Rechtliches / Astrobass
Privacy
Unofficial translation. The German version is authoritative.
Legal information for Astrobass.
1. Joint controllers
For the processing described below, the platform operator and the respective
artist are joint controllers within the meaning of Article 26 GDPR. They
jointly determine the purposes and essential means of artist-related
processing, with different areas of responsibility.
Artist:
Astrobass
Responsible person / representative:
Frank Sauer
Address:
Am Pfingstbrunnen 15
65719 Hofheim am Taunus
Artist privacy contact:
frank@astrobass.de
The platform operator is identified with its full name, address and contact
details in the applicable platform privacy policy. The
essential contents of the Article 26(2) GDPR arrangement are made available
through this policy. Data subjects may exercise their rights against either
joint controller.
The artist is responsible in particular for songs, lyrics, recordings, files,
profile information, group assignments, publication decisions, the configured
contact destination and, where enabled, the artist newsletter. The artist
decides the purposes of publication and the editorial use of these contents,
checks the required rights and legal bases, and handles requests relating to
the artist’s contents.
The platform operator is responsible in particular for hosting, the
application, accounts, sessions, technical authorisation checks, delivery,
security measures, deletion processes and technical versioning of legal
documents. Processors are bound by contracts under Article 28 GDPR.
2. Purposes, data and legal bases
| Processing | Data | Legal basis |
|---|---|---|
| Public artist page and technical operation | IP address, time, URL, method and status, browser/operating-system data and connection data received by hosting | Article 6(1)(f) GDPR; secure and stable operation |
| Account, invitation and authorisation | Email address, name, password hash, session data, memberships, roles, groups, status and account events | Article 6(1)(b) GDPR; additionally Article 6(1)(f) for security and evidence |
| Songs and media | Titles, lyrics, musical details, tags, group relation, publication status, MP3 and leadsheet files | Article 6(1)(b) and (f) GDPR; publication decided by the artist |
| Ratings, feedback and moderation | Rating, feedback text, visibility, time, song/artist/user relation and optional alias | Article 6(1)(b) and (f) GDPR |
| Contact with the artist | Name, email address, message and technical delivery information | Article 6(1)(b) or (f) GDPR, depending on the request |
| Artist newsletter | Email address, artist relation, double-opt-in, withdrawal and delivery data | Article 6(1)(a) GDPR |
| Security, error analysis and evidence | UTC time, request correlation, route, resource reference, actor, artist context, result and duration | Article 6(1)(f) GDPR |
The applicable legal basis is identified for the specific processing. Consent
may be withdrawn at any time with effect for the future.
3. Sources, invitations and required provision
Data is received from the data subject, the artist, or an authorised platform
or artist administrator. For invitations under Article 14 GDPR, this may
include an email address, name, group assignment, inviting person and
invitation status. Required account, contact or newsletter data is necessary
for the relevant function; without it, that function cannot be provided.
Public content can generally be accessed without an account.
4. Local storage and logs
Access and error raw data is generally retained for 30 days, audit evidence
for 180 days and daily aggregates for no more than 365 days. Session and CSRF
data is deleted after expiry, logout or revocation. Invitation tokens are
stored only as hashes and remain valid for no more than 48 hours. Statutory
retention and longer retention required for legal defence remain possible.
5. Recipients and third-country transfers
Recipients may include the relevant joint controller, authorised
administrators, hosting, infrastructure, storage and maintenance providers,
an activated email delivery provider, and authorities, courts and legal
advisers where a legal basis exists.
No optional third-country services are active in the current product version.
A transfer outside the EEA takes place only after review under Articles 44 et
seq. GDPR and with the required safeguards; the published version will then
identify the recipient, country and transfer mechanism.
6. Data-subject rights
Subject to the statutory requirements, data subjects have rights of access
(Article 15 GDPR), rectification (Article 16), erasure (Article 17),
restriction (Article 18), data portability (Article 20) and objection
(Article 21). They may contact the artist at
frank@astrobass.de or contact the platform operator. Each joint
controller accepts requests and forwards them internally to the responsible
party. The statutory response and extension periods apply. Data subjects also
have the right to lodge a complaint with a supervisory authority (Article 77
GDPR).
No automated decision-making under Article 22 GDPR or personalised advertising
profiling takes place.
7. Security, versioning and changes
Appropriate technical and organisational measures apply, including password
hashing, server-side sessions, CSRF protection, role- and artist-based
authorisation checks, private media paths and data-minimised logging. Legal
documents are versioned for each artist and language with version, effective
date, content hash and review evidence.
New processing activities, recipients, technologies or material changes to
responsibilities require a new review and version.