Data Privacy

The protection of your privacy is of the utmost importance to us. Furthermore, it is important to us for you to always know when we store data and how we use it.

The information below informs you about the pages on our website where we receive information from you during your visit and how we process it.

As a matter of principle, you can use the Kunst- und Ausstellungshalle der Bundesrepublik Deutschland GmbH ("Bundeskunsthalle") website without providing any personal data about yourself. If it is necessary to process personal data and no legal basis exists for doing do, we generally seek the consent of the data subject.


How do we process personal data when you visit our website?
Every time a user accesses a page on our website and retrieves a file, access data about this process is stored in a log file on our server.

Ever record is comprised of:

  • The name of the file
  • The date and time of the request (time stamp)
  • The volume of data transferred
  • The access status (file transfer, file not found etc.)
  • The website where the request came from (referrer URL)
  • The sub-pages accessed on our website via an accessing system
  • The operating system used by the accessing system
  • The Internet service provider for the accessing system
  • A description of the type of web browser used; e.g. Mozilla Firefox, Google Chrome or Microsoft Internet Explorer, Apple Safari, Opera etc.)
  • An internet protocol address (IP address)

We store IP addresses in server log files for a period of seven days.
Storage takes place for data security reasons, in order to guarantee the stability and operational security of our Internet presence.
The legal basis for this is formed by Sec 6. (1) (f) GDPR.
As a matter of principle, we do not share your data with third parties unless you have consented to this. In certain areas, however, (e.g. hosting our website), we rely on the use of service providers who we usually place under obligation by way of a data processing commission agreement to ensure compliance with the legal requirements.

Collection of additional data over the website


The "Bundeskunsthalle" website uses cookies. Cookies are text files that are deposited and stored on a computer system over an Internet browser.

Numerous websites and servers use cookies. Many cookies contain what is known as a cookie ID. A cookie ID is a unique identifier for the cookie. It consists of a character string which allows web pages and servers to be assigned to the specific Internet browser in which the cookie was stored. This allows the websites and servers visited to distinguish the individual's browser from other Internet browsers that contain other cookies. The unique cookie ID can be used to recognise and identify a particular Internet browser.

By using cookies, the "Bundeskunsthalle" can provide its website users with more user-friendly services which would not be possible without setting the cookie. As already mentioned, cookies allow us recognise our website users. The purpose of this is to facilitate their use of our website. For example, the user of a website that uses cookies does not have to re-enter their credentials every time they visit the website, because the website and the cookie stored on the user's computer system does this for them.

The data subject can prevent cookies being set through our website at any time by make a corresponding setting in the respective Internet browser, thus permanently rejecting cookies being set. The user can also delete cookies at any time that have already been set through an internet browser or other software programs. This is possible in all standard Internet browsers. However, it may not be possible to use all the functions of our website in full if the data subject deactivates cookies being the set in the Internet browser used.


We have embedded the Matomo plugin into the "Bundeskunsthalle" website. Matomo is an open-source software tool for web analysis. Web analysis involves the recording, collection and analysis of data concerning the behaviour of website visitors. One of the jobs a web analysis tool performs is to collect data about which website a data subject came from (referrer website), which sub-pages on the website he accessed and how often, and the length of time a sub-page was viewed. Web analysis is mainly used to optimise a website and perform cost-benefit analysis in relation to Internet advertising.

The software is operated on the data controller's server and log files sensitive to privacy are stored exclusively on this server.

The purpose of the Matomo plugin is to analyse visitor flows on our website. We use the data and information obtained, among other things, to evaluate the use of our website in order to compile online reports showing the activities on our web pages.

Matomo sets a cookie on the user's IT system. What cookies are, has already been explained above. Setting the cookie allows us to analyse the use of our website. Each time an individual page on this website is called up, the Matomo plugin automatically causes the Internet browser on the data subject's IT system to transmit data to our server for online analysis purposes. In the course of this technical process, we gain knowledge of personal data, such as the data subject's IP address, which, among other things, serves to help us understand where visitors originate from and their clicks.

The cookie stores personal information, such as access time, the location from where access was made and the frequency of visits to our website. Each time a data subject visits our website, this personal information, including the IP address for the Internet connection used by the data subject, is transmitted to our server. We store this personal data. We do not disclose this personal data to third parties.

The data subject can prevent cookies being set through our website at any time as described above by making a corresponding setting in the respective Internet browser and thus permanently rejecting cookies being set. Making this setting in the Internet browser used also prevents Matomo from setting a cookie on the data subject's IT system. The data subject can also delete at any time a cookie that Matomo has already set over an Internet browser or other software programs.

Furthermore, the data subject can object to the data generated by Matomo relating to the use of this website being collected and also prevent its collection. To do so, the data subject needs to set an opt-out cookie. The data subject will need to set the opt-out cookie again if his IT system is deleted, formatted or reinstalled at a later date.

Setting the opt-out cookie may result in the data subject no longer being able to use the data controller's website in full.

Further information and the currently valid Matomo privacy policy can be viewed under:


What data protection rights exist?
Each data subject has the right to information pursuant to Sec. 15 GDPR, the right to correction pursuant to Sec. 16 GDPR, the right to cancellation pursuant to Sec. 17 GDPR, the right to restrict processing pursuant to Sec. 18 GDPR, the right to object pursuant to Sec. 21 GDPR and the right to data transfer pursuant to Sec. 20 GDPR, insofar as no legal provisions preclude this (in particular pursuant to Sec. 15, 17 GDPR, Sec. 34 and 35 Federal Data Protection Act (BDSG)).

If you believe that your personal data is being processed unlawfully, you may refer your complaint to a supervisory authority responsible for data protection (Sec. 77 GDPR in conjunction with Sec. 19 Federal Data Protection Act (BDSG)).


This website uses social media plugins from,,, and This can be recognized by the corresponding logo.
When visiting a page on which such a logo appears, the browser automatically connects to the respective server of the social media service. The connected social media service receives various data including which website the user is currently visiting. The operator of the website has no influence on which data is transmitted to the respective platform. This data transfer is also independent of whether the user clicks on the plug-in.

If the user is logged into Facebook, Twitter, Instagram, or YouTube at the same time as our website, the plugin may set up a concrete connection with the account of the user. If the user writes a comment on the website or likes it via the plugin, then the plugin sends information to Facebook etc. and links this with the user’s account. To prevent this, the user must logout from the social media account.

In addition to this information, users should also observe the privacy policy of Facebook, Twitter, Instagram and YouTube. There is also the option to install an add-on that blocks the social media plugin, so data transfer can be prevented.

Is my data transferred to a third country or international organisation?
Data transfer to entities, offices and agencies in countries outside the European Union (so-called third countries) does not take place.

To what extent does automated decision-making or profiling take place?
As a matter of principle, we do not use fully automated decision-making or profiling pursuant to Sec. 22 GDPR. If we use these procedures in individual cases, we will inform you about this separately if so required by law.

Information about your right to object pursuant to Sec. 21 GDPR
Right to object in individual cases
For reasons arising from your particular situation, you are entitled at any time to object to data on your person being processed, which takes place based on Sec. 6 (1) (f) GDPR (data processing based on a balance of interests).

How up to date is this Privacy Policy?
This Privacy Policy is currently valid and was last updated in 07/2018.

Data Protection Officer
Stefanie Seifert
P +49 228 9171–220

Objection to advertising
You can object to being addressed with advertising at any time.
To exercise your rights, please send a letter by post to the "Bundeskunsthalle" postal address or by email to: