To search

Privacy policy

Responsible

Landeszentrale für politische Bildung Hamburg
(Hamburg State Agency for Civic Education)

Represented by:
Dr Sabine Bamberger-Stemmann, Director
Eike Pockrandt, Deputy Director

Dammtorstraße 14
20354 Hamburg
Germany
kontakt@stolpersteine-hamburg.de

Overview of Data Processing

The following overview summarizes the types of data processed and the purposes of such processing, and identifies the data subjects.

  • Types of Data Processed

  • Master Data

  • Contact Information

  • Content Data

  • Usage Data

  • Meta, Communication, and Procedural Data

  • Log Data

Categories of Data Subjects

  • Communication Partners

  • Users

Purposes of Processing

  • Communication

  • Security Measures

  • Audience Measurement

  • Feedback

  • Provision of Our Online Services and User-Friendliness

  • IT Infrastructure

Applicable Legal Bases

Applicable Legal Bases Under the GDPR: The following provides an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country or our country of residence or incorporation. Furthermore, should more specific legal bases apply in individual cases, we will inform you of these in the Privacy Policy.

  • Consent (Art. 6(1), sentence 1, lit. a) GDPR) – The data subject has given consent to the processing of personal data concerning him or her for a specific purpose or for several specific purposes.

  • Legitimate Interests (Art. 6(1), first sentence, lit. f) GDPR) — Processing is necessary to safeguard the legitimate interests of the controller or a third party, provided that the interests, fundamental rights, and fundamental freedoms of the data subject, which require the protection of personal data, do not override those

National Data Protection Regulations in Germany: In addition to the data protection regulations of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Act on the Protection Against the Misuse of Personal Data in Data Processing (Federal Data Protection Act—BDSG). The BDSG contains, in particular, special provisions regarding the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, data transfers, and automated decision-making in individual cases, including profiling. Furthermore, state data protection laws of the individual federal states may apply.

Note on the Applicability of the GDPR and the Swiss Data Protection Act (DSG): This privacy notice serves to provide information in accordance with both the Swiss Data Protection Act (DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that the terms used in the GDPR are employed here due to its broader geographical scope and clarity. In particular, instead of the terms “processing” of “personal data,” “overriding interest,” and “personal data requiring special protection” used in the Swiss Data Protection Act (DSG), the terms “processing” of “personal data,” “legitimate interest,” and “special categories of data” used in the GDPR are employed. However, the legal meaning of these terms continues to be determined in accordance with the Swiss Data Protection Act (DSG) within the scope of its applicability.

Safety Measures

In accordance with legal requirements, and taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the varying likelihoods and severity of threats to the rights and freedoms of natural persons, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk.

These measures include, in particular, ensuring the confidentiality, integrity, and availability of data by controlling physical and electronic access to the data, as well as access to, input of, and disclosure of the data, ensuring its availability, and maintaining its separation. Furthermore, we have established procedures that ensure the exercise of data subjects’ rights, the erasure of data, and responses to data breaches. Furthermore, we take the protection of personal data into account from the very beginning of the development or selection of hardware, software, and procedures, in accordance with the principle of data protection through technical design and privacy-friendly default settings.

Processing of Personal Data

As part of our processing of personal data, it may occur that such data is transferred to or disclosed to other entities, companies, legally independent organizational units, or individuals. Recipients of this data may include, for example, service providers entrusted with IT tasks or providers of services and content integrated into a website. In such cases, we comply with legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.

General Information on Data Storage and Deletion

We delete the personal data we process in accordance with legal requirements as soon as the underlying consents are revoked or there are no longer any legal grounds for processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule apply when legal obligations or specific interests require the data to be retained or archived for a longer period.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal proceedings or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy policy contains additional information on the retention and deletion of data that applies specifically to certain processing operations.

If there are multiple specifications regarding the retention period or deletion deadlines for a given piece of data, the longest period shall always apply.

If a period does not expressly begin on a specific date and is at least one year in duration, it automatically begins at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships under which data is stored, the event triggering the period is the date on which the termination or other cessation of the legal relationship takes effect.

We process data that is no longer retained for its originally intended purpose—but rather due to legal requirements or other reasons—exclusively for the purposes that justify its retention.

Additional information on processing procedures, methods, and services:

  • Data Retention and Deletion: The following general time limits apply to data retention and archiving under German law:

    • 10 years—retention period for books and records, annual financial statements, inventories, management reports, opening balance sheets, as well as the work instructions and other organizational documents necessary for their understanding, accounting vouchers, and invoices (Section 147(3) in conjunction with (1)(1), (4), and (4a) of the German Tax Code (AO), § 14b(1) of the Value-Added Tax Act (UStG), § 257(1)(1) and (4), (4) of the Commercial Code (HGB)).

    • 6 years—Other business records: received commercial or business correspondence, copies of sent commercial or business correspondence, other documents to the extent they are relevant for tax purposes, e.g., hourly wage slips, payroll sheets, cost calculation documents, price tags, as well as payroll records, provided they are not already accounting vouchers, and cash register receipts (Section 147(3) in conjunction with (1)(2), (3), and (5) of the German Tax Code (AO), Section 257(1)(2) and (3), (4) of the German Commercial Code (HGB)).

