Data protection privacy statement

Below we inform you in accordance with Art. 12, 13 and 21 of the General Data Protection Regulation (DSGVO or GDPR) about the handling of your personal data when using our website as well as the initiation and execution of contracts in connection with our range of services.
Personal data are individual details about personal or factual circumstances of a specific or identifiable natural person. This includes information such as civil name, address, telephone number and date of birth.

I. Person responsible for data processing and contact data

Fine Art Academy Cologne
Proprietor: Guil Zekri
Brüsseler Str. 96, 50672 Cologne, Germany
phone: +49 (0) 221/16903012
E-mail: info@fineartacademycologne.com
Website: www.fineartacademycologne.com

We are not obliged to appoint a data protection officer.

II. Purposes and legal bases of data processing

We process your personal data in accordance with the provisions of the GDPR, the German Federal Data Protection Act and other applicable data protection provisions. The processing takes place exclusively, as far as this is necessary and permitted by data protection law, e.g. to enable you to visit our website or within the framework of contract initiation and contract execution. The scope and purpose of the respective data processing as well as the corresponding legal bases are listed individually below.

1. Informational use of the website

You can visit our website without providing any personal information. If you use our website for information purposes only, without contacting us or providing us with personal information, we will not process any personal data. Excluded from this are the data transmitted by your browser to enable you to visit the website and information transmitted to us within the framework of cookies used to use our website.
For the purpose of the technical provision of the website, it is necessary for us to process certain automatically transmitted information from you so that your browser can display our website and you can use the website. This information is automatically collected each time you visit our website and stored in our server log files. This information relates to the computer system of the calling computer. The following information is collected:

• IP address;
• Browser type/ version (e.g. Firefox 59.0.2 (64 Bit));
• Browser language (e.g.: German);
• Operating system used (e.g. Windows 10);
• Internal resolution of the browser window;
• Screen resolution;
• Javascript activation;
• Java On / Off;
• Cookies On / Off;
• Color depth;
• Time of access.

We process your personal data for the technical provision of our website on the basis of the following legal bases:

• to fulfil a contract or to carry out pre-contractual measures in accordance with Art. 6 Para. 1 lit. b DSGVO, insofar as you visit our website to inform yourself about our range of services; and
• to safeguard our legitimate interests pursuant to Art. 6 para. 1 lit. f DSGVO, in order to provide you with technical access to the website. Our legitimate interest is to provide you with an attractive, technically functional and user-friendly website and to take measures to protect our website against cyber risks and to prevent cyber risks for third parties from emanating from our website.

2. Active Use of the Site

In addition to the purely informational use of our website, you can also actively use our website to send us enquiries (e.g. regarding our course offerings or for the purpose of arranging a consultation), to post comments in our blog or to register for our newsletter. In addition to the above-mentioned processing of your personal data for purely informational purposes, we also process other personal data about you that we require to process your registration or to respond to your enquiry.

a) User enquiries; Blog
In order to be able to process and answer your inquiries to us, e.g. via the contact form or to our email address, or your comments in our blog, we process the personal data provided by you in this connection. For a reply by e-mail, we process your title, your name and your e-mail address in order to send you a reply, as well as the other information that you send us as part of your message. For a reply in the blog, we process your user name in any case.

We process your personal data to respond to user queries and comments on the basis of the following legal bases:

• to the protection of our legitimate interests pursuant to Art. 6 Para. 1 lit. f DSGVO; our legitimate interest consists in responding appropriately to customer enquiries.
• for the implementation of pre-contractual measures pursuant to Art. 6 Para. 1 lit. b DSGVO, insofar as you contact us to inform yourself about our range of services.

b) Compliance with legal regulations
We also process your personal data in order to fulfil other legal obligations that apply to us in connection with the operation of our website and the conduct of our business. This includes in particular commercial, trade or tax retention periods.

We process your personal data on the basis of the following legal bases:

• to fulfil a legal obligation to which we are subject pursuant to Art. 6 para. 1 lit. c DSGVO in connection with commercial, trade or tax law, insofar as we are obliged to record and store your data.

c) Law enforcement
We also process your personal data in order to assert our rights and assert our legal claims. We also process your personal data in order to defend ourselves against legal claims. Finally, we process your personal data to the extent necessary to defend against or prosecute criminal offences.

