Controller pursuant to Art. 4 No. 7 GDPR
Grundrauschen GmbH, Werderstrasse 138, 74074 Heilbronn
Authorized representative: Philipp Kionka
Email: kontakt@grundrauschen-publishing.de
What data we process and why
We process personal data when you visit our website, get in touch with us, or work with us as part of a contractual relationship.
Website visits and server log files
When you visit our website, your browser automatically transmits data to our server, which is stored in so-called log files. This includes your IP address, date and time of access, browser type, and page views. These data are necessary to display the website properly and ensure technical functionality. Our legitimate interest in storing these log files lies in ensuring the security and proper operation of our services. Processing is based on Art. 6(1)(f) GDPR
Cookies and tracking
We use cookies and similar technologies to analyze and improve our website. For this purpose, we use Google Analytics (provider: Google Ireland Ltd.). Processing takes place only with your explicit consent (Art. 6(1)(a) GDPR). Data may be transferred to the USA. Google is certified under the EU-U.S. Data Privacy Framework. Any further use by Google is anonymized. If the EU-U.S. DPF becomes invalid, we will base the data transfer on the then-applicable Standard Contractual Clauses or adopt alternative safeguards.
Contact form
If you contact us via the form, we process the required fields (name, email address, subject, message) in order to respond to your inquiry (Art. 6(1)(b) GDPR). Any additional information you provide voluntarily (telephone number, Spotify URL, Instagram URL, GEMA status) is processed based on your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time with future effect.
Social media
Our website contains links to our profiles on YouTube, Instagram, TikTok, Pinterest, Spotify, and Facebook. When you click on these links, the privacy policies of the respective platforms apply.
Contractual relationships with artists
As part of contractual collaborations, we process the following data: name, stage name (if applicable), date and place of birth, nationality, contact details, tax information, bank details (IBAN, BIC), membership and number with collecting societies (e.g., GEMA), images (voluntarily with consent), social media links (voluntarily), and information about submitted works. The legal basis is Art. 6(1)(b) GDPR.
Third-party providers and data processing on our behalf
We use external service providers to deliver our services. These include: Google Workspace (Google Ireland Ltd.), ALV (ALVDIGITAL Systems UG, Berlin), GEMA Online Portal, Trello (Atlassian), and Redaxo CMS. We have entered into data processing agreements in accordance with Art. 28 GDPR with all these providers. Data is only shared to the extent necessary to fulfill the contract. If a provider uses data for its own purposes (e.g., product development), this is only done in anonymized form.
Data transfers to third countries
Some of the services we use are located or have servers outside the EU, particularly in the USA. Data transfers occur only if there is an adequacy decision (e.g., EU-U.S. Data Privacy Framework) or appropriate safeguards (e.g., Standard Contractual Clauses pursuant to Art. 46 GDPR). If the EU-U.S. DPF becomes invalid, we will rely on the then-applicable Standard Contractual Clauses or adopt alternative safeguards.
Royalty accounting
Royalty accounting is handled by collecting societies (e.g., GEMA). If direct accounting is necessary, this is carried out via ALV and the data processing is based on Art. 6(1)(b) GDPR.
Login area
For contractual partners, we offer a password-protected login area on our website. There, contracts, statements, and personal contract data are made available. Use of this area is voluntary and personal data are only visible after login.
Data retention
We store personal data only as long as necessary for the respective purpose or as required by law. Afterwards, the data will be deleted or anonymized.
Your rights
You have the right to access your data (Art. 15 GDPR), to have them corrected (Art. 16 GDPR), deleted (Art. 17 GDPR), to restrict their processing (Art. 18 GDPR), to data portability (Art. 20 GDPR), and to object (Art. 21 GDPR). You can also withdraw any consent you’ve given at any time (Art. 7(3) GDPR).
No automated decision-making
We do not use automated decision-making or profiling
No obligation to provide data
You are not required to provide personal data to us. However, some forms of cooperation may not be possible without certain information.
Right to lodge a complaint with the supervisory authority
If you believe that we are unlawfully processing your personal data, you have the right to file a complaint with a supervisory authority. The competent authority for our location in Baden-Württemberg is: The State Commissioner for Data Protection and Freedom of Information Baden-Württemberg, Lautenschlagerstrasse 20, 70173 Stuttgart, Phone: +49 711 61 55 41 – 0, Email: poststelle@lfdi.bwl.de, Website: www.baden-wuerttemberg.datenschutz.de
Security
Our website is TLS-encrypted (https). We take appropriate technical and organizational measures to protect your data as best as possible (Art. 32 GDPR).
Changes to this privacy policy
We may update this privacy policy if there are changes to how we handle your data—for example, due to new services, features, or legal requirements. If these changes significantly affect how your data is used, we will notify you in advance and obtain your consent if we already have an active contractual relationship. You can always access the most current version on our website.