Privacy policy

I. Controller

The Controller responsible for the collection, processing and use of your personal data within the meaning of the General Data Protection Regulation (GDPR) in conjunction with the Federal Data Protection Act (BDSG) and other data protection regulations is:

German Lost Art Foundation
Prof. Dr. Gilbert Lupfer
Executive Chairman
Humboldtstraße 12
D-39112 Magdeburg
Germany
Tel.: +49 (0) 391 727 763 0
E-mail: kontakt@kulturgutverluste.de

The German Lost Art Foundation takes data privacy very seriously. It endeavours to protect your personal data within the scope of its online services, which it uses exclusively for the purposes stated below.

Below you will find information on the type, scope and purpose of the processing of personal data, its legal basis and storage period as well as on how cookies are used in connection with the use of the website https://www.kulturgutverluste.de/Webs/DE/Start/Index.html.

II. Data Protection Officer

Data Protection Officer of the German Lost Art Foundation:

German Lost Art Foundation
Sebastian Hohmann
Data Protection Officer
Humboldtstraße 12
D-39112 Magdeburg
Germany
Tel.: +49 (0) 391 727 763 37
E-mail: sebastian.hohmann@kulturgutverluste.de

III. Competent supervisory authority

The competent supervisory authority for the German Lost Art Foundation is:

The Federal Commissioner for Data Protection and Freedom of Information
Graurheindorfer Str. 153
D-53117 Bonn
Germany
Main switchboard: +49(0)228-997799-0
Central e-mail: poststelle@bfdi.bund.de

IV. Handling of personal data

Personal data is information that can be used to identify a person, i.e. information that can be traced back to a specific individual. This includes their name, e-mail address or telephone number.

The provision of personal data on your part is neither legally nor contractually required. It is voluntary in all cases, especially in the case of the conclusion of contracts (such when purchasing publications).

If you use the services offered on our website, personal data will only be processed if you agree to us doing so. In exceptional cases, personal data is also processed without your consent, if this is permitted by law.

The German Lost Art Foundation only passes on your data to third parties without your written consent if:

• this data is required by a subcontractor or vicarious agent that we use exclusively in the context of providing the offerings or services you have requested (unless you are expressly informed otherwise, such vicarious agents are in turn only entitled to use the data insofar as this is necessary for the provision of the offer or service)
• if there is a legally binding court order or a legally binding official order to this effect, or
• insofar as it is necessary to prevent misuse of our offerings or services in a legally permissible manner.

This website is hosted by an external service provider (Hetzner Online GmbH). Insofar as personal data is processed on this website, it is stored on the servers of Hetzner Online GmbH. The external service provider has access to this personal data exclusively in the context of the technical provision and administration of this website. The external service provider is obliged to comply with the data protection regulations.

All data is located on servers within the Federal Republic of Germany. The data is not used for any other purpose, nor is it stored together with other data (profile creation).

V. Operation of the website

1. Type and scope of data processing

Every time a user accesses online services provided by the German Lost Art Foundation and every time a file is retrieved, data relating to this process is automatically stored and processed temporarily in a log file. Before being stored, each data set is anonymised in that the IP address is changed. For this reason it is not possible to assign the collected data to a specific natural person.

The following specific data is stored for each access/retrieval:

• Anonymised IP address
• Date and time
• Page accessed/name of the file accessed
• Volume of data transferred
• Message whether the access/retrieval was successful
• User agent

If you use the registration form for our press mailing list or for our newsletter, create a user account for a restitution notification or purchase a publication via the order form, we will ask you to provide some personal details. This includes your title, first and last name, home or business address, telephone number, e-mail address and/or your message. Provision of this information is always voluntary and the information is used by the German Lost Art Foundation exclusively for the purpose of providing the service in question.

If you do not voluntarily provide the required information, however, this may restrict your ability to use the website. This depends in particular on whether the information is optional or absolutely necessary for the respective usage option and the contract conclusion this involves in each case. The information required in order for you to be able to use the website or conclude a contract is shown accordingly on our website. If you do not provide the required information, you will not be able to join our press mailing list, subscribe to our newsletter, contact us, purchase publications via our website and/or report a restitution via our website, due to a lack of a user account.

2. Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a), (b) and (e) GDPR.

3. Purpose of the data processing

The processing of personal data serves the provision of this website, including its use and its display on your retrieval device.

The website is provided based on the statutory tasks of the German Lost Art Foundation and serves the public interest as part of the state’s information activities.

In addition, the personal data is processed in order to provide you with different usage options on our website. These include our press mailing list, our newsletter and setting up a user account for the submission of a restitution report.

The commissioning of an external service provider for web hosting serves to ensure the secure and reliable provision of our online offerings by a professional provider.

Beyond this, personal data is only evaluated for statistical purposes and in order to improve our website. This serves to make our offerings more user-friendly, effective and secure.

• E-Mail-Adresse
• Vor- und Nachname
• Anschrift
• Bankverbindung
• Datum der Spende

4. Storage period

Your personal data is deleted immediately after the purpose of its collection has been fulfilled. In the case of files concerning access data (log files), however, this happens no later than after 30 days. Your personal data is only saved for longer if the German Lost Art Foundation is obliged to do so by legislation at the European, national or state level or by a legally binding court or official order.

VI. Cookies

1. Type and scope of cookies

Our website uses so-called cookies in several instances. “Cookies” are small text files that are placed on your computer and stored by your browser. Cookies do not cause any damage to your computer and do not contain viruses.

This website uses necessary and optional cookies. Specifically, these are:

Necessary cookies:

• ccm_consent: Used to store the cookie consent agreement, which specifies which cookies can be set.

Optional cookies for the purpose of web analytics:

• _pk_testcookie: Used to check if the visitor’s browser supports cookies
• MATOMO_SESSID: Used to activate or deactivate web analytics
• mtm_consent or mtm_consent_removed: Created so as to remember that the user has given or withdrawn their consent
• _pk_id*: Storage of an ID to record unique visitors
• _pk_ref*: Storage of the referrer from which the website was originally visited
• _pk_ses*: Temporary storage of session data when visiting the website
• _pk_cvar.*: Captures the user-defined variables generated during the previous page view
• _pk_hsr.*: Captures the page views of a session

You can set your browser so that you do not allow cookies or only allow them in individual cases, i.e. you can exclude the acceptance of cookies in certain cases or in general, and you can activate the automatic deletion of cookies when closing the browser. If cookies are deactivated, the functionality of this website is limited to the extent that service functions (such as logging into user accounts, playing videos) can no longer be used, for example.

2. Privacy settings

On your first visit to this website, the privacy settings are displayed by means of a so-called cookie banner. In the privacy settings, you can decide which cookies are to be stored and whether external media may be displayed. You can revoke this decision at any time by clicking on this button:

Change privacy settings

3. Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a) and (e) GDPR.

4. Purpose of the data processing

Cookies enable you to make the best possible use of our website. They also serve to make our offerings more user-friendly, effective and secure.

5. Storage period

Cookies remain stored on your end device until they are manually deleted or deletion is activated by means of the relevant browser settings when the browser is closed.

VII. Use of Matomo

1. Nature and scope of the use of Matomo

This website uses the open source web analytics service Matomo.

Matomo makes use of cookies. These are text files that are stored on your computer and enable analysis of your use of the website. For this purpose, information about the use of this website is stored on our server independently of other data. IP addresses are anonymised prior to storage. The information generated by your visit to this website about the use of this website is not passed on to third parties.

If you give your consent to the use of Matomo, we collect the following data:

• 2 bytes of the IP address of the user’s retrieving system
• The website accessed
• The website from which the user accessed the website (referrer)
• The length of stay on the website
• Country
• User agent

2.  Data protection settings, consent, revocation

You can decide in the data privacy settings whether a web analysis cookie may be stored in your browser to enable us to collect and analyse various statistical data anonymously. No analysis is carried out until you have actively consented to the setting of the required cookie in the data privacy settings.

You can revoke your consent to the setting of the web analysis cookie at any time. In order to do this, you can delete the cookie in your browser or change your data privacy settings. You can make a change to your data privacy settings using the following button:

Change privacy settings.

