Privacy.

Privacy policy

1. Controller

Egon Hill, Nachtwerk Creative Studio
Hopfenstraße 33
24103 Kiel
Germany
Email: hello@nachtwerk.studio

2. Hosting and server logs

When you access this website, the hosting provider processes technically necessary data. This may include your IP address, the date and time of access, the requested file, the amount of data transferred, the referrer URL, and browser and operating system information.

Processing is carried out to provide the website securely, reliably and without errors. The legal basis is Article 6(1)(f) GDPR. The legitimate interest lies in the technical functionality and security of the website. Log data is deleted once it is no longer required for these purposes, unless longer retention is necessary for security or legal reasons.

3. Contact and project inquiries

If you use the contact or booking form, or contact us by email, we process the information you provide. Depending on your inquiry, this may include your name, email address, artist, podcast or project name, requested service, track or episode title, genre, BPM, stem count, preferred timing, audio preview and reference links, project notes, and your choice about being mentioned as a future reference. An automated confirmation that the inquiry has been received is sent to the email address you provide.

Processing is carried out to respond to your inquiry and to prepare or perform a contract pursuant to Article 6(1)(b) GDPR. For general inquiries, the legal basis is Article 6(1)(f) GDPR. The data is deleted once the inquiry has been fully handled and no statutory retention obligations apply.

The general contact form collects your name, email address, subject and message. For project inquiries you may also provide your background, vision, telephone number and preferred contact method. Project inquiries are stored in a non-public overview accessible only to authorised administrators, including handling status, our response, agreed price and timing, and the associated upload project. These records are manually deleted once no longer needed, subject to statutory retention obligations.

To protect forms, we check a short-lived form token and the time before submission. Repeated submissions are limited using a server-keyed hash of the IP address and a hash derived from the email address and message. These temporary comparison and blocking records are valid for ten minutes and are cleaned up through WordPress temporary storage. The existing additional contact-form counter is valid for 60 seconds. This local protection does not set additional cookies. When Turnstile is enabled, the service described below is also used. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is preventing abuse.

Spam protection with Cloudflare Turnstile

We use Cloudflare Turnstile, provided by Cloudflare, Inc., USA, to detect automated form submissions. Loading the widget establishes a connection to Cloudflare, which processes IP addresses, browser and connection signals, and information about the website visited. Our server verifies the result with Cloudflare without sending the message text.

We use this service in our legitimate interest in preventing spam and abuse under Article 6(1)(f) GDPR. Cloudflare processes data on our behalf to protect this website and as a controller to improve its bot detection. Processing outside the EEA, including in the USA, is possible. For processing, retention and international-transfer details, see the Turnstile Privacy Addendum and Cloudflare Privacy Policy. You can alternatively contact us directly by email.

3a. Project files, uploads and downloads

We use private upload and download links to prepare, carry out and deliver projects. We process the artist or project name, email address, supplied audio and project files, filenames and file sizes, and technical information about transfer status, link validity and project email dispatch. Audio recordings and project files may contain personal data, such as voices or information about contributors.

Data necessary for your project is processed to take steps before entering into a contract or to perform a contract under Article 6(1)(b) GDPR. Technical safeguards and protection of file transfers serve our legitimate interest in secure operation under Article 6(1)(f) GDPR. Where files contain other people's personal data, processing must be assessed in accordance with the assignment and the applicable legal basis. Please only provide files you are authorised to share and have processed.

Files are transferred through our webspace at united-domains. Local working and backup systems may be used for processing. Project emails containing upload or download links are sent through our email service provider. These providers receive data only as required to provide the relevant technical services. Where processing is carried out on our behalf, the applicable rights and obligations are governed by Article 28 GDPR.

Anyone holding a download link can access the files made available for that delivery project. Please keep links private. Links may expire or be disabled. Expiry or disabling does not delete stored files or copies already downloaded.

Audio and project files on our webspace and in our local working and backup systems are deleted no later than 30 days after project completion, unless a different retention period has been agreed or a legal obligation requires otherwise. Where no assignment proceeds, files are similarly cleared following final handling of the inquiry. Associated technical project metadata is deleted once no longer needed. Invoice and contract records subject to statutory retention requirements are unaffected.

Deletion is currently performed manually. Any additional backups maintained by the hosting provider follow its agreed backup and deletion cycles; deleting a file in the plugin does not immediately remove these backup copies. For questions or deletion requests, contact order@nachtwerk.studio.

4. Recipients

Data is shared with service providers only where necessary for hosting, email communication and technical operation, or where required by law. Processors are engaged in accordance with the applicable legal requirements.

5. Cookies and tracking

This theme does not use analytics, advertising or marketing cookies. On the first visit to the homepage, the browser's preferred language is read to display the German or English version. If you switch languages manually, only the value “de” or “en” is saved as “nachtwerk_language” in your browser's local storage. This information stays on your device, is not shared with third parties and can be removed through your browser data. WordPress may set technically necessary cookies for logged-in administrators. If analytics tools, external embeds or additional plugins are added later, this privacy policy must be updated accordingly.

6. External links

This website may contain links to external platforms. Data is transmitted to the respective provider only when you open such a link. The respective provider is responsible for processing on the external website.

WhatsApp and iMessage/SMS are optional contact methods provided as simple links, without an embedded messenger widget. If you use them, the provider processes communication and technical usage data under its own privacy terms. WhatsApp Ireland Limited is responsible for WhatsApp in the European Region; data may also be processed outside the EEA. Apple's notices apply to iMessage, and your mobile provider's terms apply to SMS. You can always use email or the contact form instead. See WhatsApp privacy and Apple Messages.

7. Retention period

Personal data is retained only for as long as necessary for the relevant purpose. Statutory retention periods, particularly under commercial and tax law, remain unaffected.

8. Your rights

Subject to the statutory requirements, you have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent at any time with effect for the future.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority for Schleswig-Holstein is the Independent Centre for Privacy Protection Schleswig-Holstein: datenschutzzentrum.de ↗.

9. Security and automated decisions

We use appropriate technical and organisational measures to protect personal data. To protect the administration area, failed login attempts are counted using an IP address that is not stored in plain text but hashed with a server-side key. The temporary record is deleted after no more than 30 minutes. After five failed attempts, access from that address is blocked for 30 minutes. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is protection against automated login attempts and unauthorised access. No automated decision-making, including profiling, takes place.