Data protection
Data protection guidelines – GDPR
As of: September 2024
1. General information
Thank you for your interest in our website and the Ludwigsburg Castle Festival. The protection of your personal data during collection, processing, and use during your visit to our website is very important to us. Your data is protected in accordance with legal regulations. Below, you will find information about the data collected during your visit to our website and how it is used.
1.1. Name and address of the responsible party
Ludwigsburger Schlossfestspiele gGmbH
Internationale Festspiele Baden-Württemberg
Marstallstraße 5, 71634 Ludwigsburg
Tel.: +49 (07141) 939 635
E-Mail: datenschutz@schlossfestspiele.de
1.2. Name and address of the external data protection officer
Wolfgang Matzke
KLW GmbH
Edisonstraße 21
74076 Heilbronn
Germany
Tel. +49 7131 38 534-0
E-Mail: datenschutz@klw.de
Home: www.klw.de
1.3. Rights of the data subject
It is important to us to make our data processing procedures transparent. This also includes your rights as a data subject, which you are entitled to under the law, depending on the reason and type of processing of your personal data. Your rights as a data subject are standardised in Articles 15-22 of the GDPR. You are entitled to the following rights:
• Your right to information, Art. 15 GDPR
• Your right to rectification, Art. 16 GDPR
• Your right to erasure, Art. 17 GDPR
• Your right to restriction of processing, Art. 18 GDPR
• Your right to object to processing, Art. 21 GDPR
• Your right to data portability, Art. 20 GDPR
• Right to revoke the declaration of consent under data protection law
You have the right to revoke your declaration of consent under data protection law at any time. Revoking your consent does not affect the legality of the processing carried out on the basis of your consent prior to revocation.
To exercise your rights, please contact us by email at: datenschutz@schlossfestspiele.de
To identify you, we ask that you provide your first and last name and postal address when exercising your rights as a data subject. If you send us a copy of your ID, please black out all data except your first and last name and postal address.
Processing is carried out in accordance with Art. 6 (1) (c) GDPR.
In all cases, or if you encounter problems with revocation on this website, you can contact the data protection officer.
Furthermore, you have the right to lodge a complaint with a supervisory authority in accordance with Art. 77 in conjunction with § 19 BDSG.
The supervisory authority responsible for Ludwigsburger Schlossfestspiele gGmbH is:
The State Commissioner for Data Protection and
Freedom of Information Baden-Württemberg
P.O. box 10 29 32
70025 Stuttgart
Tel.: +49 711/615541-0
Fax: +49 711/615541-15
www.baden-wuerttemberg.datenschutz.de
Please note the following special feature in connection with your right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Article 6(1)(e) or (f) GDPR. This also applies to profiling based on these provisions.
Your personal data will no longer be processed by the controller unless compelling legitimate grounds for the processing can be demonstrated that outweigh your interests, rights, and freedoms. This also applies if the processing serves to assert, exercise, or defend legal claims.
If your personal data is processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes; this also applies to profiling insofar as it is related to such direct marketing.
If you object to processing for direct marketing purposes, your personal data will no longer be processed for these purposes.
You have the option, in connection with the use of information society services, to exercise your right to object by means of automated procedures using technical specifications, notwithstanding Directive 2002/58/EC.
1.4. Purposes of use and legal basis for processing
We only process our users’ personal data to the extent necessary to provide a functional website and our content and services. The legal basis for data processing is derived in particular from Art. 6 GDPR. Your personal data is regularly processed for the purpose of implementing pre-contractual measures, establishing a contractual relationship, and strengthening customer relations, which may also include analyses for marketing purposes, customer satisfaction surveys, and direct advertising.
The declaration of consent also constitutes a data protection permission requirement, which, as explained under “Rights of the data subject,” can also be revoked. If the consent also relates to the processing of special categories of data within the meaning of Art. 9 (1) GDPR, this will only take place if it is required by law and there is no reason to assume that your legitimate interest in excluding the processing outweighs this.
Please note that we may also provide information for specific processing situations separately in an appropriate place.
