Information on data protection

I.    General information
1. Contact

The responsible body within the terms of the applicable data protection laws is:

 

Executive Board of the Spore Initiative

Industriestr. 2; 79541 Lörrach, Germany
Phone +49 (0)3062724559
E-mail info@spore-initiative.org

1.1 Data Security Officer

We have appointed external data protection officers, you can reach them using the following contact details:

 101LAB / Agency for digital transformation  
Owner: Benjamin Orgis

Liebenwalder Str. 11  
13347 Berlin  
E-mail: spore.dsb@101lab.it

If you have any questions about data protection, please contact our external data protection officer.

2. legal bases
The term "personal data" under data protection law refers to all information relating to an identified or identifiable individual. We process personal data in compliance with the relevant data protection regulations, in particular the DSGVO and the BDSG. Data processing by us only takes place on the basis of a legal permission. We process personal data only with your consent (Section 25 (1) TTDSG or Art. 6 (1) a DSGVO), for the performance of a contract to which you are a party or at your request for the performance of pre-contractual measures (Art. 6 (1) b DSGVO), for the performance of a legal obligation (Art. 6 (1) (c) DSGVO) or if the processing is necessary to protect our legitimate interests or the legitimate interests of a third party, unless your interests or fundamental rights and freedoms which require the protection of personal data override (Art. 6 (1) (f) DSGVO). 

3. duration of storage
Unless otherwise stated in the following notes, we store data only for as long as necessary to achieve the purpose of processing or to fulfill our contractual or legal obligations. Such legal retention obligations may arise in particular from commercial or tax law regulations.

4. categories of recipients of the data
We use processors as part of the processing of your data. Processing operations carried out by such processors include, for example, hosting, emailing, or maintenance and support of IT systems. A processor is a natural or legal person, public authority, agency or other body that processes personal data on behalf of the data controller. Processors do not use the data for their own purposes, but carry out data processing exclusively for the controller and are contractually obligated to ensure appropriate technical and organizational measures for data protection. In addition, we may transfer your personal data to bodies such as postal and delivery services, house bank, tax consultancy/auditing company or the financial administration. Further recipients may result from the following notes.

5. data transfer to third countries
Our data processing activities may involve the transfer of certain personal data to third countries, i.e. countries in which the GDPR is not applicable law. Such a transfer is permissible if the European Commission has determined that an adequate level of data protection is warranted in such third country. If such an adequacy decision by the European Commission does not exist, a transfer of personal data to a third country will only take place if appropriate safeguards exist in accordance with Art. 46 of the GDPR or if one of the conditions of Art. 49 of the GDPR is met.

Unless otherwise stated below, we use the EU standard data protection clauses as suitable safeguards for the transfer of personal data in third countries. You have the possibility to obtain a copy of these EU standard data protection clauses or to inspect them. To do so, please contact us at the address given under Contact.  

If you consent to the transfer of personal data to third countries, the transfer will take place on the legal basis of Article 49 (1) a DSGVO. 

6. processing when exercising your rights 
If you exercise your rights under Articles 15 to 22 DSGVO, we process the personal data transferred for the purpose of implementing these rights by us and to be able to provide evidence thereof. We will only process data stored for the purpose of providing information and preparing it for this purpose and for data protection control purposes and otherwise restrict processing in accordance with Art. 18 DSGVO. 

These processing operations are based on the legal basis of Art. 6 para. 1 lit. c DSGVO in conjunction with. Art. 15 to 22 DSGVO and Section 34 (2) BDSG.

 7. your rights
As a data subject, you have the right to assert your data subject rights against us. In particular, you have the following rights:
- In accordance with Art. 15 DSGVO and Section 34 BDSG, you have the right to request information about whether and, if so, to what extent we are processing personal data relating to you or not. 
- You have the right to demand that we correct your data in accordance with Art. 16 DSGVO.
- You have the right, in accordance with Art. 17 DSGVO and § 35 BDSG, to demand that we delete your personal data.
- You have the right to have the processing of your personal data restricted in accordance with Art. 18 DSGVO.
- You have the right, in accordance with Art. 20 DSGVO, to receive the personal data concerning you that you have provided to us in a structured, common and machine-readable format and to transfer this data to another controller.
- If you have given us separate consent to data processing, you may revoke this consent at any time in accordance with Article 7 (3) DSGVO. Such a revocation will not affect the lawfulness of the processing that was carried out on the basis of the consent until the revocation.
- If you believe that a processing of personal data concerning you violates the provisions of the GDPR, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 GDPR.

8. right of objection
In accordance with Art. 21(1) DSGVO, you have the right to object to processing based on the legal basis of Art. 6(1)(e) or (f) DSGVO on grounds relating to your particular situation. If we process personal data about you for the purpose of direct marketing, you may object to such processing pursuant to Article 21 (2) and (3) of the GDPR.
 
II. Data processing on our website
When you use the website, we collect information that you provide yourself. In addition, during your visit to the website, we automatically collect certain information about your use of the website. In data protection law, the IP address is also generally considered to be a personal data. An IP address is assigned to every device connected to the Internet by the Internet provider so that it can send and receive data.

1. processing of server log files
During the purely informative use of our website, general information that your browser transmits to our server is initially stored automatically (i.e. not via registration). This includes by default: browser type/version, operating system used, page accessed, the previously visited page (referrer URL), IP address, date and time of the server request and HTTP status code. 

The processing is carried out to protect our legitimate interests and is based on the legal basis of Art. 6 para. 1 letter f DSGVO. This processing serves the technical administration and security of the website. The stored data is deleted after seven days unless there is a justified suspicion of unlawful use based on concrete indications and further examination and processing of the information is necessary for this reason. We are not able to identify you as a data subject on the basis of the stored information. Articles 15 to 22 of the GDPR therefore do not apply pursuant to Article 11(2) of the GDPR unless you provide additional information that enables us to identify you in order to exercise your rights set out in these articles.

2. contact options and inquiries
You can send us a message via the contact email. We will process the data for the purpose of responding to your request. 

If your request is directed towards the conclusion or performance of a contract with us, Art. 6 (1) b DSGVO is the legal basis for the data processing. Otherwise, we process the data on the basis of our legitimate interest in contacting inquiring persons. The legal basis for the data processing is then Art. 6 para. 1 letter f DSGVO.

3. newsletter
We offer the possibility on our website to register for our newsletter. After registration, we will regularly inform you about the latest news on our offers. A valid e-mail address is required to register for the newsletter. To verify the e-mail address, you will first receive a registration e-mail, which you must confirm via a link (double opt-in). If you subscribe to the newsletter on our website, we process personal data such as your e-mail address and name based on the consent you have given. The processing is based on the legal basis of Art. 6 (1) a DSGVO. You can revoke the consent given at any time with effect for the future, for example via the "unsubscribe" link in the newsletter or by contacting us via the channels mentioned above. The legality of the data processing operations already carried out remains unaffected by the revocation. 

When registering for the newsletter, we also store the IP address and the date and time of registration. The processing of this data is necessary in order to be able to prove that consent has been given. The legal basis arises from our legal obligation to document your consent (Art. 6 para. 1 letter c in conjunction with Art. 7 para. 1 DSGVO).

We also analyze the reading behavior and opening rates of our newsletter. For this purpose, we collect and process pseudonymized usage data that we do not merge with your e-mail address or your IP address. The legal basis for the analysis of our newsletter is Art. 6 para. 1 lit. f DSGVO and the processing serves our legitimate interest in optimizing our newsletter. You can object to this at any time by contacting one of the above mentioned contact channels.

 4. cookies 
We use cookies and similar technologies ("cookies") on our website. Cookies are small data sets that are stored by your browser when you visit a website. This identifies the browser used and can be recognized by web servers. You have full control over the use of cookies through your browser. You can delete the cookies in the security settings of your browser at any time. You can object to the use of cookies through your browser settings in principle or for specific cases. 

The use of cookies is technically necessary for the operation of our website and thus permissible without the consent of the user. 

5 Google Maps
We use Google Maps of Google Ireland Limited (Ireland, EU) on our website to display maps and for virtual tours. For such integration, a processing of your IP address is technically necessary so that the content can be sent to your browser. Your IP address is therefore transmitted to Google and Google may set its own cookies. 

The processing of your data is based on Art. 6 (1) f DSGVO and is based on our legitimate interest in the optimization and economic operation of our website.

When using the service, a transfer of your data to the USA cannot be excluded. Please also note the information in the section "Data transfer to third countries". For more information on data protection at Google, please refer to Google's privacy policy at https://www.google.com/policies/privacy.

6. open street map
We use the "Open Street Map" service of the OpenStreetMap Foundation (UK) on our website to display maps. For the use of Open Street Map, a processing of your IP address is technically necessary so that the content can be sent to your browser. Your IP address is therefore transmitted to Open Street Map. To our knowledge, Open Street Map does not set its own cookies. You can object to this data processing at any time via the settings of the browser used or certain browser extensions. One such extension is the Matrix-based firewall uMatrix for the browsers Firefox and Google Chrome. Please note that this may result in functional restrictions on the website.

The processing of your data is based on Art. 6 (1) (f) DSGVO and is based on our legitimate interest in designing our website to meet the needs of our customers.

