Museum für Naturkunde Berlin: Privacy Policy

1 Introduction

When you use our website, personal data is collected and stored in databases, log files or other systems. We strictly adhere to data protection regulations when processing the data collected.

2 Name and address of the data controller and contact details of the data protection officer

The controller responsible for the processing of personal data is:

Museum für Naturkunde Berlin
Invalidenstr. 43
10115 Berlin

Prof. Johannes Vogel, PhD, Director General
Tel.: +49 30 889140 - 8544
Email: johannes.vogel@mfn.berlin

Stephan Junker, Managing Director
Tel.: +49 30 889140 - 8330
Email: stephan.junker@mfn.berlin

Data Protection Officer of the Museum of Natural History:

Tel.: +49 30 889140 - 8440
Email: datenschutz@mfn.berlin

3 Use and disclosure of personal data

The data we collect is used exclusively for the stated purposes. Data is only disclosed in explicitly stated cases (e.g. conference registrations, named partners in jointly run projects, data managed within consortia). There is no unauthorised disclosure of data to uninvolved third parties. External service providers who process data on our behalf are not third parties within the meaning of data protection regulations; they are contractually obliged to comply with data protection regulations and are subject to our control.

Data will only be disclosed to government authorities where required by mandatory legal provisions or in cases of attacks on our systems for the purposes of criminal prosecution.

Once the data is no longer required, it is deleted.

The data is not used for automated decision-making (profiling).

4 Consent to further use

The use of some of our services may require the storage and use of your data beyond the cases described in point 5. In such cases, we will inform you and obtain your consent in advance.

5 The following data is processed when using our website services:

5.1 Logging of visits to the website and access to data and web services

When accessing the MfN’s online services, access data relevant to data protection and data security relating to this process is stored in a log file. Depending on the access log used, the log entry contains the following information:

IP address of the requesting computer
Host name of the IP address
Name of the requested web page, file or action
Date and time of the request
Amount of data transferred
Access status of the web server (file transferred, file not found, command not executed, etc.)
Description of the web browser used
URL from which the access was initiated.

The stored data is used exclusively for the purposes of identifying and tracking unauthorised access attempts or access to the web server, as well as for general statistical analysis. Profiles of individual users are not created. The analysis is carried out by authorised staff of the Museum für Naturkunde Berlin. The logged data is stored for up to three months, after which all non-anonymised data is deleted. The data in the log file is stored separately from any personal data provided by a data subject.

5.2 Cookies

Our website does not use cookies in the publicly accessible area.

If you log in as an editor in the TYPO3 backend, a technically necessary session cookie (e.g. be_typo_user) is set to enable login and the secure use of the backend. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in the secure provision and operation of the backend). The cookie is deleted at the end of the session or upon logout.

5.3 Web analytics with Fathom Analytics

The Museum für Naturkunde Berlin uses Fathom Analytics (Cloud) for the statistical analysis of our website usage. The provider is Conva Ventures Inc. (Fathom Analytics).

Fathom does not use cookies. For technical reasons, connection data (in particular IP address and user agent) is processed during transmission; according to the provider, IP addresses are not stored permanently but are anonymised prior to further processing (including through hashing) and only aggregated statistics are provided. We do not create user profiles.

Processing is carried out on the basis of our legitimate interest pursuant to Article 6(1)(f) of the GDPR (optimisation and needs-based operation of our website). Processing by Fathom takes place within the framework of data processing on our behalf pursuant to Article 28 of the GDPR. Further information: https://usefathom.com/legal/dpa

5.4 Registration

To register for various services we offer, we require certain details from you. These are used exclusively for the purpose specified in each case. In such instances, we will inform you in detail about the planned disclosure of the data and obtain your consent in advance. The data will only be stored until the matter has been fully processed and in compliance with statutory retention periods. The form you have completed is transmitted via the internet exclusively in encrypted form; however, this does not rule out the possibility of unauthorised parties gaining access to it. Registration/sign-up is voluntary and may be revoked at any time.

An email address is required for some registrations. In such cases, the registration may only become valid after the address has been confirmed, e.g. after you click on a link in an email sent to you by us. Further details are voluntary and serve, for example, to enable us to address you personally. Newsletters can be unsubscribed from at any time. Your data will be deleted from our system following unsubscription.

