Data privacy statement

1.1. Person Responsible (Controller)

Responsible within the meaning of the EU General Data Protection Regulation (GDPR) and the new Federal Data Protection Act (BDSG) is:
Stiftung Staatstheater Nürnberg
Richard-Wagner-Platz 2–10
90443 Nürnberg
Telefon: +49-(0)911 / 66069-0
E-Mail: info(a)staatstheater-nuernberg.de
Homepage: www.staatstheater-nuernberg.de

1.2. Name and address of the Data Security Officer

The data protection officer is Kemal Webersohn of WS Datenschutz GmbH.

If you have questions about data protection, you can contact WS Datenschutz GmbH at the following email address: staatstheater-nuernberg(a)ws-datenschutz.de

WS Datenschutz GmbH
Dircksenstraße 51
D-10178 Berlin
webersohnundscholtz.de

1.3. Protection of your data

We have taken technical and organizational measures to ensure that the requirements of the EU General Data Protection Regulation (GDPR) are met by us, as well as, by external service providers working for us.

Wenn wir zur Erbringung unserer Dienstleistungen mit anderen Unternehmen, wie etwa E-Mail- und Server-Anbietern, zusammenarbeiten, geschieht dies nur nach einem umfangreichen Auswahlverfahren. Bei diesem Auswahlverfahren wird jeder einzelne Dienstleister auf seine Eignung in Zusammenhang mit technischen und organisatorischen Fähigkeiten im Datenschutz hin sorgfältig ausgewählt. Dieses Auswahlverfahren wird schriftlich dokumentiert und ein Vertrag gem. Art. 28 Abs. 3 DSGVO über die Verarbeitung von personenbezogenen Daten im Auftrag (AV-Vertrag) nur dann geschlossen, wenn er den Anforderungen des Art. 28 DSGVO entspricht.

If we work with other companies to provide our services, such as email and server providers, this will only be done after an extensive selection process. In this selection process, each individual service provider is carefully selected for its suitability in terms of technical and organizational data protection skills. This selection procedure will be documented in writing and an agreement on the order processing of data (data processing agreement) will only be concluded if the third party complies with the requirements of Art. 28 GDPR.

Your information will be stored on specially protected servers. Access to it is only possible for a few specially authorized persons. Our website is SSL/TLS encrypted, as can be seen by the https:// at the start of our URL. This also involves e-mail communications, which is encoded via SSL certificate.

1.4. Erasure of personal data

We process personal data only if necessary. As soon as the purpose of the data processing is fulfilled, erasure of the data is carried out according to the standards of the erasure concept, unless legal or contractual regulations oppose this.

2.1. Scope of processing personal data

When visiting our website, our web servers temporarily store every access in a log file. The following data is collected and stored until automated erasure:

- IP-address of the requesting computer
- Date and time of access
- Detection data of the browser and operating system used
- Name of your Internet access provider

We use the service provider noris network AG, Thomas-Mann-Strasse No.16 - 20, 90471 Nuremberg, Germany for hosting purposes.

Additional information on data protection at the service provider can be found at: https://www.noris.de/service/datenschutz

2.2. Legal basis for processing personal data

The legal basis for the temporary storage of the data and log files is Art. 6 para. 1 s. 1 lit. f) GDPR. Our legitimate interest is to make our website accessible for you.

2.3. Purpose of data processing

The processing of this data serves: the purpose of enabling the use of the website (connection establishment), system security, the technical administration of the network infrastructure, as well as to optimize the website. The IP address is evaluated only in case of attacks on our network infrastructure or the network infrastructure of our internet provider.

2.4. Duration of storage

As soon as the purpose of the data processing is fulfilled, erasure of the data is carried out. This happens as soon as you close our website. Our hosting service might use data for statistical purposes. Any personal data will be anonymized for this.

2.5. Right of objection and erasure

The data processing is necessary in order to present the website and to ensure the website’s operation. Therefore, objecting is impossible.

3.1. Description and scope of data processing

Our website uses cookies. This means that when using the website, cookies are stored on your computer. Cookies are small text files which are assigned to the browser you are using and which are stored on your hard drive. Through this information flows to us or the party who set the cookie. Cookies cannot run programs on or transmit viruses to your computer. They are used to analyze the use of our website in anonymized or pseudonymized form and to enable personalized advertisements on this website. The following data may be transmitted:

- Frequency of website visits
- Which functions of the website are used by you
- Your cookie-settings
- Language settings
- Items in a shopping basket
- Used search terms

Upon entering our website, a cookie banner informs you about the use of cookies on this website and asks for your consent to the use of cookies. Also, you are pointed to the data privacy statement of this website.

Notice regarding data processing in the USA:
By clicking on "Agree to all", you consent according to Art. 6 para. 1 p. 1 lit. a) GDPR that your data will be processed in the USA. According to the ECJ, the data protection standard in the USA is insufficient and there is a risk that your data will be processed by the US authorities for control and monitoring purposes, possibly also without any legal remedy. If you only consent to the setting of essential cookies, the transfer will not take place. Consent given can be revoked at any time.

3.2. Legal basis for data processing

The legal basis for the processing of data by cookies, which do not only serve the functionality of our website, is Art. 6 para. 1 s. 1 lit. a) GDPR.

The legal basis for the processing of data for cookies, which serve only the functionality of this website, is Art. 6 para. 1 s. 1 lit. f) GDPR.

