1. Description of the Data Protection Activities
The privacy notice is provided in connection with the management of visitors, including Fellows and other guests (Distinguished Visitors and Guest Lecturers).
2. Name and Contact of the Controller
American Academy in Berlin GmbH
Am Sandwerder 17-19
14109 Berlin
GermanyAmerican Academy in Berlin
14 East 60th Street, Suite 1104
New York, NY 10022
USA
3. Contact Details of the Company’s Data Protection Officer at the AAB GmbH
Lars Beitlich
IfDuS GmbH
Landsberger Str. 396
81241 München
Tel.: +49 (89) 85 63 346 – 0
Fax: +49 (89) 85 63 346 – 90
E-Mail: privacy@ifdus.de
4. Purposes, Categories, and Legal Bases of the Data Processing
| Purpose | Categories | Legal Bases |
|---|---|---|
| Customer support services | Name, titles, and academic degrees; Address and contact information; Health data; Family data; Bank account information; Group characteristics (e.g. customer group); History of business relationship and correspondence; Event dates and thematic interests; Fellowship dates; Stay-related data, including data of accompanying family members; Photographic material; Research areas and projects / presentations; Curriculum vitae (CV) and career information |
Your data will be processed based on our legal obligations under art. 6, para. 1 lit. b and lit. c of the General Data Protection Regulation and based on our legitimate interests under art. 6, para. 1 lit. f of the General Data Protection Regulation (invitation, stay, public lecture, administrative processing). |
| Contract performance | Name, titles, and academic degrees; Address and contact information; Group characteristics (e.g. customer group); Event dates and thematic interests; Fellowship dates; Stay-related data, including data of accompanying family members; Photographic material; Research areas and projects / presentations; Curriculum vitae (CV) and career information; Library media lending service |
Your data is processed in accordance with our legal obligations under art. 6, para. 1 lit. b of the General Data Protection Regulation. |
| Product marketing | Name, titles, and academic degrees; Group characteristics (e.g. customer group); Event dates and thematic interests; Fellowship dates; Stay-related data, including data of accompanying family members; Photographic material; Research areas and projects / presentations; Curriculum vitae (CV) and career information |
Your data will be processed based on our legal obligations under art. 6, para. 1 lit. b of the General Data Protection Regulation and based on our legitimate interests under art. 6, para. 1 lit. f of the General Data Protection Regulation (invitation, stay, public lecture, networking). |
| Event management | Name, titles, and academic degrees; Address and contact information; Family data; Health data; Group characteristics (e.g. customer group); History of business relationship and correspondence; Event dates and thematic interests; Fellowship dates; Stay-related data, including data of accompanying family members; Photographic material; Research areas and projects / presentations; Curriculum vitae (CV) and career information |
Your data will be processed based on our legal obligations under art. 6, para. 1 lit. b and lit. c of the General Data Protection Regulation and based on our legitimate interests under art. 6, para. 1 lit. f of the General Data Protection Regulation (invitation, stay, public lecture). |
| Support for the stay at the American Academy in Berlin | Name, titles, and academic degrees; Address and contact information; Health data; Family data; Bank account information; Goods or services used, including amount, date, and payment method; Group characteristics (e.g. customer group); History of business relationship and correspondence; Event dates and thematic interests; Fellowship dates and Distinguished Visitorship dates; Stay-related data, including data of accompanying family members; Photographic material; Research areas and projects / presentations; Curriculum vitae (CV) and career information |
Your data will be processed based on our legal obligations under art. 6, para. 1 lit. b and lit. c of the General Data Protection Regulation and based on our legitimate interests under art. 6, para. 1 lit. f of the General Data Protection Regulation (invitation, stay, public lecture, networking, administrative processing). |
| Documentation of institutional history | Name, titles, and academic degrees; Address and contact information; Family data; Group characteristics (e.g. customer group); History of business relationship and correspondence; Event dates and thematic interests; Fellowship dates; Stay-related data, including data of accompanying family members; Photographic material; Research areas and projects / presentations; Curriculum vitae (CV) and career information |
Your data will be processed based on our legal obligations under art. 6, para. 1 lit. b of the General Data Protection Regulation and based on our legitimate interests under art. 6, para. 1 lit. f of the General Data Protection Regulation (knowledge management). |
| Alumni relations | Name, titles, and academic degrees; Address and contact information; Health data; Bank account information; Group characteristics (e.g. customer group); History of business relationship and correspondence; Event dates and thematic interests; Fellowship dates; Stay-related data, including data of accompanying family members; Photographic material; Research areas and projects / presentations; Curriculum vitae (CV) and career information |
Your data will be processed based on our legal obligations under art. 6, para. 1 lit. b and lit. c of the General Data Protection Regulation and based on our legitimate interests under art. 6, para. 1 lit. f of the General Data Protection Regulation (invitation, stay, public lecture, administrative processing). |
5. Source of the Data
The controller collected the personal data directly from you or the data is coming from publicly available sources of which the publication purpose is compatible with the processing activities described in this document.
6. Recipients or Categories of Recipients of Personal Data
Processors appointed by the company include cloud service providers, other companies of the corporate group, and service providers who are essential for corporate services, e.g. companies offering IT services, experts, and consultants.
7. Transfer of Personal Data to Third Countries
The data may be transferred to countries within and outside of the European Economic Area, in particular also to the United States of America. The company takes adequate and suitable security measures pursuant to applicable data protection laws to protect your data and ensure secure data transmission.
8. Retention Period for Personal Data
Usually, your personal data is stored for the duration of the business relationship or as long as it is necessary to comply with the legal retention periods defined to fulfil the specific tasks.
| Purpose | Retention Period |
|---|---|
| Customer support services | 10 years |
| Contract performance | 10 years |
| Product marketing | 5 years / 10 years for data communicated via email |
| Event management | 5 years / 10 years for data communicated via email |
| Support for the stay at the American Academy in Berlin | 2 years / 10 years for data communicated via email |
| Documentation of institutional history | Permanently |
| Alumni relations | Until revoked |
| Containing the COVID-19 pandemic/health data | Deletion immediately after the event or visit ends / 10 years for data communicated via email |
9. Rights of the Data Subjects
Pursuant to the European GDPR you, the data subject, have the following rights:
If your personal data is processed, you have the right of information on which data concerning you was processed (art. 15 GDPR).
In case inaccurate personal data was processed, you have the right to obtain rectification of the data concerning you (art. 16 GDPR).
Where the legal requirements are met, you may request erasure of your data or restriction of processing and object to the processing of the data concerning you (art. 17, 18 and 21 GDPR).
If you have consented to data processing or a contract pertaining to data processing exits or data processing is carried out by automated means, you have the right of data portability – where applicable (art. 20 GDPR).
Should you exercise any of the rights mentioned above, the controller reviews if the legal requirements are met for this purpose.
To exercise your rights, please contact the Data Protection Officer in charge. In case of any data protection complaints you can contact the competent supervisory authority, the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
10. Right of Revocation of Consent
If you have consented to the processing of your personal data by the controller having made an according declaration, you may revoke the consent with effect for the future at any time. The lawfulness of data processing carried out until the revocation remains unaffected by this due to your former consent.
Updated on: 26.08.2026