Privacy policy

This is an English translation for convenience; only the German version is legally binding.

Controller

Musikverein Bissingen an der Teck e.V.
Pfarrstraße 16
73266 Bissingen an der Teck

Represented by Dr. Steffen Waimer (chair) and Leonard Tomschi (vice chair).

Phone: 07023 9571631
Email: Email address (visible with JavaScript)

We are not required to appoint a data protection officer; the conditions of § 38 BDSG (German Federal Data Protection Act) are not met in our case. Questions about data protection go to the address above.

What this website does not do

That can be said more briefly than what it does, and it explains why no cookie banner appears here:

No cookies. The website itself sets none.
No statistics, no audience measurement, no tracking. We do not embed any analytics tool and do not analyse any visitor data. The statistics function that our hosting provider offers for larger packages is likewise not available for ours and not active. We do not know how many people read these pages, and that is intentional.
No requests to third parties. Fonts, images, maps, stylesheets and scripts are all on our own server. Opening a page creates no connection to Google, Meta, a content delivery network or anyone else — not even for the fonts, which many websites load from Google.
No social media widgets. Our profiles are linked in the page footer, but none of them is embedded.
No newsletters, no advertising, no profiling, and no automated decision-making within the meaning of Art. 22 GDPR.

We therefore need consent in one single place only, for the embedded video — and there we ask explicitly.

Visiting the website: server log files

Every time a page is requested, our hosting provider processes technical data that the browser transmits automatically:

IP address of the requesting device
date and time of access
the address requested and the amount of data transferred
notification of whether the request succeeded
browser type and operating system, and the page visited before, if the browser sends it along

The purpose is technical operation: delivering the pages, finding faults and detecting attacks on the server. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is the secure and functioning operation of this website. This data is not combined with other sources, and we do not analyse it.

Retention period: seven days at most. After that, the hosting provider deletes the log files. This period follows from Annex 1 of the data processing agreement (Auftragsverarbeitungsvertrag) concluded with it.

Hosting

This website runs on web space provided by

STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin

Strato processes the data mentioned above solely on our behalf and in accordance with our instructions. A data processing agreement under Art. 28 GDPR was concluded on 23 September 2026. Processing takes place in the European Union or the European Economic Area; should a transfer to a third country be necessary in an individual case, the conditions of Art. 44 et seq. GDPR apply. Strato is certified to ISO 27001 and publishes the technical and organisational measures at https://www.strato.de/agb/tom/ (opens in a new tab).

For this package, Strato engages further processors. Those relevant to us are:

Company	Registered office	Task
Ionos SE	Montabaur, Germany	Operation of the platform
Eleven GmbH	Berlin, Germany	Spam filter for email
Open-Xchange GmbH	Olpe, Germany	Webmail interface
SiteLock, LLC	Scottsdale, Arizona, USA	Daily security scan

Other sub-processors on Strato’s list concern products we have not booked, and are therefore deliberately not listed here.

Security scan (SiteLock)

The hosting package includes a daily security scan that checks the website for malware and known vulnerabilities. It is activated for our domain. It is carried out by SiteLock, LLC, based in Scottsdale, Arizona, USA, as a sub-processor of Strato.

This involves a transfer to a third country. It is safeguarded by the European Commission’s standard data protection clauses, which Strato has concluded with the company (Art. 46(2)(c) GDPR). The legal basis for the processing is Art. 6(1)(f) GDPR; our legitimate interest is to notice any alteration of this website by third parties.

The scan sees the same pages that every visitor sees, as well as the files on our web space. It does not analyse visitor behaviour and receives no messages from the contact form — those are kept in the email mailbox, not on the web space.

Contact form

There is a form on the contact page. What is sent is what you have entered:

Name
Email address
Subject (chosen from a list)
Message

This information leaves our server in one direction only: as an email to the board. Exactly to whom depends on the subject:

Music lessons: to Email address (visible with JavaScript), with copies to Email address (visible with JavaScript) and Email address (visible with JavaScript)
Booking a performance: to Email address (visible with JavaScript), with a copy to Email address (visible with JavaScript)
all other subjects: to Email address (visible with JavaScript)

Your address appears in it as the reply-to address, together with the other recipients — so that we can reply directly and each of us sees that a reply has already been sent. There is no database, no ticket system and no service provider in between.

The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in being able to reply to enquiries. If the enquiry is about joining the club or about lessons, it is Art. 6(1)(b) GDPR, because the processing then serves to prepare a contractual relationship.

Retention period: We delete the message once the matter has been dealt with, but no later than twelve months after the last contact. It is kept longer only if a statutory retention obligation requires it.

The spam protection behind it

Because we do not want to use a CAPTCHA — reCAPTCHA would mean a connection to Google — the spam protection runs on our own server. Three things happen, and for the sake of completeness they are listed here:

The form contains a field that is invisible to humans. If it is filled in, we discard the message. Nothing is stored in the process.
A hidden field records how many milliseconds pass between loading the page and sending the form. If it is under three seconds, we discard the message, because no human types that fast. Nothing is stored here either.
We accept five messages per hour from each sender. To count them, we do not store any IP address in plain text, but a file whose name consists of a SHA-256 hash computed from the IP address (for IPv6, from the /64 network it belongs to) and the current date; the file contains nothing but timestamps. Files older than 24 hours are deleted by the form the next time it is used.

Point 3 calls for an honest assessment: this is pseudonymisation, not anonymisation. The hash contains no secret, so one could try every possible IPv4 address against it and find the original address. What the method achieves is that no file on our server holds addresses readable in plain text — nothing more.

