1. General Information
The protection of your personal data is important to us. This Privacy Notice explains what personal data the Wiesbaden Museum processes, for what purposes this is done, and what rights you have under the General Data Protection Regulation (GDPR).
Personal data is any information relating to an identified or identifiable natural person.
2. Scope
This information, in accordance with Article 13 of the GDPR, applies to the collection of personal data by the Museum Wiesbaden, Hessian State Museum of Art and Nature.
This privacy notice applies in particular to the use of our website, as well as to the services and processing operations of the Museum Wiesbaden described below.
3. Liability
The controller responsible for the processing of personal data within the meaning of the General Data Protection Regulation is:
Museum Wiesbaden
Hessian State Museum of Art and Nature
represented by Dr Andreas Henning (Director)
Friedrich-Ebert-Allee 2
65185 Wiesbaden
Telephone: 0611 / 335 2171 or 2250
Email: direktion@museum-wiesbaden.de
4.Data Protection Officer
You can contact the Data Protection Officer at Museum Wiesbaden at:
Museum Wiesbaden
Hessian State Museum of Art and Nature
Friedrich-Ebert-Allee 2
65185 Wiesbaden
Telephone: 0611 / 335 2171 or 2250
Email: direktion@museum-wiesbaden.de
5. General legal bases
We process personal data only where there is a legal basis for doing so.
Where processing is necessary for the performance of our public duties, it is carried out in particular on the basis of Article 6(1)(e) of the GDPR in conjunction with the relevant provisions of state law applicable to us.
Where processing is necessary for the performance of a contract or for the implementation of pre-contractual measures, it is carried out on the basis of Article 6(1)(b) of the GDPR.
Where you have given us your consent, processing is carried out on the basis of Article 6(1)(a) of the GDPR. You may withdraw any consent you have given at any time with effect for the future. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.
Further or more specific legal bases are specified in the descriptions of the respective processing operations.
6. Provision of our website
Our main website is operated using the MODX content management system.
According to our technical support team, the web server we use does not generate any personal server access logs for the MODX homepage.
Insofar as data technically necessary for the transmission of website content is processed, this is done for the purpose of providing our website securely and in a fully functional manner.
Transmission of our website is encrypted using TLS.
7. Cookies and similar technologies
Based on our current technical configuration, we do not use any non-essential cookies on our main website for analytical or advertising purposes.
Our web analytics service, Matomo, operates without cookies.
External content, in particular YouTube videos and social media content provided via Flockler, is embedded on individual pages. The following specific information applies to these services.
8. Contact forms and contacting us
On our website, we provide contact forms for general enquiries as well as for enquiries to the Education and Outreach department, for example regarding guided tours.
The details you enter are transmitted exclusively to the relevant email address at Museum Wiesbaden. The form data is not stored in the website’s database.
We process the information in order to handle and respond to your enquiry.
Where your enquiry relates to a contract or pre-contractual measures, processing is carried out on the basis of Article 6(1)(b) of the GDPR. In all other cases, processing takes place within the scope of our duties on the basis of Article 6(1)(e) of the GDPR in conjunction with the relevant provisions of state law.
The data will be deleted as soon as it is no longer required for the processing of your enquiry and there are no statutory retention obligations to the contrary.
9. Web analytics with Matomo
We use the open-source web analytics service Matomo to statistically analyse the use of our website and to improve our service.
Matomo is configured in such a way that no cookies are stored on your device. We also use IP anonymisation, so that the IP address is truncated prior to analysis.
Matomo is operated on infrastructure under our control. The analysis data is not passed on to third parties for advertising purposes.
The data stored via Matomo is regularly purged. Data older than 550 days is deleted daily.
The processing serves the purpose of statistical analysis and improving our website.
10. Newsletter and RapidMail
Newsletter subscription
You can subscribe to our newsletter. We use the so-called double opt-in procedure for registration. After registering, you will receive an email in which you must confirm your subscription. Only after this confirmation will your email address be added to our newsletter distribution list.
The legal basis for sending the newsletter is your consent in accordance with Article 6(1)(a) of the GDPR.
You may withdraw your consent at any time with future effect, in particular via the unsubscribe link included in every newsletter.
Distribution via rapidmail
We use rapidmail to send our newsletters. The data required for newsletter distribution is processed by rapidmail on our behalf for this purpose.
Where newsletter tracking is enabled, technical information may be processed regarding whether a newsletter has been opened and whether any links contained therein have been clicked. In particular, technical information relating to the retrieval of the newsletter may be processed for this purpose.
