Privacy Policy

1. Name and contact details of the controller and the company data protection officer

This privacy policy applies to data processing by:
Devrientstraße 11, Tel. 0351 8296825, E-Mail:

HELLERAU’s own company data protection officer can be contacted at the above address, Attn. Mr Andreas Gagelmann, at or by telephone on +49 351 4881906.

Collection and storage of personal data and the nature and purpose of their use

a) During visits to our website

When you visit our website, the browser used on your device automatically sends information to our website server. This information is temporarily stored in what is known as a log file. In that process, the following information is collected without your intervention and stored until its automatic erasure:

  • IP address of the requesting computer,
  • date and time of request,
  • name and URL of the retrieved file,
  • website from which access is made (referrer URL),
  • browser used and, if relevant, the operating system of your computer and name of your access provider.

We process the data named above for the following purposes:

  • to ensure that the connection to the website is established smoothly,
  • to ensure that our website can be used conveniently,
  • to assess system security and stability, and
  • for other administrative purposes.

The legal basis for this data processing is Article 6, para. 1 (1f) of the GDPR. Our legitimate interest follows from the data collection purposes listed above. In no case will we use the data collected for the purpose of identifying you.

When you visit our website, we also use cookies and analysis services. For further details on this, see Clauses 4 and 5 of this privacy statement.

b) When subscribing to our newsletter

If you have expressly consented pursuant to Article 6, para. 1 (1a) of the GDPR, we will use your e-mail address to regularly send you our newsletter. All that is required to receive the newsletter is an e-mail address.

The newsletter can generally only be received by the data subject if (1) the data subject has a valid e-mail address and (2) the data subject subscribes to the newsletter. For legal reasons, when an e-mail address is first entered for the purpose of receiving the newsletter, a confirmation e-mail is sent using the double opt-in procedure. This confirmation e-mail is use to check whether the owner of the e-mail address has authorised the receipt of the newsletter as the data subject.

When a data subject subscribes to the newsletter, we store the IP address allocated by the Internet Service Provider (ISP) to the computer system used by the data subject at the time of registration, plus the date and time of subscription. It is necessary to collect this data to track the (potential) misuse of a data subject’s e-mail address at a later point in time; this thus serves as a legal safeguard for the controller.

The personal data collected when subscribing to the newsletter are used exclusively for sending our newsletter. Furthermore, newsletter subscribers may receive information by e-mail if this is necessary for the operation of the newsletter service, or if subscription is required in this context, as in the case of changes to the newsletter service or when technological conditions change. The personal data collected in the context of the newsletter service are not disclosed to third parties. The data subject may cancel the subscription to our newsletter at any time. The data subject may at any time withdraw his or her consent to the storage of personal data as given to us for the purpose of sending the newsletter. Every newsletter contains a corresponding link for the purpose of withdrawing that consent. Furthermore, it is also possible at any time to unsubscribe from the newsletter directly via the contact persons in the public relations office (

c) Newsletter tracking

The newsletter sent by PORTRAITS – HELLERAU PHOTOGRAPHY AWARD contains what are known as “tracking pixels”. A tracking pixel is a miniature graphic embedded into e-mails of this kind sent in HTML format to enable logging and log file analysis. It can be used to carry out a statistical analysis of the success or failure of online marketing campaigns. Using the integrated tracking pixel, we can recognise whether, and when, an e-mail is opened by a data subject and what links in the e-mail are accessed by the data subject.

Personal data collected via the tracking pixels in the newsletters are stored and analysed by the controller in order to optimise the newsletter and to adapt the content of future newsletters even better to the data subject’s interests. These personal data are not disclosed to third parties. Data subjects are at any time entitled to withdraw their consent to this, as separately given via the double-opt-in procedure. Once consent is withdrawn, these personal data are erased by the controller. We automatically interpret unsubscription from the newsletter as a withdrawal of consent.

Transfer of data

Your personal data are not transferred to third parties for any purposes other than those listed below.

We only pass on your personal data to third parties if:

  • you have given your explicit consent to this pursuant to Article 6, para. 1, Point (1a) of the GDPR,
  • processing is necessary for the establishment, exercise or defence of legal claims pursuant to Article 6, para. 1, Point (1f) of the GDPR, and there are no reasons to consider that you have an overriding interest worth protecting in your data not being disclosed,
  • if there is a legal obligation to pass them on pursuant to Article 6, para. 1, Point (1c) of the GDPR, and
  • this is legally permissible and necessary to process contractual relationships with you pursuant to Article 6, para. 1, Point (1b) of the GDPR.