When using the service, a transfer of your data to the United Kingdom cannot be excluded. We base the data transfer to the United Kingdom on the adequacy decision of the European Commission according to Art. 45 DSGVO. For more information on data protection at Open Street Map, please see Open Street Map's privacy policy at https://wiki.osmfoundation.org/wiki/Privacy_Policy.
7. YouTube
We use the YouTube service of Google Ireland Limited (Ireland, EU) on our website to integrate videos. For such an integration, a processing of your IP address is technically necessary so that the content can be sent to your browser. Your IP address is therefore transmitted to Google and Google may set its own cookies. We use YouTube in "extended data protection mode", so that no cookies are set by YouTube to analyze user behavior. 

The processing of your data is based on Art. 6 (1) f DSGVO and is based on our legitimate interest in the optimization and economic operation of our website.

When using the service, a transfer of your data to the USA cannot be excluded. Please note the information in the section "Data transfer to third countries". For more information on data protection at Google, please refer to Google's privacy policy at https://www.google.com/policies/privacy. 

8 Vimeo
We use the Vimeo service of Vimeo, Inc. (USA) on our website to integrate videos. For such an integration, a processing of your IP address is technically necessary so that the content can be sent to your browser. Your IP address is therefore transmitted to Vimeo and Vimeo may set its own cookies. 

The processing of your data is based on Art. 6 para. 1 lit. f DSGVO and is based on our legitimate interest in the optimization and economic operation of our website.

When using the service, a transfer of your data to the USA cannot be excluded. Please note the information in the section "Data transfer to third countries". For more information on data protection at Vimeo, please refer to Vimeo's privacy policy at https://vimeo.com/privacy.

 

 III. Data processing on our social media pages
We are represented on several social media platforms with a company page. Through this, we would like to offer further opportunities for information about our company and for exchange. Our company has company pages on the following social media platforms:

- Facebook
- Instagram

When you visit or interact with a profile on a social media platform, personal data about you may be processed. Information associated with a social media profile used also regularly constitutes personal data. This also covers messages and statements made while using the profile. In addition, during your visit to a social media profile, certain information is often automatically collected about it, which may also constitute personal data.

1. visit of a social media page

a) Facebook and Instagram
When you visit our Facebook or Instagram page, through which we present our company or individual products from our range, certain information about you is processed. The sole controller of this processing of personal data is Meta Platforms Ireland Limited (Ireland/EU - "Meta"). For more information about the processing of personal data by Meta, please visit https://www.facebook.com/privacy/explanation. Meta offers the possibility to object to certain data processing; related information and opt-out options can be found at https://www.facebook.com/settings?tab=ads. 

Meta provides us with statistics and insights in anonymized form for our Facebook and Instagram page, which we use to gain insights into the types of actions people take on our page (so-called "page insights"). These Page Insights are created based on certain information about individuals who have visited our Page. This processing of personal data is carried out by Meta and us as joint controllers. The processing serves our legitimate interest to evaluate the types of actions taken on our site and to improve our site based on these insights. The legal basis for this processing is Article 6(1)(f) DSGVO. 

We cannot associate the information obtained via Page Insights with individual user profiles interacting with our Facebook and Instagram page. We have entered into a joint controller agreement with Meta, which sets out the distribution of data protection obligations between us and Meta. For details about the processing of personal data to create Page Insights and the agreement entered into between us and Meta, please visit https://www.facebook.com/legal/terms/information_about_page_insights_data. With regard to these data processing operations, you have the option of asserting your data subject rights (see "Your rights" in this regard) against Meta as well. Further information on this can be found in Meta's privacy policy at https://www.facebook.com/privacy/explanation.

Please note that, in accordance with the Meta Privacy Policy, user data is also processed in the USA or other third countries. Meta transfers User Data only to countries for which an adequacy decision has been issued by the European Commission pursuant to Art. 45 of the GDPR or on the basis of appropriate safeguards pursuant to Art. 46 of the GDPR.
 
2. comments and direct messages
We also process information that you have provided to us via our company page on the respective social media platform. Such information may be the username used, contact details or a message to us. These processing operations by us are carried out as the sole responsible party. We process this data on the basis of our legitimate interest in contacting inquiring persons. The legal basis for the data processing is Art. 6 para. 1 letter f DSGVO. Further data processing may take place if you have consented (Art. 6 (1) (a) DSGVO) or if it is necessary for compliance with a legal obligation (Art. 6 (1) (c) DSGVO).

3. Taking photos at the Spore House

You are welcome to take photos at the Spore House to record your visit and share your experience with others. However, photography is permitted for personal, non-commercial purposes only. Video recording, the use of flash, and the use of professional cameras or tripods are not permitted without prior written permission from Spore. Please be considerate of other visitors and the artwork on display during your visit.

Status: August 2022