Privacy policy

Privacy Policy Last updated: 31 October 2026 1. Controller The controller responsible for processing personal data on this website is: Isa Ay Soundbar 77 Kampstraße 20 33332 Gütersloh Germany Telephone: +49 172 8458398 Email: info@soundbar77.de 2. Website Access and Hosting Our website is hosted by united-domains GmbH, Gautinger Straße 10, 82319 Starnberg, Germany. When you access the website, the server processes technical access data, including your IP address, requested address, date and time, request method and, where available, the referring page. Processing serves to deliver the website, maintain security and detect abuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and reliable operation of our website. According to the hosting provider, webspace access logs are retained for 14 days for security purposes. Provider information: https://www.united-domains.de/unternehmen/datenschutz/weitere-dienstleistungen/ 3. Cookies and Browser Storage We use strictly necessary cookies for sessions, login and form security. Session cookies generally last for the browser session; browser session restoration may affect their lifetime. Your expressly selected language is stored in the “sb_language” cookie for up to one year. When using an external login provider, the “sb_oauth_bind” security cookie may be set for a maximum of ten minutes. We store your cookie choice in local browser storage under “sb_privacy_v1”. The choice is recognised for up to 180 days. Changes to available services may require a new choice. You can delete this entry through your browser. Strictly necessary storage and access are based on Section 25(2)(2) of Germany’s TDDDG. Related personal data processing is based on Article 6(1)(b) GDPR for requested services or Article 6(1)(f) GDPR for security and respecting your privacy choices. Optional services require consent under Section 25(1) TDDDG and Article 6(1)(a) GDPR. You can change your choice or withdraw consent for the future through “Cookie settings”. We do not use our own analytics or advertising trackers on this website. 4. Contact, Table Reservations and Event Enquiries When you contact us or submit an enquiry, we process the information you provide. Depending on the form, this includes your name, email address, telephone number, date, time, number of guests, occasion, company, budget and message, together with processing status and necessary internal notes. We use this information to respond to, plan and handle your enquiry. Responsible staff may receive email notifications. The legal basis is Article 6(1)(b) GDPR for steps prior to entering into a contract and contract performance. Other enquiries are handled under Article 6(1)(f) GDPR, based on our legitimate interest in responding appropriately. Mandatory fields are necessary to process the relevant form. Additional voluntary information is not required. 5. Customer and Artist Accounts Registration involves processing your name, display name, email address, account role, registration time, verification status and technical security information. Passwords are stored as hashes. We use these details to create and manage accounts, authenticate users and send necessary account messages, such as email verification and password reset messages. The legal basis is Article 6(1)(b) GDPR; security measures additionally rely on Article 6(1)(f) GDPR. Artist applications may also include a stage name, musical genre, biography, contact details, profile photograph and sample link. Profile content intended for publication becomes publicly accessible after review and may be indexed by search engines. Processing and agreed publication serve to provide the artist profile under Article 6(1)(b) GDPR. 6. Optional Login through Google, Facebook or Apple Where offered, you may choose an external provider to log in or link an account. You are redirected to the provider only after starting this process. We receive the provider identifier needed to associate your account and, depending on the provider and your authorisation, your name, email address and verification status. We do not receive your password for the external account. The provider learns that you are using its login service for our website. Our processing provides your requested login and account management under Article 6(1)(b) GDPR. Registration using an email address and password is available as an alternative. The providers’ own processing is governed by their privacy policies: Google: https://policies.google.com/privacy Facebook: https://www.facebook.com/privacy/policy/ Apple: https://www.apple.com/legal/privacy/ 7. Photographs and Guest Gallery When you upload a photograph, we process the image, account association, display name, caption, photograph date and upload, consent and review records. Approved photographs and information intended for publication are displayed publicly. Once published, copying or redistribution by third parties cannot be fully prevented. Publication of submitted guest photographs is based on consent under Article 6(1)(a) GDPR. Upload handling and moderation also provide the requested gallery service under Article 6(1)(b) GDPR. Only upload images for which you hold the necessary publication rights and, where required, consent from the people shown. An uploader’s declaration does not replace another person’s required consent. People concerned may request removal by emailing info@soundbar77.de. You can remove your own uploads using the available deletion function. 8. Google Maps Where offered, Google Maps loads only after your consent. Our address remains available as text without consent. Activation sends data including your IP address and technical browser information to Google. Google may process additional information under its own privacy policy, including outside the European Economic Area, particularly in the United States. For users in the European Economic Area, the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Our integration is based on Article 6(1)(a) GDPR; optional storage and access are based on Section 25(1) TDDDG. You can withdraw consent through “Cookie settings”. Further information: https://policies.google.com/privacy 9. WhatsApp and External Links Our social media references are ordinary links. A connection to the destination provider is established when you open the link, not merely when the link is displayed on our website. If you contact us through WhatsApp, we process your telephone number, any profile name and your message to respond to your request. Contract-related enquiries are processed under Article 6(1)(b) GDPR; other enquiries under Article 6(1)(f) GDPR, based on our interest in answering your communication. WhatsApp Ireland Limited also processes data independently. Processing outside the European Economic Area is possible. You may alternatively contact us by telephone or email. Privacy information: https://www.whatsapp.com/legal/privacy-policy-eea This policy covers our website. Separate use of external platforms is also subject to their privacy policies. 10. Security and Evidence To prevent automated or abusive requests, our application processes information including hashes derived from IP addresses, timestamps and request counters. These values are not necessarily anonymous. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in protecting the website and its users. Where acceptance of terms and conditions is required, we record the time, language, text version and associated transaction as evidence under Article 6(1)(b) and (f) GDPR. Acceptance of terms is not blanket consent to optional data processing. 11. Recipients and International Transfers Access is limited to persons responsible for the relevant purpose and necessary hosting, email and IT service providers. Authorities or other recipients receive data where legally required or necessary to establish, exercise or defend legal claims. Optional external services may transfer data outside the European Economic Area. The applicable basis may include an adequacy decision under Article 45 GDPR or appropriate safeguards such as EU Standard Contractual Clauses under Article 46 GDPR. Details of the mechanisms actually used and how to obtain information about safeguards are available in the linked provider policies or on request. Consent to activate a service does not replace the required basis for an international transfer. 12. Retention We retain data only as long as necessary for its purpose. Enquiry data is deleted after final handling once retention obligations and justified evidential needs no longer apply. Account data is kept for the duration of the account; certain transaction records may remain necessary for legal reasons after account deletion. Published content is removed when its publication purpose ends or consent is validly withdrawn, unless another legal basis applies. Legal retention obligations and specifically necessary evidence may justify longer storage. Access and use are then restricted to that purpose. Backups are cleared through their respective overwrite cycles. 13. Your Rights Subject to the applicable legal conditions, you have rights of access, rectification, erasure, restriction of processing and data portability. You may withdraw consent at any time for the future. Withdrawal does not affect the lawfulness of earlier processing. Right to object: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation. You may object to processing for direct marketing at any time without giving reasons. To exercise your rights, contact info@soundbar77.de. You may also complain to a supervisory authority, particularly in the country of your habitual residence, workplace or the suspected infringement. The authority for North Rhine-Westphalia is: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen Kavalleriestraße 2–4 40213 Düsseldorf Germany Email: poststelle@ldi.nrw.de Website: https://www.ldi.nrw.de Our website does not make solely automated decisions producing legal or similarly significant effects, including related profiling.