1.5. Data transfer
If you provide us with your personal data, it will only be passed on to third parties if this is necessary for the execution of the contractual relationship or if another legal reason legitimises this transfer. Under certain circumstances, we are legally obliged to transfer and share personal data with third parties.
Within our company, we ensure that only those employees who need your data to fulfil contractual or legal obligations receive it. In some cases, we obtain services from processors. We have carefully selected these service providers and taken appropriate measures to protect your personal data.
1.6. Third country transfer
Your data will only be transferred to a third country if required by law, if you have given us your consent, or if this is necessary for the performance of the contractual obligation.
1.7. Data deletion and storage period
The personal data of the data subject will be deleted or blocked as soon as the purpose of storage no longer applies. Storage may also take place if this has been provided for by European or national legislators in EU regulations, laws, or other provisions to which the controller is subject. The data will also be blocked or deleted if the storage period prescribed by the aforementioned standards expires, unless there is a need to retain the data for the conclusion or fulfilment of a contract.
1.8. Data security
We also use appropriate technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.
1.9. Information for children
Our company does not offer any direct services for children and does not proactively process their personal data. Persons under the age of 16 may not transmit any personal data to us or submit a declaration of consent without the consent of their legal guardians.
1.10. Current status and changes to this privacy policy
We reserve the right to change our privacy policy as necessary and to publish it here. Please check this page regularly. The updated policy will take effect upon publication, subject to applicable laws and regulations.
You can access and print out the current privacy policy at any time on our website www.schlossfestspiele.de.
2. Hosting and Logfiles
Each time you visit our website, our system automatically collects data and information from the computer system of the accessing computer, which your browser transmits to our server and which is technically necessary for the display of our website and to ensure stability and security, based on the legal basis of Art. 6 (1) lit. f GDPR.
The following data is collected:
• Information about the browser type and version used
• The user’s operating system
• The user’s Internet service provider
• The user’s IP address
• Date and time of access
• Websites from which the user’s system accesses our website
• Websites accessed by the user’s system via our website
The data is also stored in our system’s log files. This data is not stored together with other personal data relating to the user.
The data is deleted as soon as it is no longer required for the purpose for which it was collected. In the case of data collection for the provision of the website, this is the case when the respective session has ended, but no later than 14 days.
3. Cookies
Our websites use so-called “cookies.” Cookies are small text files and do not cause any damage to your device. They are either stored temporarily for the duration of a session (session cookies) or permanently (permanent cookies) on your device. Session cookies are automatically deleted at the end of your visit. Permanent cookies remain stored on your device until you delete them yourself or your web browser automatically deletes them.
In some cases, cookies from third-party companies may also be stored on your device when you visit our website (third-party cookies). These enable you or us to use certain services provided by the third-party company (e.g., cookies for processing payment services).
Cookies have various functions. Numerous cookies are technically necessary, as certain website functions would not work without them (e.g., the shopping cart or video display). Other cookies are used to evaluate user behaviour or display advertising.
Cookies that are necessary for the electronic communication process (necessary cookies) or for the provision of certain functions you have requested (functional cookies, e.g. for the shopping cart function) or to optimise the website (e.g. cookies for measuring the web audience) are stored on the basis of Art. 6 para. 1 lit. f GDPR, unless another legal basis is specified. The website operator has a legitimate interest in storing cookies for the technically error-free and optimised provision of its services. If consent to the storage of cookies has been requested, the storage of the cookies in question is based exclusively on this consent (Art. 6 (1) (a) GDPR and § 25 (1) TTDSG); consent can be revoked at any time.
Tracking and analysis cookies are only activated once the website visitor has given their consent within the cookie banner (Art. 6 (1) (a) GDPR and Section 25 (1) TTDSG).
You can set your browser so that you are informed about the setting of cookies and only allow cookies in individual cases, exclude the acceptance of cookies for certain cases or in general, and activate the automatic deletion of cookies when closing the browser. If you deactivate cookies, the functionality of this website may be restricted.