Alternatively, you can delete cookies that have already been set in your browser or you can set your browser in such a way that it indicates to site operators not to include you in such statistics (“do-not-track”).

For information provided by Matomo on data privacy, see https://matomo.org/privacy/.

3. Legal basis of the data processing

The information obtained via Matomo is used in accordance with Art. 6 (1) (a) GDPR.

4. Purpose of the data processing

We use Matomo to evaluate the use of the website and to enable us to design our website in line with needs. Cookies enable you to make the best possible use of our website. They also serve to make our offerings more user-friendly, effective and secure.

5. Storage period

The data is deleted as soon as we no longer need it to fulfil the above purposes.

Newsletter

1. Type and scope of data processing

The German Lost Art Foundation newsletter provides updates on news and activities relating to the Foundation as well as information about current funding opportunities for provenance research projects. It is published at irregular intervals and offers free background knowledge and recommendations to enable you to stay up to date.
In order to subscribe to the newsletter, you must enter your ready-to-receive e-mail address in the input field provided for this purpose on our registration page and confirm that you consent to the subscription and to the processing of your personal data this involves by clicking on the registration button.
We use the Google service reCaptcha for the registration process to determine whether a human being or a computer is making a specific entry in our newsletter form. Google uses the following data to check whether you are a human being or a computer:

•  IP address of the end device used
•  our website that you are visiting on which the captcha is integrated
•  the date and duration of the visit
•  the identification data of the browser and operating system type used,
•  your Google account if you are logged in to Google,
•  mouse movements in the reCaptcha spaces,
•  tasks requiring you to identify images

In order to cancel a subscription, you must enter your ready-to-receive e-mail address in the input field provided for this purpose on our cancellation form and confirm that you consent to the cancellation and the processing of your personal data this involves by clicking on the cancellation button. Alternatively, it is sufficient to use the cancellation link that you receive with the newsletter – in this case, the e-mail address you use will also be processed.
In addition to your e-mail address, we also process the following data:

• IP address of the accessing user
• date and time of registration/cancellation

If you contact us via the other specified contact options (e-mail, post) for the purpose of cancelling your newsletter subscription, we process the personal data provided by you automatically or manually. This information is usually the following:

• E-mail address
• First and last name
• Address
• Telephone number

The personal data is not passed on to third parties and is processed exclusively in connection with our newsletter service.

2. Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a) and (b) GDPR.

3. Purpose of the data processing

Your personal data is processed exclusively for the delivery of our newsletter to the specified e-mail address as well for the prevention of misuse of our newsletter service, also in relation to your e-mail address.

4. Storage period

The data is deleted as soon as we no longer need it for the above purposes, but all data (except the e-mail address) is deleted after six months at the latest.

Processing of your e-mail address ends in particular if we discontinue the newsletter service completely or if you cancel your subscription. You can cancel your subscription to the newsletter using the cancellation form on our website or the cancellation link in the newsletter, or else by e-mail to: presse@kulturgutverluste.de or by post to the Controller (see 1).

IX. Press mailing list

1. Type and scope of data processing

We offer you the service of being included in our press mailing list. After registering, you will receive press invitations and press information by e-mail at regular intervals.

In order to register, you must enter certain details in the input field provided for this purpose on our registration page and confirm that you consent to the registration and the processing of your personal data this involves by clicking on the registration button.

We are bound to process the following data by sending it by e-mail to one of our e-mail addresses:

• First and last name
• Town/city
• Country
• E-mail address
• Medium

We optionally process the following data in the same way:

• Street/house number
• Website
• Telephone number
• Position
• Request

The personal data is not passed on to third parties and it is processed exclusively in connection with our press mailing list service.

2. Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a) and (b) GDPR.

3. Purpose of the data processing

Your personal data is processed exclusively for the delivery of our press mailing list via e-mail to the specified e-mail address and to prevent misuse of our press mailing list service.

4. Storage period

The data is deleted as soon as we no longer need it to fulfil the above purposes.

Processing of your personal data ends in particular if we discontinue the press mailing list completely or you cancel your registration. You can cancel your subscription to the press mailing list using the cancellation form on our website (which can be used for both registering and making a change to a registration).

