Data Protection

Privacy Policy

We are delighted that you have taken an interest in our organisation. Data protection is a top priority for the management of the Stiftung Kulturpalast Hamburg. In principle, it is possible to use the Stiftung Kulturpalast Hamburg website without providing any personal data. However, should a data subject wish to make use of specific services offered by our organisation via our website, the processing of personal data may be necessary. Where the processing of personal data is necessary and there is no legal basis for such processing, we generally seek the consent of the data subject.

The processing of personal data – such as a data subject’s name, address, email address or telephone number – is always carried out in accordance with the General Data Protection Regulation and in compliance with the state-specific data protection regulations applicable to the Stiftung Kulturpalast Hamburg. Through this privacy policy, our organisation aims to inform the public about the nature, scope and purpose of the personal data we collect, use and process. Furthermore, this privacy policy informs data subjects of their rights.

As the data controller, the Stiftung Kulturpalast Hamburg has implemented numerous technical and organisational measures to ensure the most comprehensive possible protection of the personal data processed via this website. Nevertheless, internet-based data transmissions may, in principle, be subject to security vulnerabilities, meaning that absolute protection cannot be guaranteed. For this reason, any data subject is free to provide us with personal data via alternative means, such as by telephone.

A. Information on the processing of personal data

We hereby inform you about the collection and processing of your data in accordance with Article 13 of the GDPR.

Version: 2.0
Date: 28 August 2025

B. General

1. Contact details

Data controller

The data controller is:

Stiftung Kulturpalast Hamburg
Öjendorfer Weg 30a
22119 Hamburg
Email: Please enable JavaScript to render this link!
Telephone: 040 822 45 68 0

Data Protection Officer

Mag. jur. Djoko Lukic
datenschutzbuero.hamburg | Suhrenkamp 59 – 22335 Hamburg
Email (ticket system): Please enable JavaScript to render this link!
Website: https://datenschutzbuero.hamburg
Telephone: 040 414 313 070

Competent supervisory authority for data protection

The Hamburg Commissioner for Data Protection and Freedom
of Information Ludwig-Erhard-Str 22, 7th floor
20459 Hamburg
Tel.: 040 / 428 54 - 4040
Fax: 040 / 428 54 - 4000
Email: Please enable JavaScript to render this link!

C. Definitions

Personal data

‘Personal data’, as defined in Article 4(1) of the GDPR, means any information relating to an identified or identifiable natural person (hereinafter referred to as the ‘data subject’). A natural person is considered identifiable if they can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person, can be identified.

Data processing

‘Processing’ within the meaning of Article 4(2) of the GDPR means any operation or set of operations which is carried out on personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

Data controller

The ‘controller’ within the meaning of Article 4(7) of the GDPR is a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. 

Consent

‘Consent’ within the meaning of Article 4(11) of the GDPR is any freely given, specific, in an informed and unambiguous manner, by the data subject in the form of a statement or other clear affirmative action, by which the data subject indicates that they consent to the processing of personal data relating to them.

D. Your rights

You are entitled to exercise the rights set out below.

1. Right of access, Article 15 of the GDPR

In accordance with Article 15 of the General Data Protection Regulation (GDPR), you, as a data subject, have the right to obtain information regarding the processing of your personal data. 

Provided that providing this information does not involve a disproportionate effort, we will provide you, free of charge, with information about the personal data we hold about you and supply you with a copy thereof. The information must include the following:

  1. the purposes of the processing;
  2. the categories of personal data being processed;
  3. the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular where recipients are in third countries or are international organisations;
  4. where possible, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period;
  5. the existence of a right to have personal data concerning them rectified or erased, or to have processing restricted by the controller, or a right to object to such processing;
  6. the existence of a right to lodge a complaint with a supervisory authority;
  7. where the personal data are not collected from the data subject, any available information as to the source of the data;
  8. the existence of automated decision-making, including profiling, and – at least in such cases – meaningful information about the logic involved, as well as the significance and the intended consequences of such processing for the data subject.

The right to access information under Article 15 of the GDPR applies only insofar as it does not adversely affect the rights and freedoms of other data subjects in accordance with Article 15(4) of the GDPR.