The Museum does not currently actively use these statistics to analyse individual usage behaviour. Plans are in place, or are being examined, to technically deactivate opening and click tracking.
Newsletter data is generally processed until you unsubscribe from the newsletter. Statutory retention obligations and proof of consent given remain unaffected by this.
11. Events calendar
An events calendar is integrated into our website. The event information is provided, amongst other things, via a programming interface of the go~mus visitor management system.
For certain content, a server hosted in Germany is used as a technical intermediary (reverse proxy).
When the calendar is accessed, technically necessary access data is processed. This includes, in particular:
This data is processed exclusively to ensure system security and for fault diagnosis. It is not used for tracking or profiling purposes.
The relevant server log data is automatically deleted after 14 days.
12. Ticket shop, bookings and go~mus
For the sale and booking of tickets, events and other offers, we use the visitor management and ticketing system go~mus from Giant Monkey GmbH.
Depending on the type of booking, the following data in particular may be processed:
Where specific entitlements are relevant for concessions, no sensitive evidence of eligibility for concessions is permanently stored, according to the information available to us.
The processing of the data required for the booking is carried out, in particular, for the purpose of performing the contract or pre-contractual measures in accordance with Article 6(1)(b) of the GDPR.
Service provider
go~mus is provided by Giant Monkey GmbH, Brunnenstraße 39, 10115 Berlin. Giant Monkey processes the personal data required for the operation of the system on our behalf.
According to the provider, infrastructure in Germany is used for hosting the platform.
Retention period
The retention period depends on the type of data and the respective purpose of processing.
Personal data from guest orders is generally deleted six months after the latest visit date in accordance with the deletion rule specified for our go~mus instance, provided that no statutory retention obligations prevent this.
Data from guests who have not placed an order is deleted after the short period specified for this purpose. Participant data is generally deleted four weeks after the latest visit date.
Invoice, booking and transaction data are stored in accordance with the applicable statutory retention obligations.
Technical server log data are subject to automatic rotation and are deleted after 180 days at the latest.
13. Payment processing in the ticket shop
The payment service provider Adyen is used for payment processing in the online ticket shop.
Depending on the selected payment method, the payment and transaction data required for payment processing are transmitted to Adyen or to the payment service providers involved in the payment process.
The ticket shop offers, in particular, the following payment methods: Visa, Mastercard and Klarna.
Processing takes place for the purpose of carrying out the payment transaction and thus for the performance of the contract concluded with you in accordance with Article 6(1)(b) of the GDPR. Where statutory retention obligations apply, further storage takes place on the basis of the relevant legal obligations.
14. YouTube
Videos from the YouTube platform are embedded on our website. For this purpose, we use the enhanced privacy mode via youtube-nocookie.com.
When you visit a page containing embedded YouTube content, a technical connection may nevertheless be established with YouTube’s or Google’s servers. In particular, the IP address and information about the page accessed may be transmitted. When a video is played, further data may be processed.
If you are logged into your Google/YouTube account at the same time, YouTube may, where applicable, associate your use of the service with your user account.
We are currently investigating a technical adjustment whereby external YouTube content will only be loaded after active authorisation by the user.
15. Instagram content via Flockler
On our homepage, we display selected content from our Instagram account via the Flockler service.
The embedded content can be viewed, enlarged and – in the case of video content – played. There is no provision for commenting on or ‘liking’ Instagram posts directly via our website.
According to Flockler, the service itself does not use any tracking cookies or tracking codes, even for visitors to the embedded feeds. However, when displaying or using external social media content, technically necessary connections to the relevant services may be established.
We are currently looking into a technical adjustment whereby such external content will only be loaded once the user has actively given their consent.
16. Press portal and press mailing list
Members of the press can register for our press portal. The registration details provided for this purpose are stored in the system to grant access to the press area.
In addition, interested parties may, at their own request, be added to our press mailing list. Inclusion in the mailing list takes place either upon direct request or via the relevant online registration form. For online registration, we use a double opt-in procedure.
In the press mailing list, we process, in particular, names, email addresses and, where applicable, details of the editorial team or institution.
The data is used exclusively for the Museum Wiesbaden’s press and public relations work. Press releases are sent by email.
The data will be deleted if the data subject requests removal from the press mailing list or if the purpose of the processing no longer applies and there are no statutory retention obligations to the contrary.
17. Photographs and video recordings at events
Photographs and video recordings may be taken at vernissages, exhibition openings and larger events.
