Animals as Objects? Data privacy policy

1 Introduction

When using our online content, personal data is collected and stored in databases, protocol files or other systems. We consistently abide by data protection regulations when processing the data collected.

2 Name and address of the controller responsible for data processing

Processing of personal data is the responsibility of:

Museum für Naturkunde Berlin
Invalidenstr. 43
10115 Berlin

Managing Director Herr Junker
Phone: +49(0)30/889140-8798
Email: stephan.junker@mfn.berlin

Data protection officer of the Museum für Naturkunde:

Phone: +49(0)30/889140-8440
Email: datenschutz@mfn.berlin

3 Use and disclosure of personal data

The data collected by us are exclusively used for the purposes mentioned. Data is disclosed only in the cases listed (e.g. to comply with an e-mail request). There will be no unauthorised data disclosure to third parties. External service providers who process data on our behalf are not considered to be third parties as defined in the data protection regulations; they are bound by contract to abide by the data protection regulations and are subject to our control.
Data will only be passed on to state authorities within the framework of mandatory legal provisions or in cases of attacks on our systems for the purpose of criminal prosecution.
Data that are no longer needed will be deleted.
The data will not be used for automated decision-making (profiling).

The use of some of our services may require the storage and use of data beyond what has been described under point 5. If that is the case, we will inform you and ask for your consent in advance.

5 The following data will be processed when using our online services:

5.1 Keeping a log of visits to websites and accessing data and web services

When this website is accessed, data relevant for data protection and data security is stored in a log file on the server of Hetzner Online GmbH in Germany. Depending on the access protocol, the log file contains the following details:

Anonymised IP address of the computer requesting data
Name of the requested website, file or action
Date and time of the request
Volume of data transmitted
Access status of the web server (file transmitted, file not found, command not executed, etc.)
Description of the web browser used
Description of the operating system used

The stored data is used exclusively for the purpose of identification and tracking of unauthorised access attempts or access to the web server as well as for general statistical evaluations (with on-premise Matomo, see 5.3 Web Analytics). No profiles of individual users will be generated. Log files are deleted after 14 days.

In addition, fully anonymised data on consecutively visited pages is used to display a user’s own personal history during one browsing session. They are also used to weigh the strength of connections between internally linked subpages, displaying them on the website (see 5.4 User routes). The personal data of individuals concerned is processed within the scope of contract processing in accordance with GDPR Art. 28 by Trust/Arthur Baer, Kluckstr. 25, 10785 Berlin, Germany, or authorised sub-contractors.

5.2 Cookies

The website "Animals as Objects?" uses cookies. Cookies are text files which are filed and stored on a computer system via an Internet browser.

Numerous websites and servers use cookies. Many cookies contain what is known as a cookie ID. A cookie ID is a unique identification of the cookie. It consists of a sequence of characters that allow websites and servers to be associated with the actual browser on which the cookie was stored. This enables the websites and servers visited to distinguish the individual browser of the data subject from other browsers that contain different cookies. A particular browser can be recognised and identified through the unique cookie ID.

The use of cookies allows the Museum für Naturkunde Berlin to use Matomo for statistical evaluation. Cookies also make it possible to display a user’s own personal browsing history during one session, and the meta evaluation of which site links are used most frequently and which are used least frequently.

When first visiting the website "Animals as Objects?" using a new device/browser, an individual user can adjust cookie preferences for this device/browser in a dialogue box (cookie banner). Within this functionality, we ask for consent for the use of cookies that are not technically necessary for the use of the website. If the data subject does not give their consent, no cookies are used. If consent is given, the cookies are then stored in the browser for 1 day. By deleting the cookies "tao_uid" and [insert Matomo cookie name], the data subject can adjust the settings at any time.

The data subject can block the use of cookies by our website by adapting the settings of the browser and thus permanently object to the use of cookies. In addition, cookies already in place can be deleted through the web browser or other software programmes. This can be done in all the usual web browsers. If an individual inactivates the use of cookies in their web browser, they may not be able to fully use all functions of our website.

5.3 Web Analytics

The Museum für Naturkunde Berlin will only use a web analytic solution on the basis of your consent in accordance with GDPR Art. 6 Section 1 letter a, Art. 7. The consent is obtained by a pop-up cookie banner (see point 5.2 Cookies, 4th paragraph) and can be revoked by deleting the generated cookies: "tao_uid" and [insert Matomo cookie name]. After 1 day, the cookies are deleted automatically.

