Privacy

Controller

Radio for Skeletons GbR, Salamanderplatz 3, 70806 Kornwestheim, Germany, e-mail info@rfs-music.de.

Hosting and server logs

This website is served from a server we operate at IONOS SE (Germany). When you visit, technically necessary data (IP address, date and time, requested address, browser identifier) is processed in server logs. The legal basis is Art. 6 (1) (f) GDPR – our legitimate interest in operating the site securely and defending against attacks. Logs are evaluated exclusively on our own infrastructure; the web server's access logs are overwritten after a few days, and the central log analysis deletes entries after 90 days at the latest.

Settings stored in your browser (no cookie)

If you choose “Don’t show again” on the home-page intro, your browser remembers that it should not appear any more. The site uses the browser’s local storage (localStorage) for this, not cookies. These entries stay on your device, are never transmitted to us and serve only the setting you chose. You can delete them at any time via your browser’s site data.

Cookie-free audience measurement

From the server logs we derive anonymous statistics: the number of visits per day and page, the domain of the referring site, language version, browser and device type, and the approximate country of origin (derived from the IP address using a database kept on our own server, with no request to third parties). The IP address is not stored for this; visitors are counted only via a daily regenerated, non-reversible check value. Nothing is stored on or read from your device – no cookies, no other identifiers. The legal basis is Art. 6 (1) (f) GDPR (our interest in knowing how the site is used); the evaluation takes place solely on our own server.

No cookies, no tracking

This site sets no cookies, uses no third-party analytics tools and embeds no content from other servers; fonts and images are loaded from our own server. Technically necessary cookies are used only in the password-protected area for listening copies (session after login) and in the online store for the shopping cart and, if you create one, the customer account – see the “Online store” section.

Our social media profiles

Radio for Skeletons has its own profiles on Instagram and Facebook (Meta Platforms Ireland Ltd.), YouTube (Google Ireland Ltd.) and TikTok (TikTok Technology Ltd., Ireland). The icons and links on this website are plain links: no buttons, scripts or content from these providers are embedded, and no data flows to them unless you click a link. On the platforms themselves, the respective provider’s privacy policy applies. From the platforms we only receive aggregated statistics (such as views and follower counts), no data about individual visitors. For the statistics of our Facebook Page (“Insights”) we are joint controllers with Meta (Art. 26 GDPR); Meta has assumed primary responsibility (Meta’s addendum). Comments and messages you send us there are visible to us with your profile name; we store them in our internal band administration on our own server in order to reply. The legal basis is Art. 6 (1) (f) GDPR (our interest in presenting the band online and staying in touch with our audience). You can exercise your rights with us or directly with the respective provider.

RFS Backend and YouTube API Services

For our YouTube channel @radioforskeletons we use Google’s YouTube API Services in our internal band administration tool (RFS Backend, erp.radioforskeletons.de). With it we upload our own videos, maintain titles, descriptions and thumbnails, and retrieve statistics of our channel. For these features the YouTube Terms of Service and the Google Privacy Policy apply in addition.

Which data: ID, title, publishing date, visibility, duration, views, likes and comment count of our own videos; per video watch time, average view duration, shares and subscribers gained; daily figures of our channel (views, watch time, subscribers gained and lost); and aggregated figures for the last 28 days by traffic source, device type and country (totals only, nothing about individual people). We currently do not retrieve data of other people – such as viewers’ comments or profiles – through the API. Access works through a Google sign-in of our band account; the resulting token is kept only on our own server (IONOS, Germany), never in the browser, and is not shared.

Refresh and deletion: The data is refreshed every three hours; videos deleted on YouTube are removed together with their figures at the next sync. If no sync succeeds for 30 days, we delete the stored YouTube data. If access is revoked, we delete all YouTube data stored through the API by the following day at the latest, and in any case within seven days; the same applies to deletion requests sent to info@rfs-music.de. The account owner can revoke access at any time in the Google account permissions. The legal basis is Art. 6 (1) (f) GDPR (operating and analysing our own channel). For use of the backend see the Terms of Service.

