Privacy

Controller

Responsible for data processing on stevemitchell.music:
Stephen Mitchell
c/o flexdienst – #21659
Kurt-Schumacher-Straße 76
67663 Kaiserslautern
Germany
E-Mail: contact@stevemitchell.music

Hosting and server logs

My servers are hosted by Hetzner Online GmbH in Germany. They process your IP address, user agent and request times in server logs to operate and secure the service (legal basis: legitimate interest, Art. 6(1)(f) GDPR). Logs are kept for 7 days. DNS for this domain is provided by Cloudflare, Inc.

Email contact

If you email me, I process the details you provide to answer your enquiry (legal basis: Art. 6(1)(b) or (f) GDPR). My mail provider is Proton AG (Switzerland). I keep emails for as long as needed to deal with your enquiry, and longer where tax law requires.

You can ask to hear from me by email about new releases, new instruments and betas. I use it a few times a year at most (legal basis: your consent, Art. 6(1)(a) GDPR). The emails are delivered by Postmark.

What I keep. Your email address, the date you signed up, which page you signed up from and which version of the wording above you agreed to, so I can show that you agreed (Art. 7(1) GDPR). I don't store your IP address or record whether you open or click anything. If you don't confirm your address, it's deleted after seven days.

Leaving. Every email has an unsubscribe link, which deletes your address. You can also withdraw consent by emailing me, with effect for the future.

Analytics

I use Umami for website analytics, which I host myself. It is cookieless, does no cross-site tracking, builds no profiles, and does not store IP addresses (legal basis: legitimate interest in understanding how the site is used, Art. 6(1)(f) GDPR). No data is shared with any third party.

Cookies

There are no tracking, profiling or advertising cookies on this site.

Your rights

Under the General Data Protection Regulation you have the rights:

To access the personal data I hold about you (Art. 15 GDPR)
To rectify inaccurate data (Art. 16 GDPR)
To request deletion of your data (Art. 17 GDPR)
To restrict processing (Art. 18 GDPR)
To data portability (Art. 20 GDPR)
To object to processing (Art. 21 GDPR)
To lodge a complaint with a supervisory authority (Art. 77 GDPR)

Right to object. Where I rely on legitimate interest, you can object to the processing at any time on grounds relating to your particular situation (Art. 21 GDPR). Where I rely on your consent, you can withdraw it at any time, with effect for the future.

The supervisory authority for this site is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

Recipients and processors

Processors under Art. 28 GDPR: Hetzner Online GmbH (hosting), Cloudflare, Inc. (DNS, storage and downloads), Proton AG (email), flexdienst (postal mail forwarding) and ActiveCampaign, LLC (Postmark), which delivers the mailing list.

Transfers outside the EU

Proton AG is in Switzerland, which the European Commission has recognised as providing an adequate level of protection, so no further safeguard is required.

Cloudflare, Inc. and ActiveCampaign, LLC (Postmark) are in the United States, so data does leave the EU. These transfers are covered by the European Commission's Standard Contractual Clauses (Decision 2021/914/EU), incorporated into their respective data processing terms. Cloudflare additionally certifies under the EU–US Data Privacy Framework.