This is a small website run by a family for a kids' band. We collect as little as we can: no advertising, no profiling, no selling of data, and no cookies on the public pages. This page tells you, as Art. 13 of the General Data Protection Regulation (GDPR) requires, what happens to your data when you visit the site or send us a booking request, why, on what legal basis, and for how long.

1. Who is responsible

The controller within the meaning of the GDPR is:

For any question about your data, an informal e-mail to that address is enough. We have not appointed a data protection officer, because the size and nature of this site does not require one under Art. 37 GDPR and § 38 BDSG.

2. Hosting, delivery and security

The website, its database and its photo storage run on the infrastructure of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA — specifically Cloudflare Workers (the site itself), D1 (the database holding gigs, texts and booking requests), R2 (the photos) and Workers KV. Cloudflare also sits in front of the site as a content delivery network and protects it from attacks.

When you open a page, the following is processed so that the page can be delivered and the site kept secure:

• your IP address,
• the date and time of the request, the page requested and the referring page if your browser sends one,
• the browser type and version, the operating system and the language your browser asks for,
• the amount of data transferred and the status of the response.

Legal basis and retention

Art. 6 (1) (f) GDPR — our legitimate interest in a website that works, stays available and is protected against attack. Request logs are kept for a few days for error analysis and abuse protection (Cloudflare Workers Logs) and are then deleted automatically. We do not merge them with other data and we do not use them to identify individual visitors.

Encryption

The whole site is served over HTTPS with TLS encryption, so what you send us — including everything you type into the booking form — cannot be read on the way. You can see this by the lock symbol in your browser.

3. Cloudflare Web Analytics

To see how often pages are opened and how fast they load, we use Cloudflare Web Analytics (also called Real User Monitoring, RUM). Cloudflare adds a small measurement script to our pages, which your browser loads from static.cloudflareinsights.com. It reports in aggregated form:

• which page was opened, and the referring page,
• how long the page took to become visible and usable (the so-called Core Web Vitals),
• browser and operating system type, rough screen size, and the country the request came from.

No cookies and no fingerprinting: this service sets no cookies, stores and reads nothing on your device, does not build a profile of you and does not recognise you across visits or across other websites. Your IP address is used to deliver the request but is not stored for the analysis. Because nothing is stored on or read from your device, no consent under § 25 TDDDG is required. Legal basis for the processing is Art. 6 (1) (f) GDPR — our legitimate interest in knowing whether the site works and is being found.

We use no other analytics, no tracking pixels and no advertising networks.

4. Cookies and storage on your device

The public pages of this site set no cookies. Fonts are served from this site, not from Google Fonts or a similar service, so opening a page contacts no one but us and Cloudflare.

The only two exceptions are:

• Your video choice. If you press play on a video, that decision is remembered in your own browser (in localStorage), never on a server. See section 7.
• The admin login. The protected area used by the band sets a login cookie. Visitors never reach it. See section 10.

If Cloudflare's bot protection is switched on for this site it also sets a strictly necessary security cookie (__cf_bm, valid 30 minutes) to tell human visitors from automated traffic. Such a cookie is technically required and therefore exempt from consent under § 25 (2) No. 2 TDDDG.

5. Booking form

When you send us a request through the Book us form, we store what you type in:

• your name,
• your e-mail address,
• your phone number, if you give one — the field is optional,
• the occasion and the date you have in mind, also optional,
• your message,
• the date and time you sent it.

Purpose and legal basis

We use this solely to answer you and to arrange the show. Legal basis is Art. 6 (1) (b) GDPR: steps taken at your request before entering into a contract, and the performance of that contract if it comes about. Giving the data is neither required by law nor by contract, but without a name, an e-mail address and a message we cannot reply — that is the only consequence of not providing it (Art. 13 (2) (e) GDPR).

Protection against spam

We do not store your IP address with the request. The form contains a hidden field that only automated bots fill in; if it is filled, the request is discarded. Should spam become a problem we may switch onCloudflare Turnstile, a bot check that runs a short technical verification in your browser without a puzzle and without a tracking cookie. It would be visible as a small Cloudflare badge under the form, and its legal basis would be Art. 6 (1) (f) GDPR — our legitimate interest in a form that is not abused.

Who reads it

Your request is stored in our database at Cloudflare and read by the band's parents in the protected admin area. We reply by e-mail from the address in section 1. It is not passed to anyone else.

Retention

We delete a request once it is settled — the show has taken place, or it did not come about — and at the latest12 months after we received it, unless a statutory retention duty, for instance for an invoice, requires us to keep parts of it for longer.