The person responsible for cookie processing (controller) has integrated in this web page the on-premise Matomo component with anonymisation function ("Matomo"). Matomo is a service for web analytics. Web analytics is the collection, storage and evaluation of data on the behaviour of visitors of websites. A web analytics service collects, among other things, data on the website from which the individual accessed a particular (referrer) website, which sub-pages of the website have been accessed and how long the page was viewed. Web analytics are mainly used to optimise a website.

The on-premise (not cloud-based) Matomo component is run by the Museum für Naturkunde Berlin. The processing and storage of data takes place in compliance with GDPR.

The purpose of the Matomo component is to analyse traffic on our website. Museum für Naturkunde Berlin uses the data and information obtained, among other things, to evaluate the use of the website so that online reports can be compiled that show activity on our websites and further services associated with the use of our website can be generated.

Matomo places a cookie on the information technology system of the data subject. What cookies are has been explained above. By placing the cookie, Matomo is enabled to analyse the use of our website. Any time any of the pages of this website are accessed that is run by the controller and into which a Matomo component was integrated, the web browser in the information technology system of the data subject will be automatically prompted by the Matomo component to transfer data to Matomo for online analytics purposes. In the context of this technical procedure, the Museum für Naturkunde Berlin will obtain knowledge of personal data.

The cookie is used to store personal data, such as time and place of access and the frequency of visits to our website by the data subject. During each visit of our web pages, such personal data, including the IP address of the Internet connection used by the data subject, is transmitted to the server of the Museum für Naturkunde Berlin. This personal data is stored by the Museum für Naturkunde Berlin.

The data subject can block the use of cookies by our website at any time by adapting the settings of the browser and thus permanently object to the use of cookies, as explained above. Such a setting would also prevent Matomo from placing a cookie on the information technology system of the data subject. In addition, a cookie already placed by Matomo can be deleted at any time through the web browser or other software programmes.

Furthermore, the data subject has the option of objecting to and preventing the collection of data generated by Matomo that refer to the use of this website and their processing by the Museum für Naturkunde Berlin. Matomo (on-premise) is explained in more detail here.

5.4 User routes

To collect information about pages visited consecutively, the website will create an anonymous unique session identifier as a cookie called "tao_uid", if the user has consented to the use of cookies. What cookies are has been explained above. The cookie will last 1 day and then expire.

During that time, all pages of the website visited from that device and browser will be anonymously and separately from the logfiles on the Hetzner server. During that time, the user will see their own personal browsing history of the website displayed as a list of consecutively visited pages ("route"). When you return after the expiration of the cookie, a new anonymous unique session identifier will be created. There will be no connection between the data on separate browsing sessions. Users can only see their own current route on the website, neither previous ones, nor those of any other users.

The anonymised data will be kept until the end of the operating time of the website, 31 December 2023. The personal data of individuals concerned is processed within the scope of contract processing in accordance with GDPR Art. 28 by Trust/Arthur Baer, Kluckstr. 25, 10785 Berlin, Germany, or authorised sub-contractors.

Meta-information derived from this data (i.e. what page has been most or least frequently visited after another page) will be kept indefinitely. On the website itself, the meta-information will be used to display which pages have been most and least frequently visited from any particular page. All users see the same recommendations at any given point in time.

5.5 Email

If you want to communicate with us via email, please use our email address humanities(at)mfn.berlin or, if you already have a contact, FirstName.LastName@mfn.berlin. Your email address will be used exclusively for our communications with you and not passed on to third parties, except if passing on your email address is absolutely necessary to comply with your request. In such cases, your e-mail address will only be passed on with your express consent. There is currently no encrypted email system in place. To retain confidentiality, you can also contact us by post.

5.6 Information on Google services

On our website, we use a service provided by Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

Further information on the individual service YouTube by Google that are used on this website is found in point 5.6.1.

Through the integration of Google services, Google may collect and process data (including personal data). It cannot be ruled out that Google may transmit information to a server in a third country.

