berlin.de privacy policy — score 80/100 (low risk)
Dernière analyse
Ce rapport date de plus de 28 jours. Il affiche la dernière analyse enregistrée pour cette politique — actualisez pour récupérer la page en direct et mettre à jour le score.
Le contenu du rapport (résumé, constats, citations) a été généré en anglais et n'est pas localisé.
Der Regierende Bürgermeister von Berlin – Senatskanzlei · berlin.de
Détails du rapport
low risqueThe Berlin Senate Chancellery's privacy policy is generally strong, using two-click consent for third-party media and anonymizing IPs, though it relies on standard contractual clauses for some sub-processors outside the EEA and lacks clarity on AI training.
The privacy policy of the Berlin Senate Chancellery (Senatskanzlei) demonstrates a high standard of GDPR compliance typical of German public authorities. It employs robust privacy-protective measures such as two-click solutions for YouTube, Google Maps, and Vimeo, ensuring no data is transmitted without explicit consent. IP addresses are truncated before processing for analytics (Mapp Intelligence), and analytics data is stored exclusively in Germany. However, there are notable gaps: video provider movingimage and chart tool Datawrapper use sub-processors in third countries relying solely on Standard Contractual Clauses (SCCs), and the retention period for contact form data is vaguely defined. Additionally, the policy is entirely silent on whether any integrated services use data for AI model training.
Évaluation par catégorie
Répartition de la politique selon les principaux domaines de conformité. Bon = solide, moyen = mitigé, faible = préoccupant.
IP addresses are truncated/anonymized before processing for analytics and translation, and forms only request necessary data.
The policy is highly structured, detailing specific legal bases, purposes, and retention periods for each distinct processing activity.
While two-click solutions prevent passive tracking, data is shared with several US tech companies (Google, Vimeo) and sub-processors upon consent.
Analytics data is kept in Germany, but movingimage and Datawrapper explicitly use sub-processors in third countries under SCCs.
The policy is entirely silent on whether integrated services (like translation or analytics) use processed data for training their own AI models.
All standard GDPR rights are clearly listed with contact details for the Data Protection Officer and the supervisory authority.
Constats clés
Clauses notables, problèmes ou bonnes pratiques identifiées (critiques en premier)
Third-Country Transfers via Sub-processors
movingimage and Datawrapper use sub-processors (CDNs) in third countries, relying on Standard Contractual Clauses (SCCs) without mentioning supplementary technical measures, which may be insufficient post-Schrems II.
Ambiguous Retention for Contact Forms
While browser data is deleted after 14 days, contact form data is kept until the 'conversation is concluded,' which is subjective and lacks a hard maximum retention period.
Strong Two-Click Implementation for Media
Google Maps, YouTube, and Vimeo are implemented with preview images and require active consent ('Akzeptieren und Anzeigen') before connecting to external servers, preventing passive data leakage to US tech companies.
IP Anonymization and Local Storage for Analytics
Mapp Intelligence truncates IP addresses before processing and stores data exclusively in Germany, mitigating cross-border transfer risks for analytics data.
Silence on AI/Model Training
The policy does not disclose whether any integrated third-party services (such as Conword for translation or Mapp for analytics) use the processed data for their own AI or machine learning model training.
Synthèse pour l'utilisateur
Your data is generally well-protected on this government site, especially since videos and maps only load if you click to accept them, but be aware that some underlying tools might send data to servers outside the EU.
Posture de conformité
The controller demonstrates a strong compliance posture, leveraging specific legal bases (Art. 6(1)(e) and (f)) for public task operations and implementing data protection by design (e.g., IP anonymization, two-click integrations). The main weaknesses are the reliance on SCCs without mentioning supplementary measures for third-country transfers, and ambiguous retention timelines for correspondence.
Transferts UE
Data transfers to third countries occur via movingimage and Datawrapper sub-processors (CDNs), relying on Standard Contractual Clauses. Google and Vimeo are US-based but are activated only after user consent. Analytics data is explicitly kept within Germany.
Signaux détectés
Données et pratiques spécifiques identifiées dans le texte
Extraits probants
Citations directes de la politique à l'appui de ces constats
Die Google Maps Karten sind mit einem Vorschaubild versehen, um zu vermeiden, dass bereits bei Betreten der Seite Daten an Google übermittelt werden.
Die IP-Adresse wird vor jeglicher Verarbeitung gekürzt und in anonymisierter Form zur Session-Erkennung und für die Geolokalisierung (bis auf Stadt-Ebene) verwendet.
movingimage setzt Unterauftragsverarbeiter in Drittstaaten ein. Insbesondere handelt es sich hierbei um den Betreiber des Content Delivery Networks (CDN).
Beendet ist die Konversation dann, wenn sich aus den Umständen entnehmen lässt, dass der betroffene Sachverhalt abschließend geklärt ist.
Manquant ou flou
- No mention of supplementary technical measures for third-country transfers alongside SCCs
- No explicit hard deadline for deleting contact form data
- No disclosure regarding AI model training by third-party processors
Questions à poser
- What specific technical and organizational measures ensure that Mapp Digital US cannot access the analytics data stored exclusively in Germany?
- Which specific third countries do the movingimage and Datawrapper sub-processors (CDNs) operate in, and have supplementary measures been implemented alongside SCCs?
- How is the conclusion of a 'conversation' via the contact form objectively determined to trigger deletion, and is there a maximum timeout?
- Do any of the integrated third-party services (like Conword or Mapp Intelligence) use the processed data for training their own AI or machine learning models?
Partager cette analyse
Toute personne disposant de ce lien peut consulter le résultat ci-dessus.
Conçu par DentroChat
Chat IA 100 % européen pour tous
Discutez avec l'IA, travaillez avec des fichiers, générez des images et cherchez sur le web. Les données restent en Europe.