1. Scope of This Statement

This Privacy Policy applies to the website of Medienzentrum Wiesbaden e. V. (hereinafter “MDZ”) at www.wiesbaden.de/microsite/medienzentrum/, including all subpages (hereinafter “microsite”).

The microsite is technically part of the website www.wiesbaden.de of the state capital of Wiesbaden. It is operated on the same platform and uses its technical infrastructure. However, the MDZ is responsible for the editorial content of the Microsite. This arrangement results in shared responsibility, which is described in detail in Section 2.

For linked third-party offerings—including the other sections of www.wiesbaden.de outside the Microsite as well as the MDZ’s social media profiles—the privacy notices provided on those sites apply.

2. Responsibility

2.1 Controller for the Microsite’s Content and for Your Inquiries
The controller, as defined in Article 4(7) of the GDPR, for the editorial content of the microsite and for the processing of the data you submit to us via the microsite is:

Medienzentrum Wiesbaden e. V.
Hochstättenstraße 6–10, 65183 Wiesbaden

Phone: 0611 16658-41
Email: kontaktmdz-wide

Represented by the Board of Directors: Dr. Patricia Becher (President), Günter Gablenz (Vice President)

Register of Associations: Wiesbaden Local Court, VR 3365

The MDZ is a registered association and thus a non-public entity within the meaning of Section 2(4) of the Federal Data Protection Act (BDSG). The processing of personal data by the MDZ is governed by the GDPR and the provisions of the BDSG applicable to non-public entities; the Hessian Data Protection and Freedom of Information Act (HDSIG) does not apply to the MDZ.

2.2 Data Protection Officer
The MDZ has appointed an external Data Protection Officer. You can contact her at:

Attorney Antonia Dufeu
c/o Medienzentrum Wiesbaden e. V., Hochstättenstraße 6–10, 65183 Wiesbaden

Email: datenschutzmdz-wide

2.3 Technical Operation of the Platform
The MDZ is not responsible for the technical provision of the platform on which the microsite runs. The City of Wiesbaden is responsible for this; operation is entrusted to Wiesbaden Congress & Marketing GmbH (WICM), P.O. Box 3840, 65028 Wiesbaden, which in turn uses the content management system provided by Sitepark GmbH, Neubrückenstraße 8–11, 48143 Münster. Hosting takes place in Germany on servers operated by Joomo GmbH.

The city of Wiesbaden is responsible for all processing resulting from the technical operation of the platform that the MDZ neither initiates nor can influence. This applies in particular to:

• the creation of server log files (Section 4),
• technically necessary cookies and the wish list (Section 5),
• audience measurement using Matomo (Section 6),
• the technical processing of form submissions and newsletter distribution (Sections 7 and 8).

We nevertheless provide the relevant information below so that you can fully understand the data processing activities on this microsite. In addition, the privacy policy of the City of Wiesbaden at www.wiesbaden.de/datenschutzerklaerung applies in this regard.

3. Overview of Legal Bases

We process personal data only on one of the following legal bases:

• Art. 6(1)(a) GDPR – Your consent, such as for the newsletter.
• Art. 6(1)(b) GDPR – Performance of a contract or implementation of pre-contractual measures, such as inquiries regarding workshops, equipment rentals, or Makerspace appointments.
• Art. 6(1)(c) GDPR – Compliance with legal obligations, such as tax and commercial law retention requirements.
• Art. 6(1)(f) GDPR – Protection of our legitimate interests, such as ensuring the secure and stable operation of the microsite and responding to general inquiries.

Section 25 of the Telecommunications and Digital Services Data Protection Act (TDDDG) additionally applies to the storage of information on your device and access to it.

4. Accessing the Microsite and Server Log Files

Every time you access a page on the microsite, your browser automatically transmits data that is stored in log files on the web server. This data includes:

• IP address
• Date and time of access
• URL of the page accessed
• Web server status code
• Amount of data transferred in bytes
• URL of the previously visited page (referrer)
• Browser used and its version (User-Agent)

Purpose
: Processing is necessary to deliver the requested page content, ensure the stability of the website, and detect and defend against attacks on the communication technology.

Legal basis
: Art. 6(1)(f) GDPR. The legitimate interest lies in the secure, stable, and functional provision of the website.

Retention
Period: The log data is automatically deleted after 14 days. Longer retention occurs only if it is necessary in individual cases to investigate an attack on the systems; in such cases, the relevant data is exempt from deletion until the investigation is complete.

Objection
: The collection of this data is technically necessary for the operation of the microsite. There is no option to object in this regard.

5. Cookies and Similar Technologies

The microsite uses only technically necessary cookies. We do not use cookies for advertising or tracking purposes.

