Privacy policy.

Thank you for visiting our website www.music-campus.de. Protecting your personal data is important to us. In this privacy policy, we inform you which data we process, for what purposes, and what rights you have.

Personal data means any information relating to an identified or identifiable person (e.g. name, email address, phone number, IP address).

1Controller

Further legal information can be found in our legal notice.

2General principles

2.1 Data security

We use technical and organisational measures to protect data against loss, manipulation and unauthorised access.

2.2 Retention period

We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations. After that, the data is deleted or its processing is restricted.

3Data processing when you visit the website (server log files)

When you access our website, our web server automatically processes data transmitted by your browser, in particular:

• IP address
• Date and time of access
• page/file accessed
• Referrer URL
• Browser type/version, operating system
• Language settings
• HTTP status code / amount of data

4Cookies, consent and local storage

Without your consent, our website does not set any cookies and does not use any analytics or marketing tools. The only exceptions are technically necessary session cookies after logging in to the student area and the protected administration area (see the section “Student area”). We only load content from external providers (YouTube video, Google Maps) and the visitor statistics via Google Tag Manager if you consent via our consent banner or actively load the respective map or video. We store your choice in your browser’s local storage (entry “mc_consent”) so that the banner does not appear again every time you open a page; this information does not leave your device. After 12 months it is automatically discarded and we ask again. You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of every page. If your device asks for less motion (setting “Reduce motion”), we show a one-time notice. Your choice (“Turn on motion” or “Keep it”) is also stored only in local storage (entry “mc_motion”); it does not leave your device and can be changed via the corresponding link in the footer.

For the trial lesson request, we store which subject you are interested in, only for the duration of your browser session, in what is known as session storage, so that this information is available on the confirmation page. This information does not leave your device and is automatically deleted when you close the browser window.

Once you have given your consent, embedded third-party services may set cookies (YouTube, Google Maps and the statistics services loaded via Google Tag Manager). In addition, the request form from msvplus.de is embedded on the “Trial lesson” page. It is loaded without separate consent because it is technically necessary for the trial lesson request you wish to make (Section 25(2) no. 2 TDDDG). Details can be found in the respective sections.

5Fonts (hosted locally)

The fonts used on our website are stored locally on our own server and loaded from there. No connection is made to servers operated by Google or other third parties.

6Google Maps (only after a click)

On several pages (in each case in the “Contact & directions” section), you can display a map from Google Maps. The map is only loaded if you allow “External media” in the consent banner or actively click “Load map”. A click on “Load map” applies only to that particular map and that page view; no permanent consent is stored. Before that, no data is transmitted to Google. After the click, Google may process, among other things, your IP address, device and browser data and, where applicable, location data (depending on your device settings), and may set cookies.

Transfer to third countries: a transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework.

7YouTube (video on the home page)

On our home page we show a muted video embedded via YouTube in privacy-enhanced mode (youtube-nocookie.com). It is only loaded if you allow “External media” in the consent banner or click “Activate video” (this click applies only to the current page view and does not store any permanent consent). It is then loaded directly when you open the home page. Without consent, you only see a still image served from our own server. Once you consent, a connection is established to YouTube/Google servers; in particular, your IP address and device and browser data are transmitted. According to YouTube, in privacy-enhanced mode it does not set any advertising cookies as long as you do not interact with the video; however, the storage of technically necessary information on your device cannot be ruled out.

Transfer to third countries: a transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework.

8Google Tag Manager and visitor statistics (only with consent)

If you consent to the “Statistics” category in the consent banner, we load Google Tag Manager. We use this tool to embed services for measuring reach on our website, such as Google Analytics. In particular, your IP address, information about your browser and device, the pages you visit, the time and duration of your visit and your approximate region are processed and transmitted to Google. The embedded services may set cookies (for example “_ga”) that are stored for up to 2 years. Advertising features and personalised ads are disabled. Without your consent, Google Tag Manager is not loaded.

Transfer to third countries: a transfer to the USA cannot be ruled out; Google is certified under the EU-US Data Privacy Framework. If you withdraw your consent, the page is reloaded and Google Tag Manager is no longer embedded.

