Luna Spiegel
DE EN

Privacy Policy

Last updated: [insert publication date]

This English version is provided for convenience. The German version at /de/datenschutz.html is legally authoritative in case of any discrepancy, as this site operates under German law.

1. Data controller

The controller responsible for data processing on this website is:

Luna Mara Spiegel
[Postal address as in the Imprint]
Email: [dedicated booking email address, as in the Imprint]

2. Principles and your rights

We process personal data only within the limits permitted by law. You have the following rights:

  • Access to the data we hold about you (Art. 15 GDPR)
  • Rectification of inaccurate data (Art. 16 GDPR)
  • Erasure of your data (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • Data portability (Art. 20 GDPR)
  • Objection to processing (Art. 21 GDPR)
  • Withdrawal of any consent given, with future effect (Art. 7(3) GDPR)
  • Complaint to a data protection supervisory authority (Art. 77 GDPR), for example: [Insert the competent state data protection authority, depending on the state in which the address above is located — e.g. for a Hamburg address: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (datenschutz-hamburg.de); for a Lower Saxony address: Die Landesbeauftragte für den Datenschutz Niedersachsen (lfd.niedersachsen.de). Insert the correct authority before launch.]

To exercise any of these rights, simply email the address above.

3. Hosting and server log files

[To be completed once the hosting provider is chosen: when you visit this website, our hosting provider automatically collects information in so-called server log files that your browser transmits (e.g. IP address, date and time of the request, browser type, operating system used). This data is used to operate the website securely and reliably (Art. 6(1)(f) GDPR — legitimate interest) and is automatically deleted after [insert period, typically a few days to a few weeks]. Hosting provider: [name and location of the provider, once finalized].]

4. Fonts

All fonts used on this website are hosted locally on our own server (self-hosted). No connection is made to Google Fonts or any other third-party font provider when you visit this site, and no data is transmitted to a font provider as a result.

5. Cookies

This website does not set non-essential cookies by default. [If the form tool or hosting provider used sets strictly necessary technical cookies — e.g. for spam protection on the contact form — name them specifically here: name, purpose, retention period.] If a non-essential cookie (e.g. for analytics or marketing) is ever added in future, we will obtain your explicit consent via a cookie consent banner before it is set, and this policy will be updated accordingly first.

6. Contact / booking form

If you submit an inquiry via the contact form, we process the data you enter there (including name, email address, optional phone number, and details about your event) in order to handle your inquiry and, where relevant, prepare a potential engagement.

The legal basis is Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract) for the fields necessary to process your inquiry, and Art. 6(1)(f) GDPR (legitimate interest in handling your inquiry appropriately) for optional fields.

The technical processing of form submissions is carried out via [name of the form-processing service, to be inserted once chosen — e.g. Formspree, Netlify Forms, or similar]. A data processing agreement under Art. 28 GDPR is in place with this provider. [If the provider is based outside the EU/EEA, insert details of the safeguards used, e.g. EU Standard Contractual Clauses.]

Your information is stored for as long as necessary to handle your inquiry and any resulting engagement, and in any case no longer than 24 months after our last contact, unless a longer retention period is required by law (for example, German commercial or tax retention requirements under § 147 AO / § 257 HGB if an invoice is issued, typically 6–10 years).

No automated decision-making within the meaning of Art. 22 GDPR takes place.

7. Third-party embedded content (Music page)

On the Music page, once real recordings are linked, content from third-party services (e.g. Spotify, YouTube) may be embedded. This content is not loaded automatically when the page loads — it is only loaded once you actively click "Load player" (or similar).

Only at that point is a connection made to the relevant provider; this may transmit your IP address and other technical data to that provider, and the provider may set its own cookies. That provider's own privacy policy then applies [links to be inserted once the specific services are confirmed]. The legal basis for this specific, limited data transfer is the consent you give by clicking (Art. 6(1)(a) GDPR).

8. Changes to this policy

We will update this policy whenever changes to our data processing make it necessary (for example, when a form-processing service or hosting provider is chosen, or new features are added). The version currently published on this page always applies.

This text follows, to the best of the team's legal/data-protection reviewer's (Elli's) working knowledge, standard GDPR privacy-notice structure. It does not replace a review by a lawyer licensed to practice in Germany before this site goes live for real, paid bookings.