2. Right to data portability, Article 20 of the GDPR

Where data processing is carried out on the basis of consent or a contract and by automated means, you have the right to have your data provided to you in a structured, commonly used and machine-readable format. 

3. Right to rectification, Article 16 of the GDPR

You may request the rectification of inaccurate data or the completion of incomplete data relating to you. 

4. Right to erasure, Article 17 of the GDPR

Your personal data must be erased under the following conditions:

  1. The personal data is no longer necessary for the purposes for which it was collected or otherwise processed.
  2. You withdraw your consent on which the processing was based, and there is no other legal basis for the processing.
  3. You object to the processing in accordance with Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing.
  4. The personal data has been processed unlawfully.
  5. The erasure of the personal data is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
  6. The personal data was collected in relation to information society services offered to minors in accordance with Article 8(1) of the GDPR.

Your right to erasure does not apply insofar as the processing is necessary

  1. for the exercise of the right to freedom of expression and information;
  2. to comply with a legal obligation which requires the processing, or to carry out a task carried out in the public interest or in the exercise of official authority vested in the controller;
  3. for reasons of public interest in the area of public health in accordance with Article 9(2)(h) and (i) of the GDPR and Article 9(3) of the GDPR;
  4. for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) of the GDPR, insofar as the aforementioned right is likely to render impossible or seriously impair the achievement of the objectives of such processing, or
  5. for the establishment, exercise or defence of legal claims.

5. Right to restriction of processing, Article 18 of the GDPR

You have the right to have processing restricted where one of the following conditions is met:

  1. you contest the accuracy of your personal data, for a period enabling the controller to verify the accuracy of the personal data,
  2. the processing of your data is unlawful, you object to the erasure of the data and instead request that its use be restricted;
  3. you require the data to establish, exercise or defend legal claims.
  4. you have objected to the processing in accordance with Article 21(1) of the GDPR, pending verification of whether our legitimate grounds override your interests.

If processing has been restricted, your personal data – apart from its storage – may only be processed with your consent, or for the purpose of establishing, exercising or defending legal claims, or to protect the rights of another natural or legal person, or for reasons of an important ecclesiastical interest.

If you have obtained a restriction on processing, we will inform you before the restriction is lifted.

6. Right to object, Article 21 of the GDPR

As a data subject, you have the right, in accordance with Article 21 of the General Data Protection Regulation (GDPR), to object to the processing of your personal data. You may exercise this right to object in the following cases:

  1. Where the processing is based on our legitimate interest and your interests, fundamental rights and freedoms override that legitimate interest.
  2. Where personal data is processed for direct marketing purposes.
  3. If you object, we may only continue to process your personal data if we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or if the processing is necessary for the establishment, exercise or defence of legal claims.
  4. You have the right to object to the processing of your personal data at any time and without giving reasons. The objection may be made in writing or electronically and should be addressed to our contact address (see above, No. B.1.). 

7. Withdrawal of consent, Article 7(3) of the GDPR

You have the right to withdraw any consent you have given to us at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal. Withdrawal may be made in writing or electronically and should be sent to our contact address (see above, No. B.1.).

Newsletters

If you receive newsletters from us, you can withdraw your consent via the unsubscribe link in the newsletter or by sending a statement to our contact address.

Cookie or consent banner

You can adjust or withdraw the consents you have provided via the following link:

CONSENT BANNER SETTINGS 

8. Right to lodge a complaint, Article 77 of the GDPR

You also have the right to lodge a complaint with a data protection supervisory authority regarding our processing of your personal data. Employees are not required to follow official channels when submitting notifications to the supervisory authority.

E. Data processing

1. Visiting our website 

The purpose of data processing is to provide our website.

In order for our website to be displayed on your device, the website data must be transmitted to your device. This requires the processing of the following data: 

  • your public IP address,
  • the date and time of your visit,
  • the time zone difference from Greenwich Mean Time (GMT),
  • the content of the request (specific page),
  • the access status/HTTP status code,
  • the amount of data transferred in each instance,
  • the website from which the request originates,
  • information about the browser,
  • the operating system and its user interface, as well as
  • the language and version of the browser software.

