Privacy policy

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Christoph Hein
Feldstraße 1
27809 Lemwerder
christoph.hein@museumsatlas.com
+49 151 28871722

2. Summary

MuseumsAtlas can be used without signing up. There are no user accounts, no newsletter and no ads. Without your consent we set no cookies and use no services that track you across websites.

Only if you agree in the cookie banner do we load the map (OpenFreeMap) or collect usage statistics with Google Analytics. You can change your choice at any time via “Cookie settings” at the bottom of every page.

3. Hosting and server log files

The website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA and delivered through its global network (CDN). Each page request involves technically necessary data: IP address, date and time, requested address, referrer, browser and operating system (user agent), status code and amount of data transferred. To redirect you from the home page to the right language version, your browser’s language setting is also evaluated but not stored.

The purpose is to provide the website securely and reliably; the legal basis is our legitimate interest under Art. 6(1)(f) GDPR. Vercel processes the data as a processor under a contract pursuant to Art. 28 GDPR and keeps log data only as long as necessary for operation and security. Vercel is certified under the EU-U.S. Data Privacy Framework; transfers to the US are based on the European Commission’s adequacy decision (Art. 45 GDPR), supplemented by standard contractual clauses.

4. Self-hosted content

Fonts and photos are served from our own server. The photos come from Wikimedia Commons, but viewing them does not create any connection to Wikimedia or to font providers such as Google Fonts. Author and license are shown with each image.

5. Consent (cookie banner)

We store your choice in the cookie banner in your browser’s local storage (localStorage, key “dm:consent”) so the banner does not appear on every page. Nothing is sent to us. The legal basis is Section 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act) in conjunction with Art. 6(1)(c) GDPR (proof of consent).

You can withdraw or change your consent at any time with effect for the future (Art. 7(3) GDPR) – using the button at the top of this page or “Cookie settings” in the footer.

6. Map (OpenFreeMap)

The interactive map uses map tiles, fonts and symbols from OpenFreeMap (tiles.openfreemap.org), operated by Hyperknot Software Kft. (Hungary). The map only loads after you consent to the “Map” category in the cookie banner or click “Load map”. Your browser then requests the map data directly from OpenFreeMap, transmitting your IP address, the requested map areas and browser data.

According to OpenFreeMap, it sets no cookies, does not log IP addresses by default and only does so for up to 30 days in case of security incidents. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Without consent you can use the website in full; only the map stays hidden. More at openfreemap.org/privacy.

7. Statistics (Google Analytics 4)

Only if you consent to the “Statistics” category do we use Google Analytics 4 by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Only then does your browser load the script from www.googletagmanager.com. This tells us which pages are visited how often, where visitors come from, and which devices, browsers, countries and regions they use, so we can improve content and usability.

For this purpose the cookies “_ga” and “_ga_<ID>” are set (stored for up to 2 years) to recognize your browser. Google uses the IP address only to estimate your approximate location and does not store it in the EU. Advertising features, Google signals and personalized ads are disabled (Consent Mode: ad_storage, ad_user_data and ad_personalization “denied”). Event data in Google Analytics is deleted after 14 months at the latest.

Google may transfer data to Google LLC in the US. Google LLC is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); standard contractual clauses apply in addition. Google processes the data on our behalf as a processor.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). If you withdraw it, tracking stops immediately and we delete the Analytics cookies. More: policies.google.com/privacy.

8. Local storage in your browser

Some features store settings only in your browser’s local storage (localStorage). This data never leaves your device:

• “dm:favorites” – your saved museums
• “dm:theme” – light or dark design
• “dm:locale” – your chosen language version
• “dm:currency” – your chosen currency for prices
• “dm:consent” – your cookie choice (see section 5)

The legal basis is Section 25(2) no. 2 TDDDG, as storage is strictly necessary for the feature you requested. You can delete this data at any time in your browser settings.

9. Location feature

“Near me” lets you sort museums by distance. Your location is only requested when you use this feature and allow it in your browser. The calculation takes place entirely on your device; your location is not sent to us or stored. If the map is loaded, your browser requests the map areas around your location from OpenFreeMap (see section 6).

10. Contact by email

If you email us, for example to report an error, we process your address and message only to handle your request (Art. 6(1)(f) GDPR, or (b) for contract-related inquiries). We delete the message once it has been dealt with, unless statutory retention obligations apply.

11. Links to other websites

We link to museum websites, ticket shops, Wikimedia Commons, OpenStreetMap and Google Maps (directions). Data is only transferred there when you click a link; the respective provider’s privacy policy then applies.

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7(3)). An informal message to the address above is sufficient.

Right to object: Where we process data based on legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the authority responsible for us, the Data Protection Commissioner of Lower Saxony: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, lfd.niedersachsen.de.

13. Further information

You are not obliged to provide personal data; however, the website cannot be displayed without the technically necessary connection data. There is no automated decision-making, including profiling. All data is transmitted in encrypted form (HTTPS/TLS).

We update this policy when the website or the legal situation changes. The version published here applies.

14. MuseumsAtlas app (iOS and Android)

This policy applies accordingly to the MuseumsAtlas app; the controller is the same (section 1). The app can be used without signing in – no user account, no advertising, no cookies. Unlike the website:

Museum data and map: The app loads museum data and photos from museumsatlas.com (hosting see section 3) and map tiles directly from OpenFreeMap (section 6); this technically requires transmitting your IP address. Because the map is the app’s core feature, it loads without asking first. The legal basis is our legitimate interest in a working app (Art. 6(1)(f) GDPR).

Location: The app only determines your location if you tap “My location” or “Nearby” and allow access. It is used solely on your device (distances, position on the map) and never sent to us. You can revoke access at any time in your device settings.

Usage statistics: Only if you agree in the introduction or under “More → Privacy” does the app use Google Analytics for Firebase by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It records which screens are opened, session duration, app version, device type, operating system, language and approximate country or region; for this, Firebase creates a random identifier for this installation. Your device’s advertising ID (IDFA/Advertising ID) is not used; advertising features and Google signals are disabled. Event data is deleted after 14 months at the latest. For transfers to the US see section 7. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG); if you turn statistics off again, collection stops immediately and the identifier is reset.

Storage on your device: The app stores your saved museums, language, appearance and currency, your choice on usage statistics and a copy of the most recently loaded museum data and exchange rates (offline use). This data never leaves your device and is removed when you delete the app.

Links: Museum websites, ticket shops and directions open your device’s browser or maps app; the respective provider’s privacy policy applies there.