Online shop

When you order in our shop, we process the details from the order form (name, e-mail address, the delivery address for vinyl, the items ordered and the chosen payment method) to fulfil the purchase contract (Art. 6 (1) (b) GDPR). Order, invoice and shipping status are stored on our own server; we keep invoices for eight years for tax reasons (§ 147 (3) AO, § 14b UStG, Art. 6 (1) (c) GDPR). We pass the delivery address on to the postal carrier (Deutsche Post / DHL). For items we only produce if there is enough demand (“count me in”), we store your e-mail address and size preference after your double-opt-in confirmation (Art. 6(1)(a) GDPR), solely to tell you whether and when the item is coming; you can delete the entry at any time via the link in the e-mail. A customer account is optional (see below); you reach your order page via a link in our e-mail that contains a signed identifier and expires after 400 days. We anonymise the name, address and e-mail address of an order 24 months after the order; the invoice is kept for the statutory retention period.

PayPal: If you pay with PayPal, you are redirected to PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg). We transmit the order number, amount, items and – for vinyl – name and delivery address; PayPal tells us whether the payment was made and the transaction number. PayPal’s privacy statement applies to processing at PayPal (paypal.com/legalhub/privacy-full).

Bank transfer: If you pay by bank transfer, we see your name, IBAN and payment reference on our bank statement. The GiroCode on your order page is generated on our server and contains only our bank details, the amount and the order number.

Download code: When a download code is redeemed, we store the time, the code number, a non-reversible hash of the IP address and the browser type to detect abuse (Art. 6 (1) (f) GDPR); we delete these entries after twelve months.

Withdrawal function: If you declare a withdrawal via “Withdraw from contract”, we store your name, order number, e-mail address, your declaration, the date and time of receipt and a non-reversible hash of the IP address (Art. 6 (1) (b) and (c) GDPR – processing and proof of the withdrawal, § 356a BGB) and send you an acknowledgement of receipt by e-mail. We keep this data as long as the related order data.

Customer account (optional): If you create a customer account, we store your name, e-mail address, your password as a hash (scrypt), your delivery address if you wish, and the link to your orders, so that you can view your address, order status and download codes at any time (Art. 6 (1) (b) GDPR). The account becomes active only after confirmation by e-mail; unconfirmed accounts are deleted after seven days. For signing in, the shop sets a cookie (“__Host-rfs_shop”, 30 days, HttpOnly) that only keeps the session and is used for nothing else – it is technically required for the login (§ 25 (2) no. 2 TDDDG). You can delete the account yourself at any time; completed orders are anonymised in the process, open orders keep name and address until delivery, and invoices remain with us for the statutory retention period.

Contact by e-mail

If you write to us, we process your details to handle your enquiry (Art. 6 (1) (b) or (f) GDPR) and delete them once they are no longer required.

Release news (newsletter)

If you subscribe to release news, we store your e-mail address, the chosen language, the times of subscription, confirmation and unsubscription, and a shortened hash of your IP address as proof of consent (double opt-in). We use the address solely to inform you about the release of “The New Sea” and news from the band. The legal basis is your consent (Art. 6 (1) (a) GDPR). The data is kept on our own server; mails are sent through our mailbox at IONOS SE. No newsletter provider is used and no tracking takes place. You can unsubscribe at any time via the link in every e-mail or by writing to info@rfs-music.de; your data will then be deleted. Unconfirmed subscriptions are deleted after 30 days.

Sponsoring request

If you request the sponsoring packages via the form, we store your e-mail address, optionally company or name, the language, the time and a shortened hash of your IP address, send you the information automatically and then get in touch personally (Art. 6 (1) (b) GDPR, pre-contractual request). We delete the data once the request is settled, at the latest after twelve months.

Encryption

This website is served exclusively over TLS (https); form data is transmitted encrypted. Fonts, images and all other content are loaded from our own server – no fonts are fetched from Google or other providers.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority – for us, the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg.

Changes

We update this privacy policy when the website or the legal situation changes. Last updated: October 2026.