Session Cookie
A session cookie (PHP session) ensures that the web server can associate your requests for pages, images, and other content with a single browser session. This cookie is valid only for the current session and is deleted when you close your browser.

Bookmark
List The platform offers a bookmark list that allows you to save individual pages for future visits. The information stored for this purpose remains on your device and is used exclusively for the function you requested. No analysis takes place.

Privacy Safeguards for External Services
External content is generally not loaded automatically on the platform but only after you have explicitly enabled it. Your decision is stored so that you are not asked again on every page.

Legal Basis
The storage of information on your device and access to it are permitted without consent under Section 25(2)(2) of the German Telecommunications Data Protection Act (TDDDG), as they are strictly necessary to provide the service you have expressly requested. We base the subsequent processing of the data obtained in this manner on Article 6(1)(f) of the GDPR.

You can delete cookies or reject them altogether via your browser settings. The microsite will remain largely readable even then; however, certain convenience features will not be available.

6. Audience Measurement with Matomo

The open-source software Matomo is used on the platform for statistical analysis of usage. Matomo runs exclusively on the platform operator’s servers in Germany; data is not shared with third parties.

It is used in a data-minimal configuration:

• No tracking cookies are set.
• Your IP address is truncated by one byte before being stored (example: 192.168.100.xxx).
• To recognize users during a single visit, a temporary identifier generated on the server side is used, which changes every 24 hours. This precludes long-term recognition.

In particular, the following data is collected: the date and time of the visit, the title and URL of the page accessed, the previously visited page, screen resolution, browser language and user agent, downloads and external links clicked, page load times, and a rough geographic location at the country, region, and city levels.

Purpose
We analyze the statistics to tailor the structure and content of our website to the actual interests of our users. The MDZ receives the analyses exclusively in aggregated form.

Legal Basis
: By truncating the IP address and not using cookies, we assess that it is generally no longer possible to establish a link to a specific individual. To the extent that personal data is nevertheless processed in individual cases, we base this on Article 6(1)(f) of the GDPR; the legitimate interest lies in designing and improving the service to meet user needs. You may object to this processing pursuant to Article 21(1) of the GDPR.

Retention
Period The statistics derived from the raw data do not contain any personal data and are retained indefinitely.

7. Contact

7.1 Contact Form
A contact form is available on the microsite. We process the information you enter into the form as well as the technical transmission data. Required fields are marked as such; all other information is voluntary and helps us process your inquiry more quickly.

7.2 Contact via Email, Phone, or Mail
If you contact us using the methods listed in the legal notice, we will process the information provided to handle your inquiry.

Purpose and Legal Basis
If your inquiry is aimed at initiating or fulfilling a contractual relationship—such as booking a workshop, renting media equipment, or using the Makerspace—the legal basis is Article 6(1)(b) of the GDPR. In all other cases, we base the processing on Article 6(1)(f) of the GDPR; our legitimate interest lies in properly responding to inquiries directed to us.

Retention
Period We will delete your inquiry as soon as it has been fully processed and there is no indication that the data is still needed for follow-up questions or for the defense of legal claims. If the process is subject to statutory retention requirements—in particular under commercial and tax law—the data will be deleted after those requirements have expired.

Note on Email Communication
: Unencrypted emails may be read by third parties during transmission. Please do not send us any particularly sensitive information via email. For confidential matters, please send us a letter by mail or arrange a secure method of transmission with us.

8. Newsletter

You can subscribe to the MDZ newsletter free of charge via the microsite. Your email address is required. Additional information is voluntary and is used to address you personally.

After you sign up, you will receive an email with a confirmation link. Your email address will not be added to the mailing list until you have clicked this link (double opt-in procedure). To verify your registration, we log the time of registration and confirmation, as well as the IP address used during the process.

Purpose and Legal Basis
We use your data exclusively for sending the newsletter. The legal basis is your consent pursuant to Art. 6(1)(a) of the GDPR. We base the logging of the registration process on Article 6(1)(c) of the GDPR in conjunction with our obligation to provide evidence under Article 5(2) of the GDPR.

Withdrawal of Consent and Retention
Period You may unsubscribe from the newsletter at any time, thereby withdrawing your consent with future effect. You will find an unsubscribe link at the end of each newsletter; alternatively, a simple message to kontaktmdz-wide is sufficient. After you unsubscribe, we will delete your data from the mailing list. The lawfulness of the processing carried out up until the time of withdrawal remains unaffected.

9. External Links and Route Planning

The microsite contains links to third-party services. Personal data—in particular your IP address—is only transmitted to the respective provider when you click on such a link. We have no influence over the content or data processing of these services.

On the “Directions” page and in the contact information, you will find a link to route planning. Map services are not integrated into the microsite; this is exclusively an external link. Only when you click on this reference will you leave our website, and your data—including your IP address and the URL you visited—will be transmitted to the map service provider. If you do not wish this to happen, please do not click on the link.