These recordings are used for documentation purposes as well as for the Museum Wiesbaden’s press and public relations work. In doing so, we take care, where possible, not to place visitors in the focus of the recordings as individually recognisable persons without good reason.
Selected recordings may, in particular,
In the case of specific individual photographs or where consent is required, we will obtain this consent prior to the relevant use.
When published via social media, the images are transmitted to the respective platform operators and processed there in accordance with their own data protection policies. This may also involve processing outside the European Union or the European Economic Area.
Images are stored only for as long as is necessary for documentation and public relations purposes. Where images are processed on the basis of consent, this consent may be withdrawn at any time with effect for the future.
18. Social Media Presence
Museum Wiesbaden maintains its own accounts on:
If you visit our pages on these platforms or interact with us there, personal data will be processed both by the respective platform operator and, where applicable, by us.
We respond to messages and comments directly via the respective platform. We do not use any additional external social media management system for this purpose.
We have only limited influence over the further processing of personal data by the respective platform operators. For further details, please refer to the privacy policies of the respective providers.
19. Social media competitions
We occasionally run competitions via our social media channels, in particular Instagram.
In doing so, we process the data necessary to run the respective competition, such as the account name and – in the case of winners – further contact or delivery details where applicable.
The data is used solely for the purpose of organising and administering the relevant competition and is subsequently deleted, provided there are no statutory retention obligations to the contrary.
Further information may be provided in the relevant terms and conditions of the competition.
20. CCTV in the museum
Video surveillance is in operation in selected areas of the Museum Wiesbaden. Signs are displayed on site to draw attention to the areas under surveillance. There is no comprehensive surveillance covering the entire museum.
Video surveillance serves, in particular,
Recordings are generally deleted after 72 hours.
Where a recording is required to investigate or prosecute a specific incident, it may be stored beyond this period until the purpose ceases to apply.
Recordings are not, as a general rule, disclosed to third parties. However, in specific cases, recordings may be provided to the police, the public prosecutor’s office or pursuant to a court order.
Access to the recordings is restricted to authorised personnel.
21. Public Wi-Fi
The Museum Wiesbaden provides its visitors with public Wi-Fi.
In the course of providing the Wi-Fi service, technically necessary connection data may be processed. This serves, in particular, to provide network access and to ensure the security and functionality of the service.
According to the information currently available to us, connection data is generally stored for seven days and then deleted.
22. Event registrations outside the ticket shop
In certain exceptional cases, registrations for events may also be made outside the go~mus ticket shop, for example by email.
In such cases, we process the contact details provided solely for the purpose of organising and running the respective event. The contact details held for this purpose are deleted once the event has concluded, provided there are no statutory retention obligations to the contrary.
23. Job applications
Application procedures for positions at Museum Wiesbaden are generally handled centrally via the procedures designated for this purpose by the State of Hesse.
The privacy notices provided during the application process apply to the processing of personal application data carried out there.
24. Recipients and Data Processors
Where necessary to fulfil our tasks or to provide our services, we engage external service providers. Where these service providers process personal data exclusively on our behalf, they are contractually bound to comply with the relevant legal requirements.
The recipients and service providers described in this privacy notice include, in particular, the providers of our newsletter, ticketing, payment and technical infrastructure services.
Furthermore, personal data will only be disclosed to other bodies where there is a legal basis for doing so, where you have given your consent, or where such disclosure is necessary for the establishment, exercise or defence of legal claims.
25. Retention period
Unless a specific retention period is stated in this privacy notice, we will only store personal data for as long as is necessary to fulfil the respective purpose of processing.
The data will then be deleted, provided that no statutory retention obligations or other legal grounds require further storage.
All retention periods commence at the end of the year in which your matter is concluded.
26. Your data protection rights
Provided that the legal requirements are met, you have the following rights in particular:
To exercise your rights, you may contact the Museum Wiesbaden or our Data Protection Officer.
27. Right to lodge a complaint with the data protection supervisory authority
Under Article 77 of the GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.
The competent authority for the Museum Wiesbaden is:
The Hessian Commissioner for Data Protection and Freedom of Information
Wilhelmstraße 7
65185 Wiesbaden
Telephone: 0611 / 1408–0
Email: poststelle@datenschutz.hessen.de
http://www.datenschutz.hessen.de
28. Updates to this privacy notice
We review this privacy notice regularly and update it if our processing activities, the services we use or the legal framework change.
Last updated: August 2026