When visiting our website, users are informed about the use of cookies for analysis purposes via an information banner and referred to this privacy policy. Cookies are only used for analysis purposes with the user’s consent in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TTDSG by agreeing to the cookie banner. You can revoke your consent at any time by changing your settings in the “Cookie settings” on our website.
4. Contact form
There is currently no contact form on our website.
4.1. Purpose and legal basis of data processing
The processing of personal data from the input mask is used solely for processing the contact request. In the case of contact by e-mail, this also constitutes the necessary legitimate interest in the processing of the data. The other personal data processed during the sending process serves to prevent misuse of the contact form and to ensure the security of our information technology systems.
The legal basis for processing the data is Art. 6 (1) lit. a GDPR and § 25 (1) TTDSG if the user has given their consent. The legal basis for processing data transmitted in the course of sending an email is Art. 6 (1) lit. f GDPR. If the purpose of the contact is to conclude a contract, the additional legal basis for processing is Art. 6 (1) lit. b GDPR.
4.2. Duration of storage
The data will be deleted as soon as it is no longer necessary for the purpose for which it was collected and there is no legal retention period that prevents this. For personal data sent by email or via the contact form, this applies when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. The additional personal data collected during the sending process will be deleted at the latest within 14 days.
4.3. Right of objection and removal
The user may revoke their consent to the processing of their personal data at any time. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of establishing contact will be deleted in this case.
4.4. Data transfer
Your personal data will not be transferred to third parties for purposes other than those listed below.
We will only pass on your personal data to third parties if:
• you have given your express consent to this in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TTDSG,
• in the event that there is a legal obligation to disclose information pursuant to Art. 6 (1) (c) GDPR, and
• this is legally permissible and necessary for the performance of contractual relationships with you in accordance with Art. 6 (1) (b) GDPR.
5. Email contact
Our website offers the option of contacting us by email. In this case, the user’s personal data transmitted with the email will be stored. In this context, the data will not be shared with third parties. The data will be used exclusively for processing the conversation.
5.1. Purpose of data processing and legal basis
We process personal data solely for the purpose of processing your contact request. In the case of contact by email, this also constitutes the necessary legitimate interest in the processing of the data.
The legal basis for the processing of data transmitted in the course of sending an email is Art. 6 (1) lit. f GDPR.
If the purpose of the contact is to conclude a contract, the additional legal basis for processing is Art. 6 (1) lit. b GDPR.
5.2. Duration of storage
The data will be deleted as soon as it is no longer required for the purpose for which it was collected and there is no legal retention period that prevents this. For personal data sent by email, this applies when the respective conversation with the user has ended. The conversation is ended when it can be inferred from the circumstances that the matter in question has been conclusively clarified. The additional personal data collected during the sending process will be deleted at the latest within 14 days.
5.3. Right of objection and removal
The user may revoke their consent to the processing of their personal data at any time. If the user contacts us by email, they may object to the storage of their personal data at any time. In such a case, the conversation cannot be continued. All personal data stored in the course of establishing contact will be deleted in this case.
5.4. Data transfer
Your personal data will not be transferred to third parties for purposes other than those listed below.
We will only pass on your personal data to third parties if:
• you have given your express consent to this in accordance with Art. 6 (1) (a) GDPR and § 25 (1) TTDSG,
• in the event that there is a legal obligation to disclose information pursuant to Art. 6 (1) (c) GDPR, and
• this is legally permissible and necessary for the performance of contractual relationships with you in accordance with Art. 6 (1) (b) GDPR.
6. Privacy policy for applicants
Our handling of your data and your rights Information pursuant to Articles 13 and 14 of the General Data Protection Regulation (GDPR)
6.1. Scope and purpose of data processing
We process data that you provide to us when you apply for an advertised position or submit a speculative application (personal data, contact details, education data, data on your previous professional career, cover letter, resume, portrait photo, references).
We need this data in order to process your application.