    • 3 years—Data necessary to address potential warranty and damage claims or similar contractual claims and rights, as well as to process related inquiries, based on past business experience and standard industry practices, is retained for the duration of the regular statutory limitation period of three years (Sections 195, 199 of the German Civil Code (BGB)).

Rights of Data Subjects

Rights of Data Subjects Under the GDPR: As a data subject, you have various rights under the GDPR, which arise in particular from Articles 15 through 21 of the GDPR:

  • Right to Object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you that is carried out pursuant to Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling to the extent that it is related to such direct marketing.

  • Right to Withdraw Consent: You have the right to withdraw any consent you have provided at any time.

  • Right of Access: You have the right to request confirmation as to whether your personal data is being processed, as well as access to such data, further information, and a copy of the data in accordance with legal requirements.

  • Right to Rectification: In accordance with legal requirements, you have the right to request that data concerning you be completed or that inaccurate data concerning you be corrected.

  • Right to Erasure and Restriction of Processing: In accordance with legal requirements, you have the right to request that data concerning you be erased without delay or, alternatively, in accordance with legal requirements, to request a restriction of processing.

Provision of Online Services and Web Hosting

We process users' data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to deliver the content and features of our online services to the user's browser or device.

  • Types of Data Processed: Usage data (e.g., page views and time spent on the site, click paths, usage intensity and frequency, types of devices and operating systems used, interactions with content and features); Meta, communication, and procedural data (e.g., IP addresses, timestamps, identification numbers, individuals involved). Log data (e.g., log files regarding logins, data retrieval, or access times).

  • Data subjects: Users (e.g., website visitors, users of online services).

  • Purposes of processing: Provision of our online services and user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment (computers, servers, etc.)). Security measures.

  • Retention and Deletion: Deletion in accordance with the information provided in the section “General Information on Data Storage and Deletion.”

  • Legal Bases: Legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR).

Additional information on processing procedures, methods, and services:

  • Collection of Access Data and Log Files: Access to our online services is logged in the form of so-called “server log files.” Server log files may include the address and name of the web pages and files accessed, the date and time of access, the amount of data transferred, a notification of successful access, the browser type and version, the user’s operating system, the referrer URL (the previously visited page), and, as a rule, IP addresses and the requesting provider. The server log files may be used, on the one hand, for security purposes—for example, to prevent server overload (particularly in the event of malicious attacks, known as DDoS attacks)—and, on the other hand, to ensure server capacity and stability; legal basis: legitimate interests (Art. 6(1), sentence 1, lit. f) of the GDPR). Data Deletion: Log file information is stored for a maximum of 30 days and is then deleted or anonymized. Data that must be retained for evidentiary purposes is exempt from deletion until the respective incident has been fully resolved.

  • DigitalOcean: Services in the field of information technology infrastructure provision and related services (e.g., storage space and/or computing capacity); Service Provider: DigitalOcean, LLC., Attn: Data Protection, 101 Avenue of the Americas, 10th Floor, New York; Hosting in Frankfurt am Main, Germany; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.digitalocean.com; Privacy Policy: https://www.digitalocean.com/legal/privacy-policy; Data Processing Agreement: Provided by the service provider.

  • Analysis and Monitoring: We use “Matomo” on this website for statistical analysis. This is an open-source tool for visitor analysis. Matomo does not transmit any data to servers outside of our control. Our Matomo installation operates without cookies and respects your browser’s “Do Not Track” setting. If data is collected, it is fully anonymized and stored for a maximum of 365 days. The legal basis for using Matomo is legitimate interests (Art. 6(1)(f) of the GDPR). We use it to further improve our website and tailor it to the needs of our users.

Using Google Maps and Apple's “Maps” in the Stolperstein app

The State Agency for Political Education uses the Google Maps API and Apple “Maps” API in the “Stolpersteine” app, depending on whether your mobile phone runs on Android or iOS. This allows us to display interactive maps directly within the app and enables you to use the map feature conveniently. The legal basis is Article 6(1), sentence 1, letter f of the GDPR.

Through these mapping services, Google or Apple receives information that you have opened the app. Your IP address and location are transmitted. The map feature is integrated to enable navigation within the Stolpersteine app. If you enable location sharing in the Stolpersteine app, your device’s location is tracked and stored, even if you are not actively using the Stolpersteine app, a Google product, or a Google service at that moment. All location data transmitted to Google or Apple is anonymized. When you use the app to navigate to a nearby Stolperstein, your location is determined so that the map feature can show you the way to the Stolperstein. You can revoke your consent to location sharing by the Stolpersteine app at any time in your device’s settings.

Google's Terms of Service can be found at: https://policies.google.com/terms?hl=de&gl=de, and its Privacy Policy at: www.google.de/intl/de/policies/privacy. Google may also process your personal data in the United States and has complied with the EU-U.S. Privacy Shield, https://www.privacyshield.gov/EU-US-Framework.

Apple’s Terms of Service can be found at: www.apple.com/legal/internet-services/maps/terms-de.html and its Privacy Policy at: www.apple.com/de/privacy/