Source: https://www.bscmusic.com/en/about_bsc/privacy/privacy.htm
Timestamp: 2019-04-23 04:55:50+00:00

Document:
Data protection is of a particularly high priority for us. In doing so, we adhere to the strict provisions of German data protection law as well as the requirements of the European General Data Protection Regulation (GPDR).
The use of our Internet pages is possible without any indication of personal data; however, if a data subject wants to use special enterprise services via our website, processing of personal data could become necessary. If the processing of personal data is necessary and there is no statutory basis for such processing, we generally obtain consent from the data subject. The processing of personal data, such as the name, address, e-mail address, or telephone number of a data subject shall always be in line with the General Data Protection Regulation (GPDR), and in accordance with the country-specific data protection regulations applicable to us. By means of this data protection declaration, our enterprise would like to inform the general public of the nature, scope, and purpose of the personal data we collect, use and process. Furthermore, data subjects are informed, by means of this data protection declaration, of the rights to which they are entitled.
Our data protection declaration is based on the terms used by the European legislator for the adoption of the General Data Protection Regulation (GPDR). Our data protection declaration should be legible and understandable for the general public, as well as our customers and business partners.
Art. 6(1) lit. a GPDR serves as the legal basis for processing operations for which we obtain consent for a specific processing purpose. If the processing of personal data is necessary for the performance of a contract to which the data subject is party, as is the case, for example, when processing operations are necessary for the supply of goods or to provide any other service, the processing is based on Article 6(1) lit. b GPDR. The same applies to such processing operations which are necessary for carrying out pre-contractual measures, for example in the case of inquiries concerning our products or services. Is our company subject to a legal obligation by which processing of personal data is required, such as for the fulfillment of tax obligations, the processing is based on Art. 6(1) lit. c GPDR.
In rare cases, the processing of personal data may be necessary to protect the vital interests of the data subject or of another natural person. This would be the case, for example, if a visitor were injured in our company and his name, age, health insurance data or other vital information would have to be passed on to a doctor, hospital or other third party. Then the processing would be based on Art. 6(1) lit. d GPDR.
Finally, processing operations could be based on Article 6(1) lit. f GPDR. This legal basis is used for processing operations which are not covered by any of the abovementioned legal grounds, if processing is necessary for the purposes of the legitimate interests pursued by our company or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. Such processing operations are particularly permissible because they have been specifically mentioned by the European legislator. He considered that a legitimate interest could be assumed if the data subject is a client of the controller (Recital 47 Sentence 2 GPDR).
Where the processing of personal data is based on Article 6(1) lit. f GPDR our legitimate interest is to carry out our business in favor of the well-being of all our employees and the shareholders.
the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GPDR and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for the data subject.
The data subject withdraws consent to which the processing is based according to point (a) of Article 6(1) of the GPDR, or point (a) of Article 9(2) of the GPDR, and where there is no other legal ground for the processing.
The data subject objects to the processing pursuant to Article 21(1) of the GPDR and there are no overriding legitimate grounds for the processing, or the data subject objects to the processing pursuant to Article 21(2) of the GPDR.
The personal data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GPDR.
The data subject has objected to processing pursuant to Article 21(1) of the GPDR pending the verification whether the legitimate grounds of the controller override those of the data subject.
Each data subject shall have the right granted by the European legislator, to receive the personal data concerning him or her, which was provided to a controller, in a structured, commonly used and machine-readable format. He or she shall have the right to transmit those data to another controller without hindrance from the controller to which the personal data have been provided, as long as the processing is based on consent pursuant to point (a) of Article 6(1) of the GPDR or point (a) of Article 9(2) of the GPDR, or on a contract pursuant to point (b) of Article 6(1) of the GPDR, and the processing is carried out by automated means, as long as the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Furthermore, in exercising his or her right to data portability pursuant to Article 20(1) of the GPDR, the data subject shall have the right to have personal data transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.
Each data subject shall have the right granted by the European legislator to object, on grounds relating to his or her particular situation, at any time, to processing of personal data concerning him or her, which is based on point (e) or (f) of Article 6(1) of the GPDR. This also applies to profiling based on these provisions.
In addition, the data subject has the right, on grounds relating to his or her particular situation, to object to processing of personal data concerning him or her by us for scientific or historical research purposes, or for statistical purposes pursuant to Article 89(1) of the GPDR, unless the processing is necessary for the performance of a task carried out for reasons of public interest.
The legal basis for the temporary storage of data and log files is Art. 6 para. 1 lit. f GPDR.
The data is deleted from the server as soon as it is no longer necessary to achieve the purpose of its collection. The data of the server log files are stored separately from all personal data provided by an affected person and automatically overwritten at the latest 7 days after the end of your page visit.
The collection of the data for the provision of the website as well as the storage of this data in log files is essential for the operation of the website. There is consequently no contradiction on the part of the user.
The services of our Internet Service Providers and Access Providers used by us are to provide the following services: infrastructure and platform services, computing capacity, storage and database services, security services as well as technical maintenance and security check for emails we use for the purpose of the operation of this online offer.
We (or our hosting providers) process inventory data, contact data, content data, contract data, usage data, meta and communication data of customers, interested parties and visitors to this online offer on the basis of our legitimate interests in an efficient and secure provision of this online offer acc. Art. 6 para. 1 lit. f GPDR i.V.m. Art. 28 GPDR (order processing contract). The staff of our hosting providers will never consult the content of log files or, in particular, e-mails (e-mail body) without our request and knowledge.
In the security check of our e-mails, messages that are not filtered ("secure" e-mails) are usually only for a few seconds on our partner's servers and will only be temporarily stored if they can not be delivered. Messages detected as spam are kept, but only examined by employees of our hosting providers (eg for the resolution of incorrectly filtered e-mails ("false positives").) The backup of all servers of our hosting providers against unauthorized access is state-of-the-art regularly maintained.
Due to legal regulations, our website contains information that enables quick electronic contact to our company as well as direct communication with us, which also includes a general address of the so-called electronic mail (e-mail address). If an affected person contacts the data controller by e-mail or through a contact form, the personal data provided by the data subject will be automatically saved.
For contact forms, in addition to the filled-in input fields to prevent misuse of the contact form and to ensure the security of our information technology systems, the IP address of the user as well as the date and time are stored. For the processing of the data in the context of the sending process your consent is obtained and referred to this privacy statement.
Alternatively, you can send us messages via the provided e-mail addresses. In such a case, the personal data transmitted by you by e-mail will be stored. Such personal data will be stored voluntarily by the data subject to the data controller for the purpose of processing or contacting the data subject. There is no disclosure of this personal data to third parties.
Legal basis for the processing of the data is in the presence of the consent of the user Art. 6 para. 1 lit. a GPDR. The legal basis for the processing of the data transmitted in the course of sending an e-mail is Article 6 (1) lit. f GPDR. If the e-mail contact aims to conclude a contract, then additional legal basis for the processing is Art. 6 para. 1 lit. b GPDR.
The processing of personal data from the input form of contact forms only serves to process the contact. If you contact us by e-mail, this is also the required legitimate interest in the processing of this data.
The transmitted data will be deleted as soon as it is no longer necessary for the purpose of its collection. This occurs when the respective conversation ends with the user and can be deduced from the circumstances that the request is finally clarified.
You have the opportunity to revoke your consent to the processing of personal data at any time. Also in the case of contact by e-mail, you can object to the further storage of personal data at any time. Please note that the conversation can not be continued afterwards. All personal data stored in the course of contacting will be deleted in this case.
The legal basis for processing users' personal data is Article 6 (1) lit. f GPDR.
The personal data will be transmitted under the EU-US Privacy Shield on the basis of the adequacy decision of the European Commission in the USA. You can find the certificate here.
The data sent by us and linked to cookies, user IDs (eg user ID) or advertising IDs will be automatically deleted after 14 months.The deletion of data whose retention period has been reached is done automatically once a month.
Further information and the applicable data protection provisions of Google may be retrieved under https://www.google.de/intl/en/policies/privacy/ and under https://www.google.com/analytics/terms/us.html. Google Analytics is further explained under the following Link https://www.google.com/analytics/.
We use Spotify Play Button on our websites. Provider is Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden, SE556703748501 (Spotify).
Spotify provides streaming services offering a selection of music and other content. Certain Spotify services are provided to you free-of-charge. Other Spotify services require payment before you can access them.
With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a Spotify component (Spotify play button) was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding Spotify component.
Spotify may collect information about your interactions with the Spotify Service which includes the date and time of any requests you make, songs you have listened to, playlists you create, video content youâve watched, and your interactions with other Spotify users. This also may include details of your use of Third Party Applications and advertising you receive. Furthermore Spotify may access Technical Data which may include URL information, cookie data, your IP address, the types of devices you are using to access or connect to the Spotify Service, unique device IDs, device attributes, network connection type (e.g. WiFi, 3G, LTE, Bluetooth) and provider, network and device performance, browser type, language, information enabling digital rights management, operating system, and Spotify application version.
If the data subject is logged in on Spotify, Spotify recognizes with each call-up to a sub-page that contains a Spotify play button, which specific sub-page of our Internet site was visited by the data subject. This information is collected by Spotify and assigned to the respective Spotify account of the data subject.
Spotify will receive information through the Spotify component that the data subject has visited our website, if the data subject at the time of the call to our website is logged in on Spotify; this occurs regardless of whether the person clicks on a Spotify play button or not. If such a transmission of this information to Spotify is not desirable for the data subject, the delivery may be prevented if the data subject logs off from their own Spotify account before a call-up to our website is made.
On this website, the controller has integrated components of Songrila. Songrila is an Internet music portal that enables music publishers to set music clips and other users free of charge, which often is limited to the 30 seconds per record. Moreover Songrila offers to purchase one or multiple record or a full album.
With each call-up to one of the individual pages of this Internet site, which is operated by the controller and on which a Songrila component (Songrila Player) was integrated, the Internet browser on the information technology system of the data subject is automatically prompted to download a display of the corresponding YouTube component. During the course of this technical procedure, Songrila gains knowledge of what specific sub-page of our website was visited by the data subject. Cookies may be used to help remember and process the items in the shopping cart.
On this website, the controller has integrated components of Vimeo. We present videos on our website using services provided by Vimeo. Vimeo is operated by Vimeo, LLC with headquarters at 555 West 18th Street, New York, New York 10011, USA.
We use Vimeo plugins on some of our web pages. When you visit a page which contains such plugins â for example, our media library â a connection is established with the Vimeo servers and the plugin is shown. This provides the Vimeo server with information about the pages you have visited on our website. If you are logged onto Vimeo as a member, then Vimeo will automatically assign this information to your personal user account. When you activate the plugin (e.g. by clicking the start button of a video), the corresponding information is likewise assigned to your user account. You can prevent the automatic assignment of this information by logging out of your Vimeo account and deleting its respective cookies before logging onto our website.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 28
 Art. 6
 Art. 6