With this privacy policy we would like to inform you how we process personal data and explain your rights. We are aware of the importance that the processing of personal data has for you as a user, and we observe the applicable legal requirements accordingly. The protection of your privacy is of the highest importance to us. Your personal data is processed in compliance with the EU General Data Protection Regulation (GDPR) and, as the website is operated from Switzerland, with the Swiss Federal Act on Data Protection (FADP).
Last updated: 9 August 2026
Name and contact details of the controller
Tjioe Meyer Hecken
Wehrmuehle GmbH
HRB 199266 FF
Wehrmuehlenweg 8, 16359 Biesenthal, Germany
berlin@offsitearts.com
Offsite Arts is a project by Wehrmuehle GmbH, registered in Germany under HRB 199266 FF. No representative in the EU has been appointed, and no data protection officer is required for the limited processing described below.
Definitions
This privacy policy uses the terminology of the GDPR. “Personal data” means any information relating to an identified or identifiable natural person (the “data subject”), such as a name, an email address, a telephone number or an online identifier. “Processing” means any operation performed on personal data, such as collection, recording, storage, use, disclosure by transmission, restriction, erasure or destruction. “Controller” means the person or body that decides on the purposes and means of processing. “Processor” means a person or body that processes personal data on behalf of the controller. “Consent” means a freely given, specific, informed and unambiguous indication of your wishes agreeing to the processing of your personal data.
Processing operations
We collect and process the following personal data about you:
- First name and last name, submitted through the booking form
- Email address
- Telephone number (optional)
- Selected visit date and time slot
- Whether you asked to be informed about further projects (optional, off by default)
- The content of any message you send us by email, together with your email address
- Online identifiers in short-lived server logs (IP address, date and time of the request, browser type and version, operating system, requested address, status of the request, amount of data transferred)
Each reservation is for one person, so no number of visitors is collected. No account or login is required, and no special categories of personal data are collected. Automated decision-making and profiling do not take place.
Purposes of processing
- To process and manage visitor reservations
- To prevent duplicate bookings
- To manage exhibition capacity
- To send booking confirmations
- To communicate information necessary for your reservation (for example a change of date or access conditions)
- To respond to enquiries
- To maintain the security and functionality of the website
- To inform you about further projects, only if you explicitly asked for it
Legal basis of processing
- Your consent, Art. 6(1)(a) GDPR — for information about further projects
- Performance of, and steps prior to, the reservation you requested, Art. 6(1)(b) GDPR
- Compliance with legal obligations, Art. 6(1)(c) GDPR
- Our legitimate interests, Art. 6(1)(f) GDPR
Legitimate interests
Where we base processing on legitimate interests within the meaning of Art. 6(1)(f) GDPR, these are the secure and functioning operation of the website, protection against misuse and abusive or automated booking attempts, and orderly access control at the exhibition venue.
Data sources
We receive the data from you, including from the device you use. We do not obtain personal data about you from third parties or from publicly accessible sources.
Recipients or categories of recipients
When processing your data we work with the following service providers, who act as processors on our behalf. No advertising networks, social media pixels, tag managers or analytics services are used on this website.
- Website hosting & delivery: Lovable (lovable.dev) hosts and serves this website, including the server endpoints that handle bookings. Server logs may briefly contain technical data such as IP address for security and error diagnosis.
- Database: Booking records are stored in a managed PostgreSQL database provided through Lovable Cloud (operated on Supabase infrastructure, EU region).
- Email delivery: Booking confirmation and internal booking notification emails are sent through the email infrastructure provided with Lovable Cloud (delivery carried out by Mailgun). The recipient address and the booking details contained in the message are processed for delivery.
Your name and the date of your reservation are also visible to the staff carrying out access control at the venue on the day of your visit. The website links to our Instagram profile. The link is a plain hyperlink; no Instagram content is embedded and no data is sent to Instagram unless you click the link and thereby visit Instagram, where Instagram’s own privacy policy applies.
Transfers to third countries
The database holding booking records is hosted in the European Union. Hosting and email delivery providers may process data in, or access it from, countries outside Switzerland and the EU/EEA, including the United States. Where that happens, the transfer takes place on the basis of the standard contractual clauses and equivalent safeguards contained in those providers’ data processing agreements, which are intended to ensure an adequate level of protection for your data. If you would like details of the safeguards in place, write to berlin@offsitearts.com.
Duration of storage
Booking records are stored in order to manage the exhibition and its reservations. They are kept for up to 12 months after the end of the exhibition (25 September 2026) and are then deleted, unless a longer period is required by law or in order to handle a pending matter. Email correspondence is deleted once the enquiry has been dealt with and no retention obligation applies. Server log entries are short-lived and are deleted or overwritten automatically. The retention period is configured centrally and may be shortened.
Duplicate booking prevention
Admission is free and capacity is limited, so each email address may be used for one reservation for the whole exhibition. To enforce this, your email address is normalised (trimmed and lower-cased) and checked against existing reservations, and the database itself rejects a second reservation with the same address. This is the only purpose of that check; no profiling takes place.
Your rights
As a data subject you have — subject to the statutory conditions — the right:
- to request information about the processing of your data free of charge, together with a copy of your personal data, including the purposes of processing, the categories of data processed, the recipients of the data and the duration of storage or the criteria used to determine it;
- to have your data corrected or completed;
- to have your data erased or blocked;
- to have the processing restricted;
- to object to the processing of your data;
- to receive the data you provided in a portable form, where applicable;
- to withdraw your consent to processing with effect for the future; and
- to lodge a complaint with the competent supervisory authority about unlawful processing — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or in the EU/EEA your local data protection authority.
To exercise any of these rights, write to berlin@offsitearts.com.
Requirement or obligation to provide data
Unless expressly indicated at the point of collection, providing data is neither required nor obligatory. The first name, last name and email address in the booking form are necessary in order to create and confirm a reservation; without them a reservation cannot be made. The telephone number is optional.
Booking confirmation
When you make a reservation, we send you a confirmation email containing your name, the date and time of your visit, the venue address and the identification requirement. An internal notification of the booking is sent to the organisers. We do not send you any further email after your visit unless you separately asked to be informed about further projects.
Data security
We have taken technical and organisational measures to protect your data against risks such as unauthorised access, unauthorised disclosure, alteration or dissemination, as well as loss, destruction or misuse. Data is transmitted over encrypted HTTPS connections. Booking records are stored in a managed database accessible only to server-side code holding privileged credentials; they are never readable by other website visitors, are not exposed through any public endpoint and are never included in page URLs. Input is validated on the server, booking requests are rate limited, and credentials and keys are held as server-side secrets that are never included in the code delivered to your browser. No method of transmission or storage is completely secure, but we take reasonable measures to protect your data.
Log files
Each time our pages are accessed, usage data is transmitted by your browser and recorded in server log files. These records may contain the date and time of the request, the IP address of the accessing device, the pages requested, the amount of data transferred, the browser type and version, the operating system and whether the request was successful. These records are short-lived and are used only to deliver the website, to find and fix errors and to detect misuse.
Cookies
This website sets no cookies and uses no comparable tracking technologies. There are no first-party, third-party, performance, marketing, advertising or social media cookies. Your language selection and form input exist only in your browser’s memory for the duration of your visit. Because only technically necessary technologies are used, no consent banner is required. Should tracking technologies be introduced in future, consent will be requested before they are activated and this policy will be updated.
Changes
This privacy policy may be updated when the website, the services used, or applicable legal requirements change. The date of the latest update is shown above.
See also our Booking Terms and Legal Notice.