Skip to content

Privacy

This is a translation for convenience; the German version is legally binding.

Privacy policy

This privacy policy explains the type, scope and purpose of the processing of personal data (“data” for short) within our online offering and the websites, functions and content connected with it, as well as external online presences such as our social media profiles (together the “online offering”). For the terms used, such as “processing” or “controller”, we refer to the definitions in Art. 4 of the General Data Protection Regulation (GDPR).

Controller

Types of data processed

  • Master data (e.g. names, addresses).
  • Contact data (e.g. email, phone numbers).
  • Content data (e.g. text entries, photos, videos).
  • Usage data (e.g. pages visited, interest in content, access times).
  • Meta and communication data (e.g. device information, IP addresses).

Categories of data subjects

Visitors and users of the online offering (below, we refer to the data subjects collectively as “users”).

Purpose of processing

  • Providing the online offering, its functions and content.
  • Answering contact requests and communicating with users.
  • Security measures.

Terms used

“Personal data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

“Processing” means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data.

“Pseudonymisation” means the processing of personal data in such a way that the data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures ensuring that the personal data are not attributed to an identified or identifiable natural person.

“Profiling” means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

“Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Processor” means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller.

In accordance with Art. 13 GDPR, we inform you of the legal bases of our data processing. Unless the legal basis is stated in this privacy policy, the following applies: the legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR; the legal basis for processing to provide our services, carry out contractual measures and answer enquiries is Art. 6(1)(b) GDPR; the legal basis for processing to fulfil our legal obligations is Art. 6(1)(c) GDPR; and the legal basis for processing to protect our legitimate interests is Art. 6(1)(f) GDPR. Where the vital interests of the data subject or another natural person require the processing of personal data, Art. 6(1)(d) GDPR serves as the legal basis.

Security measures

In accordance with Art. 32 GDPR, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, as well as the varying likelihood and severity of the risk to the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical access to the data, as well as access to, input, disclosure, securing the availability and separation of the data. We have also established procedures that ensure that data subjects’ rights are exercised, data is deleted and threats to the data are responded to. Furthermore, we take the protection of personal data into account when developing or selecting hardware, software and procedures, in line with the principle of data protection by design and by default (Art. 25 GDPR).

Cooperation with processors and third parties

If, in the course of our processing, we disclose data to other persons and companies (processors or third parties), transmit it to them or otherwise grant them access to the data, this is done only on the basis of a legal permission (e.g. if a transmission of data to third parties, such as payment service providers, is necessary to perform a contract under Art. 6(1)(b) GDPR), if you have consented, if a legal obligation provides for it, or on the basis of our legitimate interests (e.g. when using agents, web hosts, etc.).

If we commission third parties to process data on the basis of a so-called “data processing agreement”, this is done on the basis of Art. 28 GDPR.

Transfers to third countries

If we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this happens in the course of using third-party services or disclosing or transmitting data to third parties, this only takes place if it is necessary to fulfil our (pre-)contractual obligations, on the basis of your consent, due to a legal obligation or on the basis of our legitimate interests. Subject to legal or contractual permissions, we only process data in a third country, or have it processed there, if the special requirements of Art. 44 et seq. GDPR are met. This means, for example, that processing takes place on the basis of an adequacy decision of the EU Commission (for the USA: the EU-US Data Privacy Framework, if the recipient is certified under it), on the basis of the EU Commission’s standard contractual clauses or on the basis of your explicit consent (Art. 49(1)(a) GDPR).

Rights of data subjects

You have the right to obtain confirmation as to whether data concerning you is being processed, and to access this data, further information and a copy of the data in accordance with Art. 15 GDPR.

In accordance with Art. 16 GDPR, you have the right to have incomplete data concerning you completed or inaccurate data concerning you corrected.

In accordance with Art. 17 GDPR, you have the right to demand that data concerning you be deleted without delay or, alternatively, in accordance with Art. 18 GDPR, to demand that the processing of the data be restricted.

In accordance with Art. 20 GDPR, you have the right to receive the data concerning you that you have provided to us and to request that it be transmitted to other controllers.

In accordance with Art. 77 GDPR, you also have the right to lodge a complaint with the competent supervisory authority.

You have the right to withdraw any consent you have given, with effect for the future, in accordance with Art. 7(3) GDPR.

Right to object

You can object to the future processing of data concerning you at any time in accordance with Art. 21 GDPR. In particular, you can object to processing for the purposes of direct marketing.

Cookies and local storage

“Cookies” are small files stored on users’ devices. Comparable techniques include, for example, the browser’s local storage.

This website itself sets no cookies and uses no analytics or tracking services. The only exception is the password-protected admin area (/admin/), which the band members use to maintain the content: after logging in there, a technically necessary session cookie is set that only applies to that area (§ 25(2) no. 2 TDDDG). Visitors to the website do not receive a cookie.

Third-party cookies can only be set if you actively load embedded content (a YouTube video or a Bandcamp player). Details can be found in the sections on YouTube and Bandcamp.

