Privacy policy

This English version is provided as a courtesy. The German version is legally binding.

We have written this privacy policy (last updated: November 2026) in order to explain to you, in accordance with the requirements of the General Data Protection Regulation (EU) 2016/679 and applicable national laws, which personal data (data for short) we, as the controller – and the processors commissioned by us (e.g. providers) – process, will process in future, and what lawful options you have. The terms used are to be understood as gender-neutral.

In short: we inform you comprehensively about the data we process about you.

Privacy policies usually sound very technical and use legal terminology. This privacy policy, by contrast, is intended to describe the most important matters to you as simply and transparently as possible. Where it serves transparency, technical terms are explained in a reader-friendly way, links to further information are provided and graphics are used. In doing so we state in clear and simple language that, in the course of our activities, we only process personal data where a corresponding legal basis exists. This would certainly not be possible if we gave the briefest possible, unclear and legal-technical explanations, as is often standard on the internet when it comes to data protection. I hope you find the following explanations interesting and informative, and perhaps there is a piece of information you did not know yet.
If questions remain, we would ask you to contact the controller named below or in the legal notice, to follow the links provided and to consult further information on third-party sites. Our contact details can of course also be found in the legal notice.

This privacy policy applies to all personal data processed by our website and to all personal data in general. By personal data we mean information within the meaning of Art. 4 No. 1 GDPR, such as the name, email address and postal address of a person. The processing of personal data enables us to offer and invoice our services and products, whether online or offline. The scope of this privacy policy covers:

• our website sueddeutsches-sinfonieorchester.de
• our social media presences (Facebook, Instagram) and email communication with you

In short: the privacy policy applies to all areas in which personal data is processed in a structured way via the channels mentioned. Should we enter into legal relationships with you outside these channels, we will inform you separately where appropriate.

In the following privacy policy we give you transparent information on the legal principles and provisions, i.e. the legal bases of the General Data Protection Regulation, which enable us to process personal data.
As far as EU law is concerned, we refer to REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016. You can of course read this EU General Data Protection Regulation online on EUR-Lex, the access point to EU law, at https://eur-lex.europa.eu/legal-content/DE/ALL/?uri=celex%3A32016R0679.

We only process your data if at least one of the following conditions applies:

Consent (Article 6(1)(a) GDPR): You have given us your consent to process data for a specific purpose. An example would be the storage of the data you entered in a contact form.

Contract (Article 6(1)(b) GDPR): To perform a contract or pre-contractual obligations with you, we process your data. If, for example, we conclude a purchase contract with you, we need personal information beforehand.

Legal obligation (Article 6(1)(c) GDPR): If we are subject to a legal obligation, we process your data. For example, we are legally required to retain invoices for accounting purposes. These usually contain personal data.

Legitimate interests (Article 6(1)(f) GDPR): In the case of legitimate interests that do not restrict your fundamental rights, we reserve the right to process personal data. For example, we have to process certain data in order to operate our website securely and economically efficiently. This processing is therefore a legitimate interest.

Other conditions, such as the performance of tasks carried out in the public interest and the exercise of official authority, as well as the protection of vital interests, do not generally arise in our case. Should such a legal basis nevertheless be relevant, it will be indicated at the appropriate place.

In addition to the EU regulation, the German Federal Data Protection Act (BDSG) applies in Germany. Where further regional or national laws apply, we will inform you about them in the following sections.

If you have any questions about data protection or the processing of personal data, you will find below the contact details of the controller pursuant to Article 4(7) of the EU General Data Protection Regulation (GDPR):

Süddeutsches Sinfonieorchester e.V.
Brettacher Str. 9
70437 Stuttgart
Stuttgart Local Court (Amtsgericht Stuttgart), register of associations VR 727326
info@sueddeutsches-sinfonieorchester.de

Authorised board representative: Patrick Giesel. Further details can be found in the legal notice.

It is a general criterion for us that we store personal data only for as long as is strictly necessary for the provision of our services and products. This means that we delete personal data as soon as the reason for the data processing no longer exists. In some cases we are legally obliged to store certain data even after the original purpose has ceased to apply, for example for accounting purposes.

If you wish to have your data deleted or withdraw your consent to data processing, the data will be deleted as quickly as possible, provided there is no obligation to retain it.

We will inform you below about the specific duration of the respective data processing, where we have further information on this.

In accordance with Articles 13 and 14 GDPR, we inform you about the following rights to which you are entitled so that data is processed fairly and transparently:

Under Article 15 GDPR you have a right of access as to whether we process data about you. If so, you have the right to receive a copy of the data and to be informed of the following:

• the purpose for which we carry out the processing;
• the categories, i.e. the types of data, that are processed;
• who receives this data and, if the data is transferred to third countries, how security can be guaranteed;
• how long the data will be stored;
• the existence of the right to rectification, erasure or restriction of processing and the right to object to processing;
• that you can lodge a complaint with a supervisory authority (links to these authorities can be found below);
• the origin of the data, if we did not collect it from you;
• whether profiling is carried out, i.e. whether data is automatically evaluated in order to arrive at a personal profile of you.

Under Article 16 GDPR you have the right to rectification of data, which means that we must correct data if you find errors.

Under Article 17 GDPR you have the right to erasure (“right to be forgotten”), which specifically means that you may demand the deletion of your data.

Under Article 18 GDPR you have the right to restriction of processing, which means that we may only store the data but no longer use it.

Under Article 20 GDPR you have the right to data portability, which means that, on request, we will provide you with your data in a common format.

Under Article 21 GDPR you have a right to object, which, once enforced, entails a change in processing.

