Privacy policy

Controller

The controller is The Agency, owner Robin Kolb, Carrer de S’Illot 13, 07400 Alcúdia, Spain. We have not appointed a data protection officer, as we are not required to.

Email: info@the-agency.de

Hosting and server data

When you open the site, the servers technically process your IP address, the time, the requested address, the referrer and browser and device information so the site can be delivered securely. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is secure operation. We do not store this server data ourselves. Vercel keeps the logs only for a limited time that depends on the plan and then deletes them.

Hosting: Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. Server functions run in the Frankfurt am Main region (fra1), and requests are received by a global network at the nearest location. Transfers to the USA rely on EU standard contractual clauses (Art. 46 GDPR) and, where certified, the EU-US Data Privacy Framework (Art. 45 GDPR).

Database and sign-in: Supabase Inc. (USA) as processor, stored in the eu-central-1 region (Frankfurt). Transfers to the USA rely on EU standard contractual clauses.

Enquiry form

Required: occasion, date, place, first name, last name, email, plus the country, preset to Germany. Optional: start time, number of guests, line-up, song board and wish songs, whether equipment is on site, phone and preferred contact method, message and how you found the site. We also store a rough origin group (such as search engine or direct visit), not the full previous address. We do not ask for your postal address.

The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps). We process how you found the site and the origin group under Art. 6(1)(f) GDPR; our legitimate interest is understanding how enquiries come about. The occasion, a baptism for example, may point to a religious belief. You decide what you state and can choose “Something else”. Where that detail is specially protected, we process it only to handle your enquiry, based on your consent given by sending it (Art. 9(2)(a) GDPR).

The recipient is The Agency. It receives your enquiry in full by email, transmitted over TLS, and passes it on to Te Amoako Jr. and participating musicians where needed for the performance. Replies go to the address you gave. Mail is sent via Resend, Inc. (USA) in the eu-west-1 region (Ireland); transfers to the USA rely on EU standard contractual clauses.

After sending, you receive an automatic confirmation with a reference number and the next steps, at most one per address in 24 hours. It contains none of the details from your enquiry.

To protect against abuse we convert the IP address and email address into checksums and use them to limit the number of enquiries (Art. 6(1)(f) GDPR). The checksums for the limit expire after one hour, those for the confirmation and the protection against automated senders after 24 hours.

Visitor counting only with consent

Only if you choose “Allow statistics” in the notice do we count visits ourselves, with no cookies and no third parties. We collect the page path, language version, origin or campaign tag, country, device type, time on page, a daily hash and the category of an action (enquiry button, line-up chosen, form step, submission, video started, song chosen, enquiry with board), never form contents.

The IP address only goes into the hash and is not stored. The hash uses a random value renewed daily and deleted by the day after next at the latest, after which recognition beyond the day is impossible. Individual events are kept for at most 90 days, after that only daily totals. Views in the admin area and preview do not count, and we respect a Global Privacy Control or Do Not Track signal.

The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). We store your decision in your browser's storage, and only after you have chosen. You can withdraw at any time via “Privacy settings” in the footer; withdrawal takes effect immediately for the future. If you decline or do not decide, nothing is counted.

If we switch counting off entirely, we delete the daily keys by the day after next at the latest.

YouTube videos after a click

Videos and listening samples come from YouTube, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you click, nothing loads from Google; the preview images are on our own server. Only when you click ▶ does the player load from youtube-nocookie.com, and with it further Google services such as fonts, preview images and video data. Your IP address and device data then go to Google, including in the USA, and Google may store data on your device.

The legal basis is your consent by clicking (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). The transfer to the USA relies on the EU-US Data Privacy Framework (Art. 45 GDPR). Instagram and Facebook are only linked, not embedded.

Light and dark design

The site opens in its dark design. If you switch between light and dark design yourself, your browser stores that choice in its local storage (key “te-amoako:farbschema:v1”, value “hell” or “dunkel”). It does not leave your device and we do not receive it. It is stored only after your click, because you expressly ask for this function (Section 25(2) no. 2 TDDDG). You can delete the choice in your browser settings at any time.

Translation of our own texts

To translate our own site texts in the protected studio we use Anthropic Ireland, Limited as processor. Only public texts we wrote ourselves are sent, never visitor data or enquiries (Art. 6(1)(f) GDPR; our interest is a consistent multilingual site). Anthropic does not use these texts to train its models and deletes inputs and outputs within 30 days, unless a breach of its usage policy or a legal obligation requires longer retention. Processing may also take place in the USA; the EU Standard Contractual Clauses in Anthropic's data processing addendum apply to it.

Technical support

NiiRo.ai provides technical support for this website as a processor under Art. 28 GDPR. Warnings about email delivery problems go to info@niiro.ai.

Retention

Enquiries in the inbox are deleted automatically after 180 days, and at the latest 30 days after completion (closed, spam or taken into a contract). The Agency keeps contract data outside this site within statutory retention periods. The Agency deletes emails already sent by hand after completion; according to Resend, it keeps email data for up to 30 days.

Your rights

Subject to the statutory conditions, you have these rights:

• Access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent for the future.

Supervisory authority

You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for the controller is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

Privacy contact

A message is all it takes for privacy questions.

Email: info@the-agency.de