1. Controller

The controller responsible for processing on this website is Lennard Bäthge (full address in the Legal Notice). Contact: prismatixwav@gmail.com.

2. Hosting, CDN and server log files

This site is hosted on Cloudflare (Cloudflare, Inc., USA), which also provides the CDN and DNS for the domain. When you visit, Cloudflare automatically processes technical data such as your IP address, date and time, the page requested, referrer, and your browser and operating system, in server and security logs, to deliver the site reliably and to protect it. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a stable, secure website). Cloudflare acts as a processor under a data processing agreement; data may be transferred to the USA, safeguarded by the EU-US Data Privacy Framework and standard contractual clauses. Cloudflare does not set tracking cookies on this site; any cookie it sets is strictly necessary for security (for example, during a bot challenge).

To protect the contact and subscription forms from automated abuse, we briefly process your IP address to count requests within a short time window (rate limiting). This counter is stored transiently (about a minute) and is not used to identify you or build a profile. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing spam and abuse).

3. Content and media delivery (Sanity)

Text, images and audio are managed in and delivered through Sanity (sanity.io). When your browser loads media from cdn.sanity.io, your IP address is transmitted to Sanity and its infrastructure provider (Google Cloud) solely to deliver the requested content. Legal basis: Art. 6(1)(f) GDPR. A data processing agreement is in place, EU data residency is used where available, and standard contractual clauses cover any transfer outside the EU.

4. Fonts

Fonts are self-hosted on this website and served from the same domain (via Next.js font optimisation). No connection is made to Google Fonts or any third-party font server, and no data is transmitted to Google for fonts.

5. Booking form

If you send a booking enquiry, the data you enter is transmitted via Resend (Resend, Inc., USA) and received in an email inbox provided by Google (Gmail), so we can respond. The fields are: name, email, type of booking, preferred date, venue or event, city, country, expected capacity, budget range, and your free-text message. Both providers act as processors. Legal basis: Art. 6(1)(b) GDPR (steps taken prior to a contract) and Art. 6(1)(f) GDPR (interest in handling enquiries). Data sent via Resend is stored in the USA under the EU-US Data Privacy Framework and standard contractual clauses. Enquiries are kept for up to 12 months after our last contact, then deleted, unless a longer legal retention duty applies.

Please do not include special-category data (for example health, religion, or details about your sexual orientation or gender identity) in the free-text message unless it is necessary for the booking. If you do, we process it only to answer your enquiry and delete it on request.

6. Newsletter / drop list (double opt-in)

When you subscribe with your email address, we first send a confirmation email; your address is added to our list only after you click the confirmation link (double opt-in). The list is stored in a Resend audience (Resend, Inc., USA). We use it solely to send you the updates you signed up for, and we keep your address until you unsubscribe. To prove your consent we store a minimal record (your address, the signup and confirmation timestamps, and the policy version); we do not store your IP address. Legal basis: Art. 6(1)(a) GDPR (consent). You can withdraw your consent at any time with effect for the future via the unsubscribe link in every email or by emailing us; data transfer to the USA is covered by the EU-US Data Privacy Framework and standard contractual clauses.

7. Contacting us by email

If you contact us by email (directly or via a mailto link on this site), your message and email address are processed to handle your request. These emails are received in an inbox provided by Google (Gmail). Legal basis: Art. 6(1)(b) GDPR (pre-contractual or contractual) and Art. 6(1)(f) GDPR (interest in answering enquiries).

8. Cookies and analytics

This website does not use tracking cookies, advertising, or analytics services, and does not create user profiles. Only the technically necessary processing described above takes place, so no cookie consent banner is required. The only item stored in your browser is a small flag that remembers you dismissed the one-time notice that this site uses no tracking cookies; it is technically necessary and needs no consent.

9. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object (Art. 21). Where processing is based on consent, you may withdraw it at any time (Art. 7(3)). To exercise any of these, contact prismatixwav@gmail.com.

10. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The competent authority for the controller is Die Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen).

11. Changes to this policy

We may update this policy to reflect changes to the website or legal requirements. Last updated: June 2026.