In some cases (e.g. electronic journals, wikis or blogs), the purpose of data collection is the publication or permanent storage of content created. Insofar as this content is subject to copyright, we are obliged, in order to clarify copyright issues and to safeguard the author’s moral rights, to verify and retain a minimum set of data (name and contact details, e.g. address or email) even after registration has ended. Insofar as this data was not publicly visible from the outset, it remains protected. However, it may be viewed by the publishers of the publication platform (electronic journals, wikis, blogs).

5.5 Orders

When placing orders via our website, you have the choice of whether to create a customer account with us or to order without a customer account.

To process your order, we process your name, address and email address, and where applicable your telephone number, as well as payment and order details. We process this data on the basis of Article 6(1)(b) of the GDPR in order to fulfil the contractual relationship with you, i.e. to send you the goods you have ordered and to process payments. Access to this data is restricted exclusively to employees of the Museum für Naturkunde Berlin involved in the contractual relationship and to service providers commissioned for this purpose and specifically obliged to handle this data with care (e.g. postal service providers), solely for the purposes of contract fulfilment.

We store our visitors’ data only for as long as is necessary to fulfil the respective processing purpose, for as long as statutory or contractual warranty and guarantee rights exist, or for as long as statutory retention obligations (e.g. arising from tax or commercial law provisions, Section 146 of the German Fiscal Code (AO) et seq.) apply.

5.6 Email

If you wish to communicate with us by email, please use our email address info@mfn.berlin or <name>@mfn.berlin if you have a specific contact person. Your email address will be used exclusively for our communication with you and will not be passed on to third parties, except in cases where disclosure to third parties is strictly necessary to address your enquiry, in which case disclosure will always only take place with your express consent. An encrypted email service is not currently available. If your message is confidential, you are welcome to contact us by post.</name>

5.7 Newsletter

The following information explains the content of our newsletter, as well as the registration, distribution and statistical analysis procedures, and your rights to object. By subscribing to our newsletter, you agree to receive it and to the procedures described.

5.7.1 Content of the newsletter

We send newsletters, emails and other electronic notifications containing promotional information (hereinafter “newsletters”) only with the consent of the recipients or where permitted by law. Where the content of the newsletter is specifically described during the subscription process, this content is decisive for the user’s consent. In addition, our newsletters contain information about the Museum of Natural History’s public events programme, information on publications relating to the Museum of Natural History’s research and public relations work, as well as competitions, prize draws and links to offers on our website or, in exceptional cases, the websites of our cooperation partners.

5.7.2 Double opt-in and logging

Subscription to our newsletter takes place via a so-called double opt-in procedure. This means that after subscribing, you will receive an email asking you to confirm your subscription. This confirmation is necessary to ensure that no one can subscribe using someone else’s email address.

Subscriptions to the newsletter are logged so that we can provide evidence of the subscription process in accordance with legal requirements. This includes storing the time of subscription and confirmation, as well as the IP address. Changes to your data stored with MailChimp are also logged.

5.7.3 Use of the mailing service provider “MailChimp”

The newsletter is sent via “MailChimp”, a newsletter distribution platform operated by Rocket Science Group LLC d/b/a MailChimp (Intuit), 675 Ponce De Leon Ave NE #5000, Atlanta, GA 30308, USA.

The email addresses of our newsletter recipients, as well as their other data described in this notice, are stored on MailChimp’s servers in the USA. MailChimp uses this information to send and analyse the newsletters on our behalf. Furthermore, according to its own information, MailChimp may use this data to optimise or improve its own services, e.g. for the technical optimisation of the dispatch and presentation of the newsletters, or for commercial purposes to determine which countries the recipients come from. However, MailChimp does not use the data of our newsletter recipients to contact them directly or to pass it on to third parties.

We have agreed a ‘Data Processing Addendum’ (DPA) with MailChimp, which governs processing in its capacity as a data processor (Art. 28 GDPR). As processing in the USA cannot be ruled out, MailChimp states that it bases data transfers to third countries on applicable transfer mechanisms (including the EU-US Data Privacy Framework; alternatively, standard contractual clauses). Further information: https://mailchimp.com/legal/data-processing-addendum/ and https://www.intuit.com/privacy/statement/data-privacy-certification/

5.7.4 Registration details

To subscribe to the newsletter, simply provide your email address. We also ask you to enter your first name and surname.

This information is used solely to personalise the newsletter. We only require your address details if you select the option to receive information from us by post. Information regarding your membership of the Friends’ Association, as a sponsor of one of our collection items, or as a holder of our annual passes is used solely for internal purposes and to avoid duplication of information.

