Privacy Policy

Protecting your personal data matters to me. This policy explains which data is processed when you visit whitecapmusic.de — and which explicitly is not.

Last updated: August 12, 2026. This English version is provided for convenience; the German version is authoritative.

1. Controller

2. The essentials up front

• This website uses no analytics, tracking, or marketing tools.
• No cookies are set — with one exception: a technically required session cookie once you use the contact form (see section 5).
• At most two entries are stored in your browser's storage — both only once you click something yourself, never on merely opening the page. The first, wcm-lang, appears when you switch languages, then holds either "de" or "en", and makes sure an error page shows up in your language (it does not control the displayed language itself — the page address does). It stays until you delete it. The second, wcm-lang-banner, appears once you respond to the notice about the other language version — by dismissing it or by following it — and keeps it from appearing again; it lives in session storage and expires automatically when you close your browser. Neither contains an identifier, neither allows you to be recognised, and neither is ever transmitted to a server. No consent is required for this storage (§ 25 (2) no. 2 TDDDG), because it does nothing but carry out the function you triggered yourself; you can delete both any time via your browser settings.
• Fonts, images, and artwork are served from this site's own server. Your browser makes no connections to third parties during a visit — release covers are cached server-side and delivered first-party.
• Links to streaming and social platforms (Spotify, Deezer, Instagram, etc.) only lead to those external sites after you click; from there the respective provider's privacy policy applies.

A cookie banner is therefore not required: there is simply nothing you would need to consent to (§ 25 (2) TDDDG permits technically necessary storage without consent).

3. Hosting and server logs

This website is hosted by goneo Internet GmbH (Dresdner Straße 18, 32423 Minden, Germany). When you access the site, the server automatically processes technical access data (server log files):

• IP address of the requesting device
• Date and time of access
• Name and URL of the requested file
• Referrer URL, browser type and operating system

Processing serves the reliable operation and IT security of the site (legal basis: Art. 6 (1)(f) GDPR). Log data is deleted automatically according to the host's deletion policy. A data processing agreement (Art. 28 GDPR) is in place with goneo.

Because cover art and audio previews are served by my own server (see section 4), those requests also appear in the log files. Starting a preview therefore records the corresponding file request. These entries are not analysed, not combined into usage profiles, and are subject to the same automatic deletion as all other log data.

4. Release data from Deezer and Spotify

The discography on this site updates automatically via the public Deezer API. This happens exclusively server-side: my server queries Deezer and caches the response. Your browser never contacts Deezer, and none of your personal data is transferred to Deezer. The same applies to cover art and the 30-second audio previews in the catalog: they are served (cached) by my own server, not by Deezer.

The matching Spotify link for each release is determined server-side as well: my server queries the Spotify API using the release's identifier (UPC or ISRC) and stores the result permanently. Here too, your browser sends no request to Spotify and no data about you is transmitted. Only when you click a release link do you leave this site — from that point Spotify's privacy policy applies (see section 6).

5. Contact form

When you use the contact/booking form, I process the data you provide:

• Name and email address (required)
• Phone number (optional)
• Subject and message

This data is sent to me by email and used exclusively to handle your enquiry. You also receive an automatic confirmation to the address you provided. The legal basis is Art. 6 (1)(b) GDPR (steps prior to entering into a contract, e.g. booking) or Art. 6 (1)(f) GDPR (handling general enquiries); by submitting, you confirm the processing via checkbox.

Recipients of the data

Form submissions are sent via the mail server of goneo Internet GmbH and stored in my email account hosted there. goneo is therefore a recipient within the meaning of Art. 13 (1)(e) GDPR and acts as a processor under the agreement mentioned in section 3. No disclosure to any further third party takes place, and no transfer to third countries is envisaged.

Technically required session cookie

As soon as you use the form, the server sets a session cookie. It exists solely to protect the form (CSRF protection, abuse limiting), contains no profiling data, and is deleted when you close your browser (§ 25 (2) no. 2 TDDDG, Art. 6 (1)(f) GDPR).

Abuse protection

To prevent automated abuse, not your IP address itself is stored when you submit, but a SHA-256 value derived from it with a secret key (HMAC). It is no longer evaluated after one hour and is deleted automatically the next time the contact form is used, at the latest (Art. 6 (1)(f) GDPR).

Retention

I keep enquiries submitted via the form or email for as long as needed to handle them; booking-related correspondence may be subject to statutory retention periods (up to 10 years, § 147 AO).

6. External links

This website links to streaming and social media profiles (Spotify, Apple Music, Deezer, Beatport, SoundCloud, YouTube, 1001Tracklists, Instagram, TikTok, Facebook). These are plain links without embedded content — data is only transferred to these providers once you click a link and open the external site.

7. Your rights

Under the GDPR you have the following rights:

• Access to the data stored about you (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17) and restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection to processing based on Art. 6 (1)(f) (Art. 21)

An informal email to info@whitecapmusic.de is sufficient to exercise these rights.

8. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority is:

9. Changes

I reserve the right to update this privacy policy if the legal situation or the website's functionality changes (e.g. future embedded players — these would only load after your explicit click-to-load consent). The current version is always available on this page.