Privacy Policy

1. Privacy at a glance

The following information provides a simple overview of what happens to your personal data when you visit this website. Personal data means any information that can be used to identify you personally.

2. Data controller

twofoursix Studios UG (haftungsbeschränkt)
Vogelsanger Straße 348
50827 Cologne, Germany
Email: info@twofoursix.de

3. Data collected on this website

Enquiry form. If you contact us through the form, the information you provide, including your contact details, is stored so we can process the enquiry and respond to follow-up questions. We do not share this data without your consent. Legal basis: Article 6(1)(b) GDPR, steps prior to entering into a contract.

Server log files. The hosting provider automatically collects and stores information sent by your browser in server log files. This may include browser type and version, operating system, referrer URL, host name of the accessing device, time of request and IP address. Legal basis: Article 6(1)(f) GDPR.

4. Hosting

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When the website is accessed, STRATO processes technically necessary data, including IP address, browser type and timestamps, on servers in Germany. The German original states that no transfer to third countries takes place.

The legal basis is Article 6(1)(f) GDPR, our legitimate interest in operating the website securely and efficiently. Further information is available in STRATO's privacy policy.

Enquiries submitted through the contact form are forwarded to us by email and stored on our own systems. The legal basis is Article 6(1)(b) GDPR.

For our internal reporting, we count form enquiries accepted by the mail server by calendar day and enquiry type. These statistics contain no names, contact details, IP addresses or project descriptions. No cookies are set and no visitor profiles are created for this purpose.

To prevent automated misuse, your IP address is stored briefly in hashed form, not in plain text, when the form is submitted. This limits the number of enquiries per sender. The limiting window is ten minutes; the data is then removed automatically, and no later than after a few hours. The legal basis is Article 6(1)(f) GDPR.

5. Maps provided by OpenStreetMap

The About page embeds a map supplied by the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge CB4 0WS, United Kingdom. Loading the map transfers your IP address to the Foundation's servers. The map uses a no-referrer policy to minimise the transmission of referrer information. The legal basis is Article 6(1)(f) GDPR, our legitimate interest in showing our location. Further information is available in the OpenStreetMap privacy policy.

6. Cookies

This website uses only technically necessary cookies, such as the cookie that stores your privacy setting. We do not use analytics, tracking or marketing cookies, so no consent is requested for non-essential cookies.

The application page “In Der Lobby” additionally stores data in your browser's local storage (not a cookie); see section 10.

7. Your rights

You have the right to obtain information about the personal data stored about you, its origin, recipients and the purpose of processing, and to request rectification, restriction or deletion under Articles 15 to 22 GDPR. You may contact us at the address listed in the Legal Notice.

You also have the right to lodge a complaint with a data protection supervisory authority. The competent authority is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, LDI NRW.

8. Transfers to third countries

When you visit this website, your personal data is generally not transferred outside the European Union or European Economic Area. The exception is applying through “In Der Lobby” (section 10), where we use services from providers based in the United States. Where third-party services process data outside the EU, suitable safeguards, such as the EU Standard Contractual Clauses or an adequacy decision of the European Commission, are used to maintain an appropriate level of protection.

9. Retention period

Enquiry data is deleted once processing has been completed and no later than three years afterwards, unless statutory retention requirements apply. Applications through “In Der Lobby” are subject to the shorter periods in section 10.

10. Applying through “In Der Lobby”

Artists can apply with a song for the “In Der Lobby” format at twofoursix.de/inderlobby. The controller is the entity named in section 2. Applying is voluntary; without the required details we cannot process your application.

Data we process. Artist name, email address, Instagram profile, TikTok profile (optional), the titles of your songs (up to three), the song files or a link to the songs, your confirmation that you hold the rights to the songs, and our team's decision with feedback. After acceptance, the excerpt you choose and release details (status, date, streaming link where applicable) are added in your artist area. We process it to review your application, give you feedback and, if you are in, to arrange the shoot. We also use it to limit abuse and duplicate applications and to take accepted artists into our internal planning. Legal basis: Article 6(1)(b) GDPR (steps taken at your request). By confirming the rights you allow the team to listen to the songs for review; they are only published with your consent.

Who sees the data. Team members see your name, profiles and song, but not your email address, which only the responsible person at twofoursix Studios can see. Individual team votes stay internal. You see the status of your application through your personal link, which never shows votes, notes or other applications.

Services used. The application runs on Supabase (Supabase Inc., USA) for the database, file storage and functions; the data is held on servers in the Frankfurt am Main region (EU). The artist area, where you choose your shoot day after being accepted, is provided through Netlify (Netlify, Inc., USA) and is available at plan.twofoursix.de; technically necessary data such as your IP address is processed when you open it. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in secure operation. To protect against automated requests we use Cloudflare Turnstile (Cloudflare, Inc., USA), which processes, among other things, your IP address and browser information. Legal basis: Article 6(1)(f) GDPR, our legitimate interest in preventing abuse. We send your personal link and our decision by email through the service provider Resend (Resend, Inc., USA, sending region Ireland) from lobby@mail.twofoursix.de, which processes the recipient address, content and sending data. Fonts are served from our own server; no fonts are loaded from Google.

Storage in your browser. Your browser remembers your personal link and an unsent draft on your device (local storage, not a cookie). This is not stored on our servers. “Sign out on this device” removes it. Legal basis: Section 25(2) no. 2 TDDDG (necessary to provide the service you requested).

How long we keep the data. A draft without a song is deleted after 48 hours. If we reject an application or ask for different songs, we delete the song files immediately and the rest of the application 30 days after the decision. We delete the application of accepted artists (contact details, song and excerpt) automatically 6 months after the shoot day, or 6 months after acceptance if there is no shoot day. The artist's entry in our production planning remains for as long as the format runs. Sent email jobs are deleted after 30 days, and links from permanently failed jobs after 7 days. Technical counters used to prevent abuse are deleted after 3 days. You can withdraw your application on the page at any time; we then delete it together with the song files. If you delete a rejected application during the ten-day waiting period, a block note remains until that period ends so that the waiting period cannot be bypassed. It contains no name, email address or profile name, only pseudonymised hash values and the end date.

Your rights under section 7 also apply here. Contact us at the address in section 2 or message us on Instagram: @inderlobby.