We process your personal data for this purpose on the basis of the following legal bases:

• to protect our legitimate interests pursuant to Art. 6 Para. 1 lit. f DSGVO, insofar as we assert legal claims or defend ourselves in legal disputes or we prevent or clarify criminal offences.

d) Newsletter and marketing measures
By subscribing to our newsletter, you have the opportunity to receive regular information about us and our range of services. Of course, you will only receive our newsletter if you have given us your express permission to do so. We process mandatory information, such as your title, name and e-mail address, in order to be able to send you our newsletter. You can click on the link provided in the newsletter to unsubscribe at any time.

To obtain your consent, we use the so-called double opt-in procedure, i.e. we only send you a newsletter when you request it by clicking on the confirmation link in a notification e-mail sent separately by us. This notification e-mail is sent by “Fine Art Academy Cologne on behalf of Fine Art Academy Cologne” and has the subject “Fine Art Academy Cologne: Confirmation of Newsletter Registration”.

We process your data for the dispatch of newsletters on the following legal basis:

• If you have given us your consent using the double opt-in procedure, in accordance with Art. 6 Para. 1 lit. a DSGVO.

e) Use of data for e-mail advertising and your right of objection
If we receive your e-mail address in connection with the conclusion of the contract and the provision of our services and you have not objected to this, we reserve the right to send you offers for similar services from our range of courses by e-mail on a regular basis. You can object to this use of your e-mail address at any time by sending a message to the contact person described below or via a link provided for this purpose in the advertising mail, without incurring any costs other than the transmission costs according to the basic rates.

We process your data for e-mail advertising on the following legal basis:

• if you have provided us with your e-mail address in connection with the use of our services (see above), to protect our legitimate interests pursuant to Art. 6 Para. 1 lit. f DSGVO i.V.m. § 7 para. 3 UWG; our legitimate interest is based on our economic interests in the implementation of advertising measures.

3. Links on the website, social media links

Our website contains links to third-party websites and links (buttons) to services such as Facebook, YouTube and Instagram. After clicking on the link you will be taken to the page of the respective provider.

These websites are subject to their own data protection principles. We are not responsible for their operation including data handling. If you send information to or through such third-party sites, you should review the privacy statements of those sites before sending them information that personally identifies you.

4. Contract initiation and execution

The processing of your personal data, which you make available to us within the scope of the preparation of a contract conclusion, e.g. during the agreement or execution of a consultation, during the binding registration for our course offer or during the execution of a contract with us, takes place for the purpose of the offer and sale of our services as well as for the fulfilment of our resulting obligations. We process your personal data within the framework of contract initiation and contract execution on the basis of the following legal basis:

to carry out pre-contractual measures and to justify, carry out and, if necessary, terminate our contracts with you pursuant to Art. 6 para. lit. b DSGVO.

5. Categories of recipients

Initially, only our employees receive knowledge of your personal data. In addition, to the extent permitted or required by law, we share your personal information with other recipients who provide services to us in connection with our website. We limit the disclosure of your personal data to what is necessary, in particular to process your requests. Some of our service providers receive your personal data as contract processors and are then strictly bound by our instructions when handling your personal data. In some cases, the recipients act independently with your data, which we transmit to them.

Below we list the categories of recipients of your personal data:

• IT service provider for the administration and hosting of our website;
• Service providers for the registration and dispatch of our newsletter;
• Banks in connection with the processing of payments (direct debit authorisation for course fees);
• If applicable, legal adviser in the assertion of our claims.

6. Third country transfer

We do not transfer your personal data to countries outside the EU or the EEA or to international organisations.

7. Duration of storage

a) Informational use of the website
When using our website for purely informational purposes, we store your personal data on our servers exclusively for the duration of your visit to our website. After you have left our website and close your browser, your personal data will be deleted immediately.

b) Active use of the website; contract initiation and contract processing
If you actively use our website, we store your personal data initially for the duration of answering your inquiry or for the duration of our business relationship. This also includes the initiation of a contract (pre-contractual legal relationship) and the execution of a contract.

If we collect your personal data during a consultation, we store your data for the duration of the consultation including the initiation of a contract (pre-contractual legal relationship) or for the duration of our business relationship and the execution of a contract.

