Privacy Policy

1. Controller

The controller responsible for data processing on this website within the meaning of Art. 4 (7) GDPR is:

Heiko Vortmeyer
Großer Born 2e
22851 Norderstedt, Germany
Email: [email protected]

2. Data protection officer

A data protection officer has not been appointed. The statutory requirements of Art. 37 GDPR and § 38 BDSG are not met: no core activity involves regular and systematic large-scale monitoring, and fewer than twenty people are permanently engaged in the processing of personal data.

3. Hosting, content delivery network and server log files

This website is hosted by an external provider. Personal data collected on this website is stored on that provider’s servers.

Hosting provider: Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The servers are located within the EU. Processing on our behalf under Art. 28 GDPR is governed by Hostinger’s Data Processing Addendum, which forms part of the service agreement; Hostinger’s data protection contact is [email protected].

Requests are additionally routed through the content delivery network of Cloudflare Germany GmbH, Rosental 7, c/o Mindspace, 80331 Munich, Germany (parent company: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA). This speeds up delivery and protects the site against overload and attacks. In doing so, Cloudflare processes your IP address and technical metadata about the request. The legal basis is Art. 6 (1) (f) GDPR; the legitimate interest lies in fast, stable and attack-resistant delivery. A data processing agreement is in place. A transfer to the USA is possible; Cloudflare, Inc. is certified under the EU-US Data Privacy Framework. Further information: cloudflare.com/privacypolicy.

Each time the site is accessed, the provider automatically records information that your browser transmits, in what are known as server log files:

  • browser type and version
  • operating system used
  • referrer URL
  • host name of the accessing device
  • date and time of the request
  • IP address

Purpose: technically error-free provision and optimisation of the website, and protection against attacks.
Legal basis: Art. 6 (1) (f) GDPR. The legitimate interest lies in the secure and stable operation of the website.
Storage period: the log files are stored on the hosting provider’s systems and are deleted there as soon as they are no longer required for the secure operation of the servers. Hostinger does not publish a fixed period. We have no access to these files, do not evaluate them and do not merge them with other data.

4. Cookies and storage on your device

This website sets no cookies. There is no tracking, no web analytics and no advertising technology.

One single value is stored in your browser’s local storage: the language you select via the globe icon (key dl-lang). This only happens once you actively choose a language, it contains no personal data, and it is not transmitted to any server. This storage is strictly necessary to provide the function you explicitly requested and therefore does not require consent under § 25 (2) no. 2 TDDDG. You can delete the value at any time in your browser settings.

Because no consent-relevant technologies are used, this website does not need a cookie banner.

5. Fonts, images and audio files

All fonts (Bebas Neue, Inter), cover artwork, photographs and video preview images are served from this website’s own address. No connection to Google Fonts or to any other external font or media provider is established when the page loads. Apart from the delivery path described in section 3, simply visiting the site therefore causes no request to any third party.

6. Music videos (YouTube)

Music videos are embedded from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

The videos are not loaded when the page opens. Only a preview image stored on this server is displayed, together with a note about the data transfer. The YouTube player is loaded only after you actively click the play button (two-click solution), and then in extended privacy mode via youtube-nocookie.com.

Once you start a video, data – in particular your IP address, information about your browser and device, and the address of the page you are on – is transmitted to Google. Google may store this information and, if you are logged into a Google account, assign it to that account. YouTube may also store information on your device.

Legal basis: your consent, given by clicking play, under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. You can withdraw your consent at any time by not starting any further videos and by deleting the stored data in your browser settings.
Third country transfer: a transfer to the USA is possible. Google LLC is certified under the EU-US Data Privacy Framework, for which the European Commission has issued an adequacy decision under Art. 45 GDPR.
More information: policies.google.com/privacy

7. Audio previews (Apple)

Every release can be sampled with a 30-second preview. These audio files are provided by Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.

As with the videos, the audio file is only requested after you press play – there is no connection to Apple before that, and a note about the data transfer is displayed above the release grid.

When a preview starts, data – in particular your IP address – is transmitted to Apple.

