1. Data Controller

The data controller within the meaning of the European General Data Protection Regulation (GDPR) and other data protection regulations is:

Stiftung Deutsches Technikmuseum Berlin Director Joachim Breuninger Trebbiner Straße 9 10963 Berlin Phone: +49 (0) 30 43 97 34 0 Email: info@technikmuseum.berlin

Contact details of the Data Protection Officer

Dr. Bittner Consulting GmbH & Co. KG Podbielskistraße 386 30659 Hannover Email: datenschutzteam375@drbg.de

1. Scope, Purposes, and Legal Basis of Data Processing

The processing of personal data of users of this website is largely carried out to provide the website and its contents. Where there is a legal basis for processing personal data, user consent is not required. Otherwise, the processing of personal data of users of this website is only carried out with prior consent in accordance with Art. 6 para. 1 lit. a GDPR.

The necessary processing of personal data for the initiation or fulfillment of a contract, to which the data subject is a party, is carried out in accordance with Art. 6 para. 1 lit. b GDPR. If processing is necessary for the performance of our tasks or our legal obligations, it is carried out in accordance with Art. 6 para. 1 lit. c, e GDPR.

Once the purpose of the respective data processing has been fulfilled, the personal data will be blocked or deleted. The processing of personal data may be carried out by us or by service providers commissioned by us within the framework of order processing in accordance with Art. 28 GDPR; service providers only perform the activities specified by us, which do not include processing for their own business purposes, which is contractually prohibited.

When visiting our website, our server system automatically collects data via the web analysis tool Matomo (see point 6), if you have consented to this.

Providing your personal data may not be legally or contractually required. However, the use of our services or offerings may not be possible or may not be executed correctly if no user data is provided (see, for example, the ticket tool). Statistical evaluations serve to improve the usability and content of our websites.

1. User Registrations

The use of certain offers on our website may require prior registration and further processing of personal data, such as long-term storage of email addresses, registration for the ticket tool, user IDs, and passwords. Such data is only used if you have provided it to us and have expressly consented to its processing in advance. In the following cases, we ask for your consent:

Ticket Tool

If you, as a user of the ticket tool (https://fahrkartentool.technikmuseum.berlin), wish to collect success points and participate in the leaderboard, as well as to be notified by email in the event of a possible win, we ask for your consent. We collect your name and email address for the purpose of enabling you to process tickets, record the number of processes, and assign the points awarded to your username. You can choose your username yourself. Please note that this username is publicly visible. Usernames and scores are evaluated internally for reporting purposes and used to publish a leaderboard. A small token of appreciation is given to users with the three highest scores. In this case, we use your email address for notification and, if necessary, address data for sending prizes.

The legal basis for consent to the use of your personal data for the user account is Art. 6 para. 1 lit. a GDPR; otherwise, Art. 6 para. 1 lit. b GDPR applies for the fulfillment of the respective contract for use with you or for sending the token of appreciation to you.

Event Registration

Our websites offer the possibility to register for events and to receive informational material or to use certain website services (Junior Campus or Science Center Spectrum). We collect the personal data required to carry out the respective process, such as your contact details. Your data will be passed on to third parties if this is necessary for the provision of services and related processes, such as payment processing. Your data will be passed on, for example, if an event is not organized by us but by third parties.

1. Communication via Email or Contact Form

Communication via email can have security gaps. Emails can be intercepted and read by skilled internet users on their way to us. If we receive an email from you, it is assumed that our employees are also authorized to respond by email. Otherwise, we ask you to consider another form of communication (e.g., by post).

It is possible to send messages via a predefined contact form when requesting contact, for example, to the Press and Public Relations Department or the Historical Archive. In this case, first name, last name, and email address, as well as the content of the message, are relevant.

1. Right to Object, Withdrawal of Consent

Regarding the data for the delivery of the website and the storage of data in log files, no objection is possible, as these are essential for the operation of the website.

If you have given your consent to the processing of your data, for example, for user registration or participation in a competition, you can withdraw your consent at any time without giving reasons. Please use either the specific hyperlinks or inform us of your withdrawal by email.

1. Web Analysis by Matomo

We use the open-source software tool Matomo (formerly PIWIK) on our website to analyze the surfing behavior of our users.

Scope of Processing Personal Data

The software sets a cookie on the user's computer (see above for cookies). When individual pages of our website are accessed, the following data is stored after your consent:

• Two bytes of the IP address of the user's calling system
• The accessed webpage
• The website from which the user accessed the accessed webpage (referrer)
• The subpages accessed from the accessed webpage
• The duration of stay on the webpage
• The frequency of accessing the webpage
• Technical details of the browser such as version number or resolution

The software runs exclusively on the servers of our website. The personal data of users is only stored there. The data is not passed on to third parties.

