl=de. For more information about how Google handles user data, please see Google’s privacy policy: https://support.google.com/analytics/answer/6004245?hl=de. 

Data Processing Agreement
We have entered into a data processing agreement with Google and comply fully with the strict requirements of the German data protection authorities when using Google Analytics.

Demographic Features in Google Analytics
This website uses the “Demographic Features” function of Google Analytics to show relevant ads within the Google advertising network. This allows reports to be generated containing information on the age, gender, and interests of website visitors. This data comes from Google’s interest-based advertising as well as visitor data from third-party providers. This data cannot be assigned to a specific individual. You can disable this feature at any time via your Google Account settings or opt out of data collection by Google Analytics as described in the section “Opt-Out” above. 

Storage Duration
User-level and event-level data stored by Google, which is linked to cookies, user IDs, or advertising IDs (e.g. DoubleClick cookies, Android advertising ID), are automatically deleted or anonymised after 14 months. For more details, visit: https://support.google.com/analytics/answer/7667196?hl=de. 

Google Remarketing
This website uses the Google Analytics Remarketing feature. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. 

Google Remarketing analyses your user behaviour on our website (e.g. clicking on certain products) to categorise you into specific advertising target groups and display relevant web advertisements when you visit other online services (remarketing or retargeting). Additionally, the advertising target groups created with Google Remarketing can be linked to Google’s cross-device features. This allows personalised ads to be displayed based on your previous browsing behaviour, even on other devices (e.g. switching from mobile to desktop).

If you have a Google account, you can opt out of personalised advertising at any time here: https://www.google.com/settings/ads/onweb/. The use of Google Remarketing is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in effective marketing of its services. If consent has been requested, processing is based exclusively on Article 6(1)(a) GDPR; consent may be revoked at any time. For more information, please see Google’s privacy policy:  https://policies.google.com/technologies/ads?hl=de. 

Google Conversion Tracking
This website uses Google Conversion Tracking. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. 

Google Conversion Tracking allows Google and us to see whether users have performed specific actions. For example, we can evaluate which buttons are clicked on our website and which products are frequently viewed or purchased. This information is used to generate conversion statistics. We receive the total number of users who have clicked on our ads and what actions they performed. However, we do not receive information that personally identifies the user. Google itself uses cookies or similar recognition technologies for tracking. 

The use of Google Conversion Tracking is based on Article 6(1)(f) GDPR. The website operator has a legitimate interest in analysing user behaviour to optimise its website and advertisements. If consent has been requested (e.g. consent to store cookies), processing is based exclusively on Article 6(1)(a) GDPR; consent may be revoked at any time. For more details, please refer to Google’s privacy policy: https://policies.google.com/privacy?hl=de. 

6 NEWSLETTER

Newsletter Data
If you would like to subscribe to the newsletter offered on this website, we require your e-mail address as well as information that allows us to verify that you are the owner of the provided e-mail address and agree to receive the newsletter. No further data will be collected, or only on a voluntary basis. This data will be used exclusively for sending the requested information and will not be shared with third parties.

The processing of data entered into the newsletter subscription form is based exclusively on your consent (Article 6(1)(a) GDPR). You may revoke your consent to store data, the e-mail address, and its use for sending the newsletter at any time, for example, via the “unsubscribe” link in the newsletter. The lawfulness of the data processing carried out before the revocation remains unaffected. The data you provide for the purpose of receiving the newsletter will be stored by us or by the newsletter service provider until you unsubscribe from the newsletter, at which point it will be deleted from the newsletter distribution list. Data stored for other purposes remain unaffected by this.

After unsubscribing from the newsletter, your e-mail address may be stored in a blacklist by us or the newsletter service provider to prevent future mailings. The data from this blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with legal requirements for newsletter distribution (legitimate interest under Article 6(1)(f) GDPR). The storage period in the blacklist is not limited in time. You can object to this storage if your interests outweigh our legitimate interest.