Legal basis: your consent, given by pressing play, under Art. 6 (1) (a) GDPR.
Third country transfer: a transfer to the USA is possible. Apple Inc. is certified under the EU-US Data Privacy Framework (adequacy decision under Art. 45 GDPR).
More information: apple.com/legal/privacy

8. Links to streaming services and social networks

The icons for Spotify, Apple Music, Amazon Music, YouTube, Instagram, TikTok and X are plain hyperlinks. No social media plug-ins are embedded, so no data is transmitted merely by loading the page. Data is only transferred once you click a link and open the respective platform. The privacy policy of that provider then applies; we have no influence over the processing that takes place there.

9. Contact by email

If you contact us at the email address given above, your message including all personal data it contains will be stored and processed solely in order to handle your enquiry.

Legal basis: Art. 6 (1) (b) GDPR where the enquiry relates to a contract or pre-contractual measures, otherwise Art. 6 (1) (f) GDPR (legitimate interest in answering enquiries).
Storage period: the data is deleted once your enquiry has been dealt with conclusively and no statutory retention obligations apply.

10. Guest book in Room 404

Behind the access code in Room 404 you can leave an entry consisting of a name of your choice and a short message. Both are stored on our server and shown to everyone who enters the room.

We do not store your IP address for this, we do not set a cookie and we do not use recognition of any kind. Leaving an entry requires the access code, which is why no further protection against automated entries is needed. The only data stored are the name you enter, your message and the date.

Please do not enter personal data about yourself or others there. Entries are visible to everyone who enters the room. Links are rejected automatically.

Legal basis: Art. 6 (1) (a) GDPR – you consent by deliberately submitting the entry; in addition Art. 6 (1) (f) GDPR (legitimate interest in an exchange with listeners).
Storage period: until you ask for deletion or we remove the entry ourselves. At most 500 entries are kept; older ones drop out automatically.
Withdrawal and deletion: write to the email address in section 1 and name the entry. We will delete it without undue delay.

11. Recipients and transfers to third countries

Personal data is not passed on other than as described in this policy. Recipients are limited to:

  • the hosting provider and the content delivery network named in section 3 (Hostinger and Cloudflare), as processors under Art. 28 GDPR
  • Google Ireland Limited, if you start a video (section 6)
  • Apple Distribution International Ltd., if you start an audio preview (section 7)

Transfers to countries outside the EU/EEA only take place in the cases described in sections 6 and 7, and only on the basis of an adequacy decision of the European Commission (EU-US Data Privacy Framework).

12. Storage periods

Personal data is stored only for as long as is necessary for the respective purpose. The specific periods are stated in the individual sections. Beyond that, data is retained where statutory retention obligations under commercial or tax law require it.

13. No automated decision-making

Automated decision-making including profiling within the meaning of Art. 22 GDPR does not take place. Your data is not used to analyse or predict personal aspects.

14. Obligation to provide data

You are not obliged to provide personal data, either by law or by contract. Apart from the technically unavoidable server log files, the website can be used in full without providing any data.

15. Your rights

You have the following rights in respect of the personal data concerning you:

  • Access to the data stored about you (Art. 15 GDPR)
  • Rectification of inaccurate or incomplete data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR – see the following section)
  • Withdrawal of consent at any time with effect for the future (Art. 7 (3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

To exercise these rights, an informal message to the email address in section 1 is sufficient.

16. Right to object

Information on your right to object under Art. 21 GDPR: where data is processed on the basis of Art. 6 (1) (f) GDPR – on this website, that concerns the server log files described in section 3 – you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

17. Right to lodge a complaint

Without prejudice to any other remedy, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. The authority competent for the controller is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Holstenstraße 98
24103 Kiel, Germany
datenschutzzentrum.de

18. SSL/TLS encryption

For security reasons this website uses SSL/TLS encryption to protect the transmission of content. You can recognise an encrypted connection by the prefix “https://” in your browser’s address bar and by the lock symbol.

19. Status and changes

Version of this privacy policy: August 2026. We reserve the right to adapt this policy so that it always complies with current legal requirements or in order to reflect changes to the website. The current version applies to your next visit.

← Back to homepage