If you choose the option “Always load Bandcamp players” on a Bandcamp player, we store this setting in your browser’s local storage (entry pyrior-consent-bandcamp). It is stored solely at your request, to provide the function you asked for (§ 25(2) no. 2 TDDDG). The entry is not transmitted to us. You can remove it at any time using the “Withdraw Bandcamp consent” link in the footer of the website or by deleting the site data in your browser.

Deletion of data

The data we process is deleted or its processing restricted in accordance with Art. 17 and 18 GDPR. Unless expressly stated in this privacy policy, the data we store is deleted as soon as it is no longer required for its purpose and no statutory retention obligations prevent deletion. If data is not deleted because it is required for other, legally permitted purposes, its processing is restricted, i.e. the data is blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax reasons.

Under German law, retention takes place in particular for 10 years in accordance with §§ 147(1) AO and 257(1) nos. 1 and 4, (4) HGB (books, records, management reports, accounting vouchers, commercial books, documents relevant for taxation, etc.) and for 6 years in accordance with § 257(1) nos. 2 and 3, (4) HGB (commercial letters).

Under Austrian law, retention takes place in particular for 7 years in accordance with § 132(1) BAO (accounting documents, vouchers/invoices, accounts, business papers, statements of income and expenditure, etc.), for 22 years in connection with real estate and for 10 years for documents relating to electronically supplied services, telecommunications, radio and television services provided to non-businesses in EU member states for which the Mini One Stop Shop (MOSS) is used.

Hosting

This website runs on our own server. No external hosting provider and no content delivery network (CDN) are used; the data generated when you visit the website is therefore not transmitted to third parties.

Collection of access data and log files

On the basis of our legitimate interests within the meaning of Art. 6(1)(f) GDPR, our server collects data about every access to the server (so-called server log files). The access data includes the name of the page or file requested, the date and time of access, the amount of data transferred, a notification of successful retrieval, the browser type and version, the user’s operating system, the referrer URL (the previously visited page) and the IP address.

The log files are used for security (e.g. to investigate misuse or fraud) and for technical operation. They are deleted regularly. We do not analyse the log files ourselves.

Contacting us

When you contact us (e.g. via a contact form, email, phone or social media), the information you provide is processed to handle and respond to your enquiry in accordance with Art. 6(1)(b) GDPR. The information may be stored in a customer relationship management system (“CRM system”) or a comparable way of organising enquiries.

We delete enquiries once they are no longer required. We review whether they are still required every two years; statutory archiving obligations also apply.

Online presences in social media

We maintain online presences within social networks and platforms (e.g. YouTube, Bandcamp, SoundCloud, Facebook) to communicate with the users active there and to inform them about our music and concerts. We only refer to these presences with simple links; merely visiting this website does not transmit any data to these platforms. Only when you follow a link do the terms and data processing policies of the respective operators apply.

Unless stated otherwise in our privacy policy, we process the data of users who communicate with us within the social networks and platforms, e.g. who write posts on our online presences or send us messages.

Fonts and images

All fonts and images used on this website are delivered from our own server. In particular, no fonts are loaded from Google Fonts or other external providers. The preview images of the YouTube videos are also copied to our server in advance, so that no connection to YouTube is made when a page is loaded.

Embedding third-party services and content (two-click solution)

We embed videos from YouTube and music players from Bandcamp. This content is not loaded automatically when you visit the website. Instead, you first see a placeholder with a notice. Only when you click “Play” or “Listen” is a connection to the respective provider established.

By clicking, you consent to the content being loaded. The provider receives at least your IP address and technical information about your browser; the provider may also use cookies or comparable techniques on your device and use the data for its own purposes (e.g. statistics or advertising). The legal basis is your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Consent applies only to the content clicked and the current page view, unless you explicitly choose “Always load”. You can withdraw consent at any time with effect for the future (see “Cookies and local storage”).

We have no influence on the data processing by the providers.

YouTube

We use YouTube to embed videos. The provider for users in the EEA is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the so-called “privacy-enhanced mode” (embedding via youtube-nocookie.com). A video is only loaded when you click it.

Data may be transmitted to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework.

Google’s privacy policy: policies.google.com/privacy, ad settings: adssettings.google.com.

Bandcamp

We use Bandcamp players to embed our music. The provider is Bandcamp Ventures LLC, USA. A player is only loaded when you click it or have previously chosen the option “Always load Bandcamp players”.

Data is transmitted to Bandcamp in the USA. If no adequacy decision (EU-US Data Privacy Framework) applies to the provider, the transfer is based on your explicit consent (Art. 49(1)(a) GDPR). In this case there is a risk that US authorities may access the data and that you have no effective legal remedies against this.

Bandcamp’s privacy policy: bandcamp.com/privacy.

Last updated: October 2026

Originally created with Datenschutz-Generator.de by attorney Dr. Thomas Schwenke, adapted to the current website.