This privacy notice explains how we process your personal data and outlines your rights under the European Union’s General Data Protection Regulation (GDPR) and the Data Protection Act of North Rhine-Westphalia (DSG NRW). The City of Mönchengladbach is responsible for processing your personal data and is referred to in this notice as “we” or “us.”
General Information on the Legal Bases for Data Processing
“Personal data” means any information relating to an identified or identifiable natural person. We process personal data in accordance with applicable data protection laws, in particular the GDPR and the Data Protection Act of North Rhine-Westphalia (DSG NRW). We may process personal data only where there is a legal basis for doing so.
Name and Contact Details of the Controller
The controller responsible for processing your personal data is:
Stadt Mönchengladbach
Der Oberbürgermeister
Fachbereich Museen
Museum Abteiberg
41050 Mönchengladbach
Germany
Phone: +49 2161 25-2637
Email: email hidden; JavaScript is required
Contact Details of the Data Protection Officer
You can contact the City of Mönchengladbach’s data protection officer at:
Phone: +49 2161 25-2550
Email: email hidden; JavaScript is required
Processing: Image and Video Hosting for the Website
We use an external hosting service to provide images and videos on the website. Uploaded media files are stored on the hosting provider’s servers and transmitted over the internet to visitors’ devices when requested. Delivering this content requires the processing of connection data, particularly the IP address of the requesting device. This includes uploading, storing, caching, and delivering content to users.
Purpose of Processing
We process your personal data to the extent necessary for the following purpose:
- Providing and delivering image and video content on the website
The purpose of this processing is to make image and video content available on the museum’s website, allowing visitors to access digital content.
Legal Basis
The legal bases for processing your personal data for the purposes stated above are
- Article 6(1)(e) GDPR (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller)
- Section 3(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW) (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority)
- Section 6 of the E-Government Act of North Rhine-Westphalia (EGovG NRW)
Recipients of Personal Data Outside the Organization
Article 4(9) GDPR defines “recipient” as “a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.”
- Hetzner Online GmbH
- Studio Tobias Sawitzki
- BunnyWay d.o.o.
Sources of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of its sources.
- Processors
- Technical systems and sensors
- Automatic transmission for technical reasons
Categories of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of the categories of personal data concerned.
- Content data
- Usage data
Retention Period
We inform you of the period for which personal data will be stored or, where this is not possible, the criteria used to determine that period.
- Deletion when the data is no longer necessary (e.g., in the context of ongoing customer relationships or legal proceedings)
Possible Consequences of Not Providing Personal Data
The provision of personal data by the data subject may be required by law or contract or may be necessary to enter into a contract. There may also be a legal obligation to provide the data.
Failure to provide personal data may have the following consequences:
- Content cannot be displayed
Processing: Press Access on the Website
The website provides a separate login area for members of the press. When users log in, their login credentials (username or email address and encrypted password) and technical information (IP address and time of access) are processed, and a session cookie is generated for authentication. This data is used exclusively to identify users and maintain their sessions.
The login function is used solely to authenticate accredited members of the press and provide access to exclusive press materials. The data is not used for any other purposes.
Login credentials (username) are retained for as long as press accreditation remains valid.
Purpose of Processing
We process your personal data to the extent necessary for the following purpose:
- Verification of access permissions
This processing is intended to reliably identify members of the press and maintain their authenticated sessions, allowing them to access exclusive press materials after successfully logging in.
Legal Basis
The legal basis for processing your personal data for the purposes stated above is
- Article 6(1)(b) GDPR (processing necessary for the performance of a contract)
- A framework agreement is in place with Verwertungsgesellschaft Bild-Kunst.
Recipients of Personal Data Outside the Organization
Article 4(9) GDPR defines “recipient” as “a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.”
- Hetzner Online GmbH
- Studio Tobias Sawitzki
Sources of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of its sources.
- Technical systems and sensors
- Automatic transmission for technical reasons
- Information provided voluntarily by the data subject
Categories of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of the categories of personal data concerned.
- Contact data
- Usage data
Retention Period
We inform you of the period for which personal data will be stored or, where this is not possible, the criteria used to determine that period.
- Deletion when the data is no longer necessary (e.g., in the context of ongoing customer relationships or legal proceedings).
Possible Consequences of Not Providing Personal Data
The provision of personal data by the data subject may be required by law or contract or may be necessary to enter into a contract. There may also be a legal obligation to provide the data.
Failure to provide personal data may have the following consequences:
- No access to press materials
- Contractual services cannot be provided
- Information cannot be provided
Processing: Event Registration on the Website
When you register for an event using the online form, we collect personal data such as your first and last name, phone number, email address, and any optional comments. This information is stored in a content management system that prevents public access to the data. We use the information to organize participation in the event and establish a contractual relationship between the event organizer and the person registering.