You also have the option of changing your details. In order to do this, use the relevant option entitled “I would like to change my details” in the registration/cancellation form on our website. When data is updated, the corresponding existing data is deleted.

X. Press photos

1.    Type and scope of data processing

As a service, we offer you current German Lost Art Foundation press photos for download. You may use these images free of charge for editorial reporting on the Foundation. Terms of use apply to the use of press images as attached to the download kits; they are also available for retrieval/download.

The following specific data is stored each time one of the kits is downloaded:

• anonymised IP address
• date and time
• accessed file
• volume of data transferred
• message whether the download was successful

2.    Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a) and (b) GDPR.

3.    Purpose of the data processing

We process personal data for statistical purposes as well as in order to secure and improve our services. In addition to ensuring proper, functional download, the processing of the data serves in particular to make our service more user-friendly, effective and secure.

4.    Storage period

Your personal data is deleted immediately after the purpose of its collection has been fulfilled. In the case of files concerning access data (log files), however, this happens no later than after 30 days.

XI. Online registration for events

1. Type and scope of data processing

We offer you the service of being able to register for our events via an online tool. You will receive a confirmation e-mail from us after you have registered.

In order to register, you must enter certain details in the input field provided for this purpose on the relevant registration page and confirm that you consent to the  registration and the processing of your personal data this involves by clicking on the registration button.

We are bound to process the following data by sending it by e-mail to one of our e-mail addresses:

• First and last name
• Institution
• Profession
• E-mail address

We optionally process the following data in the same way:

• Title
• Street
• Building number
• Postcode
• Town/city
• Country

The personal data is not passed on to third parties and is processed exclusively in connection with our event registration service.

2. Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a), (b) and (e) GDPR.

3. Purpose of the data processing

Your personal data is processed exclusively for the purpose of registering for our events, to ensure your participation in the events, and to prevent misuse of our “Online registration for events” service.

4. Storage period

The data is deleted as soon as we no longer need it to fulfil the above purposes.

XII. Explanatory videos

1.    Type and scope of data processing

The German Lost Art Foundation makes short, animated explanatory videos available for use free of charge in order to support the educational work done by cultural heritage institutions. They answer questions such as “What is provenance research?”, “What are just and fair solutions?” and “What is the Lost Art database?”. The films can be embedded in multimedia guides, media stations and websites. The explanatory videos are published under the Creative Commons licence CC BY-NC-ND 4.0 (Attribution-NonCommercial-NoDerivatives 4.0 International).

The following specific data is stored for each access/retrieval:

• anonymised IP address
• date and time
• accessed file
• volume of data transferred
• message whether the download was successful

2.    Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a) and (b) GDPR.

3. Purpose of the data processing

We process personal data for statistical purposes as well as in order to secure and improve our services. In addition to ensuring proper, functional download, the processing of the data serves in particular to make our service more user-friendly, effective and secure.

3.    Storage period

Your personal data is deleted immediately after the purpose of its collection has been fulfilled. In the case of files concerning access data (log files), however, this happens no later than after 30 days.

XIII. Notification of restitutions

1. Type and scope of data processing

a) Public and private institutions

Public or private institutions wishing to inform us of a restitution or any other just and fair solution can use our online notification procedure.

In order to use the online notification procedure, it is first necessary to register with us for this purpose and create a user account. When you use our user account registration form, we ask you to provide certain personal details.

In the case of registering a user account, these are firstly the following:

• E-mail address
• User name
• Password
• Position of the person registering
• Type of institution
• Name of the institution (preset selection or manual)

Provision of this information is always voluntary, but it is required in order to create a user account. If you do not voluntarily provide the required information, this will restrict your ability to use the website. If you do not provide the required information, you will not be able to create a user account on this website or make use of the online notification procedure.

Secondly, the following additional details can also be provided voluntarily, but these details are not required for the opening of a user account:

• Name of the person reporting on behalf of the institution
• Sites of the institution
• German federal state

After entering your data in the registration form and submitting your registration request, we will receive a notification e-mail at an e-mail box at our Foundation as part of the registration process. You will first receive notification of receipt from us to your e-mail address. After successful verification of your registration, you will receive an e-mail from us about the creation of a user account.

