This translation is provided for your information only and is not legally binding. Only the German version is authoritative. Go to the German version
1. Controller
The party responsible for data processing on this website is:
OneCrewRecords c/o Cliff Dölling
Chopinstraße 36
09119 Chemnitz
Germany
Email: contact@onecrewrecords.de
2. General Information on Data Processing
As a general rule, we process our users' personal data only to the extent necessary to provide a functional website as well as our content and services. Personal data is regularly processed only with the user's consent (Art. 6(1)(a) GDPR), to perform a contract or take pre-contractual measures (Art. 6(1)(b) GDPR), to comply with a legal obligation (Art. 6(1)(c) GDPR), or on the basis of our legitimate interest (Art. 6(1)(f) GDPR), for example in operating our platform securely and efficiently. We state the applicable legal basis for each individual processing activity below.
3. Provision of the Website and Creation of Log Files
When you visit this website, the browser on your device automatically sends information to the server of our website (including IP address, date and time of the request, requested page, browser type, operating system used, referrer URL). This data is temporarily stored in a log file and is used for the technical provision of the website, system security, and error analysis. The legal basis is our legitimate interest in the secure and stable operation of the website (Art. 6(1)(f) GDPR).
Our website is hosted at nicResell.de. We have concluded a data processing agreement with our hosting provider in accordance with Art. 28 GDPR, which ensures that the provider processes the data handled there exclusively in accordance with our instructions and in compliance with the GDPR.
4. Cookies and Local Storage
This website uses technically necessary cookies or comparable storage technologies (e.g. Local Storage), among other things to:
- keep you logged in during a login session in the artist dashboard or the admin area (session cookies),
- securely manage your two-factor authentication (2FA) and active sessions,
- save your chosen light/dark display mode of the website.
These technically necessary cookies are required to operate the website and to use certain functions you have requested. The legal basis is Art. 6(1)(b) and (f) GDPR (performance of a contract and legitimate interest in a functional and secure website). There is no option to object here, since certain functions (e.g. login) would not be usable without these cookies. However, you can set your browser to reject cookies in general - this may limit the functionality of the website.
In addition, we use cookies for audience measurement - if activated in the backend (see Section 14).
5. Contact Form
If you send us inquiries via the contact form, your details from the inquiry form, including the contact information you provide there (name, email address, message), will be stored by us for the purpose of processing your inquiry and in case of follow-up questions. We do not share this data without your consent. The legal basis is Art. 6(1)(b) GDPR, insofar as your inquiry is related to the performance of a contract or is necessary for taking pre-contractual measures. In all other cases, the processing is based on our legitimate interest in the effective handling of inquiries (Art. 6(1)(f) GDPR) or on your consent (Art. 6(1)(a) GDPR).
6. Registration, Artist Dashboard, and User Account
For artists and labels who work with us, we create a personal user account in our artist dashboard upon registration. In doing so, we process in particular your username, display name, email address, an encrypted password, and the profile data you store in the dashboard (including biography, profile picture, social media and streaming links). This information is used to display your public artist profile and to manage our collaboration, for example when handling music releases. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in label and contract management).
For security reasons, we also log login times, rough device/session information and - if you have enabled it - two-factor authentication (TOTP) data. The legal basis is our legitimate interest in protecting user accounts against unauthorized access (Art. 6(1)(f) GDPR).
7. Payment Processing via Stripe
To process payments for our paid packages and services, we use the payment service provider Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland; or, for card data where applicable, Stripe, Inc., USA). When you make a payment, we transmit the data required for payment processing (including name, email address, billing address, payment amount, and payment method data) to Stripe. Stripe processes this data as an independent controller or as our processor in accordance with Stripe's own privacy notices. The legal basis is Art. 6(1)(b) GDPR (performance of a contract). You can find more information in Stripe's privacy policy: https://stripe.com/de/privacy.
Where data is transferred to countries outside the EU/EEA (e.g. to the USA) as part of payment processing, Stripe relies on appropriate safeguards within the meaning of Art. 46 GDPR (including EU Standard Contractual Clauses).
8. Invoicing and Tax Retention Obligations
To fulfill our contractual and legal obligations (in particular under commercial and tax law), we issue invoices and credit notes, which may contain personal data (including name, address, description of services, invoice amount). The legal basis is Art. 6(1)(b) and (c) GDPR. These documents are subject to statutory retention periods of up to ten years (§ 147 AO, § 257 HGB) and are deleted after these periods expire, unless a further retention obligation applies.