We do not actively pass on the processed data. To provide the necessary technical infrastructure, we use service providers who, in the course of their work, may access the data listed above. Furthermore, all necessary data processing agreements have been concluded and the service providers have been obliged to implement adequate technical and organisational security measures. We may verify compliance with these security measures at any time.

The provision of the website and the information published on it is based on our own legitimate interests in accordance with Article 6(1)(f) of the GDPR. Our interests in this regard are the presentation of our services and the provision of our contact details. 

Hosting:

F7 Media GmbH, Humboldtstraße 67a, 22083 Hamburg
(https://f7.de/datenschutz)

Content Delivery Network:
Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA
(https://www.cloudflare.com/privacypolicy/)

2. Email infrastructure

The purpose of the processing is to send and receive electronic mail.

Sending and receiving emails requires the processing of the recipient’s or sender’s email address. In doing so, various pieces of information, such as log data and communication content, are transmitted and processed.

Where we transmit data requiring special protection, we encrypt it beforehand. We also use transport-encrypted connections for the transmission and receipt of emails.

To provide the necessary technical infrastructure, we use service providers who, in the course of their work, may have access to the data listed above. The necessary data processing agreements have been put in place. Furthermore, the service providers have been obliged to implement adequate technical and organisational security measures. We may verify compliance with these protective measures at any time.

The operation and use of the email infrastructure is based on our legitimate interest, in accordance with Article 6(1)(f) of the GDPR, in providing a means of electronic communication.

3. Recruitment Process

The purpose of the processing is to conduct recruitment procedures.

As part of recruitment procedures, we process the data provided in the application documents. This includes both personal details and professional information relating to the applicants. If a candidate is appointed, the data is stored in their personnel file.

Internally, the application documents are made available to the relevant departments and, where applicable, to the relevant representative bodies (representatives for people with severe disabilities, etc.).

The legal basis for the processing of application documents is Section 26 of the Federal Data Protection Act (BDSG) and Article 6(1), first sentence, point (b) of the General Data Protection Regulation (GDPR) for the purpose of initiating or concluding contractual relationships.

If no employment relationship is established, the data will be destroyed or deleted after six months at the latest.

4. Newsletter

The purpose of the processing is to provide information and promote our services via newsletters, such as the weekly lunch menu in our Palastküche, information about our events and our work.

Sending the newsletter requires the processing of the recipient’s name, email address and technical log data. Furthermore, the newsletter system can be used to determine whether newsletter content has been displayed or read.

To provide the necessary technical infrastructure, we use service providers who may access the data listed above in the course of their work. The necessary data processing agreements have been concluded with these service providers. Furthermore, the service providers have been obliged to implement adequate technical and organisational security measures. We may verify compliance with these safeguards at any time.

We use transport-encrypted connections for sending emails.

Newsletters are sent on the basis of your consent in accordance with Article 6(1)(a) of the GDPR.

To withdraw your consent to receive newsletters, you can use the unsubscribe link in the newsletters. Alternatively, you can also contact the data controller or the data protection officer (see above).

5. Social media

We operate our own pages on social media (Facebook, YouTube, Instagram and LinkedIn). The purpose is to inform the public about our work and to provide additional communication channels.

No data is transmitted to social media platforms when you visit our website. Only when you use our pages on the respective platforms will the providers process the information that is necessary for the provision of a website. This includes, in particular, the following data:

  • your public IP address,
  • the date and time of your visit to the page,
  • the time zone difference from Greenwich Mean Time (GMT),
  • the content of the request (specific page),
  • the access status/HTTP status code,
  • the amount of data transferred in each instance,
  • the website from which the request originates,
  • information about the browser,
  • the operating system and its user interface, as well as
  • the language and version of the browser software.

Furthermore, digital content (photographs, videos, reports, etc.) is published on social media.

We have no control over how and what other data is processed by the platform operators. Information on the data processing carried out by the respective platform operators can be found below:

Facebook: https://www.facebook.com/policy.php

LinkedIn: https://de.linkedin.com/legal/privacy-policy

YouTube: https://policies.google.com/privacy?hl=de

Instagram: https://help.instagram.com/519522125107875

All data processed in connection with your use of these platforms may be viewed by the platform operators.

The operation and use of the social media pages are based on our legitimate interest, in accordance with Article 6(1)(f) of the GDPR, in providing additional communication channels.

