Privacy Policy
1. Controller
Luther 1517 gGmbH
Lutherstr. 42
06886 Lutherstadt Wittenberg
Germany
Represented by the Managing Directors:
Ulrich Schneider and Camilo Seifert
Phone: +49 3491 45949-10
E-mail: [email protected]
Audio guide contact:
Dirk Uhly
Data protection questions regarding the audio guide and technical enquiries
E-mail: [email protected]
2. Scope
This Privacy Policy applies to the WITTENBERG360 Audio Guide on w-360.de. The audio guide can be used on a private device with an access code or on an audio guide device provided by us.
3. Provision, security and server log data
When the audio guide is accessed, technically necessary connection data is processed. This may include, in particular, IP address, date and time, requested file or page, amount of data transferred, referrer as well as browser and operating system information. Processing serves the secure and reliable provision of the service, error analysis and prevention of misuse.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically error-free operation of the audio guide.
Web server logs: Web server logging is administered using the KeyHelp server management software. IP anonymisation of the web server logs is enabled. IP addresses are processed there only for the period required for technical analysis and are generally anonymised after 7 days as part of the automatic log rotation. Visitor IP addresses are not recorded in the web statistics system used (AWStats).
These web server logs are separate from the optional internal audio-guide usage statistics described in section 6. Log data is otherwise retained only for as long as necessary for operation, security and technical error analysis or where statutory obligations require longer storage.
4. Technically necessary session
The audio guide uses a technically necessary session for time-limited access and navigation. In particular, this ensures that a valid access is recognised and that the guide functions during the intended period of use.
Legal basis for data processing: Art. 6(1)(b) GDPR where processing is necessary to provide the requested audio guide; additionally Art. 6(1)(f) GDPR for security and prevention of misuse. Access to or storage of information on the end device is carried out, where strictly necessary, in accordance with Section 25(2) no. 2 TDDDG.
5. Company-owned audio guide devices
The devices provided by Luther 1517 gGmbH are used as operational audio guides. At present, Guide 01 and Guide 02 in particular are in use; the system is technically prepared for additional device numbers.
No optional visitor analytics and no consent-based tracking is activated on these devices. For operation, functional checks and usage overview, only reduced event data is recorded: guide number, time, selected language, accessed station or picture number, content type (audio/text) and the technical source within the guide. IP address, user agent, browser, operating system, referrer, browser language, screen size and viewport data are not stored for new playback records from company-owned guide devices.
When a company-owned guide device is issued, its device number is not linked in the audio guide system to a name, an identifiable individual, a booking or a visitor group. The operational data are not used to determine the identity of the individual visitor or to create a personal visitor profile. Where allocation to an individual use session is technically possible, the data are used only for operation, functional checks, error analysis and improvement of the audio guide workflow.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in operational security, functional checks and needs-based provision of the company-owned audio guide devices. Consent for optional statistics is not requested on these devices because optional statistics are disabled there.
6. Use on a private smartphone
When using an access code on a private device, technically necessary session functions are available independently of consent to statistics. Optional usage statistics are activated only if you have given prior consent.
If you consent to optional usage statistics, the following data may be processed for each recorded audio or text use: time, station or content, language, a session identifier, the access code used, IP address, general device type, browser and operating system, user agent, screen and viewport dimensions, device pixel ratio (DPR), browser language preference, referrer and the technical source within the audio guide. This information is used exclusively for internal analysis and to improve content, presentation, device compatibility and functionality of the audio guide. Access to detailed analysis is restricted to authorised administrative users.
Legal basis for optional statistics: Art. 6(1)(a) GDPR and, where information is stored on or read from the end device, Section 25(1) TDDDG. Consent is voluntary and may be withdrawn at any time with effect for the future via the cookie settings. The audio guide remains usable without consent to optional statistics.
7. Cookies and consent settings
Necessary cookies or session information are used exclusively for basic functions, access and security. Optional statistics are separated from these functions. On private devices, the selected cookie preference is stored so that the decision can be respected on subsequent page views.
8. Feedback
If you voluntarily submit feedback, we process the selected category and your message. Name and e-mail address are voluntary and are processed only if you provide them yourself. In the audio guide feedback function, IP address and user agent are not additionally stored together with the feedback.
Legal basis: Art. 6(1)(f) GDPR for processing and improving our service; for contact requested by you, additionally Art. 6(1)(b) GDPR or Art. 6(1)(a) GDPR where consent is applicable.
9. Fonts and QR code scanner
The audio guide uses system fonts or locally defined standard fonts. Google Fonts are not embedded in the audio guide.
The JavaScript library used for the QR code scanner is provided locally by w-360.de. Loading the QR scanner therefore does not require a connection to an external CDN.
Camera access occurs only if you use the QR scanning function and grant permission in your browser. The QR code is evaluated in the browser of the end device. The scan function does not send a camera image to an external QR service for evaluation.
10. Hosting by STRATO
The WITTENBERG360 Audio Guide is operated on a root server hosted within the infrastructure of STRATO GmbH.
Hosting provider:
STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany
When the audio guide is accessed, technically necessary data for providing the service is processed via STRATO's server infrastructure. This may include, in particular, IP address, date and time of access, requested pages or files as well as technical browser and connection information.
Where STRATO processes personal data on our behalf, STRATO acts as a processor pursuant to Art. 28 GDPR. A data processing agreement (DPA) is in place with STRATO.
The root server is technically administered by Dirk Uhly on behalf of Luther 1517 gGmbH. Contact for technical matters: [email protected]. Applications, databases and audio guide data on the server are managed within the operation of the WITTENBERG360 Audio Guide.
Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and technically error-free provision of the audio guide. Where processing is directly necessary to provide the audio guide requested by the visitor, Art. 6(1)(b) GDPR may additionally apply.
11. Storage period
Web server logs (KeyHelp): IP addresses in the web server logs are generally anonymised after 7 days as part of the automatic log rotation. These server logs are technically separate from the optional internal audio-guide usage statistics.
Optional usage statistics on private devices: Full IP addresses in the internal usage statistics are removed no later than after 7 days. After 90 days, further potentially identifying detail fields – in particular session identifier, private access code, user agent, referrer, browser language preference, screen and viewport data – are removed. The remaining statistical event data is deleted completely no later than after 365 days.
Company-owned guide devices: New playback events are stored from the outset without IP address, user agent, browser, operating system, referrer, browser language or display data. Existing older guide records are automatically reduced to this minimal data set. Session tokens of expired device uses are detached after 7 days; device usage history is deleted no later than after 365 days.
We do not store personal data for longer than necessary for the respective purpose. Session data is generally linked to use of the audio guide. Feedback is retained until processing is completed and thereafter only for as long as required for evidence, security or statutory retention obligations. Consent information is stored for as long as necessary to document and respect the relevant choice.
12. Your rights
Subject to the statutory requirements, you have in particular the rights to access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and objection (Art. 21 GDPR). Consent may be withdrawn at any time with effect for the future pursuant to Art. 7(3) GDPR.
13. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection law.
Competent supervisory authority:
State Commissioner for Data Protection of Saxony-Anhalt
Otto-von-Guericke-Straße 34a
39104 Magdeburg
Germany
Postal address: P.O. Box 1947, 39009 Magdeburg, Germany
Phone: +49 391 81803-0
E-mail: [email protected]
14. Requirement to provide data
Data required for access and technical provision must be processed for the audio guide to function. Providing data for optional statistics and voluntary feedback information is not required.
15. Automated decision-making
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place in the audio guide.
16. Version
Version: 23 August 2026.