panke.gallery – Verein für künstlerisch-kulturelle Bildung e.V.
Gerichtstr. 23 · Hof V
13347 Berlin, Germany
info [at] panke.gallery

We are the controller under the General Data Protection Regulation (GDPR). The board that represents the association is named in the imprint.

• No cookies, no advertising and no tracking across websites.
• Our visitor statistics (Matomo) run without cookies, with shortened IP addresses and without user profiles.
• Content from other providers, such as Google Maps, YouTube and Twitch, loads only after you click.
• We only process what you send us yourself: a newsletter sign-up, an RSVP or an email.

Hosting

The website is hosted by Netlify, Inc., 101 2nd Street, San Francisco, CA 94105, USA. When you open a page, your browser sends technical data to Netlify's servers: IP address, date and time, the page requested, referrer, and browser and operating system. Netlify needs this data to deliver the site and keep it secure.

Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Netlify processes the data on our behalf under a data processing agreement. Netlify is certified under the EU-US Data Privacy Framework, which covers transfers to the USA (Art. 45 GDPR).

Images

Images are delivered by the content management system Contentful (Contentful GmbH, Max-Urich-Straße 3, 13355 Berlin, Germany) from images.ctfassets.net. Your browser loads them directly from Contentful's servers, which receive your IP address and the technical data listed under Hosting.

Legal basis: Art. 6(1)(f) GDPR, our interest in delivering images quickly. Contentful processes the data on our behalf under a data processing agreement. Its content delivery network can serve images from servers outside the EU; such transfers are covered by the EU-US Data Privacy Framework or the EU's standard contractual clauses.

Visitor statistics (Matomo)

We count page views with Matomo, an open-source analytics tool that we host ourselves, on a server rented from netcup GmbH in Karlsruhe, Germany. Matomo records the page viewed, the time, the page that linked to it (without any parameters in its address), browser, operating system, screen resolution and a rough location (usually the country). Your IP address is shortened by two bytes (e.g. 192.168.xxx.xxx) before anything is stored or looked up, so it can no longer be traced back to you.

Matomo sets no cookies and stores nothing on your device. Every page view is counted on its own and is not linked to your other page views, so Matomo cannot recognise you, not even during one visit. It builds no user profiles, and the data is not passed on to anyone. We use the figures only to see which parts of the site are read and to improve it.

Legal basis: Art. 6(1)(f) GDPR, our interest in understanding how the site is used. You can object at any time, for example by enabling "Do Not Track" in your browser, which Matomo respects, or by emailing us. Data about individual page views is deleted after 180 days; only aggregated statistics, which contain no personal data, are kept.

Newsletter

If you subscribe to our newsletter, your email address and, if you give it, your name are stored in our newsletter software listmonk, which we host ourselves on a server rented from Hetzner Online GmbH in Germany. Nothing is sent to the newsletter server until you submit the form.

After signing up you receive an email with a confirmation link (double opt-in). We record the time of sign-up and confirmation as proof of your consent.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time through the link in every newsletter. Your address then stays in our list marked as unsubscribed, so you get no further newsletters. If you want it deleted completely, email us.

RSVP for events

For some events you can register through a form on the event page. We ask for your name and email address, and you can add a comment. We store the registration in our own database (Baserow, which we host ourselves on a server rented from Hetzner Online GmbH in Germany) to manage the guest list and the number of places.

You receive a confirmation email, which is sent through Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) under a data processing agreement. Resend stores the email and its delivery log in the USA for 30 days. Resend is certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

Legal basis: Art. 6(1)(b) GDPR, as you asked to attend the event. We delete your registration, with your name, email address and comment, 3 months after the event. After that we keep only the number of registrations per event, which can’t be traced back to you.

Email

If you email us, we use your address and message only to reply. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR if it concerns a contract. We delete the messages once the matter is settled, unless we are legally required to keep them.

Google Maps (only after a click)

The map on the contact page is not loaded until you click "Show map". Only then does your browser connect to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may set cookies. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

Legal basis: your consent through the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The consent applies to that one page view. See Google's privacy policy: https://policies.google.com/privacy

YouTube (only after a click)

Some event pages show a recording from our YouTube channel. The video is not loaded until you click "Watch recording". Only then does your browser connect to YouTube through youtube-nocookie.com (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and may store information on your device. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

Legal basis: your consent through the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG). The consent applies to that one page view. See Google's privacy policy: https://policies.google.com/privacy

Twitch (only after a click)

During some events we stream live on Twitch. While a stream is running, the homepage and the event page offer a player. It is not loaded until you click "Play stream". Only then does your browser connect to Twitch (Twitch Interactive, Inc., 350 Bush Street, 2nd Floor, San Francisco, CA 94104, USA), which receives your IP address and may set cookies. Twitch's representative in the EU under Art. 27 GDPR is Twitch Interactive Germany GmbH, Marcel-Breuer-Str. 12, 80807 München, Germany (privacy@twitch.tv). Twitch is not certified under the EU-US Data Privacy Framework, so there is no adequacy decision for this transfer to the USA; US authorities may be able to access the data. By clicking, you also consent to this transfer.

Legal basis: your consent through the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG; for the transfer to the USA Art. 49(1)(a) GDPR). The consent applies to that one page view. See Twitch's privacy notice: https://www.twitch.tv/p/legal/privacy-notice/

Stored on your device

The website uses no cookies. It keeps a few entries in your browser's local storage, only to provide what you asked for (§ 25(2) no. 2 TDDDG):

• themeColor: the colour you picked in the colour switcher.
• audioguide-language: the audio guide language you picked.

The site also installs a service worker that keeps copies of its pages and files in your browser's cache, so the site loads faster and works offline. It contains no personal data.

You can delete all of this in your browser settings at any time.

Links to social media

We link to our profiles on Instagram, Facebook, Mastodon, Bluesky, Threads, TikTok, Telegram, YouTube and Twitch. These are plain links: no data goes to these platforms until you follow a link. Their own privacy policies apply from then on.

Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR),
• have it corrected (Art. 16) or deleted (Art. 17),
• restrict its processing (Art. 18),
• receive it in a portable format (Art. 20),
• object to processing based on our legitimate interests (Art. 21),
• withdraw your consent at any time, with effect for the future (Art. 7(3)).

Email info [at] panke.gallery for any of these.

You can also complain to a data protection authority (Art. 77 GDPR). Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, https://www.datenschutz-berlin.de

We do not use automated decision-making or profiling.

Last updated: 9 November 2026