5.7.5 Statistical surveys and analyses

The newsletters contain a so-called “web beacon”, i.e. a pixel-sized file that is retrieved from the MailChimp server when the newsletter is opened. As part of this retrieval, technical information – such as details about your browser and system – as well as your IP address and the time of retrieval are initially collected. This information is used to improve our services technically based on the technical data, or to analyse target groups and their reading behaviour based on their location (which can be determined using the IP address) or access times.

The statistical analysis also includes determining whether the newsletters are opened, when they are opened and which links are clicked. Although this information can, for technical reasons, be attributed to individual newsletter recipients, it is neither our intention nor that of MailChimp to monitor individual users. Rather, the analyses serve to help us identify our users’ reading habits and tailor our content to them, or to send different content according to our users’ interests.

5.7.6 Online access and data management

There are instances where we redirect newsletter recipients to Mailchimp’s websites. For example, our newsletters contain a link enabling recipients to view the newsletter online (e.g. in the event of display issues in the email programme). Furthermore, newsletter recipients can subsequently correct their data, such as their email address. Similarly, Mailchimp’s privacy policy is only available on their website.

In this context, we would like to point out that cookies and similar technologies may be used on Mailchimp’s websites and that personal data may be processed by Mailchimp in the process. We have no influence over this data collection. Further information can be found in Mailchimp’s privacy policy.

5.7.7 Cancellation/Withdrawal

You may cancel your subscription to our newsletter at any time, i.e. withdraw your consent. This will simultaneously revoke your consent to its dispatch via MailChimp and to statistical analyses. Unfortunately, it is not possible to withdraw consent separately for dispatch via MailChimp or for statistical analysis.

You will find a link to unsubscribe from the newsletter at the end of every newsletter.

5.7.8 Legal basis: General Data Protection Regulation

In accordance with the provisions of the General Data Protection Regulation (GDPR), which came into force on 25 May 2018, we hereby inform you that consent to the sending of emails is based on Article 6(1)(a) and Article 7 of the GDPR, as well as Section 7(2)(3) and Section 7(3) of the German Unfair Competition Act (UWG). The use of the mailing service provider Mailchimp, the carrying out of statistical surveys and analyses, and the logging of the registration process are based on our legitimate interests pursuant to Article 6(1)(f) of the GDPR. Our interest lies in the use of a user-friendly and secure newsletter system that serves both our business interests and meets users’ expectations.

We would also like to point out that you may object at any time to the future processing of your personal data in accordance with the legal provisions under Article 21 of the GDPR. In particular, you may object to processing for the purposes of direct marketing.

5.8 Applications and the application process

Interested users may apply for vacancies at the Museum für Naturkunde Berlin via the job advertisements. Additional personal data is processed as part of the application process. Further information on the scope and nature of the processing can be viewed here.

5.9 Use of YouTube

We use YouTube videos on our website. YouTube is a service provided by YouTube LLC, 901 Cherry Ave., San Bruno, CA 94066, USA. The data controller in the EU is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

We embed YouTube videos using a two-click solution. This means that no data is transferred to YouTube/Google when the page is first loaded. Only when you activate the video (second click) is a connection established with YouTube and the video loaded. In doing so, personal data (e.g. IP address, device/browser information, page accessed) may be processed and transferred to third countries (in particular the USA).

The legal basis is Article 6(1)(a) of the GDPR (consent through activation). If you do not activate a video, no data will be transferred to YouTube in this regard. Information on data protection at Google/YouTube: https://policies.google.com/privacy

5.10 Use of web fonts from Monotype

We embed fonts locally via our own servers. No connection is made to third-party servers (e.g. Monotype/fonts.com) in the process.

5.11 Use of Podigee

We use podcasts on our website that are provided via Podigee. Podigee is a service provided by Podigee GmbH, Revaler Str. 28, 10245 Berlin, Germany.

We integrate Podigee players using a two-click solution. No data is transmitted to Podigee when the page is loaded. Only when you activate the player is a connection established with Podigee and the content loaded. In doing so, personal data (e.g. IP address, device/browser information, page accessed) may be processed.

The legal basis is Article 6(1)(a) of the GDPR (consent through activation). Further information: https://www.podigee.com/de/ueber-uns/datenschutz/

5.12 Interactive content (H5P)

We use H5P to provide interactive content (e.g. learning modules/quizzes). Provided this content is hosted on our systems, no data is transferred to third parties; the information on logging in Section 5.1 applies. Where content is loaded from external platforms in individual cases, this only occurs after you have activated it (two-click solution); this may result in data being transferred to the respective provider.

