Privacy policy

Last updated: 28 September 2026. This notice covers the museum website. Orders are also subject to the privacy information in the separate ticket shop.

1. Controller and privacy contact

The controller is Das Mauermuseum-Betriebs gGmbH, Friedrichstraße 44, 10969 Berlin, Germany, represented by Managing Director Alexandra Hildebrandt. Telephone: +49 30 2537250. Please address privacy questions and requests concerning your rights to info@mauermuseum.de or our postal address.

2. Website, hosting and security logs

To deliver the website and protect it against attacks, we process IP address, time, requested address, response status and browser, device and referrer information transmitted. The legal basis is Article 6(1)(f) GDPR; our interest is secure, reliable operation. Hosting and website email delivery use Host Europe. Technical service providers receive the data needed for their respective services.

Logs are needed for fault diagnosis, security and investigating abuse. Retention depends on the purpose of each log and what is needed to investigate specific incidents. Limited download availability in the hosting control panel does not mean every copy of a provider’s logs has been erased. See Host Europe’s privacy information.

3. Contact enquiries

We process your contact details and message to answer your enquiry. Article 6(1)(b) GDPR applies to contractual enquiries and pre-contractual steps; Article 6(1)(f) GDPR and our interest in responding apply to other enquiries. Form messages are sent to our responsible email mailbox; the WordPress form keeps no additional message archive in the website database.

Please provide only necessary information. You can also contact us directly by email, telephone or post. When using the form, we need your name, email address and message to handle the enquiry and reply; it cannot be submitted without its required information.

To limit abuse, the form uses an IP identifier derived with a secret key and counters in ten-minute windows. These counters do not store the unchanged IP address. Expired counters are cleaned in limited batches when further form requests arrive; without another request they may remain longer. They are not used for visitor analytics. Server logs are separate.

4. Cookies and your choices

Storing information on, or accessing information from, your device generally requires consent under section 25(1) of Germany’s TDDDG. Exceptions apply only under section 25(2), in particular where strictly necessary to provide an expressly requested service. Subsequent processing of personal data also needs a GDPR legal basis.

Complianz manages separate choices for statistics, campaign measurement and the external map. Allowing the map does not allow Google advertising. Use “Manage consent” to change or withdraw consent for the future at any time. Choices are stored for up to 180 days. Material changes may require a new decision. Our cookie information describes storage technologies and durations. Museum information and direct contact remain available after rejection. Section 8 explains the particular behaviour of Google Advanced Consent Mode.

5. Newsletter with Mailjet

The newsletter provides news about exhibitions, events and our work. We need your email address and consent (Article 6(1)(a) GDPR). After registration we send a confirmation email; only its confirmation link activates the selected language subscription. Confirmation time and registration and delivery information also serve as evidence of your choice.

The subscription form is part of our website. We use Mailjet, a Sinch-group service, for confirmation emails, list management and newsletter delivery. Only after submission does our server send your email address to Mailjet; merely viewing the form creates no browser connection to Mailjet. Cloudflare Turnstile checks the request before sending. While confirmation is pending, we store your email address in encrypted form and a one-way hash of the single-use confirmation link. The link is valid for one hour. After successful confirmation the address is removed from the local record; the mailing list is held by Mailjet. Information about the provider’s processing and recipients is available in the Mailjet privacy notice and its linked data protection terms.

Expired local registration records are cleaned hourly and when further registrations arrive, in limited batches; erasure may be delayed if these tasks do not run. To evidence consent, we retain the language, consent wording, registration and confirmation times and a keyed hash of the address for three years from confirmation. This is not an additional mailing list. These records serve the defence of possible legal claims (Article 6(1)(f) GDPR). Withdrawal stops delivery regardless of this evidence-retention period.

German and English subscriptions are separate lists. You may withdraw one or both subscriptions at any time through the unsubscribe link or info@mauermuseum.de. Unsubscribing from one list does not end the other subscription. Open and click tracking and additional analytics and landing-page tracking are disabled in our Mailjet account. Delivery and registration information are separate. Unsubscribing stops delivery but does not automatically erase all necessary evidence or suppression records.

6. Cloudflare Turnstile

Turnstile protects forms against automated requests. The provider is Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. In our contact and newsletter forms, the check starts only when you submit, not when you merely visit the page. Processing includes IP address, browser identification, TLS and other technical browser characteristics, and website/widget context. The result is validated on the server; the form sends no message without a successful check.

Our purpose is preventing spam and attacks on the requested form; we rely on Article 6(1)(f) GDPR for this processing. This does not authorise visitor analytics or advertising. Cloudflare describes itself as our processor for protecting forms and as a separate controller for improving detection. Its stated basis and further information are in the Turnstile Privacy Addendum. You can contact us directly if you prefer not to use the check.

Cloudflare may process data in the USA and other countries. Its privacy policy explains recipients, international processing and safeguards. Provider retention depends on purpose and legal requirements; we do not promise one universal Turnstile erasure period.

7. Maps, fonts and external links

The location map loads tiles from the OpenStreetMap Foundation (OSMF, United Kingdom) through tile.openstreetmap.org only after map consent. The provider receives information including IP address, technical connection data and requested map areas. The basis is consent under Article 6(1)(a) GDPR and, for device access requiring consent, section 25(1) TDDDG. Its worldwide delivery network may process data outside the EEA; see the OSMF privacy policy.