Colour scheme: a setting in the browser

At the foot of every page you can choose between System, Light and Dark. So that the choice still applies on your next visit, the website stores it in your browser’s local storage (localStorage), under the name color-scheme with the value light or dark. With System, the entry is deleted, and then nothing is stored there.

This setting does not leave your browser; we never see it. It is technically necessary in order to provide a function that you yourself have chosen, and therefore requires no consent under § 25(2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act). You can delete it at any time in your browser’s settings.

Video from YouTube: only when you click

One post embeds a video that is hosted on YouTube. When the page is opened, nothing is loaded from YouTube — you only see a notice and two buttons. Only when you press Play the video here is the connection to YouTube made, and in doing so your browser transmits, among other things, your IP address to the provider. For this we use the address youtube-nocookie.com, which reduces the data collection but does not prevent it.

The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google LLC is responsible for the processing in the USA. The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG, which you give by pressing Play the video here and which you can withdraw by reloading the page and not starting the video. What data Google processes is set out in its privacy policy: https://policies.google.com/privacy (opens in a new tab).

Anyone who wants to watch the video without this transfer cannot — it is hosted on YouTube. The second button, Watch on YouTube, leads there, which means the same connection, only a visible one.

Maps on event pages: from our own server

Many events show a map of the venue under Directions. This map comes entirely from our own server: the map data, the program that draws it, and the font of the street names. Viewing, panning or zooming it creates no connection to Google, to OpenStreetMap or to any other provider, and nothing is stored. The map data comes from the OpenStreetMap contributors and is available under the Open Database License.

The buttons Route with Google Maps and View on OpenStreetMap are ordinary links. Only when you click one of them does Google Maps or openstreetmap.org open, and from then on the privacy policy of Google (https://policies.google.com/privacy (opens in a new tab)) or of the OpenStreetMap Foundation (https://osmfoundation.org/wiki/Privacy_Policy (opens in a new tab)) applies, respectively.

Links to our profiles

The footer of every page contains links to our profiles on Instagram, Facebook and YouTube. These are ordinary links, not embeds: as long as you do not click them, neither Meta nor Google learns anything about your visit here. After the click, the privacy policy of the respective provider applies, and we have no influence over the processing there.

Donation projects on betterplace.org

On the Donations page we show our projects on the donation platform betterplace.org, with a picture and the amount donated so far. We fetch this information when the website is built and deliver it from our own server — when you open the page, your browser loads nothing from betterplace. Only when you click one of the links do you leave our website; anyone who donates there gives their details to betterplace, and the privacy policy of betterplace.org applies to that.

Photos on this website

People can be seen on the pages and in the gallery: musicians at concerts, performances and club festivities.

The purpose is to present the club and its work to the public. The legal basis is Art. 6(1)(f) GDPR in conjunction with §§ 22, 23 KUG (German Art Copyright Act); our legitimate interest is the public relations work of a non-profit club. For pictures in which individual people are the focus, we rely on their consent under Art. 6(1)(a) GDPR; for minors, on that of their parents or legal guardians.

We do not give names in image descriptions and captions if the person pictured has not agreed to it.

If you do not want a picture of yourself here, write to Email address (visible with JavaScript). We will take it down without you having to give a reason, and we will do so within days, not months. You can withdraw consent you have given at any time (Art. 7(3) GDPR); this does not affect the lawfulness of the processing carried out before the withdrawal.

Editorial area

At /admin/, some members of the board maintain the content of this website. For visitors, this part is of no relevance — it can only be reached with an account. For the sake of completeness:

Signing in works through a GitHub account, because the content of this website is kept in a Git repository. In the process, the editing person’s browser is redirected to GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA — processing in a third country. For the duration of the sign-in, our server sets a single cookie named __Host-mvb-oauth, which is valid for ten minutes and serves solely to secure the sign-in: it carries a random number that fends off sign-in attempts from other sites, and a key used only once that protects the exchange with GitHub (PKCE). Because the browser accepts such a cookie only for the whole website, it sends it with every request to this website during those ten minutes; it is evaluated only at sign-in. It is technically necessary (§ 25(2) no. 2 TDDDG) and is deleted after the sign-in process. The legal basis is Art. 6(1)(b) GDPR with respect to the editing members. GitHub’s privacy policy: https://docs.github.com/site-policy (opens in a new tab).

Unlike the rest of this website, the editing software (Sveltia CMS) loads files from third-party servers as soon as /admin/ is opened, before signing in: its German texts and a check for new versions from unpkg.com, and it asks www.githubstatus.com whether GitHub is currently reachable. Anyone who sets the point on the map while editing an event loads the map for it from the map servers at tile.openstreetmap.org, and the address search queries nominatim.openstreetmap.org (both OpenStreetMap Foundation, United Kingdom). Like any server when something is requested from it, these servers receive the browser’s IP address. Anyone who only visits the website never opens /admin/.

Your rights

With respect to us, you have the right at any time to

access the data stored about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
object to processing that is based on a legitimate interest (Art. 21 GDPR) — here this mainly concerns the photos,
withdraw consent (Art. 7(3) GDPR), with effect for the future.

A word on how little we hold: apart from the log files at our hosting provider and the emails from the contact form, we hold no data about an ordinary visit to this website. A request for access will therefore often receive the answer “we hold nothing about you” — and that is the correct answer, not an excuse.

Right to lodge a complaint

If you believe that we are infringing the law in processing your data, you can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
Heilbronner Straße 35, 70191 Stuttgart
Postfach 10 29 32, 70025 Stuttgart
Phone: 0711/615541-0
Email: Email address (visible with JavaScript)
https://www.baden-wuerttemberg.datenschutz.de/ (opens in a new tab)

Date of this policy

28 September 2026. We update it when something described here changes on the website.