We have no influence on what data Google will actually collect and process. However, Google says that in principle, the following information (including personal data) may be processed:

Log data (in particular the IP address)
Location-related information
Unique application numbers
Cookies and similar technologies

If you are logged into your Google account, Google can add processed information, dependant on your account setting and treat those as personal data, cf in particular these explanations by Google.

Google includes the following statements:

"We may combine personal information from one service with information and personal information from other Google services. We thereby simplify sharing of contents with friends and acquaintances. Depending on your account settings, your activities on other websites and in apps may be connected to your personal data in order to improve Google services or pop-up advertising supported by Google." (source at Google)

To prevent the addition of these data, you can log out of your Google account or change the relevant settings in your Google account.

5.6.1 Using YouTube

We use YouTube videos and YouTube plug-ins on our website. YouTube is a service of YouTube LLC ("YouTube"), 901 Cherry Ave., San Bruno, CA 94066, USA and is provided by this company. Youtube LLC is a subsidiary of Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.

YouTube videos are integrated by embedding the service on our website using iframe tags. Introducing the iframe may allow Youtube or Google to collect and process data (including personal data). It cannot be ruled out that Youtube or Google may transmit information to a server in a third country.

Through the integration of YouTube, we are able to present various videos on our website that can be viewed directly on the website.

The legal basis for the processing of personal data described above is GDPR Art. 6 section 1 letter f). Our legitimate interest that is relevant here lies in the great benefit that YouTube offers. By embedding external videos we lighten the burden on our servers and can use our resources for other purposes. This may add to the stability of our servers. Beyond that, YouTube and Google have a legitimate interest in the collected (personal) data to improve their own services.

Making personal data available is neither a legal nor a contractual obligation and not required for concluding a contract. Furthermore, you are under no obligation to make your personal data available. However, not making the data available might mean that you cannot use our website or use its full functionality.

For further information go to privacy policy of YouTube and Google. Guidance on privacy settings in Google can be found here.

5.7 Using Vimeo

We use Vimeo videos and Vimeo plug-ins on our website. Vimeo is a service of Vimeo.com, Inc. ("Vimeo"), 555 West 18th Street, New York, NY 10011, USA, and is provided by this company.

Vimeo is integrated by embedding the service on our website using iframe tags. Introducing the iframe may allow Vimeo to collect and process data (including personal data). It cannot be ruled out that Vimeo may transmit information to a server in a third country.

Through the integration of Vimeo, we are able to present various videos on our website that can be viewed directly on the website.

The legal basis for the processing of personal data described above is GDPR Art. 6 section 1 letter f). Our legitimate interest that is relevant here lies in the great benefit that Vimeo offers. By embedding external videos we lighten the burden on our servers and can use our resources for other purposes. This may add to the stability of our servers. Beyond that, Vimeo has a legitimate interest in the collected (personal) data to improve their own services.

Vimeo states that they comply with the GDPR for those users who access their services from the European Economic Area (EEA) or the United Kingdom (UK). UK and EEA users have the right to: opt out of non-essential cookies; access, correct, delete, restrict, or object to our use of personal information; be forgotten; port data; and withdraw consents.

For further information go to the privacy policy of Vimeo.

6. Links to other service providers

This privacy policy note is applicable to the Internet services of the website "Animals as Objects?". As far as these point or link to web services of third parties, the Museum für Naturkunde Berlin is neither responsible nor liable regarding the accuracy and completeness of contents as well as the data security of linked websites. The linked contents are checked for obvious violations of the law at the time of linking. However, continuous checking of linked pages cannot be reasonably expected without some concrete evidence of a breach of the law. If a linked website breaches existing law or contains other inappropriate content, we would be grateful for being notified. The Museum für Naturkunde Berlin has no influence on third parties’ compliance with privacy policy legislation. In order to check compliance, you must look at the privacy policy note of the service provider concerned.

7. Data security

Your personal data is stored on protected computers. In order to protect the data collected by us from loss, manipulation or access by unauthorised individuals, the Museum für Naturkunde Berlin has put technical and organisational state-of-the-art technology measures in place. Access to data is subject to an authorisation procedure so that only the individuals in charge of data processing have access to it. All employees who collect, process or use personal data are bound by data secrecy according to §8 of the Berlin Privacy Act.

Within the context of various activities, personal data of individuals concerned is processed within the scope of contract processing in accordance with GDPR Art. 28.

