Data Protection

When visiting the website of Kunsthaus Göttingen, personal data may be collected, processed and used. This takes place within the framework of the legal provisions, in particular the Basic Data Protection Regulation (DSGVO), the German Telemedia Act (TMG), the Federal Data Protection Act (BDSG), the Data Protection Act of the State of Lower Saxony (NDSG) and the Interstate Broadcasting Treaty (RStV). The following data protection statement provides information on the nature, scope, purpose and legal basis of the collection, processing and use of personal data:

I. Name and address of person responsible

The responsible party within the meaning of the Basic Data Protection Regulation and the other laws mentioned above is:

The City of Göttingen, represented by the Lord Mayor Petra Broistedt, Hiroshimaplatz 1-4, 37083 Göttingen, phone: 0551/400-0, e-mail:

Name and address of data protection officer(s)

C. Ludwikowski, Kommunale Dienste Göttingen (KDG) kAöR, Paulinerstraße 14, 37073 Göttingen. Phone: 0551/384-4151, e-mail: 

II. Data collection and processing
1. Scope of the processing of personal data

As a matter of principle, we process personal data of the users of the Internet page of Kunsthaus Göttingen only to the extent that is necessary for the provision of a functional website as well as its contents and services. As a rule, personal data is only processed with the consent of the user. An exception applies in those cases in which obtaining prior consent is not possible for actual reasons and/or the processing of data is permitted by legal regulations.

2. Basic information on the legal basis for the processing of personal data

Insofar as consent of the data subjects is obtained for processing operations of personal data, Article 6 (1) lit. a DSGVO serves as the legal basis.

Where the processing of personal data is necessary for the performance of a contract to which the data subject is a party, Article 6 (1) (b) DSGVO serves as the legal basis. This also applies to data processing operations that are necessary for the implementation of pre-contractual measures.

Insofar as we collect and process data for the fulfilment of legal obligations, Article 6 (1) c DSGVO serves as the legal basis.

Insofar as vital interests of the data subject or another natural person make processing of personal data necessary, Article 6 (1) (d) DSGVO serves as the legal basis.

If and insofar as the collection and processing of personal data by us is necessary to protect a legitimate interest of Kunsthaus Göttingen or a third party and the interests, fundamental rights and freedoms of the data subject do not override this interest, Article 6 (1) (f) DSGVO serves as the legal basis for the processing. This does not apply insofar as we carry out the processing in the fulfilment of their tasks (Article 6 (1) last sentence DSGVO).

3. Cookies

In some areas of the website of Kunsthaus Göttingen, so-called cookies are used. Through this, your computer with which you visit the website is recognized. The purpose of the cookies is to enable faster loading of the page, especially during repeat visits to our Internet pages, and thus to facilitate the use of the Internet pages.

If you do not wish to use cookies, you have the option of setting your Internet browser so that you are informed about the occurrence of cookies and in this case, you can allow or exclude the cookies individually. In addition, you have the option of deleting cookies that already exist. In principle, it is also possible to generally deactivate cookies. This can also be done through your internet browser. Cookies do not allow access to private data stored on your computer.

The use of cookies is based on Article 6 (1) lit. f DSGVO. The processing is carried out to improve the functioning of the portal. It is therefore necessary for the protection of legitimate interests.

4. Google Analytics

Insofar as you have declared your consent, Google Analytics is used on this website, a web analytics service provided by Google Ireland Limited. The use includes the Universal Analytic mode of operation. This makes it possible to assign data, sessions and interactions across multiple devices to a pseudonymous user ID and thus analyse the activities of a user across devices.

Google Analytics uses cookies, which are text files placed on your computer, to help the website analyse how users use the site. The information generated by the cookie about your use of the website will be transmitted to and stored by Google on servers in the United States. In the event that IP anonymization is activated on this website, however, your IP address will be truncated beforehand by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area. We would like to point out that on this website Google Analytics has been extended by IP anonymization to ensure anonymized collection of IP addresses (so-called IP masking). The IP address transmitted by your browser as part of Google Analytics will not be merged with other data from Google.

Purpose of processing

On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator.

Legal basis

The legal basis for the use of Google Analytics is your consent in accordance with

Recipients / categories of recipients

The recipient of the collected data is Google.

Transfer to third countries

The personal data is transferred to the USA under the EU-US Privacy Shield based on the European Commission’s adequacy decision. You can view the certificate here:

Duration of data storage

Data sent by us and linked to cookies, user IDs (e.g. user ID) or advertising IDs are automatically deleted after 14 months. Data whose retention period has been reached is automatically deleted once a month.

Data subject rights

You can revoke your consent at any time with future effect by preventing the storage of cookies by means of an appropriate setting in your browser software; however, we would like to point out that in this case you may not be able to use all the functions of this website to their full extent.

5. Newsletter

With our newsletter we keep you regularly informed by e-mail about current exhibitions and events of the Kunsthaus.

