Privacy policy

The data controller within the meaning of the GDPR is:

Friedrich Weniger
Weißenburger Str. 35
81667 München
Germany
Email: mail@kammermusik-muenchen.de
Telephone: +49 89 62423332

No data protection officer has been appointed, as the statutory requirements (Section 38 BDSG) are not met.

We process personal data to operate kammermusik-muenchen.de and the organiser portal, where organisers can submit chamber music concerts for publication in the editorial calendar. Processing purposes include in particular:

• Providing the website and concert calendar – Article 6(1)(f) GDPR (legitimate interest in a functioning online presence)
• Registration and authentication of organiser accounts, submission and editorial review of concerts – Article 6(1)(b) GDPR (performance of the user agreement)
• Publishing concert information submitted by organisers and approved by the editorial team – Article 6(1)(b) GDPR
• Email communication (confirmations, password resets, notifications about submissions, publications and enquiries) – Article 6(1)(b) GDPR
• Protection against abuse (server logs, rate limiting) – Article 6(1)(f) GDPR

• Organiser details (name and, where applicable, organisation)
• Contact details (email and, where applicable, telephone)
• Organiser portal login data (email, password stored as a hash, session token)
• Concert information (title, description, date, venue, performers, programme/works, uploaded images, ticket links)
• Correspondence with the editorial team (e.g. enquiries, reasons for rejection)
• Server log files (IP address, date/time, user agent, requested URL), stored briefly to defend against attacks

When registering for the organiser portal, users actively confirm, by means of a mandatory checkbox, acceptance of the terms and conditions and acknowledgement of this privacy policy. In a separate table called consent_log we record the time of consent, the version identifier (date) of each document accepted and the IP address at registration. Legal basis: Article 6(1)(b) GDPR (steps prior to entering into a contract) in conjunction with Article 7 GDPR (evidence of consent). Records are retained for the lifetime of the account plus three years.

Data is shared with the following processors (agreements under Article 28 GDPR are in place or will be concluded before production use):

Data transfers to third countries outside the EU/EEA do not take place.

Content submitted by organisers and approved by the editorial team (concert title, description, performers, programme, images, venue, ticket links and, where applicable, the organiser's name/organisation) is displayed publicly on kammermusik-muenchen.de and may be indexed by search engines. Organisers are responsible for submitting only content for which they hold the necessary rights and whose publication is permitted under data protection law (e.g. consent from people depicted).

• Organiser accounts: until the account is deleted by the organiser or editorial team
• Concert information (drafts, submitted and published versions): permanently in the archive, unless the organiser requests deletion and no legitimate interests prevent it
• Email correspondence: generally up to 3 years
• Server log files: generally no more than 30 days

• Access (Article 15 GDPR)
• Rectification (Article 16 GDPR)
• Erasure (Article 17 GDPR)
• Restriction of processing (Article 18 GDPR)
• Data portability (Article 20 GDPR)
• Objection (Article 21 GDPR)
• Complaint to a supervisory authority (Article 77 GDPR), in Bavaria in particular the Bavarian State Office for Data Protection Supervision (BayLDA), Ansbach

To exercise your rights, please use the contact details given in section 1.

• Authentication: Login uses Directus Auth; the session token is stored in the browser's localStorage storage.
• Transmission: All communication is encrypted using HTTPS (TLS).
• Files: Uploaded images are stored in Directus file storage; public delivery is restricted to approved content.
• Access control: Organisers can view and edit only their own concerts; separation is enforced on the server in Directus through roles and permissions.

• TLS encryption for all connections
• Passwords stored exclusively as hashes
• Role-based permissions in Directus
• Regular security updates for the components used

Technically necessary cookies or localStorageentries are required for operation (particularly login to the organiser portal) and are set without consent. We do not use advertising cookies.

We use Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to measure website usage. Analytics is loaded only after your explicit consent (Article 6(1)(a) GDPR, Section 25(1) TDDDG). Unless you agree in the cookie notice, no Google script is loaded and no data is transmitted to Google.

If consent is given, cookies are set and usage data (including truncated IP address, pages visited, time, device and browser) is processed. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework. Advertising and personalisation features (Google Signals) are disabled.

You can withdraw your consent at any time with effect for the future by deleting this site's stored website data in your browser. The cookie notice will then reappear and you can choose ‘Decline’.

We reserve the right to amend this policy, for example if technical circumstances or legal requirements change. The current version is available on this page.

Last updated: 1.6.2026