Once you have an activated user account, a restitution notification can be submitted. This requires the following minimum information to be provided:

• Name of the institution
• Date of restitution or other just and fair solution
• Type or genre of the object
• Quantity (in the case of several objects)
• Unit
• Artist/author/manufacturer
• Title/designation of the object
• Last owner before seizure as a result of Nazi persecution
• Circumstances of confiscation/loss
• Was this preceded by a project funded by the German Lost Art Foundation (or the Arbeitsstelle für Provenienzforschung (Bureau for Provenance Research))?
• Was there a report on the object in the Lost Art database?

b) Private individuals

Private individuals can send a restitution notification by e-mail to kontakt@kulturgutverluste.de. In this case, we process the personal data provided by you automatically or manually. This information is typically the following:

• E-mail address
• First and last name
• Lost Art ID

2. Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a) and (e) GDPR.

3. Purpose of the data processing

The above data is used by us for the registration process (institutions), the provision of user accounts (institutions), correspondence with you (institutions, private individuals) and the maintenance of the so-called restitution register (institutions, private individuals).

4. Storage period

Your personal data is deleted immediately after the purpose of its collection has been fulfilled.

XIV. Contact

1. Type and scope of data processing

If you contact us via the other channels (e-mail, post, telephone) specified on our website, we process the personal data provided by you automatically or manually. This information is usually the following:

• E-mail address
• First and last name
• Address
• Telephone number

2. Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a), (b) and (e) GDPR.

3. Purpose of the data processing

We process the personal data for the purpose of communicating with you. This can take place in particular in order to exchange information regarding our fields of work, but also for the initiation or conclusion of contracts.

4. Storage period

Your personal data is deleted immediately after the purpose of its collection has been fulfilled. In the case of a telephone number being transmitted during a call, however, this occurs no later than after three months.

XIV. Donations

1. Type and scope of data processing

If you contact us in order to support our work by making a donation, we process the personal data you provide. This information is usually the following:

• E-mail address
• First and last name
• Address
• Bank details
• Date of donation

First and last name, address, date of donation and amount of donation must be stated on the donation receipt if it is to be recognised by the responsible tax authorities.

2. Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a), (b) and (c) GDPR.

3. Purpose of the data processing

We process the personal data for the purpose of communicating with you, accounting of the donation in connection with our budget management, accounting of the donation with the tax authorities, and the creation and transmission of a donation receipt.

4. Storage period

Your personal data is deleted immediately after the purpose has been fulfilled; however, the data required for a donation receipt is not deleted before the expiry of the retention period of ten years under tax law. The above period begins at the end of the year in which the donation was paid to us.

XV. Publications produced by the former Koordinierungsstelle (Coordination Office)

1. Type and scope of data processing

You can purchase the publications produced by the former Koordinierungsstelle (Coordination Office) via our website. In order to obtain an overview of the content of these publications, you can download the tables of contents. If you decide to purchase one or more publications, you can use the order form on our website.

In order to place an order, you need to enter certain information in the respective input fields provided and confirm your order by clicking on the button “Buy now”.

Provision of the information is voluntary, but at least some of it is absolutely necessary for the conclusion of a purchase contract.

We are bound to process the following data:

• IP address of the accessing user
• Date and time of the order
• First and last name
• Address
• E-mail address

We optionally process the following data:

• Institution
• Telephone number

2. Legal basis of the data processing

The processing of your personal data is based on Art. 6 (1) (a) and (b) GDPR.

3. Purpose of the data processing

Your personal data is processed exclusively for the purpose of processing the order, in particular for communicating with you and shipping the publication(s).

4. Storage period

The data is deleted as soon as we no longer need it to fulfil the above purposes. In the case of your personal details (including address), however, it is not deleted before the expiry of any claims arising from the contractual relationship (deadline: three years to the end of the year in which the contract was concluded).

XVI. Use of social media services

We use plugins from the social networks LinkedIn and YouTube on our website.

This serves to fulfil the statutory tasks of the German Lost Art Foundation and serves the public interest as part of the state’s information activities.

