YOUR DATA.
YOUR RIGHTS.

1. Data controller

This notice concerns personal data processed when visiting the artist website and making contact enquiries. The applicable framework is the GDPR, the Austrian Data Protection Act and, for access to devices, section 165(3) of the Austrian TKG 2021.

2. Website access and hosting

Serving pages, images, fonts and audio samples requires connection and request data to reach the delivering servers. This includes your IP address and the requested address and, depending on the request, timing, browser and HTTP status information. The purpose is secure website delivery, troubleshooting and prevention of abuse. The intended legal basis is Article 6(1)(f) GDPR: the legitimate interest in a secure, functioning website.

3. Contact and booking enquiries

The contact form sends your name, email address, enquiry type, optional date and venue, and message to the web server. The server forwards the enquiry by email to the contact address. A simple arithmetic challenge helps limit automated requests. To limit requests and prevent reuse, hashed keys and counters are stored in the website database. These counters are relevant for approximately 24 hours and are cleaned up during a later request. The application does not store the message in the website database; it is transmitted by email.

Enquiries about arranging or performing a service are processed under Article 6(1)(b) GDPR. General correspondence is based on Article 6(1)(f) GDPR, with the legitimate interest of responding appropriately to incoming messages. The information is used to handle and answer your enquiry. Providing it is voluntary; without sufficient contact and enquiry details it may not be possible to reply. You may also email directly.

4. Retention

Enquiries are to be deleted when they have been resolved and are no longer needed. Records subject to statutory retention requirements are kept for the applicable legal period (Article 6(1)(c) GDPR). Further retention to establish, exercise or defend specific legal claims is limited to what is necessary for that purpose (Article 6(1)(f) GDPR).

5. Recipients and international processing

Hosting and email providers receive the technical data or communication data required to deliver their services. Any appointed technical support is limited to the access necessary for its task.

6. Cookies, fonts and media

The website application code uses no analytics or advertising trackers. Signing into event management sets a necessary session cookie (see section 11). Fonts, photos, cover artwork and audio samples are served from this website’s files. No YouTube, Facebook or map embeds load automatically. Media playback and image viewing do not create visitor profiles. Copying the email address at your request writes only that contact address to your device’s clipboard.

7. External links

YouTube, Facebook and Google Maps are ordinary external links. Opening one visits the relevant provider’s service, where subsequent processing is governed by that provider’s privacy information. This website does not pre-load those services in the background.

8. Your rights

Subject to the statutory conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and portability (Article 20). Where processing relies on consent, you may withdraw it at any time for the future without affecting the lawfulness of processing before withdrawal. Please use the contact address above for requests.

Requests are generally addressed within one month. If the statutory conditions for extending that period apply, you will be informed within that period. Statutory exceptions and others’ rights are taken into account.

9. Complaint to a supervisory authority

If you consider the processing unlawful, you may complain in particular to the supervisory authority for your habitual residence, workplace or place of the alleged infringement. You do not need to contact us first (Article 77 GDPR). In Austria:

10. Automated decisions

The artist website application does not carry out solely automated decisions with legal or similarly significant effects, or profiling.

11. Protected event management

The independent administrator account stores a username, password hash and session data. Passwords are not stored in plain text. The HttpOnly session cookie “__Host-mp_admin” is protected over HTTPS and lasts at most eight hours. Sign-in is required again after one hour of inactivity. Signing out invalidates that session; changing the password invalidates all sessions. Expired session records are removed at the next sign-in. Hashed IP or username keys and counters limit sign-in attempts; old counters are cleaned during subsequent attempts after approximately 24 hours. Event records remain until changed by the administrator; deleted events are retained internally for restoration and hidden from the public website.