In addition, we then store your personal data until the statute of limitations for any legal claims arising from the relationship with you, in order to use them as evidence if necessary. The limitation period is generally between 12 and 36 months, but can also be up to 30 years.

We will delete your personal data as soon as the limitation period has expired, unless there is a legal obligation to retain it, for example from the German Commercial Code (§§ 238, 257 para. 4 HGB) or from the German Tax Code (§ 147 para. 3, 4 AO). These storage obligations can amount to two to ten years.

c) Newsletter
Your data, which you have transmitted to us within the scope of your consent to the newsletter dispatch, will be deleted as soon as you revoke your consent.

8. Your rights as an affected person

Under the statutory conditions, you are entitled to the following rights as a person concerned, which you can assert against us:

Right to information: You are entitled at any time to request confirmation from us within the framework of Art. 15 DSGVO as to whether we are processing personal data concerning you; if this is the case, you are also entitled within the framework of Art. 15 DSGVO to request information about this personal data as well as certain further information (e.g. processing purposes, categories of personal data, categories of recipients, planned storage period, the origin of the data, the use of an automated decision making process, etc.).

Right to rectification: You are entitled, pursuant to Art. 16 DSGVO, to demand that we rectify the personal data stored about you if it is inaccurate or erroneous.

Right to deletion: You are entitled to demand that we delete personal data concerning you immediately, subject to the requirements of Art. 17 DSGVO. The right to deletion does not exist, among other things, if the processing of personal data is necessary for (i) the exercise of the right to freedom of expression and information, (ii) the fulfilment of a legal obligation to which we are subject (e.g. statutory storage obligations) or (iii) the assertion, exercise or defence of legal claims.

Right to limitation of processing: You are entitled to demand that we restrict the processing of your personal data subject to the conditions of Art. 18 DSGVO.

Right to data transfer: You are entitled, under the conditions of Art. 20 DSGVO, to demand that we transfer to you the personal data concerning you which you have provided to us in a structured, common and machine-readable format.

Right of revocation: You have the right to revoke your consent to the processing of personal data at any time with effect for the future.

Right of objection: You are entitled to object to the processing of your personal data under the conditions of Art. 21 DSGVO, so that we must stop processing your personal data. The right of objection only exists within the limits provided for in Art. 21 DSGVO. In addition, our interests may prevent the processing from being terminated, so that we are entitled to process your personal data despite your objection.

Right of appeal to a supervisory authority: You are entitled, under the conditions of Art. 77 DSGVO, to lodge a complaint with a supervisory authority, in particular in the member state of your place of residence, your place of work or the place of the presumed infringement, if you are of the opinion that the processing of your personal data violates the DSGVO. The right of appeal is without prejudice to any other administrative or judicial remedy.

The supervisory authority responsible for us is:

State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia
P.O. Box 20 04 44
40102 Düsseldorf, Germany
Phone: 0211/38424-0
Fax: 0211/38424-10

If possible, your requests concerning the exercise of your rights should be addressed in writing to the address given under I. Above.

9. Scope of your obligations to provide data

In principle, you are not obliged to provide us with your personal data. However, if you do not do this, we will not be able to make our website available to you, answer your enquiries to us and conclude a contract with you regarding our range of services. Personal data, which we do not necessarily need for the processing purposes mentioned above, may be marked as voluntary information.

10. Automated decision making / profiling

We do not use automated decision making or profiling (an automated analysis of your personal circumstances).

11. Changes

We reserve the right to change this privacy statement at any time. Any changes will be announced by publishing the amended privacy policy on our website. Unless otherwise stated, such changes will be effective immediately. Therefore, please check this Privacy Policy periodically to ensure that you have the most current version.

12. Right of objection

You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data on the basis of Art. 6 para. 1 sentence 1 lit. e (performance of a task in the public interest) or lit. f (legitimate interest of the person responsible) DSGVO; this also applies to profiling based on these provisions. We will no longer process your personal data unless we can prove compelling reasons for the processing worthy of protection which outweigh your interests, rights and freedoms, or the processing serves the assertion, exercise or defence of legal claims.

If your personal data is processed by us for the purpose of direct marketing, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling, to the extent that it is associated with the processing of your personal data.

If your personal data are processed by us for the purpose of direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is connected with such direct advertising. If you object to the processing for purposes of direct marketing, the personal data concerning you will no longer be processed for these purposes.