3.3. Purpose of data processing

Our legitimate interests are to provide you with a working website connection and to ensure a comfortable use of this website. Also, we need to process your personal data to solve occurring safety and security issues, as well as to ensure system stability. The data processing takes place to make a statistical evaluation of our website possible.

3.4. Duration of storage

This website uses the following types of cookies. The extend and function of each are being explained below:

- Transient cookies (see a)
- Persistent cookies (see b)

a) Transient cookies are automatically deleted when you close the browser. This is especially true for session cookies which store your session ID, with which various requests from your browser can be assigned to your session. This will allow your computer to be recognized when you return to our website. Session cookies are deleted when you log out or close the browser.

b) Persistent cookies are automatically deleted after a specified period, which may differ depending on the cookie.

3.5. Right to objection and erasure

You have the possibility to revoke your consent to the data processing by means of cookies, which do not only serve the functionality of the website. In addition, we do not set cookies until you have agreed to set cookies when you visit the site. In this way, you can prevent data processing via cookies on our website. You can also delete the cookies in your browser's security settings at any time. Please note that you may not be able to use all the features of this website. The setting of cookies can also be prevented at any time by appropriate settings in your internet browser.

4.1. Description and scope of data processing

Via our website it is possible to contact us via e-mail or via contact form. This will require different data to answer the request, which will be automatically saved for processing. The following data are required to process your request:

- Salutation
- First Name
- Last Name
- E-Mail Adress
- Subject
- Request

Furthermore, you can enter the following data optionally:

- Department

Your data will not be passed on to third parties, unless you have given your consent.

4.2. Legal basis for data processing

The legal basis depends on Art. 6 para. 1 s. 1 lit. b) GDPR, insofar as your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of requests addressed to us Art. 6 para. 1 p. 1 lit.f ) GDPR in conjunction with. Art. 4 para. 1 BayDSG.

4.3. Purpose of data processing

The processing of personal data from the input form is used solely handling the contact request.

4.4. Duration of storage

The data will be deleted as soon as we answer your request. There might occur rare cases when legal or contractual retention periods interfere with the erasure of your personal data. In this case your data will be deleted after these periods.

4.5. Right to objection and erasure

The user has the right to withdraw their consent to the processing of personal data at any time. If the user contacts us, they can object to storage of their personal data at any time. In such cases, the conversation cannot be continued. All personal data that has been stored in the course of the contact will be deleted.

4.6. LimeSurvey

4.6.1. Description and scope of data processing

The website uses the survey and consulting service LimeSurvey. The data processing is carried out by: LimeSurvey GmbH, Papenreye 63, 22453 Hamburg / Germany.

The following personal data is processed by LimeSurvey:

- Log information
- Information logged during access, such as cookies, hardware addresses or similar, as well as
- All data that is requested by the survey and that you provide there.

You can find more information about data protection at LimeSurvey here: https://www.limesurvey.org/de/datenschutzhinweise

4.6.2. Legal basis for data processing

The legal basis is your consent pursuant to Art. 6 para. 1 p. 1 lit. a) GDPR.

4.6.3. Purpose of data processing

We use the service to create and analyze customer surveys, which help us to constantly improve our services and adapt them to your needs.

4.6.4. Duration of storage

The data will be deleted as soon as the purpose of processing has been achieved and no legal, contractual or official regulations prevent deletion.

4.6.5. Right to objection and erasure

You can decide independently whether you would like to participate in a survey about our performance and have the option to object to the data processing at any time. To do so, please contact us using the contact details provided above.

5.1. Description and scope of data processing

The data subject can register on our website. This requires the data subject to enter personal data in the registration form. The following data is at least collected for this:

- Salutation
- First name

- Last name
- Adress
- Country
- Phone number
- Email address

The user can optionally specify the following data:

- Title
- Name affix
- Birthday
- Cell phone number

The information provided by the data subject in the registration mask will be used exclusively for processing and will not be disclosed to third parties.

5.2. Legal basis for data processing

If the data subject enters mandatory personal data in the registration form, the legal basis of the data processing is based on Art. 6 para. 1 s. 1 lit. b) GDPR. However, if the user also enters personal data in the optional input field, the data processing is based on Art. 6 para. 1 s. 1 lit. a) GDPR.

5.3. Purpose of data processing

The processing of personal data is used solely for us to finish your registration and organize your website-account.

5.4. Duration of storage

The data are deleted as soon as the purpose of storage is no longer required. This is the case if you delete your account and no statutory or regulatory retention periods of erasure contradict.

5.5. Right to objection and erasure

During and after the registration, the data subject is free to change, correct or delete their personal data.

6.1. Description and scope of data processing

We offer the opportunity to apply for jobs by email or postially. For this purpose, personal data is processed and stored for further processing during the respective application process.

6.2. Legal basis for data processing

Data processing will be based on Art. 88 GDPR and § 26 BDSG.

6.3. Purpose of data processing

We process your data exclusively for the purpose of carrying out the application process.

6.4. Duration and storage

In case of successful application and employment, the personal data is stored in accordance with the legal requirements. In case of unsuccessful application, the data will be deleted in accordance with the rules of the local erasure concept. In doing so the provisions of the AGG (German Employment Law), especially the existing evidence pursuant to § 22 AGG, are taken into account.