Purpose of Processing
We process your personal data to the extent necessary for the following purpose:
- Performance of contractual obligations or implementation of precontractual measures
The personal data collected is used to organize the event and administer the existing contractual relationship between the event organizer and the person registering.
Legal Basis
The legal basis for processing your personal data for the purposes stated above is
- Article 6(1)(b) GDPR (processing necessary for the performance of a contract)
Recipients of Personal Data Outside the Organization
Article 4(9) GDPR defines “recipient” as “a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.”
- Instructors
- Hetzner Online GmbH
- Studio Tobias Sawitzki
- Kommunaler Zweckverband ITK Rheinland
Sources of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of its sources.
- Information provided voluntarily by the data subject
- Contractual data
Categories of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of the categories of personal data concerned.
- Personal identification data
- Contact data
- Content data
Retention Period
We inform you of the period for which personal data will be stored or, where this is not possible, the criteria used to determine that period.
- Deletion upon expiration of the statutory retention period
Possible Consequences of Not Providing Personal Data
The provision of personal data by the data subject may be required by law or contract or may be necessary to enter into a contract. There may also be a legal obligation to provide the data.
Failure to provide personal data may have the following consequences:
- A contract cannot be concluded
- Participation in the event will be denied
- Confirmation and a ticket will not be issued
- The event organizer cannot provide its services
Processing: Museum Abteiberg Newsletter
Visitors can subscribe to the museum’s newsletter through the website. Only their email address is collected, and they are added to the mailing list through a double opt-in process. The newsletter is sent by email at regular intervals, and email addresses are stored by an external service provider. To improve the newsletter, anonymized statistics on email opens and clicks are analyzed.
Purpose of Processing
We process your personal data to the extent necessary for the following purposes:
- Compiling statistics and conducting internal analyses
- Sending newsletters
The purpose of this processing is to send regular updates about the museum by email to interested subscribers and to improve the newsletter through the analysis of anonymized email open and click statistics. When subscribers unsubscribe, their email addresses are removed from the active mailing list.
Legal Basis
The legal basis for processing your personal data for the purposes stated above is
- Article 6(1)(a) GDPR and Article 7 GDPR (consent)
Recipients of Personal Data Outside the Organization
Article 4(9) GDPR defines “recipient” as “a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.”
- CleverReach GmbH & Co. KG
Sources of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of its sources.
- Information provided voluntarily by the data subject
Categories of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of the categories of personal data concerned.
- Contact data
Retention Period
We inform you of the period for which personal data will be stored or, where this is not possible, the criteria used to determine that period.
- Deletion upon withdrawal of consent
Processing: Website Usage Statistics and Web Analytics
Each time someone visits the Museum Abteiberg website, technical usage data is collected and analyzed for statistical purposes. The data collected includes the page visited, the time and duration of the visit, the previously visited page, browser type, operating system, country of origin, device category, and anonymized IP addresses. The data is aggregated and stored in anonymized form on the web analytics tool’s server without the use of cookies. The data is not combined with other personal data.
Purpose of Processing
We process your personal data to the extent necessary for the following purpose:
- Compiling statistics and conducting internal analyses
This processing involves collecting and analyzing technical usage data to assess visitor numbers, page views, and navigation patterns and improve the website.
Legal Basis
The legal bases for processing your personal data for the purposes stated above are
- Article 6(1)(e) GDPR (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller)
- Section 3(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW) (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority)
- Section 6 of the E-Government Act of North Rhine-Westphalia (EGovG NRW)
Recipients of Personal Data Outside the Organization
Article 4(9) GDPR defines “recipient” as “a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.”
- Hetzner Online GmbH
- Studio Tobias Sawitzki
Sources of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of its sources.
- Technical systems and sensors
- Data obtained through online tools and procedures
Categories of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of the categories of personal data concerned.
- Usage data
Retention Period
We inform you of the period for which personal data will be stored or, where this is not possible, the criteria used to determine that period.
- Deletion when the data is no longer necessary (e.g., in the context of ongoing customer relationships or legal proceedings)
Possible Consequences of Not Providing Personal Data
The provision of personal data by the data subject may be required by law or contract or may be necessary to enter into a contract. There may also be a legal obligation to provide the data.
Processing: Providing the Website and Creating Log Files
The website is hosted on a web server, allowing visitors to access its content online. Each time a visitor accesses the site, technical information about their device is automatically collected, including the browser, operating system, IP address, time of access, and referring and destination URLs. This data is stored in log files to ensure the website operates properly and securely. The data is not linked to other personal data.
Purpose of Processing
We process your personal data to the extent necessary for the following purposes:
- Security measures
- IT and system administration, including user management
The purpose of this processing is to provide access to the website and record technical access data in log files to ensure the site operates properly and securely.
Legal Basis
The legal bases for processing your personal data for the purposes stated above are
- Article 6(1)(e) GDPR (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller)
- Section 3(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW) (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority)
- Section 6 of the E-Government Act of North Rhine-Westphalia (EGovG NRW)
Recipients of Personal Data Outside the Organization
Article 4(9) GDPR defines “recipient” as “a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.”