Trust/Arthur Baer: 5.4 User routes
Google Ireland Limited ("Google"):, 5.5.1 YouTube
Vimeo.com Inc. ("Vimeo"): 5.5.2 Vimeo

8 Rights of data subjects

a) Right to confirmation

Every data subject has the right granted by the European legislator of Directives and Regulations to receive confirmation from the controller whether their personal data has beem processed. If a data subject wants to exercise their right to confirmation, they can contact a controller employee at any time.

b) Right to information

Every person whose data is being processed has the right granted by the European legislator of Directives and Regulations to receive free information on personal data relating to the data subject and a copy of this information. In addition, the European legislator of Directives and Regulations has granted the data subject access to the following information:

the purpose of data processing
the categories of personal data being processed
the recipients or categories of recipients to whom access to personal data is given or will be given, in particular regarding recipients in third countries or international organisations
if possible, the planned duration of storage for personal data, or, if that is not possible, the criteria according to which the storage period is established.
the existence of a right to correction or deletion of personal data of the data subject or to restriction of processing by the controller or the right to objection against data processing.
the existence of a right to complain to a control body
if personal data is not collected from the data subject: All available information about the origin of the data
the existence of automated decision making, including profiling, in accordance with Article 22 (1) and (4) of the DPA and, at least in these cases, meaningful information about the logic involved and the scope and intended impact of such processing on the data subject

Furthermore, the data subject has a right to information on whether personal data has been transmitted to a third country or an international organisation. If this is the case the data subject has the right to receive information about guarantees in the context of the transmission.

c) Right to correction

Every person whose data is being processed has the right granted by the European legislator of Directives and Regulations to demand immediate correction of their personal data. Furthermore, taking into account the purpose of data processing, the data subject has the right to demand the completion of incomplete personal data - which may take the shape of a complementary declaration.

If a data subject wants to exercise their right to correction, they can contact an employee of the data processing controller at any time.

d) Right to deletion (right to be forgotten)

Every person whose data is being processed has the right granted by the European legislator of Directives and Regulations to demand immediate deletion of their personal data if one of the following reasons applies and processing is not required.

The personal data were collected for purposes no longer required or in a way that is no longer necessary.
The data subject revokes their consent on which the processing is based according to GDPR Art.6 Section 1 letter a or GDPR Art. 9 Section 2 letter a, and there is no other legal base for processing the data.
The data subject objects to data processing on the grounds of GDPR Art. 21 Section 1 and their are no overruling legitimate reasons for data processing, or the data subject formally objects to data processing based on GDPR Art. 21 Section 2.
The processing of personal data was illegitimate.
The deletion of personal data is required to fulfil statutory obligations based on (European) Union legislation or legislation in a Member State that applies to the controller.
The personal data were collected in relation to the offer of information society services according GDPR Art. 8 Section 1.

If one of the reasons above applies and a data subject wants to have the personal data deleted that are stored at the Museum für Naturkunde Berlin, they can contact controller at any time; see point 2. Name and address of the controller responsible for data processing. The controller will then ensure that the demand for deletion is complied with without delay.

If the personal data has been made public by the Museum für Naturkunde Berlin and if the organisation is responsible as defined in GDPR Art. 17 Section 1 and is therefore under obligation to delete the personal data, the Museum für Naturkunde Berlin will take appropriate steps, including technical measures, taking into account the available technology and implementation costs, to inform other controllers that the data subject has demanded the deletion of all links to personal data or to copies and replicas of such data, as far as processing is not required.

e) Right to restricting processing

Every person whose data is being processed has the right granted by the European legislator of Directives and Regulations to demand restrictions on processing their personal data if one of the following prerequisites is met:

The accuracy of personal data is disputed by the data subject who leaves enough time to enable the controller to check the accuracy of the personal data.
The data processing is illegitimate, the data subject objects to the deletion of personal data and demands instead the restriction of the use of personal data.
The controller no longer requires the personal data for processing, whereas the data subject still requires them to make, exercise and defend legal claims.
The data subject has objected to data processing, pursuant to GDPR Art. 21 Section 1 and it is not yet certain if the legitimate reasons of the controller outweigh those of the data subject.