10. Social Media Presence

The MDZ maintains profiles on social media platforms that are linked to from the microsite. The link itself does not trigger any data transfer; we do not use social media plugins.

If you visit one of our profiles, the respective provider will process your data under its own responsibility and in accordance with its own terms and conditions. We have no influence over this and receive only aggregated statistics from the providers regarding the use of our profiles. To the extent that we are jointly responsible with the provider for the collection of these statistics (Art. 26 GDPR), you may exercise your data subject rights both with us and with the provider.

The legal basis for operating our profiles is Article 6(1)(f) of the GDPR; our legitimate interest lies in providing information about our offerings and engaging with interested parties.

We maintain profiles on:

• Facebook (Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland)
• Instagram (Meta Platforms Ireland Ltd., address as above)
• YouTube (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland)

11. Recipients of the Data

Within MDZ, only those individuals who need your data to process your request have access to it.

In addition, we use carefully selected service providers who process data on our behalf. We have entered into data processing agreements with them in accordance with Article 28 of the GDPR. This applies in particular to the technical provision of the microsite as well as the operation of our email and office systems.

Data will only be transferred to other recipients if you have consented, if it is necessary for the performance of a contract, or if we are legally obligated to do so.

12. Transfer to Third Countries

Data processing related to the operation of the microsite takes place exclusively on servers located within the Federal Republic of Germany. This does not involve any transfer to countries outside the European Union and the European Economic Area.

An exception may arise if you click on a link to a third-party offering or visit one of our social media profiles. In these cases, data may be transferred to providers based in or affiliated with companies in third countries, particularly the United States. Transfers to companies based in the United States, provided they are certified under the EU-US Data Privacy Framework, are made on the basis of the European Commission’s Adequacy Decision of July 10, 2023, and otherwise on the basis of standard contractual clauses pursuant to Article 46(2)(c) of the GDPR.

13. Minors

The microsite’s offerings are intended for teachers, educational professionals, schools, and other institutions, as well as interested adults. They are not designed to collect personal data from children.

If you are under 16 years of age, please obtain consent from your parents or legal guardians before subscribing to the newsletter or using the contact form. If we become aware that we have received a child’s data without the required consent, we will delete it immediately.

14. Data Security

The microsite is delivered via a TLS-encrypted connection (indicated by “https://” in your browser’s address bar). In addition, we and the platform operator implement technical and organizational measures in accordance with Art. 32 of the GDPR to protect your data against loss, destruction, manipulation, and unauthorized access. Our measures are continuously updated to reflect the latest state of the art.

15. Necessity of Providing Data

You are under no legal or contractual obligation to provide us with personal data. However, without the data marked as required, we cannot process your request, enter into a contract with you, or send you a newsletter. You may use the content of the microsite without providing any personal data.

16. No Automated Decision-Making

Automated decision-making, including profiling as defined in Article 22 of the GDPR, does not take place.

17. Your Rights

You have the following rights with respect to the personal data concerning you:

• The right to obtain information, pursuant to Article 15 of the GDPR, regarding whether and what data we process about you;
• Rectification of inaccurate data and completion of incomplete data pursuant to Article 16 of the GDPR;
• Erasure pursuant to Article 17 of the GDPR, provided that no statutory retention obligations or other reasons prevent this;
• Restriction of processing pursuant to Article 18 of the GDPR;
• Data portability under Article 20 of the GDPR for data that you have provided to us based on consent or for the performance of a contract;
• Objection pursuant to Article 21 of the GDPR to processing that we base on a legitimate interest.

Right to object under Article 21 of the GDPR
: To the extent that we process your data based on Article 6(1)(f) of the GDPR, you may object to such processing for reasons arising from your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims.

Withdrawal of Consent
You may withdraw any consent you have given at any time with future effect. The lawfulness of the processing carried out prior to the withdrawal remains unaffected.

Exercising
Your Rights To exercise your rights, simply send an informal notice to the MDZ or to our Data Protection Officer using the contact information provided in Section 2. Exercising your rights is free of charge.

18. Right to File a Complaint with the Supervisory Authority

Pursuant to Article 77 of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your data violates data protection law. The authority responsible for the MDZ is:

The Hessian Commissioner for Data Protection and Freedom
of Information, Gustav-Stresemann-Ring 1, 65189 Wiesbaden

Mailing address: P.O. Box 3163, 65021 Wiesbaden

Phone: 0611 1408-0

Email: poststelledatenschutz.hessende

19. Changes to This Privacy Policy

We will update this Privacy Policy if the services offered on the microsite, the technology used, or the legal framework change. The version available on the microsite at any given time is the one that applies.

Effective date of this Privacy Policy: September 10, 2026