- Hetzner Online GmbH
- Studio Tobias Sawitzki
Sources of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of its sources.
- Technical systems and sensors
Categories of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of the categories of personal data concerned.
- Usage data
Retention Period
We inform you of the period for which personal data will be stored or, where this is not possible, the criteria used to determine that period.
- Deletion when the data is no longer necessary (e.g., in the context of ongoing customer relationships or legal proceedings)
Possible Consequences of Not Providing Personal Data
The provision of personal data by the data subject may be required by law or contract or may be necessary to enter into a contract. There may also be a legal obligation to provide the data.
Failure to provide personal data may have the following consequences:
- The security and proper operation of the website cannot be ensured
- Legal obligations cannot be fulfilled
- Troubleshooting activities cannot be logged
- Misuse cannot be traced
Processing: Inquiries by Email and Through the Website Contact Form
When inquiries are submitted by email or through the online contact form, the personal data provided is collected and linked to the relevant inquiry. This includes inquiries about the museum’s collection and art-historical matters. The data is stored and processed in an internal system and may be used to follow up with the person making the inquiry. Once the inquiry has been handled, the data is routinely deleted unless statutory retention obligations apply.
Purpose of Processing
We process your personal data to the extent necessary for the following purpose:
- Handling inquiries, complaints, reports, and submissions from members of the public
The purpose of this processing is to handle inquiries about the museum’s collection and art-historical matters received by email or through the online contact form. This includes reviewing and responding to inquiries and, where necessary, seeking clarification. The data is stored and processed in an internal system for these purposes and deleted once the inquiry has been handled, unless retention obligations apply.
Legal Basis
The legal bases for processing your personal data for the purposes stated above are
- Article 6(1)(e) GDPR (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller)
- Section 3(1) of the Data Protection Act of North Rhine-Westphalia (DSG NRW) (processing necessary for the performance of a task carried out in the public interest or in the exercise of official authority)
Recipients of Personal Data Outside the Organization
Article 4(9) GDPR defines “recipient” as “a natural or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not.”
- Hetzner Online GmbH
- Studio Tobias Sawitzki
- Kommunaler Zweckverband ITK Rheinland
Sources of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of its sources.
- Information provided voluntarily by the data subject
Categories of Personal Data
Where personal data is not collected directly from the data subject, the controller is required to inform the data subject of the categories of personal data concerned.
- Contact data
- Content data
Retention Period
We inform you of the period for which personal data will be stored or, where this is not possible, the criteria used to determine that period.
- Deletion when the data is no longer necessary (e.g., in the context of ongoing customer relationships or legal proceedings)
Possible Consequences of Not Providing Personal Data
The provision of personal data by the data subject may be required by law or contract or may be necessary to enter into a contract. There may also be a legal obligation to provide the data.
Failure to provide personal data may have the following consequences:
- The inquiry cannot be processed
- No response to the inquiry
- No access to information
- No participation in events
- Legal obligations cannot be fulfilled
Rights of the Data Subject
Articles 15–22 GDPR guarantee data subjects certain rights concerning their personal data. These include:
- Right of access: Every data subject has the right to obtain confirmation from us as to whether their personal data is being processed and, if so, to access that data and receive additional information and copies of the data.
- Right to rectification: Every data subject has the right to obtain the rectification of inaccurate personal data without undue delay.
- Right to erasure (“right to be forgotten”): Every data subject has the right to obtain the erasure of their personal data without undue delay.
- Right to restriction of processing: Every data subject has the right to obtain restriction of the processing of their personal data.
- Right to data portability: Every data subject has the right to receive the personal data concerning them that they have provided to us in a structured, commonly used, and machine-readable format.
- Right to object: Every data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them that is based on Article 6(1)(e) or (f) GDPR. Where we process personal data concerning a data subject for direct marketing purposes, that individual may object to such processing in accordance with Article 21(2) and (3) GDPR.
Where processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR, the data subject has the right to withdraw their consent at any time. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
The data subject also has the right to lodge a complaint with a supervisory authority if they believe that the processing of their personal data infringes the GDPR.
The competent supervisory authority is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Kavalleriestr. 2–4
40213 Düsseldorf
Germany
Phone: +49 211 38424-0
Email: email hidden; JavaScript is required
Processing When You Exercise Your Rights
If you wish to exercise your rights under Articles 15–22 GDPR, we will process the personal data you provide to facilitate the exercise of those rights and document the measures taken. We will process the data stored for the purpose of providing information and preparing responses solely for those purposes and for data protection compliance monitoring. Otherwise, we will restrict processing in accordance with Article 18 GDPR.
The legal basis for this processing is Article 6(1)(c) GDPR in conjunction with Articles 15–22 GDPR and Sections 10–14 DSG NRW.
Last updated: September 8, 2026