6 Links to other providers

This privacy policy applies to the websites of the Museum für Naturkunde Berlin. Insofar as these refer to or link to third-party websites, the MfN accepts neither responsibility nor liability for the accuracy or completeness of linked content or for data security on the linked websites. The linked content is checked for obvious legal violations at the time the link is created. However, permanent monitoring of the content of linked pages is not reasonable without concrete evidence of a legal infringement. Should linked content violate applicable law or otherwise contain inappropriate content, we would be grateful for notification. The MfN has no influence over third parties’ compliance with data protection regulations. To verify this, you should consult the privacy policy of the respective service.

We link to social media profiles, amongst other things. These are standard links (not social media plugins), meaning that simply visiting our website does not result in any data being automatically transmitted to social media providers. The respective platform is only accessed when you click on a link.

7 Data security

Your personal data is stored on secure computers. To protect the data we collect from loss, manipulation or access by unauthorised persons, the Museum für Naturkunde Berlin employs technical and organisational measures that reflect the current state of the art. Access to data is regulated by authorisation procedures, ensuring that only those persons entrusted with processing the data have access to it. All staff members who collect, process or use personal data are bound by a duty of confidentiality.

In the course of various activities, personal data of data subjects is processed on a contract processing basis in accordance with Article 28 of the GDPR:

Conva Ventures Inc. (“Fathom Analytics”): 5.3 Web analytics
Rocket Science Group LLC d/b/a Mailchimp: 5.7 Newsletter
Google Ireland Limited (“Google”): 5.9 YouTube
Podigee GmbH (“Podigee”): 5.11 Podcasts

8 Data subjects’ rights

a) Right to confirmation

Every data subject has the right, granted by the European legislator, to request confirmation from the controller as to whether personal data concerning them is being processed. If a data subject wishes to exercise this right to confirmation, they may contact a member of staff of the controller at any time.

b) Right of access

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to obtain from the controller, at any time and free of charge, information regarding the personal data stored about them and a copy of this information. Furthermore, the European legislator has granted the data subject the right to information regarding the following:

the purposes of the processing
the categories of personal data being processed
the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations
where possible, the envisaged period for which the personal data will be stored, or, if this is not possible, the criteria used to determine that period
the existence of a right to rectification or erasure of personal data concerning them, or to restriction of processing by the controller, or a right to object to such processing
the existence of a right to lodge a complaint with a supervisory authority
where the personal data are not collected from the data subject: any available information as to the source of the data
the existence of automated decision-making, including profiling, in accordance with Article 22(1) and (4) of the GDPR and — at least in such cases — meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject

Furthermore, the data subject has the right to be informed whether personal data has been transferred to a third country or to an international organisation. If this is the case, the data subject is also entitled to receive information about the appropriate safeguards in connection with the transfer.

c) Right to rectification

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to request the immediate rectification of inaccurate personal data concerning them. Furthermore, the data subject has the right to request the completion of incomplete personal data — including by means of a supplementary statement — taking into account the purposes of the processing.

If a data subject wishes to exercise this right to rectification, they may contact a member of staff of the controller at any time.

d) Right to erasure (right to be forgotten)

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to request that the controller erase personal data concerning them without undue delay, provided that one of the following grounds applies and insofar as the processing is not necessary:

The personal data has been collected or otherwise processed for purposes for which it is no longer necessary.
The data subject withdraws their consent on which the processing was based pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR, and there is no other legal basis for the processing.
The data subject objects to the processing pursuant to Article 21(1) of the GDPR, and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GDPR.
The personal data has been processed unlawfully.
The erasure of the personal data is necessary for compliance with a legal obligation under Union law or the law of the Member States to which the controller is subject.
The personal data was collected in relation to information society services offered in accordance with Article 8(1) of the GDPR.

If any of the above grounds apply and a data subject wishes to request the erasure of personal data stored by the Museum für Naturkunde Berlin, they may contact the controller at any time (see 2.). The controller will ensure that the request for erasure is complied with without delay.

If the personal data has been made public by the Museum für Naturkunde Berlin and our organisation, as the controller, is obliged to erase the personal data in accordance with Article 17(1) of the GDPR, the Museum für Naturkunde Berlin shall, taking into account available technology and the cost of implementation, take appropriate measures, including technical measures, to inform other controllers processing the published personal data that the data subject has requested these other data controllers to delete all links to such personal data or copies or replicas of such personal data, insofar as the processing is not necessary.

e) Right to restriction of processing

Any data subject affected by the processing of personal data has the right, granted by the European legislator, to request from the controller the restriction of processing where one of the following conditions applies:

The data subject disputes the accuracy of the personal data, for a period enabling the controller to verify the accuracy of the personal data.
The processing is unlawful, the data subject objects to the erasure of the personal data and requests instead that the use of the personal data be restricted.
The controller no longer requires the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defence of legal claims.
The data subject has objected to the processing pursuant to Article 21(1) of the GDPR and it has not yet been determined whether the legitimate grounds of the controller override those of the data subject.

