Privacy

Controller

Responsible for data processing on stevemitchell.music:
Stephen Mitchell
c/o flexdienst – #21659
Kurt-Schumacher-Straße 76
67663 Kaiserslautern
Germany
E-Mail: contact@stevemitchell.music

Hosting and server logs

This site is hosted on servers operated by Hetzner Online GmbH in Germany. When you visit, the web server processes your IP address, user agent, and request timestamps in server logs for operating and securing the service (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Logs are retained for 7 days. DNS for this domain is provided by Cloudflare, Inc., which also stores and serves the application downloads.

Email contact

If you email me, I process the details you provide to answer your enquiry (legal basis: Art. 6(1)(b) or (f) GDPR). My mail provider is Proton AG (Switzerland).

You can ask to hear from me by email about new releases, new instruments and betas. I use it a few times a year at most (legal basis: your consent, Art. 6(1)(a) GDPR). The mailing list runs on my own server in Germany and the emails themselves are delivered by Postmark.

What I keep. Your email address, the date you signed up, which page you signed up from, and which version of the wording above you agreed to. That last pair is my record that you asked for this, which Art. 7(1) GDPR requires me to be able to show. I do not store your IP address, I do not record whether you open anything or click anything, there are no tracking pixels in the emails, and I build no profile of you.

Leaving. Every email has an unsubscribe link at the bottom. This deletes your address outright rather than marking it inactive. You can also withdraw consent by emailing me, with effect for the future.

Analytics

I use Umami for website analytics, which I host myself. It is cookieless, does no cross-site tracking, builds no profiles, and does not store IP addresses (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, no consent banner is required under § 25 TDDDG. No data is shared with any third party.

Cookies

There are no tracking, profiling or advertising cookies on this site, and nothing here is shared with an advertising network or any other third parties.

Your rights

Under the General Data Protection Regulation you have the rights:

To access the personal data I hold about you (Art. 15 GDPR)
To rectify inaccurate data (Art. 16 GDPR)
To request deletion of your data (Art. 17 GDPR)
To restrict processing (Art. 18 GDPR)
To data portability (Art. 20 GDPR)
To object to processing (Art. 21 GDPR)
To lodge a complaint with a supervisory authority (Art. 77 GDPR)

The supervisory authority for this site is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Recipients and processors

Processors under Art. 28 GDPR: Hetzner Online GmbH (hosting), Cloudflare, Inc. (DNS, and delivery of application downloads), Proton AG (email), and flexdienst (Matthias Dully, Kaiserslautern), together with ActiveCampaign, LLC (Postmark), which delivers the mailing list.

Transfers outside the EU

Proton AG is in Switzerland, which the European Commission has recognised as providing an adequate level of protection, so no further safeguard is required.

Cloudflare, Inc. and ActiveCampaign, LLC (Postmark) are in the United States, so data does leave the EU. These transfers are covered by the European Commission's Standard Contractual Clauses (Decision 2021/914/EU), incorporated into their respective data processing terms. Cloudflare additionally certifies under the EU–US Data Privacy Framework.