Where we publish content from you that can be personally identified, this publication is based on your consent in accordance with Article 6(1)(a) of the GDPR. 

6. Donation form

The purpose of the processing is to provide a donation form on our website and to manage donations. We use the ‘FundraisingBox’ service provided by Wikando GmbH for this purpose. 

We process the following personal data relating to you: name, email address, donation amount, donation frequency, payment details and, where applicable, any message you send to us.

If you would like a donation receipt from us, we will also process your address in order to issue the donation receipt and send it to you by post. 

A data processing agreement has been concluded with the service provider. Data will only be passed on to third parties where required by law (e.g. to tax authorities). The service provider does not store any payment information. 

Information necessary to carry out the transaction is processed by the payment service providers used. The following payment service provider may be used for this purpose:

PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg, Luxembourg, privacy policy:
https://www.paypal.com/de/legalhub/paypal/privacy-full)

You also have the option of issuing us with a SEPA direct debit mandate. To carry out the direct debit transaction, we pass your data on to your bank, which will debit your bank account accordingly and make a transfer to us. Your personal data is therefore passed on by us to the banks commissioned to process the SEPA direct debit.

Making a donation constitutes a ‘donation agreement’ (contract of gift pursuant to Section 516 of the German Civil Code (BGB)). We therefore process your data on the basis of Article 6(1)(b) of the GDPR to fulfil the contractual relationship.

We store your personal data for as long as is necessary to process the donation, issue the donation receipt and comply with statutory retention obligations.

Further information on data processing can be found in the service provider’s privacy policy: 

Wikando GmbH, Schießgrabenstr. 32, 86150 Augsburg,
https://fundraisingbox.com/privacy/datenschutzerklaerung-websitenutzende/

7. Ticket shop

The purpose of data processing is to provide a ticket shop for the purchase of tickets for our events.

To this end, we use the LeoTicket ticketing software from LeoMedia GmbH on our website. We also use the services of Reservix GmbH.

The personal data you provide (master data, contact details, payment details) is stored and processed for the purpose of fulfilling the contract. You will receive the information required to complete the purchase (order confirmation, invoice, etc.) by email. 

To process orders, we process the following data from you: your name, your date of birth, your contact details (telephone number, email address) and delivery address details. 

Data processing is carried out to exercise our contractual rights and to fulfil our contractual obligations in accordance with Article 6(1)(b) of the GDPR. 

For tax purposes, data relating to order processing must be retained for 10 years in accordance with Section 147 of the German Fiscal Code (AO).

Data recipients: 

LeoMedia GmbH, Römerstraße 97, 71229 Leonberg – Privacy Policy:
https://www.leoticket.de/datenschutz

Reservix GmbH, Humboldtstraße 2, 79098 Freiburg im Breisgau
https://www.reservix.de/datenschutz

8. Provision of videos on our website via YouTube 

The purpose of the processing is to provide videos on our website. 

To provide videos, we use the services of platform providers that enable us to integrate them into our website. In doing so, the provider processes the information that must be processed in order to provide a website. In particular, the following data is processed in this context:

  • your public IP address,
  • the date and time of your visit to the site,
  • the time zone difference from Greenwich Mean Time (GMT),
  • the content of the request (specific page),
  • the access status/HTTP status code,
  • the amount of data transferred in each instance,
  • the website from which the request originates,
  • information about the browser,
  • the operating system and its user interface, as well as
  • the language and version of the browser software.

Further information on data processing can be found below:

YouTube: https://policies.google.com/privacy?hl=de

The integration of the videos is based on your consent in accordance with Article 6(1)(a) of the GDPR. 

Where we do not provide videos via platform providers but host them directly on our website, the processing of personal data is carried out on the basis of our legitimate interest in promoting our services in accordance with Article 6(1)(f) of the GDPR.

9. 3D indoor tour (Google Street View)

The purpose of the processing is to provide a 3D tour of our premises. In this context, Google Street View processes the information that is necessary for the provision of a website. In particular, the following data is processed in this context:

  • your public IP address,
  • the date and time of your visit to the site,
  • the time zone difference from Greenwich Mean Time (GMT),
  • the content of the request (specific page),
  • the access status/HTTP status code,
  • the amount of data transferred in each instance,
  • the website from which the request originates,
  • information about the browser,
  • the operating system and its user interface, as well as
  • the language and version of the browser software.