Personal data is only processed after active consent to its use, unless the processing is necessary for the operation of the website and its services.

On your first visit to this website, the privacy settings are displayed by means of a so-called cookie banner. In the privacy settings, you can decide which cookies are to be stored. You can revoke this decision at any time by clicking on this button:

Change privacy settings

The processing of your personal data is based on Art. 6 (1) (a) and (e) GDPR.

1. YouTube

We maintain an online presence on YouTube. YouTube is a service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, a subsidiary of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA.

Our website contains a plugin for playing videos. Before loading a video on our website, you will be shown a link to YouTube’s privacy policy. At https://policies.google.com/privacy?hl= you can find out about the type and scope of the processing of personal data, its purposes, the relevant legal basis, the storage period concerning the aforementioned data and your rights.

If you wish to use our services associated with YouTube, you must expressly consent to the loading of the video (again). In order to do this, click on the “Load video” button in the video window. This consent is voluntary. If you do not give your consent, however, it will not be possible to use the plugin and therefore watch the videos we provide on our website. Alternatively, however, we offer you the option of downloading selected videos. This enables you to play these videos directly from your device.

We would like to point out that there is a possibility that when using YouTube, users’ data may be processed outside the European Union, in particular in the USA. This can lead to increased risks for users in that, for example, later access to user data may be more difficult. We do not have access to this user data either. YouTube is exclusively able to access this data.

Google LLC, and therefore YouTube, obtained certification under the EU-US Privacy Shield, thereby committing to comply with European data privacy standards. According to information provided by Google LLC, the processing of personal data is also based in particular on standard contractual clauses which have been approved by the European Union and which require compliance with European data privacy standards, even outside the EU. You can access further information and the standard contractual clauses via the Google LLC privacy policy: https://policies.google.com/privacy?hl=.

2. LinkedIn

We maintain an online presence on the website https://de.linkedin.com. A separate privacy policy for this online presence can be found here: https://www.kulturgutverluste.de/datenschutzerklaerung-linkedin.

XVII. Rights of data subjects

If the German Lost Art Foundation processes your personal data, you as the data subject have the following rights:

• according to Art. 7 GDPR, you have the right to revoke any consent you may have given at any time, whereby the lawfulness of the processing of your personal data carried out based on your consent up until revocation is not affected
• according to Art. 15 GDPR, you have the right to obtain information about the personal data processed by us and to further information according to the regulatory catalogue
• according to Art. 16 GDPR, you have the right to have inaccurate personal data relating to you corrected and/or to have incomplete personal data completed
• according to Art. 17 GDPR, you have the right to have the personal data concerning you erased
• according to Art. 21 GDPR, you have the right to object to the processing of your personal data on grounds relating to your particular situation, unless we have compelling legitimate grounds which override your interests, rights and freedoms
• according to Art. 18 GDPR, you have the right to restrict the processing of your personal data if
  • the accuracy of this data is disputed by you
  • the processing is unlawful, you refuse the erasure of the data and instead request the restriction of the use of the data
  • we no longer need to process the data for the above purpose but for the assertion, exercise or defence of legal claims
  • you have objected to the processing of your data pursuant to Art. 21 (1) GDPR, but it has not yet been determined whether our compelling legitimate grounds for continuing to process your personal data outweigh your interests, rights and freedoms
• according to Art. 20 GDPR, you have the right to receive the personal data you have provided in a structured, common and machine-readable format and to transfer it to another controller without hindrance on our part, insofar as we process your data automatically and you have consented to the processing
• according to Article 77 GDPR, you have the right, without prejudice to other legal remedies, to lodge a complaint with a supervisory authority – in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement – if you are of the opinion that the processing of your personal data by us violates data protection regulations. The Federal Commissioner for Data Protection is responsible for us (see 3).

If you wish to assert the above rights vis-à-vis the German Lost Art Foundation or have any questions on the subject of data privacy, please contact our Data Protection Officer (see II of this privacy policy).

XVIII. Changes to our privacy policy

We will continually update this policy to protect your personal data. You should review this policy from time to time to keep informed of how we are protecting your data and continually improving the content of our website.