This does not apply if we are obliged to any legal erasure periods or if you have given consent to store your data for further communication with us (e.g. we have another suitable job in the future). If you have given consent the legal basis for further storage of your data is Art. 6 para. 1 s. 1 lit. c) or lit. a) GDPR.

6.5. Right to objection and erasure

You can contact us at any time and object to further processing of your data. All personal data of the application process will be deleted in this case.

7.1. Description and scope of data processing

On our website visitors can subscribe to our newsletter. When subscribing to the newsletter, you will be asked to provide personal data for processing. This is the data that is requested in the newsletter registration form. Input fields marked with an "*" are mandatory fields:

- E-mail address

This data is necessary to send the newsletter to its recipients.

The newsletter will be sent via email only after the sign-up process is completed. In order to meet the requirements of the GDPR, we use DOI (Double Opt.-In). If you sign up for our newsletter, we will send a confirmation email to the address you provided us with. This email contains a confirmation link that you must click to complete the sign-up process. Following this procedure, the IP address, date and time of login are stored. This is done to prevent abuses. We won’t transfer the data to third parties.

7.2. Legal basis for data processing

This processing is legally based on Art. 6 para. 1 s.1 lit. a) GDPR, thus your consent.

7.3. Purpose of data processing

The newsletter has the functions of informing the affected parties about offers and news at a regular basis.

7.4. Duration of storage

We process personal data only as long as necessary. As soon as the purpose of the data processing is fulfilled, erasure of the data is carried out according to the standards of the erasure concept, unless legal or contractual regulations oppose this.

7.5. Right to objection and erasure

The consent to receiving the newsletter can be revoked by you at any time. For this purpose, you can click the integrated link in each newsletter to unsubscribe. It is also possible to inform us about the revocation of the consent in any other way, e.g. via mail or email.

7.6. Shipping service provider Brevo

7.6.1. Description and scope of data processing

We also use the newsletter tool from Brevo (formerly Sendinblue). The data processing is carried out by: Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.

Brevo operates a server location in Germany and has a TÜV Rheinland certificate for data protection.

Further information on data protection can be found here: https://www.brevo.com/de/legal/privacypolicy/

7.6.2. Legal basis for data processing

The data processing by the provider is based on your consent pursuant to Art. 6 para. 1 p. 1 lit. a) GDPR.

7.6.3. Prupose of data processing

We use the service provider as our shipping service provider to ensure effective address management and to keep in touch with you via the newsletter.

7.6.4. Duration of storage

The provider deletes personal data as soon as the purpose of the data processing has been achieved and no legal, contractual or official regulations prevent deletion. This is the case at the latest two years after termination of the contract between us and Sendinblue.

7.6.5. Right to objection and erasure

You have the possibility to revoke your consent at any time. For this purpose, please contact our data protection officer. In addition, you are free at any time to use the "opt-out" link at the end of each e-mail, which will result in us deleting your e-mail address from our address file, which is why the service provider will then also not further process your personal data. For questions regarding data protection at Sendinblue, you can contact the service's data protection officer at the following address: datenschutz(a)brevo.com.

8.1. Description and scope of data processing

We will process the personal data that you provide to us when you make a donation. This data will normally include your name, your bank details and the sum being donated.

When you donate, we collect and process only the personal data that we need for the purpose of receiving the donation or responding to your enquiry. Only in cases where you require a receipt by post or email do we ascertain the relevant address for this purpose. You can provide these details voluntarily by emailing us at development(at)staatstheater-nuernberg.de .

8.2. Legal basis for data processing

The donation is carried out pursuant to Art. 6 Para. 1 lit. b) GDPR. Personal data and receipts/confirmations are stored pursuant to Art. 6 Para. 1 lit. c) GDPR.

8.3. Purpose of data processing

We process your data only for the purpose of enacting and administering the donation and complying with our legal obligation to retain records.

8.4. Duration of data storage

We store your data only for the time it takes to complete the action and/or for the period required by law / contractual obligations. Your data will be stored for 10 years pursuant to § 14b Para. 1 S. 1 UStG (VAT Act). This period is laid down by law and helps us in our interactions with tax authorities.

8.5. Right to deletion of data

The collection and processing of your data is essential to the transacting of your donation and cannot be waived. You are invited to contact us at any time to assert any rights relating to data protection.

When you shop tickets at our Webstore, it is necessary to create an customer account in which you have to enter personal data. Mandatory data required for the purchase transaction are marked with an asterisk (*):

- Salutation
- First name
- Last name
- Address
- Country
- Phonenumber
- E-Mail address

The user can optionally specify the following data:

- Title
- Name affix
- Birthday
- Cell phone number

9.1. Legal basis for data processing

We only transmit personal data to third parties if this is necessary within the scope of the contract processing, for example to the companies entrusted with the delivery of the goods or to the credit institution commissioned with the payment processing. Further transmission of data does not take place or only if you have expressly consented to the transmission. Your data will not be passed on to third parties without your express consent, for example for advertising purposes.

The legal basis for the processing of customers' personal data is Art. 6 para. 1 p. 1 lit. b) DSGVO.

Existing customers may receive newsletters from us who have not given explicit consent. However, this only takes place within the narrow limits of § 7 para. 3 UWG, which in the light of Art. 95 DSGVO is to be understood as a mirror image of Art. 6 para. 1 p.1 lit. f) DSGVO. Our legitimate interest is to inform our existing customers about our products through promotional e-mails and thus to maintain contact with these customers.

