Privacy policy

This policy applies to the websites nphm.info and musikwerkstattjugend.de, both run by Musikwerkstatt Jugend e.V. We keep data processing to a minimum on purpose: the websites set no cookies, use no advertising services and load fonts and images only from our hosting provider, not from any other third party. To see how often which pages are visited, we use our hosting provider’s cookieless statistics service (see “Audience measurement with Vercel Web Analytics”).

Controller

Musikwerkstatt Jugend e.V.
represented by Franz Deutsch (chairman)
Spatzenloh 10, 82057 Icking, Germany
Phone: +49 8178 90018
Email: deutsch@musikwerkstattjugend.de

As an association run by volunteers, we are not required to appoint a data protection officer. Please send any privacy questions to the address above.

Visiting the websites and server log files

When you open a page, your browser sends technically necessary data to our hosting provider’s servers: IP address, date and time, the address requested, amount of data transferred, status code, the previously visited page (referrer), and browser and operating system. This information is stored briefly in log files in order to deliver the websites, find errors and fend off attacks.

The legal basis is our legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR). Log files are kept only as long as necessary for these purposes. We do not use them for any other purpose and do not combine this data with other data.

Hosting

The websites are hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Vercel delivers the pages through a worldwide server network, usually from a location close to you; in the process, the data listed above may also be transferred to the USA. The legal basis is our legitimate interest in providing the websites reliably and quickly (Art. 6(1)(f) GDPR).

Vercel is certified under the EU-U.S. Data Privacy Framework, so transfers to the USA are covered by the European Commission’s adequacy decision (Art. 45 GDPR). For more information see Vercel’s privacy policy.

Audience measurement with Vercel Web Analytics

To see which pages are read and where visitors come from, we use Vercel Web Analytics, a service provided by our hosting provider Vercel Inc. (address under “Hosting”). On every page view, a small script loaded from our own domain sends the following to Vercel: the page viewed, the previously visited page (referrer), the time, browser, operating system, device type and the country derived from the IP address.

No cookies are set and no cross-device profiles are created. To group page views into a visit, Vercel computes a hash from the request data that is recalculated daily and discarded after 24 hours; the IP address itself is not stored for this. We only see aggregated figures, such as views per page, referring sites or countries, and cannot identify individual people from them.

The legal basis is our legitimate interest in shaping the websites around visitors’ needs and assessing the impact of our public relations work (Art. 6(1)(f) GDPR). As with hosting, transfers to the USA are covered by the adequacy decision on the EU-U.S. Data Privacy Framework. You may object to this processing at any time (Art. 21 GDPR), for example by email to the address above; technically, you can prevent the measurement by blocking scripts for our websites, for instance with a content blocker. For more information see Vercel’s documentation on privacy in Web Analytics.

Contact by email or phone

If you write to us or call us, we process your details (such as name, email address, phone number and the content of your message) to deal with your request. The legal basis is Art. 6(1)(b) GDPR where your request concerns participation, membership or a contract, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the details once they are no longer needed and no statutory retention obligations apply.

Applications and registrations via Airtable

Applications for Neue Philharmonie München and registrations for the Sinfonietta Isartal use online forms provided by Airtable (Formagrid Inc., 799 Market Street, San Francisco, CA 94103, USA). The forms only open when you click the corresponding link. There we collect the information we need to select participants and organise the project, for example name, contact details, instrument, education and recordings.

The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into an agreement and taking part in the project). Airtable processes the data on our behalf and may transfer it to the USA. The transfer is based on the EU Standard Contractual Clauses included in Airtable’s data processing agreement. We keep participants’ data for as long as accounting and statutory obligations require.

YouTube videos

Some pages show videos hosted on YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Loading a page does not connect to YouTube; at first you only see a placeholder. Only when you click “Play video” does your browser load the video in privacy-enhanced mode (youtube-nocookie.com). YouTube then receives your IP address and the address of our page, among other things, and may transfer data to its parent company Google LLC in the USA.

The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, § 25(1) TDDDG). It applies only to that video and the current page view. For more information see Google’s privacy policy.

Links to other websites

Our pages link to other services, such as ticket shops, concert venues, press articles or YouTube. Their operators are responsible for how data is processed there. They only receive data from you once you follow such a link.

Donations and membership

If you transfer money to us or become a member, we process your name, address, bank details and the amount in order to book the payment, collect fees by direct debit and issue donation receipts. The legal basis is Art. 6(1)(b) GDPR (membership) and Art. 6(1)(c) GDPR (retention obligations under tax and commercial law, usually ten years).

Your rights

You have the right to access the data we hold about you (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Last updated

October 2026. We update this policy whenever the websites or the services we use change. The German version is the legally binding one.