It cannot be ruled out that Google may process data in the USA. The legal basis for this is the EU-US Data Privacy Framework, for which Google has obtained certification. This ensures that an adequate level of data protection is implemented by the data recipient.

The 3D tour is displayed on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. Further information on data processing can be found below:

Data recipient: Google Germany GmbH, ABC-Strasse 19, 20354 Hamburg, Germany,
(https://policies.google.com/privacy?hl=de) 

10. Provision of an interactive map 

The purpose of the processing is to display our event venues on an interactive map to help you find your way there.
To do this, we use the uMap application, which is based on the OpenStreetMap mapping platform. The provider processes the following data:

  • your public IP address,
  • the date and time of your visit to the site,
  • the time zone difference from Greenwich Mean Time (GMT),
  • the content of the request (specific page),
  • the access status/HTTP status code,
  • the amount of data transferred in each instance,
  • the website from which the request originates,
  • information about the browser,
  • the operating system and its user interface, as well as
  • the language and version of the browser software.

The map is displayed on the basis of your consent in accordance with Article 6(1)(a) of the GDPR. 

Further information on data processing can be found in the service provider’s privacy policy.

OpenStreetMap Foundation, 132 Maney Hill Road, Sutton Colffield, West Midlands, B72 1JU, UK,
(https://www.openstreetmap.de/impressum/datenschutz/)

11. Google Analytics

We use Google Analytics to determine whether, and if so which, content on our website is of interest.

The following data is processed in this context: Your public IP address, the date and time the webpage was viewed, the time zone difference from Greenwich Mean Time (GMT), the content of the request (the specific page), the amount of data transferred in each instance, the website from which the request originates, information about the browser, the operating system and its user interface, as well as the language and version of the browser software.

The legal basis for the processing is your consent in accordance with Article 6(1)(a) of the GDPR.

To withdraw your consent to data processing, you can access the consent banner again and adjust the settings accordingly. Further information, as well as the link to access the consent banner, can be found under section C of this privacy policy (Consent).

Data recipient: Google Germany GmbH, ABC-Strasse 19, 20354 Hamburg, Germany
(https://policies.google.com/privacy?hl=de)

12. Google Tag Manager 

This website uses Google Tag Manager. By triggering tags, the tool forwards data to the connected analytics tools, such as Google Ads or Google Analytics. Google Tag Manager itself does not set any cookies and does not collect any personal data. The tool does not analyse the data, but merely acts as an interface between the website and the analytics software. The legal basis for data processing is your consent in accordance with Article 6(1)(a) of the GDPR. 

It cannot be ruled out that Google may process data in the USA. The legal basis for this is the EU-US Data Privacy Framework, for which Google has obtained certification. This ensures that an adequate level of data protection is implemented by the data recipient.

Data recipient: Google Germany GmbH, ABC-Straße 19, 20354 Hamburg, Germany
(https://policies.google.com/privacy?hl=de)

13. Google reCAPTCHA

To protect against automated attacks, we check whether interactions with our website and the ticket shop are carried out by machines or in an automated manner. To this end, we use Google reCAPTCHA. This generates queries that can be answered correctly by humans – but not by software systems. The following data is analysed in the background: IP address, referrer URL, information about the operating system and browser, cookies, mouse movements and keystrokes, and time spent on the site.

The legal basis for this data processing is our legitimate interest in protecting our website and the data processed, in accordance with Article 6(1)(f) of the GDPR. 

Data recipient: Google Germany GmbH, ABC-Strasse 19, 20354 Hamburg, Germany,
(https://newrelic-com.translate.goog/termsandconditions/),
(https://www.google.com/recaptcha/about/)

14. Cookies and adjusting your consent

Cookies are files that are stored on your computer when you use the website. You can delete cookies at any time via your browser settings or prevent them from being stored altogether.

We use the cookies listed below:

Cookie – Function/Processing activity – Lifespan – Technically necessary (Yes/No)

Cookies that are not technically necessary require your consent. You can adjust the consents you have given via the following link:

CONSENT BANNER SETTINGS