6.2. Legal basis for processing
6.2.1. Data processing for employment purposes – §26 BDSG (Federal Data Protection Act)
Your personal data will be processed for the purpose of personnel selection to fill vacant positions, i.e., to initiate an employment contract. The necessity and scope of data collection are assessed based on, among other things, the position to be filled. If your desired position involves particularly confidential tasks, increased personnel and/or financial responsibility, or is linked to certain physical and health requirements, more extensive data collection may be necessary. The legal basis for this is Section 26 (1) of the Federal Data Protection Act (BDSG).
6.2.2. Consent – Art. 6 (1) (a) GDPR, Section 25 (1) TTDSG, Section 26 (2) BDSG
If you have given us your voluntary consent to the processing of certain personal data, this consent forms the legal basis for the processing of this data.
In the following cases, we process your personal data on the basis of your consent:
• Inclusion in the applicant pool, i.e., we store your application documents and other data created about you during the application process beyond the current application process for consideration in future application processes.
If we base data processing on your consent, you have the right to withdraw your consent at any time with effect for the future. Please send your withdrawal of consent by email to datenschutz@schlossfestspiele.de. The lawfulness of the processing of your data up to the point of withdrawal remains unaffected.
6.2.3. Data processing based on legitimate interest – Art. 6(1)(f) GDPR
In certain cases, we process your data to protect a legitimate interest of ours or of third parties, unless your interests or fundamental rights and freedoms prevail. A legitimate interest exists, for example, if your data is necessary for asserting, exercising, or defending legal claims in the context of the application process (e.g., claims under the General Equal Treatment Act). In the event of a legal dispute, we have a legitimate interest in processing the data for evidentiary purposes.
6.2.4. Recipients of personal data
Your data will only be passed on to the employees in the Human Resources department responsible for the application process and to the employees in the relevant specialist departments, insofar as this is necessary for the decision on the establishment of the employment relationship.
Your data will not be transferred to countries outside the European Union/European Economic Area.
6.2.5. Storage period
We only store your data for as long as we need it for the application process. If you have not given your consent to further processing of your data (e.g. for the applicant pool), your application data will be stored for six months after completion of the application process for an advertised position and then deleted.
If no employment relationship is established, but you have given us your consent to continue storing your data (“applicant pool”), we will store your data until you revoke your consent, but for a maximum of 12 months.
6.2.6. Automated decision-making; profiling
Your personal data will not be used for automated decision-making or profiling.
6.2.7. Your rights as a data subject
You may request information about whether we have stored any personal data about you. If you wish, we will inform you what data we have stored, for what purposes the data is processed, to whom the data is disclosed, how long the data is stored, and what further rights you have in relation to this data.
In addition, you have the right to have your data corrected or deleted. You can also request that we provide all personal data you have provided to us in a structured, commonly used, and machine-readable format either to you or to a person or company of your choice.
We do not use automated processing, including profiling, for decision-making in the application process.
You also have the right, for reasons arising from your particular situation, to object at any time to the processing of personal data concerning you that is carried out on the basis of Art. 6 (1) (e) GDPR (data processing in the public interest) or on the basis of Art. 6 (1) (f) GDPR (data processing to safeguard a legitimate interest); this also applies to profiling based on this provision.
In the event of your objection, we will no longer process your personal data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing serves to assert, exercise, or defend legal claims.
In addition, you have the right to lodge a complaint with the competent data protection supervisory authority.
To exercise your rights, you can send an email to datenschutz@schlossfestspiele.de
7. Analytics tools and third-party tools
When you visit this website, your surfing behaviour may be statistically evaluated. This is primarily done using cookies and so-called analysis programs. Detailed information about these analysis programs and other third-party providers can be found in this section.
7.1 WP Statistics – statistics tool
This website uses WP Statistics, an analytics tool that is used for statistical analysis of visitor traffic. WP Statistics uses technologies that enable the interaction of users with the website to be recognized and analyzed
Data processing by WP Statistics WP Statistics collects data in anonymized form. This includes information such as access time, pages viewed, and the browser version used. This data is stored exclusively on our own server and is not passed on to third parties.
