Privacy Policy

1. Data controller

The data controller for this website within the meaning of the General Data Protection Regulation (GDPR) is:

Max Philipp Reuter (artist name: MBZ.Music)
Hermann-Heye-Straße 26
28199 Bremen
Email: info@mbz-music.com

2. Overview

This website showcases music, events and videos by MBZ.Music. There is no registration process and no user account for visitors. We process personal data only to the extent necessary for the secure operation of the website or where you provide it to us yourself.

3. Hosting

The website is hosted on a server administered by us at IONOS SE (Germany).

4. Server log files

When you access the website, the web server processes technically necessary data: IP address, date and time, URL accessed, HTTP status code, amount of data transferred, referrer URL and browser identifier (User-Agent). This processing serves to ensure the security and stability of operations and to defend against attacks. The legal basis is Article 6(1)(f) of the GDPR (legitimate interest in secure operation).

Access logs are rotated weekly and automatically deleted after approximately four weeks, whilst error logs are deleted after up to ten weeks. No merging with other data sources takes place.

Error reports: If a technical error occurs on a page (script error or a breach of the page’s security policy), your browser sends a brief message to this server: error text, affected file and page (without query parameters), as well as browser and operating system in general terms (e.g. ‘Chrome 140 / Android’). The IP address and full browser identifier are not stored in this process; the IP address is used only in a truncated, non-traceable form for a maximum of 60 seconds to limit the volume of reports. Duplicate reports are consolidated and deleted after 30 days. The purpose is to resolve errors; the legal basis is Article 6(1)(f) of the GDPR (legitimate interest in a functioning website).

5. Audience measurement

This website uses Matomo for audience measurement only after you have given explicit consent. Before that, no Matomo script is loaded and no analytics request is sent. After consent, page views and broad interactions (such as clicks to social networks, players and external embeds, and successful form submissions) are recorded. URL query parameters and fragments are not sent, and Matomo cookies are disabled. Your choice is stored locally in your browser. You can withdraw consent at any time using “Statistics settings” in the footer; no further Matomo events will then be sent. The legal basis is your consent under Article 6(1)(a) GDPR. When statistics are enabled, technical connection data such as IP address and browser information are processed by the Matomo installation operated on our behalf.

For new visits, Matomo masks three bytes of the IPv4 address (with the corresponding masking for IPv6) before storage and uses only the masked address for geolocation. Raw visit data are deleted after 180 days and processed reports after 12 months. Selected basic metrics without visit-level detail may be retained longer.

6. Fonts

The fonts used (Inter and Space Grotesk) are served from our own server. No connection is established to third-party font services when the website is accessed.

7. Embedded content (SoundCloud, Mixcloud, YouTube, Vimeo, Spotify, OpenStreetMap)

The ‘Music’ and ‘Videos’ pages may contain content from SoundCloud, Mixcloud, YouTube (Google) and Vimeo, whilst the event detail pages may feature a map from OpenStreetMap (OpenStreetMap Foundation, United Kingdom). This content is only loaded from the respective provider’s servers once you have clicked on the ‘Load content’ button. No connection is established with these providers prior to this.

Upon loading, your IP address is transmitted to the provider, and the provider may set cookies and collect information about your device and your usage. This may involve the transfer of data to countries outside the EU, in particular to the USA. The legal basis is your consent given by clicking (Article 6(1)(a) of the GDPR, Section 25(1) of the TDDDG; for transfers to third countries, Article 49(1) (a) of the GDPR). This consent applies only to the current visit to the site and is not stored; you will need to give your consent again the next time you visit. You can withdraw your consent at any time by leaving or reloading the page.

Previews from Instagram and TikTok: On the homepage and in the gallery, we display preview images of our latest posts. Our server retrieves these images from the providers and delivers them directly; your browser does not establish a connection to Meta or TikTok in the process. Only when you click on a post does the provider’s page open.

Spotify: The press kit may include the player of our Spotify profile (Spotify AB, Sweden). Like the other embedded content, it is only loaded after your click; the information above applies.