If any of the above conditions are met and a data subject wishes to request the restriction of personal data stored by the Museum für Naturkunde Berlin, they may contact the controller at any time (see 2.).

f) Right to data portability

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to receive the personal data concerning them, which the data subject has provided to a controller, in a structured, commonly used and machine-readable format. They also have the right to transmit this data to another controller without hindrance from the controller to whom the personal data was provided, provided that the processing is based on consent pursuant to Article 6(1)(a) of the GDPR or Article 9(2)(a) of the GDPR or on a contract pursuant to Article 6(1)(b) of the GDPR, and the processing is carried out by automated means, provided that the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Furthermore, when exercising their right to data portability pursuant to Article 20(1) of the GDPR, the data subject has the right to have the personal data transmitted directly from one controller to another, insofar as this is technically feasible and provided that this does not adversely affect the rights and freedoms of others.

To exercise the right to data portability, the data subject may contact the controller at any time (see 2.).

g) Right to object

Any data subject affected by the processing of personal data has the right, granted by the European legislator, to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them which is carried out on the basis of Article 6(1)(e) or (f) of the GDPR. This also applies to profiling based on these provisions.

In the event of an objection, the Museum für Naturkunde Berlin will no longer process the personal data unless we can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or the processing serves to establish, exercise or defend legal claims.

Where the Museum für Naturkunde Berlin processes personal data for the purposes of direct marketing, the data subject has the right to object at any time to the processing of personal data for the purposes of such marketing. This also applies to profiling insofar as it is related to such direct marketing. If the data subject objects to the Museum für Naturkunde Berlin regarding processing for the purposes of direct marketing, the Museum für Naturkunde Berlin will no longer process the personal data for these purposes.

Furthermore, the data subject has the right to object, on grounds relating to their particular situation, to the processing of personal data concerning them carried out by the Museum für Naturkunde Berlin for scientific or historical research purposes or for statistical purposes in accordance with Article 89(1) of the GDPR, unless such processing is necessary for the performance of a task carried out in the public interest.

To exercise the right to object, the data subject may contact the controller directly (see 2.). The data subject is also free, in connection with the use of information society services, notwithstanding Directive 2002/58/EC, to exercise their right to object by means of automated procedures using technical specifications.

h) Automated individual decision-making, including profiling

Any data subject affected by the processing of personal data has the right, granted by the European legislator, not to be subject to a decision based solely on automated processing — including profiling — which produces legal effects concerning them or similarly significantly affects them, provided that the decision (1) is not necessary for the conclusion or performance of a contract between the data subject and the controller, or (2) is authorised by Union or Member State law to which the controller is subject and which also lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests, or (3) is based on the data subject’s explicit consent.

If the decision (1) is necessary for the conclusion or performance of a contract between the data subject and the controller, or (2) is made with the explicit consent of the data subject, the Museum für Naturkunde Berlin shall take appropriate measures to safeguard the rights and freedoms as well as the legitimate interests of the data subject, including at least the right to obtain human intervention on the part of the controller, to express their point of view and to contest the decision.

If the data subject wishes to exercise rights in relation to automated decisions, they may contact the controller at any time (see 2.).

i) Right to withdraw consent

Every data subject affected by the processing of personal data has the right, granted by the European legislator, to withdraw consent to the processing of personal data at any time.

If the data subject wishes to exercise their right to withdraw consent, they may contact the data controller at any time (see 2.).

9 Validity and currency of the privacy policy

The privacy policy was updated on 09/02/2026 and is currently valid. Due to technological developments and changes in legal requirements, it may become necessary at any time to amend the privacy policy with effect for the future. We therefore recommend that you check the privacy policy regularly for updates.

This privacy policy contains sections of text generated by the privacy policy generator of DGD Deutsche Gesellschaft für Datenschutz GmbH, which conducts data protection audits, in cooperation with the media law firm WILDE BEUGER SOLMECKE.

Source:Museum für Naturkunde Berlin – Privacy Policy (edited)
Date: 09/02/2026