7 PLUGINS AND TOOLS

YouTube
This website integrates videos from YouTube. The operator of the YouTube platform is Google Ireland Limited (“Google”), Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit one of our web pages where a YouTube video is embedded, a connection to YouTube’s servers is established. The YouTube server is then informed which of our pages you have visited. Additionally, YouTube may store various cookies on your device or use comparable recognition technologies (e.g., device fingerprinting). These enable YouTube to collect information about visitors to this website. The data collected is used, among other things, to compile video statistics, improve user experience, and prevent fraudulent activity. 

If you are logged into your YouTube account, YouTube can directly associate your browsing behaviour with your personal profile. You can prevent this by logging out of your YouTube account before visiting our website. The use of YouTube serves to provide an appealing presentation of our online content. This constitutes a legitimate interest as per Article 6(1)(f) GDPR. If consent has been requested, the processing is based exclusively on Article 6(1)(a) GDPR; you can revoke your consent at any time.

Further details on how YouTube handles user data can be found in YouTube’s privacy policy: https://policies.google.com/privacy?hl=de. 

8 E-COMMERCE AND PAYMENT PROVIDERS

Processing of Data (Customer and Contract Data)
We collect, process, and use personal data only to the extent necessary for establishing, structuring, or modifying the contractual relationship (inventory data). This is done based on Article 6(1)(b) GDPR, which permits data processing for the performance of a contract or pre-contractual measures. We also collect, process, and use personal data concerning the use of this website (usage data) only to the extent necessary to enable the user to utilise the service or to bill for it. The customer data collected will be deleted after the order is completed or the business relationship has ended. Legal retention periods remain unaffected.

Transfer of Data upon Contract Conclusion for Online Shops, Merchants, and Shipping
We only transfer personal data to third parties when it is necessary for the execution of the contract, such as to the company responsible for delivering the goods or the financial institution handling the payment process. No further transfer of data will take place unless you have expressly consented to it. Your data will not be passed on to third parties without explicit consent, particularly for advertising purposes. The legal basis for this data processing is Article 6(1)(b) GDPR, which permits data processing for contractual fulfilment or pre-contractual measures.

Transfer of Data upon Contract Conclusion for Services and Digital Content
We only transfer personal data to third parties when it is necessary for contract fulfilment, such as to the financial institution responsible for processing the payment. No further transfer of data will take place unless you have explicitly agreed to it. Your data will not be passed on to third parties without explicit consent, particularly for advertising purposes. The legal basis for this data processing is Article 6(1)(b) GDPR, which permits data processing for the fulfilment of contractual obligations or pre-contractual measures.

Payment Services
We integrate third-party payment services on our website. If you make a purchase with us, your payment data (e.g., name, payment amount, account details, credit card number) will be processed by the payment service provider for the purpose of payment processing. For these transactions, the respective contractual and data protection provisions of the providers apply. The use of payment service providers is based on Article 6(1)(b) GDPR (contract fulfilment) and serves the interest of a smooth, convenient, and secure payment process (Article 6(1)(f) GDPR). If specific actions require your consent, the legal basis is Article 6(1)(a) GDPR; consent can be revoked at any time for the future.
The following payment services are used on this website:

Giropay
Service provider: giropay GmbH, An der Welle 4, 60322 Frankfurt, Germany
More details can be found in Giropay’s privacy policy: https://www.giropay.de/rechtliches/datenschutzerklaerung/. 

Mastercard
Service provider: Mastercard Europe SA, Chaussée de Tervuren 198A, B-1410 Waterloo, Belgium
More details can be found in Mastercard’s privacy policy: https://www.mastercard.de/de-de/datenschutz.html. 

PayPal
Service provider: PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg
More details can be found in PayPal’s privacy policy: https://www.paypal.com/de/webapps/mpp/ua/privacy-full.

Visa
Service provider: Visa Europe Services Inc., Branch Office London, 1 Sheldon Square, London W2 6TT, UK
More details can be found in Visa’s privacy policy: https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html. 

Last updated: October 2020