Privacy policy

1Controller

The controller responsible for data processing on this website is:

mail@rvbang.de

2Overview

Without your consent, we only process what is technically necessary to operate the website. Everything else only runs once you consent in the cookie notice:

• Always: server log files at the host and an entry that stores your choice in the cookie notice.
• Only with “Statistics” consent: audience measurement with Metricool.
• Only with “Marketing” consent: Google Tag Manager with Google Ads/Analytics and Meta Pixel, to measure whether our advertising works.
• Only with “External content” consent: videos from YouTube, playlists from Spotify and the directions map from Google Maps.
• Only if you open tickets: the Weeztix ticket shop.
• Only if you click 🤘🏼 under a news post: an entry in your browser and a short-lived checksum of your IP address to protect against misuse (section 10).

We do not sell data, do not create profiles and do not make automated decisions within the meaning of Art. 22 GDPR.

3Hosting and server log files

The website is hosted by a hosting provider in Germany acting on our behalf (data processing under Art. 28 GDPR). Each time the website is accessed, the server automatically stores:

• IP address
• date and time of access
• page accessed and amount of data transferred
• the page you came from (referrer)
• browser type and version, operating system

We need this data to deliver the website, to ensure its security and to detect errors or attacks. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR. The data is not combined with other data sources and is deleted as soon as it is no longer needed for these purposes.

The connection to this website is encrypted using TLS. You can recognise this by “https://” and the padlock symbol in the address bar.

4Cookies and cookie notice

Cookies are small text files that your browser stores. Browser storage (localStorage) is comparable. We only use either to the extent that you allow. The legal basis is Section 25(1) TDDDG (consent), and for strictly necessary entries Section 25(2) no. 2 TDDDG.

On your first visit, a notice asks you which categories you allow:

• Necessary: an entry called “rvbevents_cookies”, as a cookie and in browser storage. It remembers your choice so that we do not ask you again on every page, and is valid for 6 months. It contains only your choice and the time, no identifier, and is not transmitted to third parties. Legal basis: Section 25(2) no. 2 TDDDG and Art. 6(1)(c) GDPR (proof of consent under Art. 7(1) GDPR).
• Statistics: Metricool (section 5).
• Marketing: Google Tag Manager, Google Ads/Analytics and Meta Pixel (section 6).
• External content: YouTube, Spotify and Google Maps (section 7).

For the like function under news posts, your browser also uses an entry in browser storage, but only once you click 🤘🏼 yourself (section 10).

Consent is voluntary. The website still works without it. Wherever there is external content, a placeholder is then shown, through which you can also load an individual item of content. You can change or withdraw your choice at any time with effect for the future, via “Cookie settings” in the footer or here:

Open cookie settings

5Audience measurement with Metricool

If you allow “Statistics”, we use Metricool, a service of Metricool Software, S.L., C/ Téllez 12, Entreplanta H, 28007 Madrid, Spain. Metricool counts which pages are accessed, for how long, and where visitors come from. For this purpose, your IP address, the page accessed, the referrer and information about your browser and device, among other things, are transmitted to Metricool when a page is accessed. Metricool may store cookies or similar technologies on your device for this purpose.

We only use the analysis in aggregated form, for example how often a page was accessed, and not to identify individual persons. According to its own information, Metricool stores the data on servers in the European Union and acts as our processor.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Without consent, Metricool is not loaded.

Metricool privacy policy

6Advertising and performance measurement

We occasionally run ads on Google as well as on Facebook and Instagram. If you allow “Marketing” in the cookie notice, we load Google Tag Manager, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Through it, we integrate tools with which we measure whether our ads work – for example Google Ads, Google Analytics and the Meta Pixel of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland.

In the process, in particular your IP address, the pages accessed, the page you came from, information about your browser and device, and identifiers in cookies or similar storage are processed. This makes it possible to determine whether someone visits our website or buys a ticket after clicking on an ad. If you are logged in to Google or Meta, the providers can assign this to your account. Google and Meta may also process data in the USA; both are certified under the EU-US Data Privacy Framework, and the transfer is covered by the European Commission’s adequacy decision (Art. 45 GDPR).

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. Without consent, Google Tag Manager is not loaded; until then, Google’s “Consent Mode” is set to “denied”, and nothing is transmitted to Google. You can withdraw your consent at any time under “Cookie settings”. Insofar as we and Meta are joint controllers for the collection and transmission of the data (Art. 26 GDPR), Meta’s corresponding agreement applies.

