Privacy

Controller

Responsible for data processing on stevemitchell.music:
Stephen Mitchell
c/o flexdienst – #21659
Kurt-Schumacher-Straße 76
67663 Kaiserslautern
Germany
E-Mail: contact@stevemitchell.music

Hosting and server logs

This site is hosted on servers operated by Hetzner Online GmbH in Germany. When you visit, the web server processes your IP address, user agent, and request timestamps in server logs for operating and securing the service (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Logs are retained for 7 days. DNS for this domain is provided by Cloudflare, Inc., which also stores and serves the application downloads.

Anything you send us is stored in a single database on that server. It is backed up daily to Cloudflare R2, encrypted before it leaves our server with a key we do not share with them, so the backups are unreadable to whoever stores them. Backups are kept for 30 days and then deleted.

Email contact

If you email us, we process the details you provide to answer your enquiry (legal basis: Art. 6(1)(b) or (f) GDPR). Our mail provider is Proton AG (Switzerland).

Analytics

We use Umami, which we host ourselves on the same German infrastructure as this site. It is cookieless, does no cross-site tracking, builds no profiles, and does not store IP addresses — it records only aggregate counts of pages and a small number of named actions (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, no consent banner is required under § 25 TDDDG. No data is shared with any third party.

Cookies and local storage

There are no tracking, profiling or advertising cookies on this site, and nothing here is shared with an advertising network. Two things are stored on your device, both only because they are needed to give you what you asked for, which is why § 25(2) TDDDG requires no consent banner for either.

If you switch between the light and dark appearance, that choice is kept in your browser's local storage so the site looks the same next time. It never leaves your browser. If you have been given a preview link to parts of this site that are not public yet, following it sets a cookie that keeps you signed in to that preview for 30 days; it records nothing about you beyond the fact that the link was used.

Your rights

You have the right to access, rectification, erasure, restriction of processing, and data portability. Where processing rests on consent, you may withdraw it at any time with effect for the future.

You have the right to object. Where we process your data on the basis of our legitimate interests — server logs, and the aggregate analytics described above — you may object at any time on grounds relating to your particular situation, and we will stop unless we can show compelling legitimate grounds that override your interests. Email us and it is done.

Nothing here involves automated decision-making or profiling in the sense of Art. 22 GDPR. We build no profiles and make no decisions about you by machine.

You also have the right to lodge a complaint with a data protection supervisory authority — for us, the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Recipients and processors

Processors under Art. 28 GDPR: Hetzner Online GmbH (hosting), Cloudflare, Inc. (DNS, and delivery of application downloads), Proton AG (email), and flexdienst (Matthias Dully, Kaiserslautern), which receives and forwards post sent to the address in our Impressum. Data processing agreements: all five are in place.

Transfers outside the EU

Hetzner is in Germany, so its processing involves no transfer at all. Proton AG is in Switzerland, which the European Commission has recognised as providing an adequate level of protection, so no further safeguard is required.

Cloudflare, Inc. is in the United States, so data does leave the EU. That transfer is covered by the European Commission's Standard Contractual Clauses (Decision 2021/914/EU), incorporated into its data processing terms. Cloudflare additionally certifies under the EU–US Data Privacy Framework.