Further information can be found in the providers’ privacy policies:

• SoundCloud
• Mixcloud
• Spotify
• OpenStreetMap
• YouTube (Google)
• Vimeo

The links to our profiles on YouTube, SoundCloud, Mixcloud, Vimeo and Instagram in the footer are simply references. Data is only transferred once you click on one of these links and visit the relevant site .

8. Cookies

We do not send cookies to visitors. Only in the secure logged-in area of the website do we set a technically necessary session cookie (mbz_session, valid for seven days) after successful login, to keep you logged in. The legal basis is Article 6(1)(f) of the GDPR in conjunction with Section 25 (2)(2) of the TDDDG. When you click on embedded content (Section 7), the respective providers may set their own cookies.

The website is available in several languages. To ensure you are not redirected again on your next visit, we store the language (only the language code, e.g. ‘en’) in your browser’s local storage (localStorage, entry ‘mbz-language’). This information is not transmitted to us and is not linked to any other data ; you can delete it at any time via your browser settings. The legal basis is Section 25(2) No. 2 of the TDDDG (absolutely necessary for displaying the content in your chosen language).

9. Contacting us

If you contact us by email, we process your details (email address, content of the message) to deal with your enquiry. The legal basis is Article 6(1)(f) of the GDPR; for contract-related enquiries (e.g. bookings), Article 6(1)(b) of the GDPR. We will delete the data as soon as the enquiry has been dealt with and provided there are no statutory retention obligations to the contrary.

Via the contact form, we process the data you enter (name, email address, subject, message). The message is sent to us via our own mail server (Stalwart on servers in Germany) and is not stored in the website’s database. To protect against misuse (spam), your IP address is logged in the web server’s cache for a maximum of one hour and then discarded; it is not stored permanently. As above, the legal basis is Article 6(1)(b) or (f) of the GDPR.

We store booking enquiries (“Request a gig”) along with your details (name, email address, optional telephone number and organiser, date, venue, type of event, number of guests, set length, budget, message) in our own content management system (Strapi, hosted on our servers in Germany) and receive a notification by email. This data is stored for the purpose of processing the enquiry and preparing a contract (Article 6(1)(b) of the GDPR). If no contract is concluded, we will delete the enquiry no later than six months after the requested date; if a contract is concluded, the statutory retention periods apply. The spam protection works in the same way as for the contact form.

Newsletters and free downloads

For the newsletter, we process your email address and, if provided, your first name. Registration takes place via a double opt-in procedure: you will receive an email containing a confirmation link; only then will we send you the newsletter. We store the time of registration and confirmation in order to be able to provide evidence of consent . The newsletter is sent using the self-hosted Listmonk software on our servers in Germany via our own mail server; no third-party providers are used. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time via the unsubscribe link in every email or by sending a message to info@mbz-music.com; your data will then be deleted.

You can unlock free downloads by subscribing to the newsletter (as above) or by clicking ‘Follow’ on a music platform. When you follow, the respective provider’s page opens in a new tab; their privacy policy applies. We do not know whether you are following us or which account you are using to do so. The download link is valid for 24 hours; we count downloads per track without linking them to you personally.

10. Radio (Live Stream)

On the ‘Radio’ page, you can listen to our live stream. The stream is only loaded once you click ‘Play’ and comes from our own streaming server (stream.mbz-music.com), not from a third-party provider. Whilst listening, the server processes your IP address, as well as the time and duration of the connection, in log files for technical reasons; the legal basis for this is Article 6(1)(f) of the GDPR (operation and security of the service). No cookies are set. The display of the current track and programme is retrieved by our web server from our own radio server (LibreTime); your IP address is not passed on to third parties in the process. The hosting structure is described in Section 3.

11. Your rights

You have the right to access (Article 15 of the GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). Where processing is based on a legitimate interest, you may object to it at any time on grounds relating to your particular situation. You may withdraw any consent you have given with effect for the future.

To exercise your rights, simply send a message to the email address given above. Furthermore, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Article 77 of the GDPR).

There is no obligation to provide personal data. No automated decision-making, including profiling, takes place.