The data you enter here will only be used to personalize the newsletter and will not be passed on to third parties. You can unsubscribe at any time via our website or from within the newsletter, or revoke your consent at any time by emailing Your data will be deleted within 3 months after termination of the newsletter receipt, provided that the deletion does not conflict with any legal retention obligations. By sending the data you entered, you consent to the data processing and confirm our privacy policy. For the security of our website, the newsletter registration form is supported by the use of the Google service reCaptcha (see below).

6. Google reCAPTCHA

We use the Google service reCaptcha to determine whether a human or a computer makes a certain input in our contact or newsletter form. Google uses the following data to check whether you are a human or a computer: IP address of the terminal device used, the website you visit with us on which the captcha is embedded, the date and duration of the visit, the recognition data of the browser and operating system type used, Google account if you are logged in to Google, mouse movements on the reCaptcha areas and tasks that require you to identify images. The legal basis for the described data processing is Art. 6 (1) lit. f of the General Data Protection Regulation. There is a legitimate interest on our part in this data processing to ensure the security of our website and to protect us from automated entries (attacks).

III. Data subject rights

Insofar as your personal data is processed by us, you are a data subject within the meaning of the GDPR and you are entitled to the following rights against the responsible party:

1. Right of information

You have the right to request confirmation from us as to whether the personal data concerning you is being processed. This right to information applies to any form of data use by us.

2. Rights of rectification

You have a right to rectification and/or completion against the responsible party insofar as the processed personal data concerning you are inaccurate or incomplete. The responsible party shall carry out the rectification without undue delay.

3. Right of restriction of processing

Under the following conditions, you may request the restriction of the processing of personal data concerning you:

(a.) if you contest the accuracy of the personal data concerning you for a period enabling the responsible party to verify the accuracy of the personal data;

b.) the processing is unlawful and you object to the erasure of the personal data and request instead the restriction of the use of the personal data;

c.) the responsible party no longer needs the personal data for the purposes of processing, but you need it for the assertion, exercise or defence of legal claims; or

d.) if you have objected to the processing pursuant to Article 21 (1) DSGVO and it has not yet been determined whether the legitimate grounds of the responsible party outweigh your grounds.

If the processing of personal data concerning you has been restricted, such data may – apart from being stored – only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing has been restricted in accordance with the above conditions, you will be informed by the controller before the restriction is lifted.

4. Right to erasure

a) Obligation to erase

The responsible party is then obliged to delete this data without delay if one of the following reasons applies:

(1) The personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed.

(2) You revoke your consent on which the processing was based pursuant to Art. 6(1)(a) or Art. 9(2)(a) DSGVO and there is no other legal basis for the processing.

(3) You object to the processing pursuant to Art. 21 (1) DSGVO and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Art. 21 (2) DSGVO.

5. Right to information

If you have asserted the right to rectification, erasure or restriction of processing against the responsible party, the responsible party is obliged to inform all recipients to whom the personal data concerning you have been disclosed of this rectification or erasure of the data or restriction of processing, unless this proves impossible or involves a disproportionate effort.

You have the right against the responsible party to be informed about these recipients.

6. Right to data portability

You have the right to receive the personal data concerning you that you have provided to the responsible party in a structured, common and machine-readable format. You also have the right to transfer this data to another controller without hindrance from the controller to whom the personal data was provided, provided that.

(1) the processing is based on consent pursuant to Art. 6(1)(a) DSGVO or Art. 9(2)(a) DSGVO or on a contract pursuant to Art. 6(1)(b) DSGVO and

(2) the processing is carried out with the help of automated procedures.

In exercising this right, you also have the right to obtain that the personal data concerning you be transferred directly from one responsible party to another, insofar as this is technically feasible. Freedoms and rights of other persons must not be affected by this.

The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the responsible party.

7. Right to object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) DSGVO; this also applies to profiling based on these provisions.

The responsible party will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims.

You have the possibility, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise your right to object by means of automated procedures using technical specifications.

8. Right to revoke the declaration of consent under data protection law.

You have the right to revoke your declaration of consent under data protection law at any time. The revocation of consent does not affect the lawfulness of the processing carried out on the basis of the consent until the revocation.

9. Automated decision in individual cases including profiling.

You have the right not to be subject to a decision based solely on automated processing – including profiling – which produces legal effects concerning you or similarly significantly affects you. This does not apply if the decision

(1) is necessary for the conclusion or performance of a contract between you and the responsible party,

(2) is permitted by legal provisions of the Union or the Member States to which the responsible party is subject and these legal provisions contain appropriate measures to protect your rights and freedoms as well as your legitimate interests; or

(3) is made with your express consent. However, these decisions may not be based on special categories of personal data pursuant to Article 9(1) of the GDPR, unless Article 9(2)(a) or (g) of the GDPR applies and appropriate measures have been taken to protect your rights and freedoms and your legitimate interests.

With regard to the cases referred to in (1) and (3), the responsible party shall take reasonable steps to safeguard the rights and freedoms as well as your legitimate interests, including at least the right to obtain the intervention of a person on the part of the responsible party, to express his or her point of view and to contest the decision.

10. Right to complain to a supervisory authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace or the place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority to which the complaint has been lodged shall inform the complainant of the status and outcome of the complaint, including the possibility of a judicial remedy under Article 78 GDPR.