9.2. Purpose of data processing

We process your data to close the contract, to handle the payment, for billing, to ensure on-time delivery and to inform you about that delivery.

We provide your data to our contracted processors and service providers, so that they can process the delivery and, if necessary, communicate with you to announce and coordinate the delivery of your ordered goods.

9.3. Duration of storage

We process personal data only as long as necessary. As soon as the purpose of the data processing is fulfilled, erasure of the data is carried out according to the standards of the erasure concept, unless legal or contractual regulations oppose this.

9.4. Right to objection and erasure

The data processing is necessary in order to be able to process your purchase contract, which is why it cannot be waived. There is therefore no option to object.

During the purchase process in the webshop, you have the option of printing out your tickets on paper at home. In order to use this service, it is necessary that you provide your date of birth in addition to your first and last name. The collection of the date of birth is necessary in order to provide you with a valid ticket for the Verkehrsverbund Großraum Nürnberg (VGN). The request for the date of birth results for us from contractual obligations towards the VGN.

10.1. Legal basis for data processing

The processing of personal data in the Print@Home procedure is based on Art. 6 para. 1 s. 1 lit. b) GDPR (contract processing) and in the interest of a smooth, convenient and secure payment process (Art. 4 para. 1 BayDSG). Insofar as your consent is requested for certain actions, Art. 6 para. 1 s. 1 lit. a) GDPR is the legal basis for data processing; consents can be revoked at any time for the future.

10.2. Prupose of data processing

The purpose of our Print@Home service is to make the use of the web store as convenient and simple as possible and to ensure proper fulfillment of the contract.

10.3. Duration of storage

The above-mentioned data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. Statutory retention periods remain unaffected by this.

10.4. Right to objection and erasure

The above-mentioned data will be deleted as soon as they are no longer required to achieve the purpose for which they were collected. Statutory retention periods remain unaffected by this.

11.1. Description and scope of data processing

We integrate payment services from third-party companies on our website. When you make a purchase from us, your payment data (e.g.: first and last name, payment amount, account details, credit card number) is processed by the payment service provider for the purpose of payment processing. For these transactions, the respective contract and data protection provisions of the respective providers apply.

We use the following payment services / payment service providers within the scope of this website:

a) TeleCash (https://www.telecash.de/datenschutz)
b) Payone (https://www.payone.com/DE-de/datenschutz)
c) Visa (https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html)
d) Mastercard (https://www.mastercard.de/de-de/datenschutz.html)

11.2. Legal basis for data processing

The legal basis for the data processing associated with this is Art. 6 para. 1 p. 1 lit. b) GDPR, i.e. the processing of your data is necessary for the fulfillment of the purchase contracts and supply agreements. Insofar as your consent is requested for certain actions, Art. 6 para. 1 lit. a) GDPR is the legal basis for data processing; consents can be revoked at any time for the future.

11.3. Prupose of data processing

We process the data you provide only for the purpose of processing your order. For this purpose, it may be necessary for us to transmit your payment data to our financial service providers.

11.4. Duration of storage

Your data will only be stored for as long as is necessary to fulfill the purpose for which it was collected and for as long as we are obligated to store your data due to legal, contractual or official obligations.

11.5. Right to objection and erasure

You have the possibility to exercise your rights at any time and, for example, to revoke a granted consent. Please contact us for this purpose.

We have integrated social media platforms through into our services, which may result in the social media provider receiving data from you. If you click on the social media link, the website of the respective social media provider is loaded. By loading the website of the respective social media provider via our services, the respective reference data is transmitted to the respective social media provider. The social media provider thereby receives the information that you have visited us.

Note on data processing to the United States:

Note on data processing to the United States: If you click on a social media link, data about you may be processed by the respective provider in the United States. According to the European Court of Justice, the data protection standard in the United States is not adequate and there is a risk that your data will be processed by the U.S. authorities for control and monitoring purposes, possibly also without any legal remedy. Provided that you do not click on the links of the social media providers, no data transfer takes place.

Further information on data processing by the social media providers can be found here:

Meta:
https://de-de.facebook.com/help/pages/insights,
https://de-de.facebook.com/about/privacy,
https://de-de.facebook.com/full_data_use_policy

Instagram:
https://help.instagram.com/155833707900388,
https://www.instagram.com/about/legal/privacy/

Twitter / X:
https://twitter.com/privacy?lang=de

YouTube:
https://www.google.de/intl/de/policies/privacy/

We integrated social media platforms on our website via "plug-ins", which may result in social media providers receiving data from you if necessary. We will break this down for you in the following.

13.1. YouTube

13.1.1. Description and scope of data processing

We have integrated the services of YouTube on this website. Data processing is carried out by: YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. YouTube, LLC. Data processing for the European Economic Area and for Switzerland is carried out by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

If the user clicks on the YouTube button or link, a website of YouTube will be opened. This might also happen in form of a small window in our website (a so-called iframe). By accessing YouTube's website through our website ("per click"), YouTube receives the information that the user has visited our website. If, at the time of visiting our website, the user is logged in via a YouTube account (it does not matter if it is their own), YouTube will receive further information, such as which pages were entered on our website by the user. YouTube collects this information, which theoretically gives you the opportunity to associate this information with the YouTube account. For more information about privacy, please refer to the following data policy from YouTube: https://www.google.de/intl/de/policies/privacy/

13.1.2. Legal basis of data processing

The legal basis for this data processing is your given consent, Art. 6 para. 1 s. 1 lit. a) GDPR.

13.1.3. Purpose of data processing

We use social media to promote our company. We also want to give you the opportunity to interact with social media through our website.

13.1.4. Duration of storage

Data collected by YouTube (Google) will be deleted by the controller after a fixed retention period of 9 to 18 months.

13.1.5. Right of objection and erasure

To prevent the processing of data by YouTube, you have the possibility to log out of YouTube and delete all cookies before visiting our website. Additional settings and objections on the use of data for promotional purposes are available within the YouTube Profile settings.

13.2. YouTube Video

13.2.1. Description and scope of data processing

We have integrated the services of YouTube on this website. We use for the integration of videos the provider YouTube. Dat processing is caried out by: YouTube LLC, 901 Cherry Avenue, San Bruno, CA 94066, USA. Data processing for the European Economic Area and for Switzerland is carried out by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

When you visit our website with embedded videos, your IP address will be sent to YouTube and cookies will be installed on your computer. We have included our YouTube videos in enhanced privacy mode (in which case, YouTube still contacts the Google DoubleClick service, but personal data is not evaluated according to Google's privacy policy). As a result, YouTube does not store any information about visitors unless they watch the embedded video. If you click the video, your IP address will be sent to YouTube and YouTube will know that you've watched the video. If you are logged in to YouTube, this information is also assigned to your user account (you can prevent this by logging out of YouTube before clicking the video). We use no influence on any possible collection or use of your data by YouTube. For more information about privacy, please refer to the following data policy of YouTube: https://www.google.de/intl/de/policies/privacy/

13.2.2. Legal basis of data processing

The legal basis for this data processing is your given consent, Art. 6 para. 1 s. 1 lit. a) GDPR.

13.2.3. Purpose of data processing

We use social media to promote our company. We also want to give you the opportunity to interact with social media through our website.

13.2.4. Duration of storage

Data collected by YouTube (Google) will be deleted by the controller after a fixed retention period of 9 to 18 months.

13.2.5. Right to objection and erasure

You have the option to revoke your consent to data processing at any time. Please contact our data protection officer for this purpose. To prevent data processing by YouTube, you have the option of logging out of YouTube before accessing our website and deleting all cookies from your browser history. Further settings and objections to the use of data for advertising purposes are possible within the YouTube profile settings. The settings are platform-independent, i.e. they are applied to all devices, such as desktop computers or mobile devices.

For the continuous improvement of our website we use the following tracking and analytics tools. Below you can find information on which personal data is processed in each case and how you can reach the respective service providers:

14.1. Google Analytics 4

14.1.1. Description and scope of data processing

Our website uses Google Analytics 4. This is a service for analyzing access to websites of Google Inc. ("Google") and allows us to improve our website. Data processing for the European Economic Area and for Switzerland is carried out by:Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Cookies enable us to analyze your use of our website. The information collected by a cookie are:

- IP address
- Access time
- Access Duration
- From which website you came to our website
- Interaction on the website
- Demographic characteristics, if the website visitor ist logged in to his google account
- Device categories, browser type, operating system, screen resolution

The information is transmitted to a Google server in the USA and stored there. The evaluation of your activities on our website is transmitted to us in the form of reports. Google may pass on the collected information to third parties, if required by law or if third parties process this data on behalf of Google. The Google tracking codes of our Internet offer use the function "_anonymizeIp ()", thus IP addresses are processed only shortened, in order to exclude a possible direct personal link to you.

Under https://www.google.de/intl/de/policies/, Datenschutz - Google Analytics-Hilfe as well as under Datenschutzeinstellungen in Google Analytics - Google Analytics-Hilfe you can find out more about the terms of use and privacy policy of Google Analytics.

14.1.2. Legal basis of data processing

The legal basis is your given consent, Art. 6 para 1 s. 1 lit. a) GDPR.

14.1.3. Purpose of data processing

By processing the data, we can analyze how our website is used, so we can improve it for our users.

14.1.4. Duration of storage

The data will be deleted 14 months after your last website visit.

14.1.5. Right to objection and erasure

You can prevent the installation of cookies by Google Analytics in your browser settings. In this case, however, it may happen that you cannot fully use all features of our website. Also, trough browsers extensions e.g. http://tools.google.com/dlpage/gaoptout?hl=deGoogle Analytics can be disabled and controlled.

We also use third-party providers to help us with the site's appearance and functionality. These are listed below:

15.1. Google Maps

15.1.1. Description and scope of data processing

This site uses the Google Maps map service via an API. Data processing for the European Economic Area and for Switzerland is carried out by:Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Further information about handling user data, can be found in the privacy policy of Google under https://www.google.de/intl/de/policies/privacy/ and https://www.google.com/intl/de_de/help/terms_maps.html

15.1.2. Legal basis of data processing

The legal basis is your consent, Art. 6 para. 1 s. 1 lit. a) GDPR.

15.1.3. Purpose of data processing

The use of Google Maps helps you to easily see where places like our location are and additionally provides further means to interact like a route planner.

15.1.4. Duration of storage

We process personal data only as long as necessary. As soon as the purpose of the data processing is fulfilled, erasure of the data is carried out according to the standards of the erasure concept, unless legal or contractual regulations oppose this.

15.1.5. Right of objection and erasure

The data processing is mandatory in order to be able to present the location information on our website, so they cannot be waived. Therefore, objecting is impossible.

15.2. VGN timetable

15.2.1. Description and scope of data processing

This website uses the VGN timetable information product. The data processing is carried out by: Cok Verkehrsverbund Großraum Nürnberg GmbH (VGN GmbH), Rothenburger Straße 9, 90443 Nürnberg, telephone: 0911 270750, e-mail: E-Mail: info(a)vgn.de, Internet: www.vgn.de.

By integrating the service on this website, data such as the IP address, the browser, the website just visited, cookies of the VGN website stored with the user are transmitted to VGN GmbH. The further processing or storage of this data is carried out by VGN GmbH in the manner described in its data protection declaration. You can prevent the storage of cookies by setting your browser software accordingly. However, VGN GmbH would like to point out that in this case you may not be able to use all functions to their full extent. An evaluation by analysis tools of VGN GmbH does not take place.

Further information on data protection can be found here: www.vgn.de/datenschutz/

15.2.2. Legal basis for data processing

The legal basis is your consent, Art. 6 para. 1 s. 1 lit. a) GDPR.

15.2.3. Prupose of data processing

The integration of the VGN timetable information is in the interest of an appealing presentation of our online offers, as well as convenient and easy access to the timetable information of public transport.

15.2.4. Duration of storage

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

15.2.5. Right to objection and erasure

You have the option to revoke your consent to data processing at any time. To do so, please contact our data protection officer.

15.3. Online booking system LUCA

15.3.1. Description and scope of data processing

We use the services of culture4life GmbH to manage reservations made online. To do this, we process your personal data that you provide to us for purposes of your reservation. These include

- e-mail address
- first name
- surname
- telephone number
- information on your booking request (date, time, number of persons)

The data are processed by: culture4life GmbH, Mörikestraße 67, 70199 Stuttgart.

Information on data protection at culture4life GmbH can be found here: luca-app.de/app-privacy-policy.

15.3.2. Legal basis for data processing

The legal basis for the processing of the reservation is Art. 6 para. 1 clause 1 b) GDPR.

15.3.3. Purpose of data processing

We process your data solely for the purpose of reservation management.

15.3.3. Duration of data retention

We only retain your data for as long as necessary to fulfil the respective purpose and as long as we are required to do so in accordance with legal, contractual or official obligations to retain your data.

15.3.4. Data subject rights to data removal

You can object to the processing of your data at any time. However, in the event of such an objection, we will not be able to accept or process your reservation. You can contact us at any time to assert your rights.

15.4. Payment services provider Rapyd

15.4.1. Description and scope of data processing

We use the payment services platform Rapyd to process payments, in particular within our online reservation system, provided by culture4life GmbH. To do this, we process your personal data that you provide to us for purposes of your reservation. These may include

- contact information: first and last name, e-mail address, home address, date of birth, telephone number
- payment information: bank data, payment information (such as credit/debit card information, transaction amount)
- transaction information: information on the conducted transactions, including digital wallet information, date and time of the transaction

The data are processed by: Rapyd Europe hf., Dalshraun 3, 220 Hafnarfjörður, Iceland

Information on data protection at Rapyd Europe hf. can be found here: www.rapyd.net/security-compliance/privacy-policy/.

15.4.2. Legal bases for data processing

• Contract fulfilment: Art. 6 para. 1 b) GDPR – The processing is required to fulfil a contract to which you are a party, or to conduct pre-contractual measures pertaining to your request
  
• Legal obligation: Art. 6 para. 1 c) GDPR – The processing is required to fulfil a legal obligation to which we are bound
  
  

15.4.3. Purpose of data processing

We process your data solely for the purpose of payment processing.

15.4.4. Duration of data retention

We only retain your data for as long as necessary to fulfil the respective purpose and as long as we are required to do so in accordance with legal, contractual or official obligations to retain your data.

15.4.5. Data subject rights to data removal

The processing of data is required to execute your payment via Rapyd. For this reason, we must process your data if you select this payment method.

We following own presences in the social media:

- Facebook: www.facebook.com/StaatstheaterNuernberg
- Instagram: www.instagram.com/staatstheaternuernberg/
- LinkedIn: de.linkedin.com/company/staatstheater-n%25C3%25BCrnberg?
- YouTube: www.youtube.com/user/StaatstheaterNbg/

Here we access the services of:

- Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA beziehungsweise Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland (“Facebook”)
- Meta Platforms Inc., 1 Hacker Way, Menlo Park, CA 94025, USA beziehungsweise Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Irland (“Instagram”)
- LinkedIn Ireland, Wilton Plaza, Wilton Place, Dublin 2, Irland beziehungsweise LinkedIn Corporation, 1000 W. Maude Ave., Sunnyvale, California 94085, USA (“LinkedIn”)
- YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA (“YouTube”) präsentiert durch: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, Data processing within the European Economic Area and Switzerland is carried out by: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

back.

Based on the ruling of the European Court of Justice of 05.06.2018 (available at: https://curia.europa.eu/juris/document/document.jsf?text=&docid=202543&pageIndex=0&doclang=DE&mode=req&dir=&occ=first&part=1&cid=298398) operators of presences in social media and the operators of the social media themselves are considered jointly responsible for data processing.

We would like to point out that you use our social media sites and their functions on your own responsibility. This applies in particular to the use of interactive functions (e.g. commenting, sharing, rating). Alternatively, you can also access the information that we make available on social media on our own website.

You can reach the data protection officers of the respective social media via the respective social media.

You can reach the data protection officer of Facebook and Instagram via the following linked contact form: https://www.facebook.com/help/contact/540977946302970

You can reach the data protection officer of LinkedIn via the following linked contact form: https://www.linkedin.com/help/linkedin/ask/TSO-DPO

You can reach the data protection officer of Google and YouTube via the following linked contact form: Kontaktformular für Fragen zum Thema Datenschutz - Richtlinien-Hilfe (google.com)

16.1. Data processed by social media

When you visit our social media sites, the social media operators collect, among other things, your IP address and other information in the form of cookies on your PC. This information is used to provide us, as the operator of the site, with statistical information about the use of the site. The data collected about you in this context will be processed by the operators of the social media and, if necessary, transferred to countries outside the European Union. What information the operator of the respective social network receives and how it is used is described in the privacy statements of the respective social networks. There you will also find information on the contact options.

You can find more detailed information on this under the following links:

Facebook:
https://de-de.facebook.com/help/pages/insights,
https://de-de.facebook.com/about/privacy,
https://de-de.facebook.com/full_data_use_policy

Google YouTube:
https://www.google.de/intl/de/policies/privacy/

Instagram:
https://help.instagram.com/155833707900388,
https://www.instagram.com/about/legal/privacy/

LinkedIn:
https://www.linkedin.com/legal/privacy-policy

In which way the operators of the social media use data from the visit of our appearance in the social media for their own purposes, to which extent activities on the appearances in social media are assigned to individual users, how long the operators store these data and whether data from a visit of the appearances in social media are passed on to third parties, is not conclusively and clearly stated by the operators of the social media and is not known to us.

When accessing our appearances in social media, the IP address assigned to your end device is transmitted to the operator of the respective social network. The social networks also store information about the end devices of the users (e.g. as part of the "login notification" function); if necessary, the operators of the social media are thus able to assign IP addresses to individual users.

If you are currently logged in to the respective social network as a user, a cookie with your individual identification in this social network is located on your end device. This allows the operator of the social network to track that you have visited a certain page and how you have used it. Based on this data, content or advertising can be tailored to your previous website visits.

If you want to avoid this, you should log out of the respective social network or deactivate the "stay logged in" function, delete the cookies present on your device, and exit and restart your browser. In this way, login information via which you can be directly identified will be deleted. This allows you to use our social media appearances without revealing your user ID. When you access interactive features of the site (like, comment, share, news, etc.), a login screen will appear. After any login, you will again be recognizable as a specific user for the social network used.

Information on how you can manage or delete existing information within the social network can be found on the above-mentioned support pages of the respective social network.

16.2. Data processed by us

16.2.1. Description and scope of data processing

The data you enter on social networks, in particular your username and the content published under your account, will be processed by us insofar as we may respond to your messages. In addition, your published posts, ratings and comments refer to your account on the respective social network. If you mention us via an @ or a # or similar, this mention will be published under your username on our site, if applicable. The data freely published and disseminated by you on the respective social network may thus be included by us in our offer and made accessible to other users of the respective social network. If you mark our appearance in the social media with "Like" or "Follow" or a similar interaction, this will be communicated to us by the respective social network with your user name and link to your account.

16.2.2. Legal basis for data processing

Data processing on our part is based on Art. 6 para. 1 s. 1 lit. f) GDPR. Our legitimate interest results from the advertising function of social media. We use these to increase awareness of our company.

16.2.3. Prupose of data processing

The data you provide in this context and which may be accessible to us (e.g. user name, pictures, interests if applicable, contact data) will be processed by us exclusively for the purpose of customer and prospect communication. Our legitimate interest is to provide you with a platform on which we can display up-to-date information and with the help of which you can address your request to us and we can respond to your request as quickly as possible.

16.2.4. Duration of storage

As far as we are able, your data will be deleted when our presence on social media is discontinued.

In order to be able to provide our services, we use the support of service providers from third party countries (non-EU countries). In order to ensure the protection of your personal data in this case, we conclude processing contracts with each - carefully selected - service provider. All of our processors provide sufficient guarantees to implement appropriate technical and organizational measures. Our third country data processors are either located in a country with an adequate level of data protection (Art. 45 GDPR) or provide appropriate safeguards (Art 46 GDPR).

Adequate level of protection:
The provider comes from a country whose level of data protection has been recognized by the EU Commission. For more information, see: Adequacy decisions (europa.eu)

EU standard contract clauses:
Our provider has submitted to the EU standard contractual clauses to ensure secure data transfer. For more information, see: https://eur-lex.europa.eu/eli/dec_impl/2021/914/oj?uri=CELEX%3A32021D0914&locale=en

Binding Corporate Rules:
Article 47 of the GDPR provides the possibility of ensuring data protection when transferring data to a third country via Binding Corporate Rules. These are examined and approved by the data security authorities within the framework of the consistency mechanism pursuant to Art. 63 GDPR.

Consent:
In addition, a data transfer to a third country without an adequate level of protection will only take place if you have given us your consent in accordance with Art. 49 sec. 1 lit. a) GDPR for this purpose.

You have the following rights with respect to the personal data concerning you:

18.1. Right to withdraw a given consent (Art. 7 GDPR)

If you have given your consent to the processing of your data, you can withdraw it at any time. This will affect the admissibility of processing your personal data by us for the time after you have withdrawn your consent. To withdraw your consent, contact us personally or in written form.

18.2. Right of access (Art. 15 GDPR)

You have the right to obtain from us confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to your personal data and the following information:

- the purpose of processing;
- the categories of personal data concerned;
- the recipients or the categories of recipient to whom your personal data have been or will be disclosed, in particular recipients in countries outside of the EU or international organisations;
- where possible, the envisaged period for which your personal data will be stored, or, if not possible, the criteria used to determine that period;
- all available information on the source of your personal data;
- the existence of automated decision-making, including profiling, referred to Art. 22 para. 1 and 4 GDPR and, in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for you.

In the case of such a request, you must provide enough information about your identity to proof that the request concerns your own personal data.

18.3. Right to rectification and erasure (Art. 16, 17 GDPR)

You have the right to obtain from us without undue delay the rectification and completion of inaccurate personal data concerning yourself.

You may also request the erasure of your personal data if any of the following applies to you:

- the personal data concerning you are no longer necessary for the purposes for which they were collected or otherwise processed;
- you withdraw consent on which the processing is based according to Art. 6 para. 1 s.1 lit. a) or Art. 9 para. 2 lit. a) GDPR, and where there is no other legal ground of processing;
- you object to the processing pursuant to Art. 21 para. 1 GDPR and there are no overriding legitimate grounds for the processing, or the you object to the processing pursuant to Art. 21 para. 2 GDPR;
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which we are subject;
- the personal data have been collected in relation to the offer of information society services referred to in Art. 8 para. 1.

Where we made the personal data public and are obliged to erase the personal data pursuant to Art. 17 para. 1 GDPR, we, taking account of available technology and the cost of implementation, shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that you have requested the erasure by such controllers of any links to, or copy or replication of, those personal data.

These rights shall not apply to the extent that processing is necessary:

- for exercising the right of freedom of expression and information;
- for compliance with a legal obligation which requires processing by Union or Member State law to which we are subject or for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
- for reasons of public interest in the area of public health in accordance of Art. 9 para. 2 lit. h) and i) as well as Art. 9 para. 3 GDPR;
- for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Art. 89 para. 1 GDPR, in so far as the right referred to above is likely to render impossible or seriously impair the achievement of the objectives of that processing, or
- for the establishment, exercise or defence of legal claims.

18.4. Right to restriction of processing (Art. 18 GDPR)

You shall have the right to obtain from us restriction of processing where one of the following applies:

- the accuracy of the personal data is contested by you, for a period enabling us to verify the accuracy of the personal data;
- the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
- we no longer need the personal data for the purposes of the processing, but they are required by you for the establishment, exercise or defence of legal claims;
- you have objected to processing pursuant to Art. 21 para. 1 GDPR pending the verification whether our legitimate grounds override yours.

Where processing has been restricted under the aforementioned conditions, such personal data shall, except for storage, only be processed with your consent or for the establishment, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of important public interest of the Union or of a Member State.

If the limitation of the processing is restricted, you will be informed by us before the restriction is lifted.

18.5. Right to information (Art. 19 GDPR)

If you have asserted us your right to rectification, erasure or restriction of data processing, we will inform all recipients of your personal data to correct, delete or restrict the processing of data, unless this proves impossible or involves disproportionate effort.

You also have the right to know which recipients have received your personal data.

18.6. Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data, which you provided to us, in a structured, commonly used and machine-readable format. Also, you have the right to transmit those data to another controller, where

- the processing is based on consent pursuant of Art. 6 para. 1 s.1 lit. a) GDPR or of Art. 9 para. 2 lit. a) GDPR or is based on a contract pursuant of Art. 6 para. 1 s. 1 lit. b) DS-GVO; and
- the processing is carried out by automated means.

In exercising your right to data portability, you have the right to obtain that personal data transmitted directly from us to another controller, as far as technically feasible. The right to data portability does not apply to processing of personal data necessary for the performance of a task carried out in the public interest or in the exercise of official authority that has been delegated to us.

18.7. Right to object (Art. 21 GDPR)

Where we based the processing of your personal data on a legitimate interest (Art. 6 para. 1 s. 1 lit. f) GDPR), you may object to the processing. The same applies if the data processing is based on Art. 6 para. 1 s. 1 lit. e).

In this case, we ask you to explain the reasons why we should not process your personal data. Based on this we will terminate or adapt the data processing or show you our legitimate reasons why we continue the data processing.

18.8. Right to lodge a complaint with supervisory authority (Art. 77 GDPR)

Without prejudice to any other administrative or judicial remedy, you shall have the right to complain to a supervisory authority, in particular in the Member State of your residence, place of work or place of alleged infringement, if you believe that the processing of the personal data concerning you is against the infringes of the GDPR.

The supervisory authority to which the complaint has been submitted shall inform you of the status and results of the complaint, including the possibility of a judicial remedy according to Article 78 GDPR.

To exercise these rights, please contact our data protection officer Kemal Webersohn from Webersohn & Scholtz GmbH:

staatstheater-nuernberg(a)ws-datenschutz.de

or by mail:
WS Datenschutz GmbH
Dircksenstraße 51
D-10178 Berlin

We reserve the right to change this privacy policy in compliance with legal requirements.