If one of the prerequisites above applies and a data subject wants to have the processing of personal data at the Museum für Naturkunde Berlin restricted, they can contact the controller at any time; see point 2. Name and address of the controller responsible for data processing.

f) Right to data transfer

Every person whose data is being processed has the right granted by the European legislator of Directives and Regulations to receive their personal data, which have been made available to a controller by the data subject, in a structured, common and machine-readable format. They have also the right to pass on the data to a different controller without interference by the current controller to whom the personal data had been made available if the processing was based on consent according to GDPR Art. 6 Section 1 letter a or Art. 9 Section 2 letter a of on a contract pursuant to Art. 6 Section 1 letter b and the processing is done automatically, if the processing is not required for taking on a task in the public interest or exerting public executive power that was handed over to the controller.

Furthermore, the data subject, who exercises their right to data transfer pursuant to GDPR Art. 20 Section 1, must ensure that the personal data is sent directly from one controller to the other if that is technically feasible and the rights and freedoms of other individuals are not infringed upon.

To exercise their right to data transfer, the data subject can contact the controller at any time; see point 2. Name and address of the controller responsible for data processing.

g) Right to object

Every person whose personal data is being processed has the right granted by the European legislator of Directives and Regulations to object at any time to the processing personal data pursuant to GDPR Art. 6 Section 1 letter e or f, for reasons relating to their particular situation. This also applies to profiling based on these regulations.

In the case of an objection, the Museum für Naturkunde Berlin no longer processes personal data unless we can argue convincingly that there are compelling reasons worth protecting that outweigh the rights and freedoms of the data subject or that the processed data are needed to make, exercise and defend legal claims.

If the Museum für Naturkunde Berlin processes personal data for direct advertising, the data subject has the right to object at any time to the processing of personal data for such advertising. This applies also to profiling if associated with such direct advertising. If the data subject objects to the Museum für Naturkunde Berlin using the processed data for direct advertising, the Museum für Naturkunde Berlin will no longer process personal data for such purposes.

In addition, the data subject has the right to object to the processing of personal data for reasons arising from their particular situation if the data is processed by the Museum für Naturkunde Berlin for scientific or historic research purposes or for statistics pursuant to GDPR Art. 89 Section 1 unless the processing is required to fulfil a task in the public interest.

To exercise their right to data transfer, the data subject can directly contact the controller at any time; see point 2. Name and address of the controller responsible for data processing. Furthermore, the data subject is free to exercise their right to objection in connection with the use of services of the information society with the help of automated procedures according to technical specifications, notwithstanding Regulation 2002/58/EC.

h) Automated decisions in individual cases including profiling

Every person affected by the processing of personal data has the right granted by the European legislator of Directives and Regulations not to be subject to decisions based on entirely automated processing - including profiling if that decision has legal consequences or may infringe their life in a similar way, as long as the decision (1) is not required to finalise a contract between the data subject and the controller or (2) due to legal provisions in the Union or its Member States to which the controller is subject, this is permissible and these provisions contain adequate measures to protect the rights and freedoms as well as legitimate interests of the data subject or (3) is taken with the express consent of the data subject.

If the decision (1) is required for finalising or fulfilling a contract between the data subject and the controller or (2) is taken with the express consent of the data subject, the Museum für Naturkunde Berlin takes suitable measures to protect the rights and freedoms as well as legitimate interests of the data subject, which includes at least the right to obtain manual intervention by the controller’s party, to clarify their own position and to challenge the decision.

To exercise their right relating to automated decision, the data subject can contact the controller at any time; see see point 2. Name and address of the controller responsible for data processing.

Every person whose data is being processed has the right granted by the European legislator of Directives and Regulations to withdraw their consent to the processing of their personal data at any time.

To exercise their right relating to withdraw their consent, the data subject can contact the controller at any time; see point 2. Name and address of the controller responsible for data processing.

9 Scope and update of the privacy policy note

The privacy policy note was updated on 5 August 2021 and is currently valid. With further developments in technology and changes of legal requirements, the privacy policy note may need to be adapted at any time and take effect for the future. We therefore recommend that you check the privacy note for updates at regular intervals.

This privacy policy note has been written using some templates by the privacy note generator (Datenschutzerklärungs-Generator) of DGD Deutsche Gesellschaft für Datenschutz GmbH,which carries out the privacy audit, in collaboration with the media law firm WILDE BEUGER SOLMECKE

Data protection policy