9. Discount Codes
When you redeem a discount code, we store which user account used which code and at what time, in order to ensure the validity and single use of discount codes and to prevent misuse. The legal basis is Art. 6(1)(b) and (f) GDPR.
10. Support Ticket System
If you contact us via our support ticket system, we process the data you provide (name, email address, message content, selected category/priority, and any file attachments you upload) in order to handle your request. The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in the orderly handling of support requests). Tickets and associated attachments are retained for a reasonable period after the case is closed in order to be able to handle follow-up questions, and are then deleted, unless a statutory retention obligation prevents this.
11. Forum
If you use our public forum, your chosen username and the posts you publish will be visible to other users and website visitors. Please note that content you voluntarily publish is generally publicly viewable. The legal basis is Art. 6(1)(b) GDPR (performance of a contract under the terms of use) or your consent through active participation (Art. 6(1)(a) GDPR).
12. Sending Emails
To fulfill our contractual obligations and to respond to your inquiries, we send emails, e.g. registration confirmations, invoices, notifications about your release status, ticket updates, or forum notifications. The legal basis is Art. 6(1)(b) GDPR. We do not currently send a separate marketing newsletter. Should this be offered in the future, we will inform you separately in advance and - where required - obtain your consent.
13. Disclosure of Data
Your personal data is only transferred to third parties insofar as this is legally permitted, necessary for the performance of a contract (e.g. to Stripe for payment processing, to our hosting provider, to distribution partners/music platforms for the release of your releases), or you have expressly consented. We have concluded corresponding data processing agreements in accordance with Art. 28 GDPR with all service providers that process personal data on our behalf, insofar as legally required.
14. Web Analytics (Matomo / Google Analytics)
If activated in the backend, we use Matomo and/or Google Analytics (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to design our website according to your needs. These services use cookies or comparable technologies that enable an analysis of website usage (e.g. pages visited, time spent, approximate origin). The legal basis is your consent (Art. 6(1)(a) GDPR), if such consent is obtained before activation; otherwise, it is our legitimate interest in designing our website according to needs (Art. 6(1)(f) GDPR). When using Google Analytics, data may be transferred to Google in the USA; Google has committed to the EU-U.S. Data Privacy Framework or bases the transfer on EU Standard Contractual Clauses. Further information: https://policies.google.com/privacy (Google) or https://matomo.org/privacy-policy/ (Matomo).
15. Data Transfers to Third Countries
Personal data is transferred to countries outside the EU/EEA only insofar as this is necessary for the use of the services named in this policy (in particular Stripe, and where applicable Google Analytics). In these cases, we ensure that an adequate level of data protection exists, for example through EU Standard Contractual Clauses or a certification of the respective provider under the EU-U.S. Data Privacy Framework.
16. Storage Period
Personal data is stored only for as long as necessary to fulfill the stated purposes or as required by statutory retention periods. In particular, the following applies:
- Server log files: are automatically deleted after a short time, unless security-relevant incidents require longer retention.
- User accounts (artist dashboard): for as long as the account exists or the collaboration continues; after termination/deletion of the account, data is deleted, unless statutory retention obligations (e.g. for invoices) prevent this.
- Invoices and credit notes: up to ten years in accordance with § 147 AO, § 257 HGB.
- Support tickets: for a reasonable period after the case is closed, then deleted.
- Contact form inquiries: until your request has been fully processed and its purpose fulfilled, then deleted, unless a retention obligation applies.
17. Your Rights
You have the right at any time to obtain information about your personal data stored by us, its origin and recipients, and the purpose of the data processing (Art. 15 GDPR). You also have the right to rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), and data portability (Art. 20 GDPR). Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). Where processing is based on our legitimate interest, you can object to it at any time on grounds relating to your particular situation (Art. 21 GDPR).
18. Right to Lodge a Complaint with a Supervisory Authority
You also have the right to lodge a complaint with the data protection supervisory authority responsible for us (Art. 77 GDPR). The competent authority is the Saxon Data Protection Commissioner (Sächsischer Datenschutzbeauftragter), as our registered office is in Saxony.
19. Changes to This Privacy Policy
We will update this privacy policy whenever changes are made to our data processing or the legal situation. The version available on this page at the time of your visit applies.