berlin.de privacy policy — score 65/100 (medium risk)
Last analyzed
This report is more than 28 days old. It shows the last saved analysis for this policy — refresh to re-fetch the live page and update the score.
Report details
medium riskThe Senatskanzlei’s privacy notice mixes solid safeguards for basic logging but relies heavily on consent and US‑based third‑party services, leaving several GDPR gaps.
The policy provides detailed descriptions for many processing activities (browser logs, analytics, contact forms, newsletters, event registrations) and lists legal bases. It uses legitimate interest for technical logs and consent for newsletters and embedded media. However, it transfers personal data to several US‑based providers (Google, Vimeo, movingimage, Datawrapper) with only generic references to Standard Contractual Clauses, lacks explicit DPIA references, does not address AI/model training, and offers vague retention periods for some categories. Overall compliance is mixed.
Category Assessment
Breakdown of the policy across key compliance areas. Good = strong, fair = mixed, poor = concerning.
Collects extensive technical data (IP, OS, referrer) even when only minimal data may be needed for page rendering.
Provides separate sections for each service with clear legal bases, but some processing (e.g., AI use) is omitted.
Shares data with many third parties (Google, Vimeo, movingimage, Datawrapper, Mapp) and only sometimes mentions that data are not passed on further.
Transfers to US providers are disclosed, but safeguards (SCCs, adequacy) are only mentioned in passing.
No information on whether collected data are used for profiling or training AI models.
Rights are listed comprehensively, though procedural details per service are limited.
Key Findings
Notable clauses, issues, or positive practices discovered (critical first)
Legitimate interest used for extensive technical logging
The policy relies on Art. 6 (1) f DSGVO for browser logs that include IP address, OS, referrer, and user‑agent, which may exceed what is strictly necessary for security.
US‑based third‑party services with limited transfer safeguards
Google Maps, YouTube, Vimeo, movingimage and Datawrapper are US‑based; the notice only generically states that SCCs are in place for movingimage and Datawrapper, leaving the legal basis for other transfers unclear.
No mention of AI or profiling
The document does not address whether any collected data (e.g., search terms in Mapp Intelligence) are used for automated decision‑making or model training, which is required under Art. 22 DSGVO if applicable.
Consent mechanisms lack clear withdrawal process
Two‑click opt‑in for embedded media and double‑opt‑in for newsletters are described, but the policy does not explain how consent is recorded, audited, or withdrawn across devices.
Vague data retention for contact‑form and event data
The notice says data are deleted "sobald sie für die Erreichung des Zweckes nicht mehr erforderlich sind" without concrete timeframes, unlike the precise 14‑day or 4‑year periods for other logs.
Consumer Takeaway
You can use the site, but be aware that personal data (IP, browsing details) may be sent to US services and the notice does not fully explain how you can control that.
Compliance Posture
mixed
EU Transfers
The notice acknowledges transfers to the US (Google, Vimeo, movingimage, Datawrapper) and claims SCCs for some, but does not provide concrete evidence or detail for all, making the assessment incomplete.
Detected Signals
Specific data points and practices identified in the text
Evidence Snippets
Direct quotes from the policy supporting these findings
Die Daten werden nach 14 Tagen gelöscht.
Der Webanalysedienst verwendet temporäre Sessioncookies, mit einer auf den Besuch begrenzten Laufzeit.
Die IP‑Adresse wird vor jeglicher Verarbeitung gekürzt und in anonymisierter Form zur Session‑Erkennung … verwendet.
Sobald Sie durch Anklicken des Buttons „Akzeptieren und Anzeigen“ der Anzeige von Inhalten zugestimmt haben, willigen Sie gemäß Art. 6 Abs. 1 S. 1 lit. a DSGVO darin ein, dass Ihre Daten an Google übertragen werden.
movingimage hat uns im Auftragsverarbeitungsvertrag zugesichert, dass mit diesen Unterauftragsverarbeitern Standardvertragsklauseln abgeschlossen wurden.
Missing or Unclear
- No explicit statement on whether data are used for AI model training or profiling.
- No reference to a Data Protection Impact Assessment (DPIA) for high‑risk processing (e.g., US transfers, analytics).
- No detailed procedure for how users can withdraw consent for embedded media across devices.
Questions to Ask
- Haben Sie für alle US‑basierten Dienste (Google, Vimeo, movingimage, Datawrapper) ein dokumentiertes DPIA vorliegen?
- Wie wird das Opt‑out‑Cookie für Mapp Intelligence technisch umgesetzt und wird es in allen gängigen Browsern respektiert?
- Welche konkreten Aufbewahrungsfristen gelten für die Daten, die über Kontakt‑ und Veranstaltungsformulare erhoben werden?
- Werden die gesammelten Suchbegriffe aus Mapp Intelligence für maschinelles Lernen oder Profiling verwendet?
- Können Sie Nachweise über die abgeschlossenen Standardvertragsklauseln für alle Drittland‑Transfers erbringen?
Share this analysis
Anyone with this link can view the result above.
Built by DentroChat
100% European AI chat for everyone
Chat with AI, work with files, generate images, and search the web. Data stays in Europe.