Withdrawal removes the map but does not retrospectively erase data already transmitted. “Open in Google Maps” leads to Google only when clicked. Font files come from our own server, not Google Fonts. Social-media links are not embedded feeds. When you move to an external service, its privacy information applies.

8. Google Tag Manager, Analytics and campaign measurement

Google Tag Manager manages Google Analytics 4 for usage statistics and Google Ads for campaign measurement. For EEA users, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is a contact; other Google companies, particularly Google LLC in the USA, may participate in processing. Google describes processing and recipients in its privacy policy.

Statistics and campaign permissions are separate. Analytics cookies are permitted only with statistics consent; advertising storage and advertising-data use for measurement only with campaign consent. The bases are Article 6(1)(a) GDPR and section 25(1) TDDDG. Advertising personalisation is not permitted; Google Signals and user-provided data collection are disabled. We do not send form contents as analytics events. URL query parameters and fragments are removed before the intended event transmission; the ticket-shop click contains the destination domain rather than the complete link.

Advanced Consent Mode: Google loads before you make a choice. Even after rejection, consent status, page and event information and technical connection data, including the IP address required for the connection, may be sent to Google without analytics or advertising cookies. These signals also support statistical modelling of usage and campaign performance. “Without cookies” means neither “anonymous” nor “no data transmission”. Rejecting optional cookies does not prevent these connections. Google explains this in its Consent Mode documentation.

For processing measurement signals without analytics/advertising storage, we rely on Article 6(1)(f) GDPR and our interest in limited statistical evaluation of website use and campaign performance. This legal basis does not replace consent for device access that requires it. You may object to processing based on legitimate interests as described in section 11.

Our GA4 property retains event data for two months and user data for 14 months, with the user-retention period reset on new activity. These periods do not apply across all aggregated standard reports. Detailed location and device information is enabled; we do not request GPS access for this. Withdrawing previously given consent resets the categories and removes the relevant measurement cookies on our website. It does not retrospectively erase data already sent; Advanced Mode signals may continue.

9. Recipients and international processing

Recipients include our responsible staff and the hosting, email, newsletter, security, map and analytics providers described above, with their necessary subprocessors. Authorities or advisers receive data only where legally required or necessary for handling matters or defending legal claims. Newsletter addresses are not published as a general directory.

Google, Cloudflare and internationally operating newsletter and map providers may process data outside the EEA, particularly in the USA. An EU data centre does not exclude access from other countries. Google and Cloudflare describe adequacy decisions for certified recipients and standard contractual clauses as transfer mechanisms; applicability depends on the recipient and processing. Information and safeguards are available through Google’s transfer mechanisms, the provider notices linked above and the Sinch data protection agreement. You may ask our privacy contact about the recipients and safeguards applicable to your data.

10. Retention and security

Data are needed only while the relevant purpose, a legal duty or establishing, exercising or defending legal claims requires them. For enquiries, the criteria include closure of the matter, possible follow-up and evidence requirements. Unconfirmed newsletter registrations serve only the pending confirmation and abuse prevention, not regular delivery. After unsubscription, only necessary evidence and minimal suppression information are retained to honour the opt-out or address legal claims. An ongoing subscription in the other language is unaffected. We do not promise automatic erasure of all email or Mailjet data within one uniform period.

Article 6(1)(c) GDPR applies to business documents subject to statutory retention; Article 6(1)(f) GDPR applies to necessary legal defence or respecting marketing objections. A specific legal matter may extend retention of the records needed for that matter, not indiscriminately of all data.

The website is backed up in encrypted form on a museum-owned NAS with restricted access. Retention considers 30 daily, eight weekly and twelve monthly recovery points, as well as at least the seven newest backups and all from the last seven days. These groups overlap. Cleanup runs only after a fresh backup has passed verification; faults may extend retention. Backups are for recovery, not routine use of erased data. Previously completed erasures must be reapplied after recovery.

11. Your rights and objections

Subject to the statutory conditions, you have rights of access, rectification, erasure, restriction and portability (Articles 15–20 GDPR). Contact our privacy address. We may need appropriate identity confirmation. Newsletter or analytics consent is not required to visit the museum or read general information. Use of this website does not involve an intended automated decision with legal or similarly significant effects under Article 22 GDPR.

You may withdraw consent at any time for the future: through the unsubscribe link or a message for the newsletter, and “Manage consent” for website categories. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to object: Where processing relies on Article 6(1)(e) or (f) GDPR, you may object on grounds relating to your particular situation. We stop processing unless there are compelling overriding legitimate grounds or grounds for establishing, exercising or defending legal claims. You may object to direct marketing, including related profiling, at any time without giving a particular reason; the data will then no longer be processed for those purposes.

12. Complaints

You may complain to a data protection supervisory authority, particularly where you usually live, work or suspect an infringement. You may contact the Berlin Commissioner for Data Protection and Freedom of Information, Alt-Moabit 59–61, 10555 Berlin, Germany, mailbox@datenschutz-berlin.de, www.datenschutz-berlin.de.