berlin.de privacy policy — score 80/100 (low risk)
Ostatnia analiza
Ten raport ma ponad 28 dni. Pokazuje ostatnią zapisaną analizę tej polityki — odśwież, aby ponownie pobrać stronę na żywo i zaktualizować wynik.
Treść raportu (podsumowanie, ustalenia, cytaty) została wygenerowana po angielsku i nie jest zlokalizowana.
Der Regierende Bürgermeister von Berlin – Senatskanzlei · berlin.de
Szczegóły raportu
low ryzykoThe Berlin Senate Chancellery's privacy policy is generally strong, using two-click consent for third-party media and anonymizing IPs, though it relies on standard contractual clauses for some sub-processors outside the EEA and lacks clarity on AI training.
The privacy policy of the Berlin Senate Chancellery (Senatskanzlei) demonstrates a high standard of GDPR compliance typical of German public authorities. It employs robust privacy-protective measures such as two-click solutions for YouTube, Google Maps, and Vimeo, ensuring no data is transmitted without explicit consent. IP addresses are truncated before processing for analytics (Mapp Intelligence), and analytics data is stored exclusively in Germany. However, there are notable gaps: video provider movingimage and chart tool Datawrapper use sub-processors in third countries relying solely on Standard Contractual Clauses (SCCs), and the retention period for contact form data is vaguely defined. Additionally, the policy is entirely silent on whether any integrated services use data for AI model training.
Ocena według kategorii
Podział polityki na kluczowe obszary zgodności. Dobry = silny, umiarkowany = mieszany, słaby = niepokojący.
IP addresses are truncated/anonymized before processing for analytics and translation, and forms only request necessary data.
The policy is highly structured, detailing specific legal bases, purposes, and retention periods for each distinct processing activity.
While two-click solutions prevent passive tracking, data is shared with several US tech companies (Google, Vimeo) and sub-processors upon consent.
Analytics data is kept in Germany, but movingimage and Datawrapper explicitly use sub-processors in third countries under SCCs.
The policy is entirely silent on whether integrated services (like translation or analytics) use processed data for training their own AI models.
All standard GDPR rights are clearly listed with contact details for the Data Protection Officer and the supervisory authority.
Kluczowe ustalenia
Istotne klauzule, problemy lub dobre praktyki (krytyczne na początku)
Third-Country Transfers via Sub-processors
movingimage and Datawrapper use sub-processors (CDNs) in third countries, relying on Standard Contractual Clauses (SCCs) without mentioning supplementary technical measures, which may be insufficient post-Schrems II.
Ambiguous Retention for Contact Forms
While browser data is deleted after 14 days, contact form data is kept until the 'conversation is concluded,' which is subjective and lacks a hard maximum retention period.
Strong Two-Click Implementation for Media
Google Maps, YouTube, and Vimeo are implemented with preview images and require active consent ('Akzeptieren und Anzeigen') before connecting to external servers, preventing passive data leakage to US tech companies.
IP Anonymization and Local Storage for Analytics
Mapp Intelligence truncates IP addresses before processing and stores data exclusively in Germany, mitigating cross-border transfer risks for analytics data.
Silence on AI/Model Training
The policy does not disclose whether any integrated third-party services (such as Conword for translation or Mapp for analytics) use the processed data for their own AI or machine learning model training.
Podsumowanie dla użytkownika
Your data is generally well-protected on this government site, especially since videos and maps only load if you click to accept them, but be aware that some underlying tools might send data to servers outside the EU.
Postawa zgodności
The controller demonstrates a strong compliance posture, leveraging specific legal bases (Art. 6(1)(e) and (f)) for public task operations and implementing data protection by design (e.g., IP anonymization, two-click integrations). The main weaknesses are the reliance on SCCs without mentioning supplementary measures for third-country transfers, and ambiguous retention timelines for correspondence.
Transfery UE
Data transfers to third countries occur via movingimage and Datawrapper sub-processors (CDNs), relying on Standard Contractual Clauses. Google and Vimeo are US-based but are activated only after user consent. Analytics data is explicitly kept within Germany.
Wykryte sygnały
Konkretne dane i praktyki zidentyfikowane w tekście
Fragmenty dowodowe
Bezpośrednie cytaty z polityki potwierdzające te ustalenia
Die Google Maps Karten sind mit einem Vorschaubild versehen, um zu vermeiden, dass bereits bei Betreten der Seite Daten an Google übermittelt werden.
Die IP-Adresse wird vor jeglicher Verarbeitung gekürzt und in anonymisierter Form zur Session-Erkennung und für die Geolokalisierung (bis auf Stadt-Ebene) verwendet.
movingimage setzt Unterauftragsverarbeiter in Drittstaaten ein. Insbesondere handelt es sich hierbei um den Betreiber des Content Delivery Networks (CDN).
Beendet ist die Konversation dann, wenn sich aus den Umständen entnehmen lässt, dass der betroffene Sachverhalt abschließend geklärt ist.
Brakujące lub niejasne
- No mention of supplementary technical measures for third-country transfers alongside SCCs
- No explicit hard deadline for deleting contact form data
- No disclosure regarding AI model training by third-party processors
Pytania do zadania
- What specific technical and organizational measures ensure that Mapp Digital US cannot access the analytics data stored exclusively in Germany?
- Which specific third countries do the movingimage and Datawrapper sub-processors (CDNs) operate in, and have supplementary measures been implemented alongside SCCs?
- How is the conclusion of a 'conversation' via the contact form objectively determined to trigger deletion, and is there a maximum timeout?
- Do any of the integrated third-party services (like Conword or Mapp Intelligence) use the processed data for training their own AI or machine learning models?
Udostępnij tę analizę
Każda osoba z tym linkiem może zobaczyć wynik powyżej.
Stworzone przez DentroChat
100% europejski czat AI dla wszystkich
Rozmawiaj z AI, pracuj z plikami, generuj obrazy i przeszukuj sieć. Dane pozostają w Europie.