Data Protection

When you use this website, various personal data is collected. Personal data is data by which you can be personally identified. This privacy policy explains what data we collect and what we use it for. It also explains how and for what purpose this is done.
We would like to point out that data transmission on the Internet (e.g. when communicating by e-mail) can have security vulnerabilities. Complete protection of data against access by third parties is not possible.

1.1. Name and address of the responsible body

The responsible body for data processing on this website is:
Stiftung Staatstheater Nürnberg
Richard-Wagner-Platz 2–10
90443 Nuremberg
Telephone: +49-(0)911 / 66069-0
E-mail: info(a)staatstheater-nuernberg.de

1.2. Data Protection Officer

You can reach our data protection officer via the following contact details:
Stiftung Staatstheater Nürnberg
-Datenschutz-
Richard-Wagner Platz 2–10
90443 Nuremberg
Phone: +49-(0)911 / 66069-4867
E-mail: datenschutz(a)staatstheater-nuernberg.de

1.3. Storage period

Unless a more specific storage period is stated within this privacy policy, your personal data will remain with us until the purpose for processing the data no longer applies. If you assert a legitimate request for deletion or revoke consent for data processing, your data will be deleted unless we have other legally permissible reasons for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, the data will be deleted after these reasons cease to apply.

Insofar as we process your personal data, you as the concerned party have the following rights:

• You have the right to obtain information about the data stored about you (Art. 15 GDPR).
  
• If inaccurate personal data is processed, you have the right to rectification (Art. 16 GDPR).
  
• If the legal requirements are met, you may request erasure or restriction of processing, as well as object to processing (Art. 17, 18 and 21 GDPR).
  
• If you have consented to the processing or if there is a contract for data processing and the data processing is carried out with the help of automated procedures, you may have a right to data portability (Art. 20 GDPR).
  
• If you have consented to the processing and the processing is based on this consent, you can revoke the consent at any time for the future. The lawfulness of the data processing carried out on the basis of the consent until the revocation is not affected by it.
  

You have the right to object to the processing of your data at any time on grounds relating to your particular situation, if the processing is carried out exclusively on the basis of Art. 6 para. 1 letter e or f GDPR (Art. 21 para. 1 sentence 1 GDPR).

Right of appeal to the supervisory authority

Furthermore, there is a right of appeal to the Bavarian State Commissioner for Data Protection. You can reach this supervisory authority under the following contact details:

Postal address: P.O. Box 22 12 19, 80502 Munich
Address: Wagmüllerstraße 18, 80538 Munich
Telephone: 089 212672-0
Fax: 089 212672-50
E-mail: post office(a)datenschutz-bayern.de
Internet: www.datenschutz-bayern.de

Further information

For more detailed information on the processing of your data and your rights, you can contact us using the contact details given in point 1 above.

Many data processing operations can only be carried out with your explicit consent. You can revoke consent you have already given at any time. The legality of the data processing carried out until the revocation remains unaffected by the revocation.

If data processing is carried out on the basis of Art. 6 para. 1 lit. e or Art. 4 para. 1 of the Bavarian Data Protection Act, you have the right to object to the processing of your personal data at any time for reasons pertaining to your particular situation; this also applies to profiling based on these provisions, the respective legal basis on which processing is based can be found in this data protection declaration. If you object, we will no longer process your personal data concerned unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the purpose of asserting, exercising or defending legal claims (objection under Article 21 para. 1 GDPR).
If your personal data is processed for the purpose of direct marketing, you have the right to object at any time to the processing of personal data concerning you for the purpose of such marketing; this also applies to profiling insofar as it is related to such direct marketing. If you object, your personal data will subsequently no longer be used for the purpose of direct advertising (objection pursuant to Art. 21 para 2 GDPR).

We collect, process and use personal data only to the extent that it is necessary for the establishment, content or amendment of the legal relationship (inventory data). This is done on the basis of Art. 6 para. 1 lit. b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures. We collect, process and use personal data about the use of this website (usage data) only insofar as this is necessary to enable the user to use the service or to charge for it.
The collected customer data will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

If you order tickets online, we will subsequently inform you by e-mail about similar products (e.g. tickets for similar events). You will be informed of this separately as part of your order. You can object to the use of your e-mail address for this purpose at any time without incurring any costs other than the transmission costs according to the basic rates. The legal basis for the processing is Art. 6 para. 1 lit. f GDPR in conjunction with § 7 para. 3 UWG. The sending of these recommendation e-mails serves our legitimate interest in acquiring existing customers.

Among other things, tools from companies based in the USA are integrated on our website. If these tools are active, your personal data may be transferred to the US servers of the respective companies. We would like to point out that the USA is not a safe third country in the sense of EU data protection law. US companies are obliged to hand over personal data to security authorities with no legal recourse for you as a concerned party. It can therefore not be ruled out that US authorities (e.g. intelligence services) process, evaluate and permanently store your data located on US servers for monitoring purposes. We have no influence on these processing activities.

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the site operator, this site uses SSL or TLS encryption. You can identify an encrypted connection by the appearance of a lock symbol in your browser bar and the fact that the browser address bar changes from "http://" to "https://".
If SSL or TLS encryption is activated, the data you transmit to us cannot be read by third parties.

8.1. External hosting

This website is hosted by an external service provider (hoster). The personal data collected on this website is stored on the hoster's servers. This may include, but is not limited to, IP addresses, contact requests, meta and communication data, contractual data, contact details, names, website accesses and other data generated via a website.
. We use the following hoster:
noris network AG
Thomas-Mann-Strasse 16 - 20
90471 Nuremberg

8.2. Purpose of processing

The hoster is used for the purpose of contract fulfilment vis-à-vis our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online offer by a professional provider.

8.3. Legal basis

The legal basis for this processing is Art. 1 para. 4 of the Bavarian Data Protection Act.

8.4. Duration of storage

Our hoster will only process your data insofar as this is necessary for the fulfilment of their service obligations and follow our instructions with regard to this data.
CONCLUSION OF A CONTRACT ON ORDER PROCESSING
In order to ensure data protection-compliant processing, we have concluded a contract on commissioned processing with our hoster.

9.1. Description and scope of data processing

Each time our website is accessed, our system, i.e. the web server, automatically collects information from the system of the requesting computer or end device of the user.
. The following data is collected by us in this process:

• Information about the browser type and version used
  
• The operating system of the user's terminal
  .
• The user's Internet service provider
  
• The IP address of the user
  
• Date and time of the server request
  .

This data is not merged with other data sources.

9.2. Legal basis for data processing

The legal basis for the temporary storage of this data and the log files is Art. 4 Para. 1 of the Bavarian Data Protection Act.

9.3. Purpose of data processing

The temporary storage of the user's IP address by our system is necessary to enable delivery of the website to the user's terminal device. For this purpose, the user's IP address must necessarily remain stored for the duration of the session.
The storage of the above-mentioned data in the server log files takes place in order to ensure the functionality of our website.
In addition, we use this data to optimise the website and to ensure the security of our information technology systems (e.g. for attack detection). An evaluation of the data for marketing purposes does not take place in this context.

9.4. Duration of storage

The above-mentioned data will be deleted,
a) as soon as it is no longer required to achieve the purpose for which it was collected. This will be the case, in the event that data is collected for the purpose of providing access to the website, when the respective session has ended.
b) In the case of storage of data in log files, this is the case after 6 months at the latest. In this case, the IP address of the user is deleted or alienated by us, so that an assignment of the calling client is no longer possible and the data contained no longer shows any personal reference. Any statutory retention periods remain unaffected by this.

10.1. Description and scope of data processing without consent

When our website is accessed for the first time, the user is shown a "cookie" notice; until then, only the session ID cookie listed under a) is stored on the user's terminal device. A randomly generated unique identification number is stored in a session cookie. This session ID cookie does not receive any elements that allow a conclusion to be drawn about the person of the user and is also stored if you click on "Decline" in the case of "Cookie" notice.
a) Designation: "PHPSESSIONID"
Purpose: This session cookie is used to recognise the user anonymously. For example, to make it easier for you to log back in. Expiry time: End of session
Publisher: Us (through webhoster)

10.1.1. Legal basis for data processing

The legal basis for the processing of users' personal data is Art.4 para.1 of the Bavarian Data Protection Act.

10.2. Description and scope of data processing with consent

Only after the user has given us his consent by clicking on the "Accept" button will the cookies listed below be stored. The following cookies are used on this website after your consent:
. b) Designation: "_ga"
Purpose: Contains a randomly generated user ID. This ID allows Google Analytics to recognise returning users on this website and to merge data from previous visits.
Expiry time: End of session
Publisher: Google Analytics (see also point 13)
c) Name: "_gid"
Purpose: Contains a randomly generated user ID. This ID allows Google Analytics to recognise returning users on this website and to merge data from previous visits.
Expiry time: End of session
Publisher: Google Analytics (see also point 13)
d) Name: "_gat"
Purpose: Certain data is only sent to Google Analytics a maximum of once per minute. The cookie has a lifespan of one minute. As long as it is set, certain data transmissions are prevented.
Expiry time: End of session
Publisher: Google Analytics (see also point 13).

10.2.1. Legal basis for data processing

The legal basis for the processing of users' personal data is Art.6 para.1 lit. a) GDPR (consent).

10.3. Purpose of data processing

The processing of this data serves us to ensure the easiest possible use of the site for the user.

10.4. Duration of storage

The data stored in the cookies will be deleted as soon as it has reached its expiry date (see above) or the user deletes this data in the settings of his browser.

11.1. Description and scope of data processing

If you contact us by e-mail, telephone, fax or via the contact form, your enquiry including all personal data resulting from it (name, enquiry) will be stored and processed by us for the purpose of processing your request. We will not pass on this data without your consent.

11.2. Legal basis for data processing

The processing of this data is based on Art. 6 para. 1 lit. b GDPR if your request is related to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective processing of the enquiries addressed to us (Art. 4 para. 1 of the Bavarian Data Protection Act) or on your consent (Art. 6 para. 1 lit. a of the GDPR) if requested.

11.3. Purpose of data processing

The processing of this personal data is solely for the purpose of processing the contact.

11.4. Duration of storage

The data you send to us via contact requests will remain with us until you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies (e.g. after we have completed processing your request). Mandatory statutory provisions - especially statutory retention periods - remain unaffected.

If you would like to receive the newsletter offered on the website, we require an e-mail address from you as well as information that allows us to verify that you are the owner of the e-mail address provided and that you agree to receive the newsletter. No further data is collected or is collected only on a voluntary basis. We use this data exclusively for sending the requested information and do not pass it on to third parties.
The data entered in the newsletter registration form is processed exclusively on the basis of your consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent to the storage of the data, the email address and their use for sending the newsletter at any time, for example via the "unsubscribe" link in the newsletter. The legality of the data processing operations already carried out remains unaffected by the revocation.
The data you provide for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe from the newsletter. Data that has been stored by us for other purposes remains unaffected by this.
After you have unsubscribed from the newsletter distribution list, your e-mail address will be stored by us or the newsletter service provider in a blacklist, if necessary, in order to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 4 Para. 1 of the Bavarian data protection act). The storage in the blacklist is not subject to a time limit. You can object to the storage if your interests outweigh our legitimate interest.

12.1. Sendinblue

This website sends out newsletters using Sendinblue (formerly Newsletter2Go). The provider is Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany.
Sendinblue is a service with which, among other things, the sending of newsletters can be organised and analysed. The data you enter for the purpose of receiving the newsletter is stored on Sendinblue's servers in Germany. If you do not want Sendinblue to analyse your data, you must unsubscribe from the newsletter. For this purpose, we provide a corresponding link in every newsletter message. Furthermore, you can also unsubscribe directly on the website.

12.1.1. Data analysis by Sendinblue

With the help of Sendinblue, we are able to analyse our newsletter campaigns. For example, we can see whether a newsletter message was opened and which links, if any, were clicked. In this way, we can determine, among other things, which links were clicked on particularly often.
We can also see whether certain previously defined actions were carried out after opening/clicking (conversion rate). For example, we can see whether you have made a purchase after clicking on the newsletter.
Sendinblue also allows us to subdivide ("cluster") the newsletter recipients according to different categories. For example, newsletter recipients can be subdivided according to age, gender or place of residence. In this way, the newsletters can be better adapted to the respective target groups.
For detailed information on the functions of Sendinblue, please visit the following link: https://de.sendinblue.com/newsletter-software/.

12.2. Legal basis

The data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). You can revoke this consent at any time. The legality of the data processing operations already carried out remains unaffected by the revocation.

12.3. Duration of storage

The data you provide for the purpose of receiving the newsletter will be stored by us or the newsletter service provider until you unsubscribe from the newsletter and will be deleted from the newsletter distribution list after you unsubscribe from the newsletter. Data that has been stored by us for other purposes remains unaffected by this.
After you have unsubscribed from the newsletter distribution list, your e-mail address will be stored by us or the newsletter service provider in a blacklist, if necessary, in order to prevent future mailings. The data from the blacklist will only be used for this purpose and will not be merged with other data. This serves both your interest and our interest in complying with the legal requirements for sending newsletters (legitimate interest within the meaning of Art. 4 Para. 1 of the Bavarian data protection act). The storage in the blacklist is not subject to a time limit. You can object to the storage if your interests outweigh our legitimate interest.
For more details, please refer to the data protection information of Sendinblue at:
https://www.newsletter2go.de/datenschutz/
https://de.sendinblue.com/legal/privacypolicy/
https://www.newsletter2go.de/informationen-newsletter-empfaenger/

CONCLUSION OF A CONTRACT ON ORDER PROCESSING
We have entered into a contract with Sendinblue in which we require Sendinblue to protect our customers' data and not to disclose it to third parties.

13.1. Data processing through social networks

We maintain publicly accessible profiles on social networks. You can find the social networks we use below. Social networks such as Facebook, Twitter etc. can typically analyse your user behaviour extensively when you visit their website or a website with integrated social media content (e.g. like buttons or advertising banners). By visiting our social media presence, numerous data protection-relevant processing operations are triggered. Here are some of the details:
If you are logged into your social media account and visit our social media presence, the operator of the social media portal can assign this visit to your user account. However, your personal data may also be collected under certain circumstances if you are not logged in or do not have an account with the respective social media portal. In this case, this data collection takes place, for example, via cookies that are stored on your end device or by recording your IP address. With the help of the data collected this way, the operators of the social media portals can create user profiles in which your preferences and interests are stored. This way, you can be shown interest-based advertising inside and outside the respective social media presence. Provided you have an account with the respective social network, the interest-based advertising may be displayed on all devices on which you are logged in or have been logged in.
. Please also note that we are not able to track all processing procedures on the social media portals. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media portals. For details, please refer to the terms of use and data protection provisions of the respective social media portals.

13.2. Person responsible and assertion of rights

If you visit one of our social media sites (e.g. Facebook), we are jointly responsible with the operator of the social media platform for the data processing operations triggered during this visit. In principle, you can assert your rights (information, correction, deletion, restriction of processing, data portability and complaint) both vis-à-vis us and vis-à-vis the operator of the respective social media portal (e.g. vis-à-vis Facebook).
Please note that despite the joint responsibility with the social media portal operators, we do not have full control over the data processing operations of the social media portals. Our options are largely determined by the corporate policy of the respective provider.

13.3. Legal basis for data processing

Our social media appearances are designed to secure the broadest possible presence on the Internet. This is a legitimate interest within the meaning of Art.4 para.1 of the Bavarian Data Protection Act. The analysis processes initiated by the social networks may be based on different legal bases, which are to be stated by the operators of the social networks (e.g. consent within the meaning of Art. 6 para. 1 lit. a GDPR).

13.4. Purpose of data processing

The purpose of the processing is to present our website to the user in the most effective and interesting way possible.

13.5. Duration of storage

The data collected directly by us via the social media presence will be deleted from our systems as soon as the purpose for storing it no longer applies, you request us to delete it, revoke your consent to store it or the purpose for storing the data no longer applies. Stored cookies remain on your end device until you delete them. Mandatory legal provisions - especially retention periods - remain unaffected. We have no control over the storage period of your data, which is stored by the operators of the social networks for their own purposes. For details, please contact the operators of the social networks directly (e.g. see their privacy policy below.).

Further information on the purpose and scope of the data collection and its processing by the provider can be found in the data protection declarations of these providers communicated below. There you will also receive further information on your rights in this regard and setting options for protecting your privacy.
. Addresses of the respective providers and URL with their data protection notices:

a) Facebook
We have a profile on Facebook. The provider of this service is Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. According to Facebook, the data collected is also transferred to the USA and other third countries.
We have entered into a Joint Processing Agreement (Controller Addendum) with Facebook. This agreement specifies which data processing operations we or Facebook are accountable for when you visit our Facebook page. You can view this agreement at the following link: https://www.facebook.com/legal/terms/page_controller_addendum.
You can change your advertising settings by yourself in your user account. To do so, click on the following link and log in: https://www.facebook.com/settings?tab=ads.
For details, please refer to Facebook's privacy policy: https://www.facebook.com/about/privacy/.

b) Twitter
We use the short message service Twitter. The provider is Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. You can change your Twitter privacy settings by yourself in your user account. To do so, click on the following link and log in: https://twitter.com/personalization.
For details, please refer to Twitter's privacy policy: https://twitter.com/de/privacy.


c) Instagram
We have a profile on Instagram. The provider is Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. For details on how they handle your personal data, please refer to Instagram's privacy policy: https://help.instagram.com/519522125107875.

d) YouTube
We have a profile on YouTube. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. For details on how they handle your personal data, please refer to YouTube's privacy policy: https://policies.google.com/privacy?hl=de.

14.1. YouTube Videos

This website embeds videos from YouTube. The operator of the pages is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
We use YouTube in extended data protection mode. According to YouTube, this mode means that YouTube does not store any information about visitors to this website before they watch the video. However, the disclosure of data to YouTube partners is not necessarily excluded by the extended data protection mode. Thus, YouTube - irrespective of whether you watch a video - establishes a connection to the Google DoubleClick network.
As soon as you start a YouTube video on this website, a connection to YouTube's servers is established. This tells the YouTube server which of our pages you have visited. If you are logged into your YouTube account, you enable YouTube to assign your surfing behaviour directly to your personal profile. You can prevent this by logging out of your YouTube account. Furthermore, after starting a video, YouTube may save various cookies on your end device or use comparable recognition technologies (e.g. device fingerprinting). In this way, YouTube can obtain information about visitors to this website. This information is used, among other things, to collect video statistics, improve the user experience and prevent fraud attempts.
. If applicable, further data processing operations may be triggered after the start of a YouTube video, over which we have no control.
For more information about privacy practices at YouTube, please see their privacy policy at: https://policies.google.com/privacy?hl=de.

14.2. Soundcloud

Plugins of the social network SoundCloud (SoundCloud Limited, Berners House, 47-48 Berners Street, London W1T 3NF, United Kingdom.) may be integrated on this website. You can recognise the SoundCloud plugins by the SoundCloud logo on the pages concerned.
When you visit this website, a direct connection is established between your browser and the SoundCloud server after the plugin is activated. SoundCloud thereby receives the information that you have visited this website with your IP address. If you click the "Like" or "Share" button while logged into your SoundCloud user account, you can link and/or share the content of this website with your SoundCloud profile. This enables SoundCloud to associate your visit to this website with your user account.
We would like to point out that we, as the provider of the pages, have no knowledge of the content of the transmitted data or its use by SoundCloud. If you do not wish SoundCloud to associate your visit to this website with your SoundCloud user account, please log out of your SoundCloud user account before activating any content of the SoundCloud plugin.

14.3. Legal basis for data processing

The storage and analysis of the data is based on Art. 4 para. 1 of the Bavarian Data Protection Act.

14.4. Purpose of data processing

The website operator has a legitimate interest in ensuring the widest possible exposure in social media.

14.5. Duration of storage

If a corresponding consent has been requested (e.g. a consent to store cookies), the processing is carried out exclusively on the basis of Art. 6 para. 1 lit. a GDPR; the consent can be revoked at any time. For more information, please see SoundCloud's privacy policy at: https://soundcloud.com/pages/privacy.

This website uses functions of the web analysis service Google Analytics. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland.
Google Analytics enables the website operator to analyse the behaviour of website visitors. In doing so, the website operator receives various usage data, such as page views, length of stay, operating systems used and the origin of the user. This data may be summarised by Google in a profile that is assigned to the respective user or his or her terminal device.
Google Analytics uses technologies that enable the recognition of the user for the purpose of analysing user behaviour (e.g. cookies or device fingerprinting). The information collected by Google about the use of this website is generally transferred to a Google server in the USA and stored there. The data transfer to the USA is based on the standard contractual clauses of the EU Commission. For details, click here: https://privacy.google.com/businesses/controllerterms/mccs/.
IP ANONYMISATION
We have activated the IP anonymisation function on this website. This means that your IP address is truncated by Google within member states of the European Union or in other contracting states to the Agreement on the European Economic Area before being transmitted to the USA. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and truncated there. On behalf of the operator of this website, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity and providing other services relating to website activity and internet usage to the website operator. The IP address transmitted by your browser as part of Google Analytics will not be merged with any other data collected by Google. BROWSER PLUGIN
You can prevent Google from collecting and processing your data simply by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout?hl=de.
For more information on how Google Analytics handles user data, please see Google's privacy policy: https://support.google.com/analytics/answer/6004245?hl=de.
ORDER PROCESSING
We have concluded an order processing contract with Google and fully implement the strict requirements of the German data protection authorities when using Google Analytics.
DEMOGRAPHIC FEATURES WITH GOOGLE ANALYTICS
This website uses the "demographic characteristics" feature of Google Analytics in order to display suitable advertisements to website visitors within the Google advertising network. This allows reports to be generated that contain statements about the age, gender and interests of site visitors. This data comes from interest-based advertising from Google as well as visitor data from third-party providers. This data cannot be assigned to a specific person. You can deactivate this function at any time via the ad settings in your Google account or generally prohibit the collection of your data by Google Analytics as shown in the item "Objection to data collection".

15.1. Legal basis for data processing

The use of this analysis tool is based on Art. 4 Para. 1 of the Bavarian Data Protection Act. The website operator has a legitimate interest in analysing user behaviour in order to optimise both the website service and its advertising.

15.2. Purpose of data processing

Processing the user's personal data with the help of Google Analytics enables us to analyse the surfing behaviour of our users. By evaluating the data obtained, we are able to compile information on the use of the individual components of our website. This helps us to constantly improve our own website and its user-friendliness.

15.3. Duration of storage

Data stored by Google at user and event level that is linked to cookies, user identifiers (e.g. User ID) or advertising IDs (e.g. DoubleClick cookies, Android advertising ID) will be anonymised or deleted after 14 months. For details, please see the following link: https://support.google.com/analytics/answer/7667196?hl=de.

15.4. Opt-out option

With the help of a browser add-on to deactivate Google Analytics JavaScripts (ga.js, analytics.js, dc.js), the user can prevent Google Analytics from using their data on our website. If the user wishes to deactivate Google Analytics, he or she can download and install the add-on for his or her own web browser. The add-on for deactivating Google Analytics is compatible with the current versions of Chrome, Internet Explorer, Safari, Firefox and Opera. For the add-on to work, it must be loaded and executed correctly in the browser. For Internet Explorer, third-party cookies must also be activated. Those interested can find more information under the following link: https://tools.google.com/dlpage/gaoptout?hl=de.

We use the map service Google Maps. The provider is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. To use the functions of Google Maps, it is necessary to store your IP address. This information is usually transferred to a Google server in the USA and stored there. The provider of this site has no control over this data transmission.
For more information on the handling of user data, please see Google's privacy policy: https://policies.google.com/privacy?hl=de.

16.1. Legal basis for data processing

The legal basis for the processing of users' personal data is Art. 4 Para. 1 of the Bavarian Data Protection Act.

16.2. Purpose of data processing

Google Maps is used in the interest of an appealing presentation of our online offers and easy location of the places indicated by us on the website.

16.3. Duration of storage

The above-mentioned data (see point 8) will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. This will be the case, in the event that data is collected for the purpose of providing access to the website, when the respective session has ended.

The VGN timetable information service is a service provided by Verkehrsverbund Großraum Nürnberg GmbH (VGN GmbH), Rothenburger Straße 9, 90443 Nuremberg, telephone 0911 270750, e-mail: info(a)vgn.de, Internet: www.vgn.de.
By integrating the service on this website, data such as the IP address, the browser, the website just visited, cookies of the VGN website stored with the user are transmitted to VGN GmbH. The further processing or storage of this data is carried out by VGN GmbH in the manner described in its data protection declaration. You can prevent the storage of cookies by setting your browser software accordingly. However, VGN GmbH would like to point out that in this case you may not be able to use all functions to their full extent. There will be no evaluation using VGN GmbH's analysis tools.
Link to VGN-DSE: https://vgn.de/datenschutz/

17.1. Legal basis for data processing

The legal basis for the processing of users' personal data is Art. 4 para. 1 of the Bavarian Data Protection Act.

17.2. Purpose of data processing

The integration of the VGN timetable information is in the interest of an appealing illustration of our online offers, as well as the comfortable and easy accessibility to the timetable information of the public transport.

17.3. Duration of storage

The above-mentioned data (see point 8) will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. This will be the case, in the event that data is collected for the purpose of providing access to the website, when the respective session has ended.

You have the opportunity to apply for a job with us (e.g. by e-mail or post). In the following, we inform you about the scope, purpose and use of your personal data collected as part of the application process. We assure you that the collection, processing and use of your data will be carried out in accordance with applicable data protection law and all other legal provisions and that your data will be treated in strict confidence.

18.1. Legal basis for data processing

The legal basis for the processing of data is Art. 6 para. 1 lit.b) GDPR (performance of a contract), as the provision of your application data is necessary for the performance of the contract or for the implementation of pre-contractual measures.

18.2. Purpose of data processing

If you send us an application, we process your associated personal data (e.g. contact and communication data, application documents, notes taken during interviews, etc.) to the extent that this is necessary to decide whether or not to establish an employment relationship. The legal basis for this is § 26 of the new Federal Data Protection Act under German law (initiation of an employment relationship), Art. 6 para. 1 lit. b) GDPR (general contract initiation) and - if you have given your consent - Art. 6 para. 1 lit. a) GDPR. The consent can be revoked at any time. Your personal data will only be passed on within our company to persons who are involved in processing your application.
If the application is successful, the data you submitted will be stored in our data processing systems on the basis of § 26 of new Federal Data Protection Act and Article 6 para. 1 lit. b GDPR for the purpose of implementing the employment relationship.

18.3. Duration of storage

The above data will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. This applies to data for the fulfilment of a proper applicant procedure or for the implementation of pre-contractual measures in the event that the data is no longer required for the implementation of the applicant procedure.
If the user/applicant has consented, his/her personal data which he/she has provided in the course of the entire application process (for example in cover letters, CVs, certificates, applicant questionnaires, applicant interviews, etc.) will be stored beyond the end of the specific application process, but for no longer than 6 months.
If the user/applicant has provided "special categories of personal data" in accordance with Art. 9 of the General Data Protection Regulation in his/her application documents or other documents submitted by him/her in the application procedure via the participation form (e.g. a photo that reveals ethnic origin, information on severely disabled status, etc.), his/her consent also pertains to this data.
However, the Stiftung Staatstheater Nürnberg would like to evaluate all applicants only according to their qualifications and therefore asks that such information be omitted from the application if possible.
This consent also applies to data about your qualifications and activities from generally accessible data sources (in particular professional social networks) that the Stiftung Staatstheater Nürnberg has permissibly collected as part of the application process.
Furthermore, it may be necessary to store personal data of the user/applicant in order to comply with contractual or legal obligations (e.g. tax retention obligation).
If we are unable to make you a job offer, if you reject a job offer or withdraw your application, we reserve the right to store the data you have submitted for up to 6 months from the end of the application process (rejection or withdrawal of the application) on the basis of our legitimate interests (Art. 4 Para. 1 of the Bavarian Data Protection Act). The data will then be deleted and the physical application documents destroyed. This storage serves especially for purposes of proof in the event of a legal dispute. If it is evident that the data will be required after the 6-month period has expired (e.g. due to a threatened or pending legal dispute), the data will only be deleted when the purpose for continued retention no longer applies.
Longer storage may also take place if you have given your consent (Art. 6 para. 1 lit. a GDPR) or if legal storage obligations prevent deletion.

If you would like to order entry tickets in our webshop, it is necessary for the conclusion of the contract that you create a customer account in which you enter your personal data, which we require for the purchase transaction. Mandatory information required for the purchase transaction is marked with an asterisk (*), other information is optional.

19.1. Processing of data (customer and contract data)

We collect, process and use personal data only to the extent that it is necessary for the establishment, content or amendment of the legal relationship (inventory data). This is done on the basis of Art. 6 para. 1 lit. b GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.

19.2. Data transfer upon conclusion of a contract

We only transmit personal data to third parties if this is necessary within the framework of the contract processing, for example to the companies entrusted with the delivery of the goods or to the credit institution entrusted with the payment processing. Further transmission of data does not take place or only if you have explicitly agreed to the transmission. Your data will not be passed on to third parties without your explicit consent, for example for advertising purposes. The basis for data processing is Art. 6 para. 1 lit. b) GDPR, which permits the processing of data for the fulfilment of a contract or pre-contractual measures.

19.3. Legal basis for data processing

The legal basis for the processing of customers' personal data is Art. 6 para. 1 p. 1 lit. b) GDPR.

19.4. Purpose of data processing

We process the data you provide only for the purpose of processing your order. For this purpose, it may be necessary for us to transmit your payment data to our financial service providers (see point 19).

19.5. Duration of storage

We collect, process and use personal data concerning the use of this website (usage data) only to the extent necessary to enable the user to use the service or to charge for it. The collected customer data will be deleted after completion of the order or termination of the business relationship. Statutory retention periods remain unaffected.

During the purchase process in the webshop, you have the option of printing out your entry tickets on paper at home. In order to use this service, it is necessary for you to enter your date of birth in addition to your first and last name. This enables us to check the validity of the entry tickets at the entrance.

20.1. Legal basis for data processing

The processing of personal data in the Print@Home procedure is based on Art. 6 para. 1 lit. b) GDPR (contract processing) as well as in the interest of a smooth, convenient and secure payment process (Art. 4 para. 1 of the Bavarian data protection act). Insofar as your consent is requested for certain actions, Art. 6 para. 1 lit. a) GDPR is the legal basis for the data processing; consents can be revoked at any time for the future.

20.2. Purpose of data processing

Our Print@Home offer serves the purpose of providing a convenient and simple use of the webshop as well as for the proper fulfilment of the contract.

20.3. Duration of storage

The above-mentioned data (see point 20) will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. Statutory retention periods remain unaffected by this.

We integrate payment services from third-party companies on our website. When you make a purchase from us, your payment details (e.g. name, payment amount, account details, credit card number) are processed by the payment service provider for the purpose of processing the payment. The respective contract and data protection provisions of the respective providers apply to these transactions.
We deploy the following payment services / payment service providers within the scope of this website:
a) TeleCash (https://www.telecash.de/datenschutz/)
b) Visa (https://www.visa.de/nutzungsbedingungen/visa-privacy-center.html)
c) Mastercard (https://www.mastercard.de/de-de/datenschutz.html)

21.1. Legal basis for data processing

The payment service providers are used on the basis of Art. 6 para. 1 lit. b) GDPR (contract processing) and in the interest of the smoothest, most convenient and secure payment process possible (Art. 4 para. 1 of the Bavarian data protection act). Insofar as your consent is requested for certain actions, Art. 6 para. 1 lit. a) GDPR is the legal basis for the data processing; consents can be revoked at any time for the future.

21.2. Purpose of data processing

We process the data you provide only for the purpose of processing your order. For this purpose, it may be necessary for us to transmit your payment data to our financial service providers (see point 21).

21.3. Duration of storage

The above-mentioned data (see point 21) will be deleted as soon as it is no longer required to fulfil the purpose for which it was collected. Statutory retention periods remain unaffected by this.

We only pass on the data we have collected if it is necessary for the fulfilment of the contract or for the provision of the technical functionality of the website, or if there is another legal basis for passing on the data.
If we pass on data to service providers, they are permitted to use the data exclusively for the fulfilment of their tasks. The service providers have been carefully selected and commissioned by us. They are contractually bound to our instructions, have appropriate technical and organisational measures in place to protect the rights of the concerned party and are regularly monitored by us.

Commissioned data processors:

a) Napsys GmbH & Co. KG
Purpose: Web design and technical implementation

c) CTS Eventim AG & Co. KGaA
Purpose: Technical services for ticket sales

d) noris network
Purpose: Server hosting

e) Sendinblue GmbH
Purpose: Newsletter services

f) Google Analytics
Purpose: Reach measurement

In order to ensure that our data protection information always complies with the current legal requirements, we reserve the right to make changes at any time. This also applies in the event that the data protection declaration has to be adapted due to new or revised services, for example new services. The new data protection statement will then apply the next time you visit our website.