In the ticket shop (Weeztix), Weeztix may also use Google Tag Manager on our behalf to measure ticket purchases. There, Weeztix asks for your consent.

Google privacy policy Meta privacy policy

7External content

On some pages we embed content from other providers. As long as you have not allowed “External content”, a placeholder is shown there and no connection to the provider is established. If you load an item of content (once or permanently), the provider learns your IP address, the page on which the content is embedded, and information about your browser and device. The providers may set their own cookies and link your usage to your account if you are logged in there.

The legal basis is your consent under Section 25(1) TDDDG and Art. 6(1)(a) GDPR. The respective provider is itself responsible for the processing after loading.

YouTube

The bands’ music videos and aftermovies come from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may also be transferred to Google LLC in the USA. Google LLC is certified under the EU-US Data Privacy Framework; the transfer is covered by the European Commission’s adequacy decision (Art. 45 GDPR).

Google privacy policy

Google Maps

The directions map on the “Getting there” page comes from Google Maps, likewise a service of Google Ireland Limited (address and transfer to the USA as for YouTube).

Spotify

The playlists for our events on the “Playlists” page come from Spotify, a service of Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. Spotify may also transfer data to countries outside the EU and, according to its own information, relies on adequacy decisions and standard contractual clauses for this (Art. 45 and 46 GDPR).

Spotify privacy policy

8Tickets

For ticket sales, the ticket shop of Weeztix B.V., Eindhoven, Netherlands, is embedded. It appears in the ticket window on the home page, under /tickets and on the event pages.

The shop loads without asking first in the cookie notice, but only when you expressly open it: when you point at or click a ticket button, when you open /tickets (for example via our QR codes) or via a direct ticket link. Anyone who does this wants to use exactly this service, i.e. buy tickets (Section 25(2) no. 2 TDDDG). When it loads, Weeztix receives your IP address and information about your browser and device. Weeztix itself asks in the shop about its own cookies that are not strictly necessary. For tickets from Eventim, we only link to their site.

The data you enter when buying or when requesting a refund (for example name, e-mail address, payment details) is processed in order to perform the contract (Art. 6(1)(b) GDPR). Payment data goes directly to Weeztix and its payment service providers, not to us. We receive the data about your ticket insofar as we need it for the event, and keep it for as long as statutory retention obligations require.

Weeztix privacy policy

9Contact by email or phone

If you email or call us, we process your details (for example name, email address, phone number, content of the enquiry) in order to deal with your request. The legal basis is Art. 6(1)(b) GDPR where a contract is concerned, otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR). We delete the data once the enquiry has been dealt with and no statutory retention obligations prevent this.

10Likes on news posts

You can like any news post with the 🤘🏼 button. You do not need an account for this, and no cookies are set. Only when you click the button is the following stored:

• In your browser: So that each device only counts once and you can take back your like, your browser remembers in browser storage (localStorage) under “rvbRock” which news posts you have liked. Only the numbers of the news posts are stored, no identifier. The entry is not transmitted to us and remains until you delete the website data in your browser. The legal basis is Section 25(2) no. 2 TDDDG, because the entry is strictly necessary for the like function you requested.
• On our server: We store how many likes a news post has, without any reference to you. To protect against misuse, such as automated mass liking, we generate a checksum (hash) from your IP address and an additional value that changes daily, and store it together with the time of your click. The IP address itself is not stored. The checksum only serves to throttle more than 40 clicks per hour; once an hour has passed, it is automatically deleted the next time our website is accessed. The legal basis is our legitimate interest in a functioning, non-manipulated like function (Art. 6(1)(f) GDPR).

The like function is voluntary. If you do not click, only the number of likes is retrieved when you read a news post; this merely generates the usual server log files (section 3).

11Links to social networks

On our website you will find links to our profiles on Instagram, Facebook, TikTok, X, WhatsApp and Linktree. These are simple links, not embedded plugins. Only when you click a link are you redirected to the respective provider. Its privacy policy applies there.

12Your rights

You have the following rights against us with regard to your personal data:

• Access (Art. 15 GDPR)
• Rectification (Art. 16 GDPR)
• Erasure (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Withdrawal of consent with effect for the future (Art. 7(3) GDPR). The lawfulness of processing carried out before the withdrawal remains unaffected.

Right to object (Art. 21 GDPR): If we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

An informal message to mail@rvbang.de is sufficient for all requests.

13Right to lodge a complaint

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is:

To the supervisory authority

14Changes

We adapt this privacy policy when the website or the legal situation changes. The version published here at the time applies.