9Trial lesson requests via msvplus.de (form/online service)

For trial lesson requests, we use a request form provided by msvplus.de and embedded on our “Trial lesson” page. When you open this page, a connection is established to the msvplus.de servers. If you submit a request there, the data you enter is processed, e.g.:

• Name, contact details (email/phone)
• preferred instrument/course, preferred appointment times
• messages/content, where applicable age/student data (if requested)
• technical data (IP address, timestamp) for system security

Where msvplus.de acts as a processor, processing is carried out on the basis of a data processing agreement (Art. 28 GDPR).

10ME Time prepaid card enquiry (form)

On the “ME Time” page, you can request a prepaid card or a gift voucher. In doing so, we process the information you enter: name, email address, phone number, where applicable the name of the gift recipient, and the selected card (number and length of lessons, price). The form is sent to us as an email via a script on our own web server at HOSTER-OFFEN; the information is not stored on the web server but is afterwards only held in our email inbox.

To protect against automated spam requests, we do not use a third-party service but a short “music check”: our server sets a random sequence of keys that you play back. We also check how quickly the form was submitted and limit the number of requests. For this purpose, a counter with an encrypted (hashed) value of your IP address is stored on our server for a maximum of one hour; it is then discarded. No cookies are set and no data is transmitted to third parties.

11Student area: tuner with microphone

In the student area (only for logged-in students) we offer a metronome and a tuner. The tuner uses your device’s microphone. Access only begins once you choose “Start microphone” and allow it in your browser.

The audio signal is analysed exclusively locally in your browser to determine the pitch. It is neither recorded nor stored and is not transmitted to us or to third parties. You can end access at any time with “Stop microphone” or revoke it in your browser settings.

The metronome and tuner do not set cookies and do not store any data on your device.

12Student area (login and practice calendar)

Our students can be given access to the student area. Using it is voluntary; lessons take place regardless. We set up access through our school administration and hand over the login details in person or by email, to parents or guardians in the case of minors.

We process the following data:

• Access: username (without your real name), the password only as an encrypted hash value, the date of setup and of the last login, the status of the access and a random identifier with which our school administration assigns the access
• Practice data: start, end and duration of the recorded practice times, the weekly goal (minutes per day, days per week) and optional notes on a practice session. Please do not enter any sensitive information in the notes.
• Security: we count failed login attempts using an encrypted value (hash) of the IP address and of the username entered. These entries are deleted after one day.

After login we set a technically necessary session cookie (“__Host-mcs”). It only contains a random session identifier. The session ends when you log out, after 30 minutes without activity and after 12 hours at the latest. The chord finder and the band remember your last settings (for example instrument, style and tempo) in your browser’s local storage (entries “mc_akkord” and “mc_band”). This information does not leave your device.

Your practice data is shown only to you. There is no view for teachers. The data is stored on our web server at HOSTER-OFFEN GmbH, which processes it on our behalf.

We manage accounts through our school administration or through a protected administration area of the website that can only be accessed with a password and a second factor. Changes to accounts (for example creating, locking or deleting) are logged with the time, the username of the account and the name of the person managing it. These entries are deleted after 12 months.

If you give us an email address for this purpose, we send the login details by email. We use the address only for this purpose and do not store it in the student area. A confirmation of the dispatch, without the password, goes to our office mailbox.

You can send us feedback via the field “Found a bug? Have an idea?” in the student area. The message is sent by email, together with your username, the selected language and your browser identifier, to the team that develops the student area. It is not stored in the student area; we delete the email once the feedback has been dealt with.

13Contacting us (email, phone)

If you contact us by email or phone, we process the data you provide in order to handle your enquiry.

14Recipients, service providers and data processing on our behalf

We use service providers (hosting by HOSTER-OFFEN GmbH, the msvplus.de request system) who may process data on our behalf. Where necessary, we conclude data processing agreements in accordance with Art. 28 GDPR.

15Your rights

Subject to the applicable requirements, you have the following rights:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing based on Art. 6(1)(e)/(f) GDPR (Art. 21 GDPR)
• Withdrawal of consent given (Art. 7(3) GDPR)

Right to lodge a complaint

You also have the right to lodge a complaint with a data protection supervisory authority. For North Rhine-Westphalia (Bayern), this is, for example:

16Objection under Art. 21 GDPR

Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation.
In the case of direct marketing, an objection takes effect without any further balancing of interests.

17Data protection contact