The software is configured so that IP addresses are not fully stored, but 2 bytes of the IP address are masked (e.g., 192.168.xxx.xxx). This way, it is no longer possible to assign the shortened IP address to the calling computer.

Legal Basis for Processing Personal Data

The legal basis for processing the personal data of users is Art. 6 para. 1 lit. f GDPR.

Purpose of Data Processing

Processing the personal data of users enables us to analyze the surfing behavior of our users. By evaluating the obtained data, we are able to compile information about the use of individual components of our website. This helps us to continuously improve our website and its user-friendliness. These purposes also constitute our legitimate interest in processing the data according to Art. 6 para. 1 lit. f GDPR. By anonymizing the IP address, the interest of users in protecting their personal data is sufficiently taken into account.

Duration of Storage

The data is deleted as soon as it is no longer needed for our recording purposes. In our case, this is after five years, as we measure the long-term impact of optimizations of our offering.

Possibility of Objection and Elimination

Cookies are stored on the user's computer and transmitted from there to our site. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your internet browser, you can disable or restrict the transmission of cookies. Cookies that have already been saved can be deleted at any time. This can also be done automatically. If cookies are disabled for our website, it may no longer be possible to use all functions of the website to their full extent.

We offer our users the option of opting out of the analysis process on our website. To do this, you must follow the corresponding link. This way, another cookie is set on your system, which signals to our system not to store the user's data. If the user deletes the corresponding cookie from their own system in the meantime, they must set the opt-out cookie again.

For more information on the privacy settings of the Matomo software, please visit the following link: https://matomo.org/docs/privacy/.

You have the option to prevent actions taken by you here from being analyzed and linked. This will protect your privacy but will also prevent the owner from learning from your actions and improving usability for you and other users.

Your visit to this website is currently being recorded by Matomo Web Analysis. Uncheck this box to opt-out.

You have agreed to display external content. Here you can disable it:

1. Cookies, Third-Party Plugins

To make visiting our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your device. The cookies we use are deleted after the end of the browser session, i.e., after closing your browser (so-called session cookies). You can set your browser to inform you about the setting of cookies and decide individually about their acceptance or exclude the acceptance of cookies for certain cases or in general. However, not accepting cookies may limit the functionality of our website.

Technically necessary cookies are required so that you can move around websites with forms and use their functions. Without these cookies, functionality, such as actions during a visit (e.g., text input), cannot be guaranteed even when navigating between the pages of the website. Functional cookies allow a website to store information already provided (e.g., username, language selection, or location) and improve the user's ability to offer personal functions. These cookies collect anonymized information and cannot track your movements on other websites. The cookies created by our website are deleted at the end of your browser session.

Of course, you can object to the use of cookies at any time by setting your internet browser not to accept cookies. Please refer to the help function of your internet browser for details. However, we point out that we cannot exclude the possibility that some functions of our website may not be usable or not fully usable.

1. Online Tickets

In cooperation with Giant Monkey GmbH (Brunnenstraße 39, 10115 Berlin, www.giantmonkey.de), online tickets for the exhibitions of the Deutsches Technikmuseum in Berlin are offered. The go~mus software implements data protection "by design" and limits data collection to the necessary data for the execution of the respective purpose. We collect personal and personally identifiable data in the following areas:

Customer Data: We collect your name, first name, email and address data, country, and language. Your data is collected via the online shop and the backend.

Entries: Entries are recorded for barcodes. Barcodes belong to ticket sales, annual passes, guided tour bookings, or participation in events. These are linked to customer data and participant data and form the basis of the contractual relationship. The collection of entries serves statistical purposes in anonymized form, in connection with customer data for the fulfillment of the contract between the museum and the customers, e.g., to prove the validation of the ticket, for support inquiries, inquiries about ticket extensions, annual passes, or rebooking. Your rights to deletion and revocation can be found in point 10. Data Subject Rights, Right to Deletion (see below).

1. Online Presence in Social Media

We maintain online presences within social networks and platforms to communicate with customers, interested parties, and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and data processing guidelines of the respective operators apply.

Unless otherwise stated in our privacy policy, we process the data of users if they communicate with us within social networks and platforms, for example, by writing posts on our online presences or sending us messages.

YouTube

We embed videos from the YouTube platform of the provider Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Privacy Policy: https://www.google.com/policies/privacy/, Opt-Out: https://adssettings.google.com/authenticated.

1. Data Subject Rights

As a data subject within the meaning of the GDPR, you can assert the following data subject rights against us.