We use cookies on our website. These are small files which your browser automatically creates and which are stored on your device (laptop, tablet, smartphone, etc.) when you visit our site. Cookies do not harm your device, and do not contain viruses, Trojans or other malicious software.

Information is stored in the cookies which arises in connection with the specific device used in each case. However, this does not mean that we are immediately made aware of your identity.

On the one hand, using cookies helps make it more pleasant for you to use our offerings. For example, we use so-called “session cookies” to recognise that you have already visited individual pages on our website. When you leave our site, these are automatically erased.

Furthermore, to improve user-friendliness, we place temporary cookies which are stored on your device for a certain period of time. If you visit our site again to make use of our services, it automatically recognises that you have visited us before and remembers the information entered and settings chosen, so you do not need to enter these again.

On the other hand, we use cookies to gather statistics on the use of our website and to analyse them in order to improve our offerings for you (see Clause 5). If you visit our site again, these cookies enable us to recognise that you have visited before. These cookies are automatically deleted after a defined time.

The data processed by cookies are required for the purposes named above of safeguarding our legitimate interests and those of third parties, pursuant to Article 6, para. 1 (1f) of the GDPR.

Most browsers accept cookies automatically. You can nonetheless configure your browser so that no cookies are stored on your computer, or so that a prompt always appears before a new cookie is placed. However, disabling cookies completely may mean that you cannot use all the features of our website.

Rights of the data subject

You have the right:

  • pursuant to Article 15 of the GDPR to demand access to the personal data concerning you which we process. Among other things, you can obtain access to the purposes of the processing, the categories of recipient to whom the personal data have been or will be disclosed, the envisaged period for which the personal data will be stored, the existence of the right to request rectification or erasure of personal data or restriction of processing of personal data or to object to such processing, where the personal data are not collected by us, information as to their source, and the existence of automated decision-making, including profiling, and meaningful information about its details;
  • pursuant to Article 16 of GDPR to obtain the rectification of inaccurate personal data concerning you stored by us or to have incomplete personal data of this kind completed;
  • pursuant to Article 17 of the GDPR to obtain the erasure of personal data concerning you and stored by us, to the extent that such processing is not required to exercise our right to freedom of expression and information, for compliance with a legal obligation, on grounds of public interest or to establish, exercise or defend legal claims;
  • pursuant to Article 18 of the GDPR to obtain restriction of processing of your personal data, where the accuracy of the personal data is contested by you, the processing is unlawful but you oppose their erasure and we no longer need the data, but you require them for the establishment, exercise or defence of legal claims, or you have objected to processing pursuant to Article 21 of the GDPR;
  • pursuant to Article 20 of the GDPR to receive the personal data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format or to transmit those data to another controller;
  • pursuant to Article 7, para. 3 of the GDPR at any time to withdraw your consent given to us. As a result, we will in future no longer be permitted to continue the data processing which was based on that consent, and
  • pursuant to Article 77 of the GDPR, to lodge a complaint with a supervisory authority. As a rule, to do so you can contact the supervisory authority at your usual place of residence or workplace, or at our offices.

Right to object

If your personal data are processed on the basis of legitimate interests pursuant to Article 6, para. 1 (1f) of the GDPR, you have the right pursuant to Article 21 of the GDPR to object to processing of personal data concerning you on grounds relating to your particular situation, or where you object to direct marketing. In the latter case, you have a general right to object which we must implement without any particular situation being specified.

If you would like to exercise your right to withdraw your consent or to object, all that is needed is to send an e-mail to

Data security

We also take appropriate technical and organisational security precautions to protect your data against accidental or intentional manipulation, partial or total loss, destruction or unauthorised access by third parties. Our security precautions undergo continuous updates in line with technological development.

Updates and amendments to this privacy statement

This privacy statement is currently valid as of September 2018.

In the process of further developing our website and related offerings, or due to changes in legal or regulatory requirements, it may become necessary for this privacy statement to be changed. The current privacy statement can be retrieved and printed by you at any time on our website at