6. Contact by e-mail

If you write to us directly instead of using the form, we process your e-mail address, your name and whatever you put in the message, for the purpose of answering you. Legal basis is Art. 6 (1) (b) GDPR where your message concerns a booking, and otherwise Art. 6 (1) (f) GDPR — our legitimate interest in answering enquiries. We keep the correspondence until it is dealt with and no longer needed.

7. Videos from YouTube

The Videos page shows preview images of our videos. Those previews areserved by this website: we fetch them from YouTube ourselves and pass them on, so simply opening the page sends nothing to Google and Google learns nothing about you.

Only when you press play is the video loaded from YouTube, in the privacy-enhanced player on the domain youtube-nocookie.com. The provider is Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. From that moment Google receives your IP address, information about the video and the page it sits on, and may store or read information on your device under its own rules; Google's privacy policy then applies (policies.google.com/privacy).

Pressing play is your consent to exactly that — Art. 6 (1) (a) GDPR together with § 25 (1) TDDDG. Personal data may reach Google in the USA; that transfer is covered by the EU-U.S. Data Privacy Framework, under which Google is certified.

Your choice is remembered in your own browser only, in localStorage, never on a server, so the players load directly on your next visit. You can withdraw that consent at any time with the "Forget my YouTube choice" button on the Videos page, or by clearing this site's data in your browser; the placeholders then come back. Withdrawing does not affect the lawfulness of what was loaded before.

8. Links to Instagram and other platforms

Links to Instagram or other services are plain links. Nothing is loaded from those platforms while you are on our site, and they learn nothing about you until you follow the link. Once you do, the privacy policy of the platform applies; for Instagram that is Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland.

9. Photos and videos of people

The pictures and videos on this site show the members of the band, who are minors, and now and then the audience at a show. Pictures of the band are published with the consent of their parents, who are also the people running this site, and the girls themselves agree to what is shown. Legal basis is Art. 6 (1) (a) GDPR together with §§ 22, 23 of the German Art Copyright Act (KUG).

If you appear in a picture and would rather not, write to the address in section 1 and we will take it down promptly, without you having to give a reason.

10. Admin area

The band and their parents maintain this site themselves through a protected area. Access is controlled by Cloudflare Access: whoever wants in receives a one-time code by e-mail, and a login cookie is then set for that session. We store the e-mail address of the person who made each change, so that it is clear within the family who edited what. Legal basis is Art. 6 (1) (f) GDPR — our legitimate interest in an area that only we can reach. None of this concerns visitors of the public site.

11. Recipients and transfers outside the EU

We pass personal data to no one except the following, and never for their own purposes unless stated:

• Cloudflare, Inc. — hosting, database, photo storage, delivery, security, web analytics and the admin login. Cloudflare acts as our processor under a data processing agreement pursuant to Art. 28 GDPR.
• Google Ireland Ltd. — only if you press play on a video, and then as a controller in its own right, not on our behalf.

Where personal data is processed in the USA, the transfer is covered by the EU-U.S. Data Privacy Framework, an adequacy decision of the European Commission under which both Cloudflare and Google are certified, and in addition by the European Commission's Standard Contractual Clauses.

12. How long we keep things

• Server and request logs: a few days, then deleted automatically by Cloudflare.
• Web analytics: aggregated figures only, no data attributable to you.
• Booking requests: until settled, at the latest 12 months.
• E-mail correspondence: until it is dealt with and no longer needed.
• Photos and texts on the site: until we take them down or you ask us to.
• Your video choice: in your browser until you withdraw it or clear the site's data.

13. Your rights

Regarding the personal data we hold about you, you have the right to:

• access — a copy of the data and information about how we use it (Art. 15 GDPR),
• rectification of inaccurate or incomplete data (Art. 16),
• erasure (Art. 17),
• restriction of processing (Art. 18),
• data portability in a machine-readable format (Art. 20),
• object to any processing we base on our legitimate interests, on grounds relating to your particular situation (Art. 21),
• withdraw a consent at any time with effect for the future — for videos with the "Forget my YouTube choice" button on the Videos page (Art. 7 (3)).

An informal e-mail to the controller named in section 1 is all it takes, and it costs you nothing.

14. Right to lodge a complaint

If you believe we handle your data unlawfully you may complain to a data protection supervisory authority (Art. 77 GDPR). The one responsible for us is:

You may also turn to the supervisory authority where you live or where you think the problem occurred.

15. No profiling, no sale of data, changes to this policy

We make no automated decisions about you and build no profiles (Art. 22 GDPR). We never sell or rent personal data. Beyond what a parent types into the booking form, we do not knowingly collect data from children through this site.

If the site changes — a new feature, a different service — we update this page and the date below. The version published here is always the one that applies.

Last updated: September 2026