← Back

Privacy Policy

Protecting your personal data is important to us. Below we inform you about the processing of personal data when you visit this website and use our services, in accordance with the General Data Protection Regulation (GDPR).

1. Controller

Arandel Akovic · Overstage
Grünstr. 25, 45525 Hattingen, Germany
Telephone: 02324 9213406
Email: info@overstage.de

There is no legal obligation to appoint a data protection officer (§ 38 BDSG, German Federal Data Protection Act).

2. Hosting

This website is hosted by Hostinger (Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus). The provider processes data on our behalf that is technically required in order to deliver the website (see server log files). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and efficient operation). A data processing agreement pursuant to Art. 28 GDPR is in place.

3. Server log files

When the website is accessed, the provider automatically collects information in so-called server log files, which your browser transmits: browser type and version, operating system used, referrer URL, host name of the accessing computer, time of the server request and the IP address. This data is not merged with other data sources and serves technical security and error analysis.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operational security).
Retention period: The log files are deleted or anonymised after 30 days at the latest.

4. Cookies and local storage

This website uses only technically necessary storage in your browser. No analytics, tracking or marketing cookies are set, no data is transmitted to advertising networks and no user profiles are created.

Specifically, we store the following in your browser's local storage:

ov_cookie — remembers that you have seen the cookie notice so that it does not reappear on every visit.
ov_vol — the audio player volume you have set. Only stored if you actively use the player.
ov_atmo_… — your display setting (background effects). Only stored if you change it.

This storage is necessary in order to provide functions you have expressly requested. Consent is not required for this under § 25 (2) no. 2 TDDDG (German Telecommunications Digital Services Data Protection Act); the legal basis for the subsequent processing is Art. 6(1)(f) GDPR. You can delete these entries at any time via your browser settings.

The notice banner on this website is therefore purely an information notice and not a consent banner.

5. Reach measurement (anonymous)

We count the number of page views per month in order to assess the success of our website. In doing so, only a counter is incremented — no IP addresses, no cookies and no device-related identifiers are stored. No reference to an identifiable person is created; no tracking and no recognition of users takes place.

6. No external fonts, no external scripts

On its public pages, this website embeds no Google Fonts, no external font services and no third-party scripts. The fonts used are delivered exclusively from our own server (self-hosted); there is no connection to font providers. Merely accessing the page therefore establishes no connection to third-party servers and transmits no IP address to third parties.

7. Contact form and email

If you send us an enquiry via the contact form or by email, we process the data you provide (name, email address, telephone number where applicable, budget and your message) in order to handle your enquiry.

Legal basis: Art. 6(1)(b) GDPR (initiation/performance of a contract) or Art. 6(1)(f) GDPR (handling of other enquiries).
Recipients: Sending and storage take place via our mailbox with Google Ireland Limited (Google Workspace); a data processing agreement pursuant to Art. 28 GDPR is in place.
Retention period: The data is deleted as soon as it is no longer required to achieve the purpose; statutory retention obligations (§ 257 HGB, German Commercial Code, and § 147 AO, German Fiscal Code: 6 and 10 years respectively) remain unaffected.
Mandatory information: The details marked as mandatory fields (*) in the form — name, email address and your message — are required so that we can answer your enquiry; without them the form cannot be submitted. All other details are voluntary. There is no statutory or contractual obligation to provide them.

8. Quotations and electronic contract signing

We send quotations via a personal quotation page that is not publicly linked. You can accept these online with binding effect (electronic signature).

When the quotation is accessed, we process the data contained in the quotation (name, band name where applicable, scope of services, prices) as well as technical access data. We can see when and how often a quotation has been opened in order to track the sales process (Art. 6(1)(f) GDPR).

When it is signed, we store the following as evidence of the conclusion of the contract:

your name and your email address,
the time of signing,
your IP address,
the identifier of your browser (user agent),
a cryptographic checksum (SHA-256) of the contract content, which makes it possible to detect any subsequent alteration of the contract text.

You are expressly informed of this storage once again immediately before signing. You also receive a confirmation by email.

Legal basis: Art. 6(1)(b) GDPR (initiation and performance of a contract) as well as Art. 6(1)(f) GDPR (legitimate interest in the evidential reliability of the conclusion of the contract). Without this data, a legally secure conclusion of contract cannot be documented.
Retention period: For the duration of the contractual relationship and thereafter until the statutory retention and limitation periods have expired (as a rule 6 and 10 years respectively, § 257 HGB / § 147 AO).

9. Client portal (studio portal)

For ongoing projects we provide you with a code-protected portal. There we process:

your access code and a technically necessary session identifier,
project data (project name, contact person, email address, dates, processing status),
audio files of your project (mixes, versions) as well as
your feedback comments on these audio files, in each case with a name and a time stamp,
an invoice overview for your project.

Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Retention period: Until the project has been completed; thereafter until the statutory retention periods have expired. We delete the audio files of your project no later than 24 months after completion of the project — at your request, earlier at any time. Retaining them until then makes subsequent revisions and follow-up projects possible (e.g. later alternative versions or adjustments).

Video conferencing: Optionally, we provide a link in the portal to a video meeting via Google Meet (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). The service is not embedded — it only opens once you actively click the link. From that point onwards, Google's privacy provisions apply; in this context data may also be transferred to the USA (basis: EU-US Data Privacy Framework or Standard Contractual Clauses). Participation is voluntary; alternatively, we can speak by telephone at any time.