Right to Information

You can request confirmation from the data controller as to whether personal data concerning you is being processed by us. If such processing is taking place, you can request information from the data controller about the following:

• the purposes for which the personal data is processed;
• the categories of personal data that are processed;
• the recipients or categories of recipients to whom the personal data concerning you has been or will be disclosed;
• the planned duration of storage of the personal data concerning you or, if specific information is not possible, criteria for determining the storage duration;
• the existence of a right to rectification or deletion of the personal data concerning you, a right to restriction of processing by the data controller, or a right to object to such processing;
• the existence of a right to lodge a complaint with a supervisory authority;
• all available information about the origin of the data if the personal data is not collected from the data subject;
• the existence of automated decision-making, including profiling, in accordance with Art. 22 para. 1 and 4 GDPR and – at least in these cases – meaningful information about the logic involved as well as the significance and intended effects of such processing for the data subject.

Right to Rectification

You have the right to rectification and/or completion against the data controller if the processed personal data concerning you is incorrect or incomplete. The data controller must make the correction without delay.

Right to Restriction of Processing

Under the following conditions, you can request the restriction of processing of personal data concerning you:

• if you contest the accuracy of the personal data concerning you for a period that allows the data controller to verify the accuracy of the personal data;
• the processing is unlawful, and you oppose the deletion of the personal data and instead request the restriction of the use of the personal data;
• the data controller no longer needs the personal data for the purposes of processing, but you need it for the establishment, exercise, or defense of legal claims, or
• if you have objected to processing in accordance with Art. 21 para. 1 GDPR and it is not yet clear whether the legitimate reasons of the data controller outweigh your reasons.

If the processing of personal data concerning you has been restricted, this data may only be processed – apart from being stored – with your consent or for the establishment, exercise, or defense of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or a Member State.

If the restriction of processing has been restricted under the above conditions, you will be informed by the data controller before the restriction is lifted.

Right to Deletion

Obligation to Delete You can request the data controller to delete the personal data concerning you without delay, and the data controller is obliged to delete this data without delay if one of the following reasons applies:

• The personal data concerning you is no longer necessary for the purposes for which it was collected or otherwise processed.
• You withdraw your consent on which the processing is based in accordance with Art. 6 para. 1 lit. a or Art. 9 para. 2 lit. a GDPR, and there is no other legal basis for the processing.
• You object to the processing in accordance with Art. 21 para. 1 GDPR, and there are no overriding legitimate grounds for the processing, or you object to the processing in accordance with Art. 21 para. 2 GDPR.
• The personal data concerning you has been unlawfully processed.
• The deletion of the personal data concerning you is necessary to fulfill a legal obligation under Union law or the law of the Member States to which the data controller is subject.
• The personal data concerning you has been collected in relation to the offer of information society services in accordance with Art. 8 para. 1 GDPR.

Information to Third Parties If the data controller has made the personal data concerning you public and is obliged to delete it in accordance with Art. 17 para. 1 GDPR, it shall take reasonable measures, including technical measures, taking into account available technology and implementation costs, to inform data controllers who process the personal data that you, as the data subject, have requested the deletion of all links to this personal data or copies or replications of this personal data.

Exceptions The right to deletion does not exist to the extent that processing is necessary:

• for exercising the right to freedom of expression and information;
• for compliance with a legal obligation that requires processing under Union or Member State law to which the data controller is subject, or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller;
• for reasons of public interest in the area of public health in accordance with Art. 9 para. 2 lit. h and i and Art. 9 para. 3 GDPR;
• for archiving purposes in the public interest, scientific or historical research purposes, or statistical purposes in accordance with Art. 89 para. 1 GDPR, to the extent that the right referred to in section a) is likely to render impossible or seriously impair the achievement of the objectives of this processing, or
• for the establishment, exercise, or defense of legal claims.

Right to Notification

If you have asserted the right to rectification, deletion, or restriction of processing against the data controller, the data controller is obliged to notify all recipients to whom the personal data concerning you has been disclosed of this rectification or deletion of the data or restriction of processing, unless this proves impossible or involves disproportionate effort.

You have the right to be informed about these recipients by the data controller.

Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you, which is based on Art. 6 para. 1 lit. e or f GDPR, including profiling based on these provisions.

The data controller will no longer process the personal data concerning you unless it can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is for the establishment, exercise, or defense of legal claims.

If the personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing, which includes profiling to the extent that it is related to such direct marketing.

If you object to processing for direct marketing purposes, the personal data concerning you will no longer be processed for such purposes.

Right to Lodge a Complaint with a Supervisory Authority

Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority (for example, the Berlin Commissioner for Data Protection and Freedom of Information), in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement, if you consider that the processing of personal data concerning you infringes the GDPR.

The supervisory authority with which the complaint has been lodged will inform the complainant about the progress and outcome of the complaint, including the possibility of a judicial remedy under Art. 78 GDPR.