The information collected by WP Statistics is used to better understand usage behavior on our website and to continuously improve our offering. The data is collected and stored exclusively in anonymized form, so that no conclusions can be drawn about individual users.
Legal basis The use of WP Statistics is based on our legitimate interest in designing our website in line with user needs, in accordance with Art. 6 (1) (f) GDPR.
Right to object As a user, you have the right to object to the processing of your anonymized data by WP Statistics. Please note that specific information is required for the objection, which could enable the data to be assigned to your person. In such cases, please contact us directly.
Duration of storage The collected data is automatically deleted after a standard period of 24 months, unless there is a legal obligation to retain it for a longer period.
Further information and contact details If you have any questions about data protection or the processing of your personal data, you can contact our data protection officer at any time. You will find the relevant contact details in the legal notice on our website.
8. Social media presence
We use the technical platform and services of Facebook Ireland Ltd., 4 Grand Canal Square Grand Canal Harbour, Dublin 2 (“Facebook”) to operate our Facebook pages; we use the technical platform and services of Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA (“Instagram”) to operate our Instagram pages.
Since the operation of our Facebook pages is a joint responsibility (Art. 26 GDPR) between Facebook and us in terms of data protection law, a corresponding agreement has been concluded with Facebook Ireland Ltd., which you can view at the following link:
https://www.facebook.com/legal/terms/page_controller_addendum
Please note that you use our Facebook and Instagram pages and their functions at your own risk. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating).
We receive anonymous statistics from Facebook and Instagram on the use of our pages. The following information is provided here, for example:
• Followers: Number of people who follow us, including growth and development over a defined time frame.
• Reach: Number of people who see a specific post. Number of interactions on a post. This can be used to determine, for example, which content is more popular with users than others.
• Ad performance: How much does a click cost us? How many people saw an ad?
• Demographics: Average age of visitors, gender, place of residence, language.
Facebook provides more detailed information on this at the following link: https://www.facebook.com/business/a/page/page-insights
You can find relevant information from Instagram at this link: https://help.instagram.com/788388387972460?helpref=related
We use these statistics, from which we cannot draw any conclusions about individual users, to continuously improve our offerings on Facebook and Instagram and better respond to our users’ interests. The legal basis for this processing is Art. 6 (1) lit. f GDPR. We cannot link statistical data to our fans’ profile data. You can use your Facebook or Instagram settings to decide how targeted advertising is displayed to you.
If you are registered with Facebook or Instagram, you can send us a message using the “Message” function. Such messages are not visible to other Facebook or Instagram users. We process the personal data contained in a message you send us exclusively for the purpose of responding to your inquiry. The legal basis for this processing is Art. 6 (1) lit. f GDPR. The message will be deleted once your inquiry has been answered, and there is no other reason that entitles or obliges us to retain the message.
Facebook and Instagram do not conclusively and clearly state how they use the data from visits to Facebook or Instagram pages for their own purposes, to what extent activities on Facebook or Instagram pages are assigned to individual users, how long Facebook or Instagram store this data, and whether data from visits to Facebook or Instagram pages is passed on to third parties. We do not have this information.
When you visit our pages, Facebook and Instagram collect your IP address and other information that is transmitted to Facebook or Instagram via cookies on your device. This information is used, among other things, to provide us, as the operator of the Facebook or Instagram pages, with statistical information about the use of our pages. Facebook provides more detailed information on this at the following link:https://www.facebook.com/business/a/page/page-insights
Facebook’s cookie policy can be found here:
https://www.facebook.com/policies/cookies/
Information about the use of cookies on Instagram can be found here:
https://help.instagram.com/1896641480634370?ref=ig
The data collected about you in this context is processed by Facebook or Instagram and may be transferred to countries outside the European Union. Facebook describes what information it receives and how it is used in its “Data Policy.” The “Data Policy” is available at the following link:
http://de-de.facebook.com/about/privacy
The „Data Policy“ of Instagram is available here:
