Website Privacy Policy

1. Data Protection, Data Controller and Data Protection Officer

Below, we provide information on the collection of personal data when you use our website. Personal data refers to any data that can be linked to you personally, e.g. name, address, email addresses and user behaviour.

This privacy notice explains what data we collect and what we use it for. It also explains how and for what purpose this is done.

Please note that data transmission over the internet (e.g. when communicating by email) may be subject to security vulnerabilities. It is not possible to guarantee complete protection of data against access by third parties.

Unless a more specific retention period is stated in this privacy notice, your personal data will remain with us until the purpose for which it is processed no longer applies. If you make a valid request for erasure or withdraw your consent to data processing, your data will be erased, provided we have no other legally permissible grounds for storing your personal data (e.g. retention periods under tax or commercial law); in the latter case, erasure will take place once these grounds no longer apply.

The controller responsible for the processing of your personal data via this website is the
Hessian Cultural Foundation 
Eva Claudia Scholtz (Executive Director)
Prof. Dr Andreas Dombret (Chairman of the Board)
State Secretary Christoph Degen (Deputy Chair of the Board) 
Luisenstrasse 3 HH 
65185 Wiesbaden 
Tel: +49 611 585 343 41
Email: info@hkst.de
You can contact our Data Protection Officer at datenschutz@hkst.de.

1. General information and mandatory details

   1. SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, such as orders or enquiries that you send to us as the website operator, this site uses SSL or TLS encryption. You can recognise an encrypted connection by the fact that the address bar of your browser changes from ‘http://’ to ‘https://’ and by the padlock symbol in your browser bar.

When SSL or TLS encryption is enabled, the data you send to us cannot be read by third parties.

1. External hosting

This website is hosted by an external service provider (host). The personal data collected on this website is stored on the host’s servers. This may primarily include IP addresses, contact enquiries, meta and communication data, contractual data, contact details, names, website visits and other data generated via a website.

The use of the hosting provider is for the purpose of fulfilling our contractual obligations towards our potential and existing customers (Article 6(1)(b) of the GDPR) and in the interest of ensuring the secure, fast and efficient provision of our online services by a professional provider (Article 6(1)(f) of the GDPR). Our hosting provider will only process your data to the extent necessary to fulfil its service obligations and will follow our instructions regarding this data.

We host the content of our website with the following provider: 

Comtrance Service GmbH
In der Steele 35
40559 Düsseldorf

Further details can be found in the following privacy policy: https://www.comtrance.net

We have entered into a data processing agreement (DPA) for the use of the above-mentioned service. This is a contract required under data protection law, which ensures that our service provider processes the personal data of our website visitors only in accordance with our instructions and in compliance with the GDPR.

1. Data collection on our website

   1. Enquiries by email or telephone

If you contact us by email or telephone, your enquiry, including all personal data contained therein (name, enquiry, email address), will be stored and processed by us for the purpose of dealing with your request. We will not pass on this data without your consent. The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures (e.g. booking tickets on account). In all other cases, the processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), provided that this has been requested; consent may be withdrawn at any time.

The data you send to us via contact enquiries will be retained by us until you request its deletion, withdraw your consent to its storage, or the purpose for which the data is stored no longer applies (e.g. once your enquiry has been dealt with). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

1. Enquiries by email or telephone 

If you contact us by email or telephone, your enquiry – including all personal data contained therein (name, email address, content of the enquiry) – will be stored and processed by us for the purpose of dealing with your enquiry. We will not pass on this data without your consent.

Processing is carried out on the basis of Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), provided that such consent has been sought; consent may be withdrawn at any time.

The data you send to us via contact enquiries will be retained by us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been fully processed). Mandatory legal provisions – in particular statutory retention periods – remain unaffected.

1. Contact form 

If you send us enquiries via the contact form, the details you provide in the enquiry form – including the contact details you specify there (salutation, first name, surname, title, email address, postal address) – will be stored by us for the purpose of processing your enquiry and in the event of any follow-up questions. We will not pass on this data without your consent.

The processing of this data is based on Article 6(1)(b) of the GDPR, provided that your enquiry relates to the performance of a contract or is necessary for the implementation of pre-contractual measures. In all other cases, processing is based on our legitimate interest in the effective handling of enquiries addressed to us (Article 6(1)(f) of the GDPR) or on your consent (Article 6(1)(a) of the GDPR), provided that such consent has been sought; consent may be withdrawn at any time.

The data you enter in the contact form will be retained by us until you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies (e.g. once your enquiry has been fully processed). Mandatory legal provisions – in particular retention periods – remain unaffected.

1. Analytics tool

   1. Tracking tool

The tracking measure listed below and used by us serves to ensure that our website is designed to meet your needs and is continuously optimised. Furthermore, we use these analytics measures to statistically record the use of our website and to evaluate this data for the purpose of optimising our offering for you. 

1. Matomo

On this website, we use the open-source software Matomo, a service provided by InnoCraft Ltd, 150 Willis St, 6011 Wellington, New Zealand, NZBN 6106769. 

In particular, the following data is collected: information on pages accessed, the time and duration of the visit, entry and exit pages, downloads, the source of the visit, the type of device used, and the country of origin.

We operate Matomo on servers located within the European Union. The data collected in this process is not transmitted to Matomo or other analytics providers.

The analysis is carried out without the use of analytics cookies. IP addresses are anonymised and not stored in full. Visitors are not identified on a personal or cross-device basis. Further information on Matomo’s terms of use and data protection regulations can be found at: https://matomo.org/privacy/. 

The legal basis for the processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in statistically analysing the use of our website in order to further develop the information provided in line with user needs and to improve the user-friendliness and technical quality of our website.

Detailed visitor data is deleted after 365 days at the latest. Aggregated statistical analyses are retained for five years.

1. Ordering publications

You can use our website to order our annual reports and the maecenas magazine free of charge for delivery by post. To this end, we process the personal data you provide in the relevant order form, in particular your name, address, email address and, where applicable, your title, academic qualifications and details of your institution or company.

The processing is carried out solely for the purpose of processing your order, sending the requested publications by post and, in the case of a subscription, managing it.

The legal basis is Article 6(1)(b) of the GDPR, insofar as the processing is necessary for the performance of a contract, or Article 6(1)(a) of the GDPR, insofar as the dispatch is based on your consent. You may withdraw any consent you have given at any time with effect for the future.

Where necessary for dispatch, your address details will be passed on to contracted delivery service providers.

Your data will be deleted as soon as it is no longer required for the purposes stated, in particular following the completion of an individual order or the termination of a subscription, provided that there are no statutory retention obligations to the contrary.

1. Social media

   1. General information

Our social media presence is designed to ensure as comprehensive an online presence as possible. We aim to communicate with our visitors and keep them informed about exhibitions and news. The specific social media platforms used are listed below.

Social networks such as Facebook, Instagram, etc. can generally analyse your user behaviour in detail when you visit their website or a website featuring integrated social media content (e.g. ‘Like’ buttons or advertising banners). Visiting our social media pages triggers numerous data processing operations relevant to data protection. Specifically: 

If you are logged into your social media account and visit our social media presence, the operator of the social media portal may associate this visit with your user account. However, your personal data may also be collected even if you are not logged in or do not have an account with the relevant social media portal. In this case, data is collected, for example, via cookies stored on your device or by recording your IP address.

Using the data collected in this way, the operators of social media platforms can create user profiles that record your preferences and interests. In this way, interest-based advertising may be displayed to you both on and off the respective social media platform. If you have an account with the relevant social network, interest-based advertising may be displayed on all devices on which you are logged in or have previously been logged in. 

Please also note that we are not able to track all data processing activities on social media platforms. Depending on the provider, further processing operations may therefore be carried out by the operators of the social media platforms. You can find details on this in the terms of use and privacy policies of the respective social media platforms. 

Legal basis 

Our social media presence is intended to ensure as comprehensive an online presence as possible. This constitutes a legitimate interest on our part within the meaning of Article 6(1)(f) of the GDPR. The analysis processes initiated by the social networks may be based on different legal grounds, which must be specified by the operators of the social networks (e.g. consent within the meaning of Article 6(1)(a) of the GDPR). 

Data controller and exercising your rights 

When you visit one of our social media pages (e.g. Facebook), we are jointly responsible with the operators of the social media platform for the data processing operations triggered by that visit. You may, in principle, exercise your rights (right of access, rectification, erasure, restriction of processing, data portability and the right to lodge a complaint) both against us and against the operator of the relevant social media portal (e.g. against Facebook). 

Please note that, despite our joint responsibility with the social media portal operators, we do not have full control over the data processing operations carried out by the social media portals. Our options depend largely on the corporate policy of the respective provider.

Retention period 

Data collected directly by us via our social media presence will be deleted from our systems as soon as you request its deletion, withdraw your consent to its storage, or the purpose for storing the data no longer applies. Stored cookies remain on your device until you delete them. Mandatory legal provisions – in particular retention periods – remain unaffected. 

We have no influence over the retention period of your data stored by the operators of social networks for their own purposes. For further details, please contact the operators of the social networks directly (e.g. in their privacy policy, see below). 

Your rights 

You have the right at any time to obtain, free of charge, information about the origin, recipients and purpose of your stored personal data. You also have the right to object, the right to data portability and the right to lodge a complaint with the relevant supervisory authority. Furthermore, you may request the rectification, restriction, erasure and, under certain circumstances, the restriction of the processing of your personal data. 

1. Facebook Fan Page

We operate a Facebook fan page to provide information about our services, activities and news, and to communicate with interested parties. The provider of the social network is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (‘Meta’).

When you visit our Facebook page, Meta processes personal data, in particular profile, usage, device and interaction data, as well as IP addresses where applicable. This may also occur if you are not logged into Facebook or do not have a Facebook account. Further information on data processing can be found in Meta’s Privacy Policy.

Page statistics and joint responsibility

Meta provides us with aggregated statistical analyses of the use of our Facebook page (known as ‘Page Insights’). These enable us to evaluate the reach and interactions with our content and to improve our public relations work. The statistics provided do not allow us to identify individual persons.

We are jointly responsible with Meta for the processing of personal data in connection with Page Insights, in accordance with Article 26 of the GDPR. The respective responsibilities are set out in the joint controller agreement. In particular, Meta assumes primary responsibility for fulfilling the data protection information obligations and for handling data subjects’ enquiries regarding the processing of Page Insights. However, you may also exercise your rights by contacting us.

The legal basis for our processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in public relations work and the analysis and optimisation of our Facebook presence.

Communication and data transfer

If you contact us via Facebook or interact with our posts, we process the personal data transmitted in the process to handle your enquiry and for communication purposes. The legal basis is Article 6(1)(f) of the GDPR or, in the case of contract-related enquiries, Article 6(1)(b) of the GDPR.

Meta may also process personal data outside the European Union, in particular in the USA. Where the conditions are met, such data transfers may be based on the European Commission’s adequacy decision regarding the EU-US Data Privacy Framework or on appropriate safeguards, in particular EU Standard Contractual Clauses.

Further information on data processing, data subjects’ rights and your privacy settings can be found in Meta’s Privacy Policy.

1. Instagram 

We have a profile on Instagram. The provider of this service is Meta Platforms Ireland Limited (“Meta”), Merrion Road, Dublin 4, D04 X2K5, Ireland. 

When you visit the platform, your profile information and details of your visit are primarily processed by Meta. Data is also processed in this context even if you do not have an Instagram account or are not logged in. 

You can find further information on this in Instagram’s privacy policy at: https://help.instagram.com/519522125107875. 

We process the data of visitors to our profile, in particular information about user interactions (e.g. likes and comments), public profile information, demographic and statistical data, and the data sent to us via messages and comments.

We use the analytics feature to learn more about visitors to our profile. Demographic and statistical data provided as part of so-called ‘Insights’ help us to tailor our content to the relevant target audience. For us, this constitutes aggregated data; we are unable to link it to specific individuals. 

Instagram and we are jointly responsible for the processing of this data in accordance with Article 26 of the GDPR. We have therefore entered into a joint controller agreement (Joint Controller Addendum) with Meta. 

The agreement is limited exclusively to the collection of data and its transfer to Facebook. Any processing carried out by Facebook following the transfer is not part of the joint responsibility. The obligations incumbent upon us jointly have been set out in the agreement and can be viewed via the following link: https://www.facebook.com/legal/controller_addendum.  

Data transfers to the USA are based on the EU-US Data Privacy Framework and/or the European Commission’s Standard Contractual Clauses. Further details can be found here: https://www.facebook.com/legal/EU_data_transfer_addendum and https://de-de.facebook.com/help/566994660333381.

1. LinkedIn

We maintain a company profile on LinkedIn, a service provided by LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (“LinkedIn”). Our profile is used to present our company, communicate with interested parties, provide information about news and events, and publish job vacancies.

When you visit our LinkedIn profile, LinkedIn processes personal data, in particular profile, usage, device and interaction data. This may also include IP addresses, location information and information about usage behaviour. Data processing is carried out by LinkedIn in accordance with its own privacy policy. Further information, in particular regarding the purposes, legal bases, retention periods and possible data transfers to third countries, can be found in LinkedIn’s privacy policy.

Page statistics and joint controllership

LinkedIn provides us with aggregated statistics on the use of our company profile (known as ‘Page Insights’). These enable us to analyse the reach and interactions with our content and to improve our offering. We do not receive any personal data that could be used to identify individual users.

We are jointly responsible with LinkedIn for the processing of personal data used to compile these statistics, in accordance with Article 26 of the GDPR. The relevant joint controller agreement sets out the respective responsibilities. In particular, LinkedIn is responsible for fulfilling the information obligations under data protection law and for the handling of data subjects’ enquiries. However, you may also exercise your rights by contacting us.

The legal basis for our processing is Article 6(1)(f) of the GDPR. Our legitimate interest lies in public relations work and the analysis and optimisation of our company profile.

Communication and job applications

If you contact us via LinkedIn or interact with our posts, we process the personal data transmitted in the process for the purposes of communication and handling your enquiry. The legal basis is Article 6(1)(f) of the GDPR or, insofar as the communication serves to initiate or perform a contract, Article 6(1)(b) of the GDPR.

In the case of job applications via LinkedIn, we process the personal data provided to carry out the application process on the basis of Article 6(1)(b) of the GDPR. In addition, our privacy notice for applicants applies.

Further information on data processing by LinkedIn, as well as your rights and settings options, can be found in LinkedIn’s privacy policy at https://www.linkedin.com/legal/privacy-policy.

1. Applications 

   1. Travel and Residency Grants

You have the opportunity to apply to the Hessian Cultural Foundation for a travel or residency grant. Applications are made via our online application portal, which you can access via the relevant link on our website.

As part of the application process, we process the personal data you provide. This includes, in particular, personal and contact details, information about your artistic career and your proposed project, as well as the application documents and attachments you submit, such as project descriptions, portfolios, images or video material, and any required supporting documents.

Purposes and legal bases for processing

We process your personal data in order to receive your application, check that you meet the application criteria, conduct the selection process and decide on the award of a scholarship.

The processing is carried out in accordance with Article 6(1)(b) of the GDPR for the purpose of taking pre-contractual measures at your request. If you are awarded a scholarship, we will also process the data required to prepare and implement the scholarship agreement on this basis.

Where we process personal data to fulfil legal obligations, this is done on the basis of Article 6(1)(c) of the GDPR. Further processing, in particular for the statistical analysis of the volume of applications, for maintaining contact or in relation to the contact persons you have named, may take place on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR, provided that the relevant legal requirements are met.

Without the information and documents required for the application process, we cannot process your application or make a decision on the award of a scholarship.

Recipients of your data

Your application data will only be made available to those persons and bodies who require it for the purposes of conducting the application and selection process or for the administration of a scholarship. This may include, in particular, staff of the Hessian Cultural Foundation, jury members, assessors, insurance companies, tax advisers, solicitors, public authorities, as well as appointed service providers and data processors.

Where we use an external application portal, personal data is processed by the relevant service provider on our behalf. Data processing for the application and selection process takes place within the European Union.

Information relating to other individuals

As part of your application, you may also provide personal data relating to third parties, such as contact persons or fellow travellers. In this context, we process, in particular, their contact details to the extent necessary for processing your application and administering the scholarship. We receive this data from you as the applicant. The information set out above applies accordingly to this processing.

Retention period

Data stored on the application portal but not submitted as an application, including the associated login details, will be deleted two weeks after the application deadline.

Applications that do not result in the award of a scholarship will be deleted once the funding decision has been announced.

In the case of successful applications, further storage is governed by the requirements for the implementation and administration of the scholarship, as well as statutory retention obligations, in particular in accordance with Section 147 of the German Fiscal Code (AO) and Section 257 of the German Commercial Code (HGB). The respective retention periods depend on the type of documents. Personal data will be deleted as soon as it is no longer required for the stated purposes and there are no statutory retention obligations or other legal grounds preventing its deletion.

1. Applications for positions at the Hessian Cultural Foundation

You have the option of applying to the Hessian Cultural Foundation for advertised vacancies or submitting a speculative application. As part of the application process, we process the personal data you provide, in particular your personal and contact details, information on your professional qualifications and career history, as well as application documents such as a cover letter, CV and certificates.

Purposes and legal bases for processing

We process your personal data for the purposes of receiving and assessing your application, conducting the selection process, and deciding whether to enter into an employment relationship.

The legal basis is Article 6(1)(b) of the GDPR (implementation of pre-contractual measures). Where processing is necessary to comply with legal obligations, it is carried out on the basis of Article 6(1)(c) of the GDPR. Any further processing, such as inclusion in a candidate pool, will only take place if there is a separate legal basis for this, in particular your consent in accordance with Article 6(1)(a) of the GDPR.

Without the information required for the application process, we may not be able to consider your application.

Recipients of your data

Your application data will be made available exclusively to those persons involved in the application and selection process. This includes, in particular, the relevant staff and decision-makers at the Hessian Cultural Foundation, as well as any service providers and data processors engaged where necessary.

Retention period

If no employment relationship is established, your application data will be deleted no later than six months after the conclusion of the application process, provided that no statutory retention obligations or other legal grounds prevent such deletion.

If your application is successful, the data required for the employment relationship will be transferred to your personnel file and processed in accordance with the applicable statutory and company retention policies.

Where you have given separate consent to the longer-term storage of your application documents, for example for future job vacancies, this is carried out on the basis of your consent. You may withdraw your consent at any time with effect for the future.

1. Disclosure of personal data & legal bases

   1. Legal bases

We will only disclose your personal data to third parties to the extent that this is necessary to achieve our purposes and at least one of the following legal bases applies:

• you have expressly given your consent to this in accordance with Article 6(1)(a) of the GDPR,
• it is permitted by law and necessary for the performance of a contract in accordance with Article 6(1)(b) of the GDPR,
• where there is a legal obligation to disclose the data under Article 6(1)(c) of the GDPR, 
• it is necessary, in accordance with Article 6(1)(e) of the GDPR, for the performance of a task carried out in the public interest or in the exercise of official authority, or
• the disclosure is necessary pursuant to Article 6(1)(f) of the GDPR to safeguard our legitimate interests, provided that your interests, fundamental rights and freedoms, which require the protection of your personal data, do not override those interests.

1. Data subjects’ rights

You have the right to

• pursuant to Article 15 of the GDPR, to request information about your personal data processed by us. In particular, you may request information regarding the purposes of processing, the categories of personal data, the categories of recipients to whom your data has been or will be disclosed, the intended storage period, the existence of a right to rectification, erasure, restriction of processing or objection, the existence of a right to lodge a complaint, the origin of your data where it was not collected by us, as well as information on the existence of automated decision-making, including profiling, and, where applicable, meaningful information regarding its details;
• to request, in accordance with Article 16 of the GDPR, the rectification of inaccurate personal data or the completion of your personal data stored by us without delay;
• to request, in accordance with Article 17 of the GDPR, the erasure of your personal data stored by us, unless processing is necessary for the exercise of the right to freedom of expression and information, to comply with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims;
• in accordance with Article 18 of the GDPR, to request the restriction of the processing of your personal data, provided that you contest the accuracy of the data, the processing is unlawful but you oppose its erasure and we no longer require the data, but you require it for the establishment, exercise or defence of legal claims, or you have objected to the processing in accordance with Article 21 of the GDPR;
• in accordance with Article 20 of the GDPR, to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format, or to request that it be transferred to another controller;
• in accordance with Article 7(3) of the GDPR, to withdraw your consent at any time. As a result, we may no longer continue the data processing that was based on this consent in future; and
• pursuant to Article 77 of the GDPR, to lodge a complaint with a supervisory authority. As a rule, you may contact the supervisory authority for your usual place of residence, your place of work or our registered office.

1. Right to object
   
   Where your personal data is processed on the basis of legitimate interests pursuant to Article 6(1)(f) of the GDPR, you have the right, pursuant to Article 21 of the GDPR, to object to the processing of your personal data, provided there are grounds arising from your particular situation or the objection relates to direct marketing. In the latter case, you have a general right to object, which we will honour without you needing to specify a particular situation.

If you wish to exercise your right to object, simply send an email to info@hkst.de . 

1. Data security

During your visit to the website, we use the widely adopted SSL (Secure Sockets Layer) protocol in conjunction with the highest level of encryption supported by your browser. This is usually 256-bit encryption. If your browser does not support 256-bit encryption, we will use 128-bit v3 technology instead. You can tell whether a particular page on our website is being transmitted securely by the closed key or padlock symbol displayed in the status bar at the bottom of your browser.

We also employ appropriate technical and organisational security measures to protect your data against accidental or deliberate manipulation, partial or complete loss, destruction or unauthorised access by third parties. Our security measures are continuously improved in line with technological developments.

1. Validity and amendments to this privacy notice 

This privacy policy is currently valid and is dated October 2026.

Due to the further development of our website and the services offered on it, or as a result of changes to legal or regulatory requirements, it may become necessary to amend this privacy policy. The most up-to-date version of the privacy policy can be accessed on our website at any time.