10. Project data of our clients

In order to carry out projects, we receive project data directly from our clients. In some cases they make the data available via their own project management system to which we are invited as a member (for example a Trello board). From there we retrieve project data on a read-only basis — project and task names, descriptions and dates — and transfer it into our own system for carrying out the project.

The controller for the respective project management system is the client, not Overstage. We do not enter any data there and have no influence on the data processing carried out there. We are the controller for the data we take over from the moment it is transferred; it is stored on our server (see section 2).

Source of the data: directly from the respective client (Art. 14(2)(f) GDPR).
Legal basis: Art. 6(1)(b) GDPR (performance of the contract).
Retention period: Until the project has been completed; thereafter until the statutory retention periods have expired.

11. Client account (course area)

Insofar as we offer video courses, you can create a personal account at /konto/. In doing so we process: email address and password (stored only as a non-reversible hash and not visible to us), optionally your name, the time of your consent, your course progress as well as the access rights assigned to you.

After registration you receive a confirmation email (double opt-in). The account is only activated after confirmation.

Legal basis: Art. 6(1)(a) GDPR (consent) as well as Art. 6(1)(b) GDPR, insofar as the account serves to provide courses you have booked.
Deletion: You can permanently remove your account yourself at any time via "Delete my account".

12. Further recipients and processors

We use the following service providers in order to deliver our services. Data processing agreements pursuant to Art. 28 GDPR are in place with all of them:

| Service | Purpose | Data processed | Registered office |
|---|---|---|---|
| Hostinger International Ltd. | Hosting of the website and database | All website and project data | Cyprus (EU) |
| Google Ireland Ltd. (Workspace) | Email mailbox, video conferencing | Communication data | Ireland (EU) |
| Lexware / Haufe-Lexware GmbH & Co. KG | Invoicing and accounting | Name, address, service and invoice data | Germany |
| Anthropic PBC | AI-assisted analysis of publicly accessible texts (see section 19), machine translation of website content (see section 13) | Public programme and profile texts, artist/band names, editorial website texts | USA |

Note on third country transfers: Our processors are predominantly established in the EU; Anthropic PBC is established in the USA. We transmit to Anthropic exclusively the data named above, which is very largely publicly accessible — the basis for this being the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR (see sections 13 and 19). Transfers to the USA may also occur in the case of Google (for example to Google LLC as a sub-processor). The basis for this is the European Commission's adequacy decision on the EU-US Data Privacy Framework, under which Google is certified, as well as, additionally, the Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Despite these safeguards, access by US authorities cannot be entirely ruled out. We therefore limit the data transmitted to what is strictly necessary.

13. Automatic translation of website content

The English-language version of this website is produced by machine. For this purpose we transmit only the editorial texts of this website to Anthropic PBC (San Francisco, USA). No personal data of our visitors, customers or prospective customers is transmitted in the process. Where texts contain quotations naming individuals, this is done with the consent of the person named. The transfer takes place on the basis of Standard Contractual Clauses.

We link to our profiles on Instagram and Facebook. These are simple links — no social plugins are embedded that would transmit data to the networks when this website is merely accessed. The privacy provisions of the respective provider only apply once you click on a link.

15. External map services / directions

For directions we link to an external map service (Google Maps). No map iFrame is embedded; you only leave this website by clicking the link, and the privacy provisions of the respective provider then apply.

16. Your rights

You have the right to:

access to the data stored about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
objection to processing based on a legitimate interest (Art. 21 GDPR).

Withdrawal of consent: Insofar as processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). The lawfulness of the processing carried out up to the withdrawal remains unaffected.

To exercise these rights, an email to info@overstage.de is sufficient.

Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

17. Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW) (North Rhine-Westphalia Data Protection Authority)
Kavalleriestr. 2–4, 40213 Düsseldorf
https://www.ldi.nrw.de

18. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognise an encrypted connection by the "https://" in your browser's address bar.

19. Research and initial approach to artists

In order to initiate business relationships, we research bands and music professionals for whom our production services may be suitable, and approach them.

Data sources: We do not collect the data from you directly, but from publicly accessible sources – in particular your public profiles on Spotify and Instagram as well as public event and programme pages of concert venues (information on the source pursuant to Art. 14(2)(f) GDPR).

Categories of data: artist or band name, town and region, genre, links to public profiles, publicly stated reach figures (e.g. monthly listeners, number of followers), public profile descriptions and post texts, the date of collection as well as our own notes on the status of the contact.

Purpose and legal basis: direct marketing and the initiation of a business relationship. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in approaching potential clients (cf. Recital 47 GDPR). We process exclusively data with a professional connection.

Use of AI: In order to analyse public programme and profile texts we use the service Anthropic (Anthropic PBC, San Francisco, USA). Only public texts and artist names are transmitted in this context – no contact details and no conversation histories. The transfer takes place on the basis of Standard Contractual Clauses (see also sections 12 and 13). No automated decision within the meaning of Art. 22 GDPR takes place; a human being always decides on the approach.

Retention period: We store the data for as long as contact appears realistic, for a maximum of 24 months from collection. In the event of an objection we delete the data without delay; a marker to suppress renewed collection is retained.

Your right to object: You can object to the processing at any time without giving reasons under Art. 21(2) GDPR. If you object to direct marketing, we will no longer process your data for this purpose. An informal email to info@overstage.de is sufficient.

*This English version is a convenience translation. In the event of any discrepancy, the German version at overstage.de/datenschutz.php shall prevail.*

Last updated: July 2026