If the processing of your data is based on Article 6(1)(e) (public interest, exercise of official authority) or Article 6(1)(f) (legitimate interest), you can object to the processing. We will then examine as quickly as possible whether we can legally comply with this objection.

If data is used for direct marketing, you can object to this type of data processing at any time. We may then no longer use your data for direct marketing.

If data is used for profiling, you can object to this type of data processing at any time. We may then no longer use your data for profiling.

Under Article 22 GDPR you may, in certain circumstances, have the right not to be subject to a decision based solely on automated processing (for example profiling).

Under Article 77 GDPR you have the right to lodge a complaint. This means you can complain to the data protection authority at any time if you believe that the processing of personal data infringes the GDPR.

In short: you have rights – do not hesitate to contact the controller listed above!

If you believe that the processing of your data infringes data protection law or that your data protection rights have been infringed in any other way, you can lodge a complaint with the supervisory authority. In Germany there is a data protection commissioner for each federal state. The following data protection authority is responsible for our association:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg)
State Commissioner for Data Protection: Prof. Dr. Tobias Keber
Lautenschlagerstraße 20, 70173 Stuttgart
Telephone: 0711/61 55 41-0
poststelle@lfdi.bwl.de
https://www.baden-wuerttemberg.datenschutz.de/

We only transfer or process data in countries outside the scope of the GDPR (third countries) if you consent to this processing or if there is another legal permission. This applies in particular where the processing is required by law or necessary for the performance of a contractual relationship, and in any case only to the extent that this is generally permitted. In most cases, your consent is the most important reason for us having data processed in third countries. The processing of personal data in third countries such as the USA, where many software providers offer services and have their server locations, can mean that personal data is processed and stored in unexpected ways.

We expressly point out that, in the opinion of the European Court of Justice, an adequate level of protection for data transfers to the USA currently exists only if a US company that processes personal data of EU citizens in the USA is an active participant in the EU-US Data Privacy Framework. You can find more information on this at: https://commission.europa.eu/document/fa09cbad-dd7d-4684-ae60-be03fcb0fddf_en

Data processing by US services that are not active participants in the EU-US Data Privacy Framework may result in data being processed and stored without being anonymised. Furthermore, US government authorities may, where applicable, gain access to individual data. In addition, collected data may be linked with data from other services of the same provider, provided you have a corresponding user account. Where possible, we try to use server locations within the EU, if this is offered.
We will inform you in more detail at the appropriate places in this privacy policy about data transfers to third countries, where applicable.

Our website consists of static pages (HTML, CSS and JavaScript). It is no longer run with a website builder but is delivered as our own code by the hosting provider Hostinger. Hostinger merely provides the server for this purpose.

Hostinger

The service provider is HOSTINGER, UAB, Svitrigailos Str. 34, LT-03230 Vilnius, Lithuania. A data processing agreement pursuant to Art. 28 GDPR is in place with Hostinger.

What data is processed?

When you visit our website, the web server automatically stores so-called log files. These include:

• the internet address (URL) accessed and the date and time of the request
• your IP address
• browser and browser version and the operating system used
• the previously visited page (referrer URL)

This data serves the secure and error-free operation of the website and the defence against attacks. It is not merged with other data and is not used by us to analyse user behaviour. According to the provider, the log files are deleted after 31 days at the latest.

Legal basis

The processing is based on our legitimate interest in the secure, reliable and fast operation of our website (Art. 6(1)(f) GDPR). More information in Hostinger’s privacy policy: https://www.hostinger.de/legal/datenschutz-bestimmungen

If you contact us by email, we process your email address, your name (if provided) and the content of your message in order to answer your enquiry and in case of follow-up questions. The data is not passed on to third parties without your consent.

The processing is based on our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR) or, if your enquiry aims at a contract, on Art. 6(1)(b) GDPR. We delete your data as soon as your enquiry has been dealt with and no statutory retention periods apply. Your emails are stored in the mailbox with our email provider Hostinger.

If you subscribe to our newsletter, we will inform you by email about concerts, projects and news from the orchestra. We use the Brevo service for registration and dispatch.

Brevo

The provider is the Brevo group, represented in Germany by Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin (parent company: Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France). A data processing agreement pursuant to Art. 28 GDPR is in place with the provider. Brevo’s privacy policy: https://www.brevo.com/de/legal/privacypolicy/

The registration form on the “Newsletter” page is embedded directly from Brevo. As soon as you open this page, your browser therefore establishes a connection to Brevo’s servers, and your IP address is transmitted to Brevo. On the home page we only link to this page.

What data is processed?

For registration we need your email address. You can voluntarily provide further details such as your name. Registration takes place using the so-called double opt-in procedure: after submitting the form you will receive an email in which you confirm your registration. This ensures that the email address belongs to you. For this purpose we record the time of registration and confirmation as well as your IP address, in order to be able to prove consent. In addition, statistical information may arise when the newsletter is sent, for example whether an email was delivered or opened.

Legal basis and duration

The newsletter is sent on the basis of your consent (Art. 6(1)(a) GDPR). For as long as you are subscribed to the newsletter, we store your email address. After you unsubscribe, we may retain it for up to three years in order to be able to prove the earlier consent (legitimate interest, Art. 6(1)(f) GDPR). On request, we will delete your data sooner if you confirm the original consent to us.

Withdrawal

You can unsubscribe from the newsletter at any time. You will find a link for this at the end of every email. Alternatively, a message to info@sueddeutsches-sinfonieorchester.de is sufficient.

Brevo may also transfer data to countries outside the EU. You will find further details, for example on the standard contractual clauses used, in Brevo’s privacy policy.

On individual pages (for example for chamber music concerts) you can watch or listen to music and videos directly on the website. This content comes from the providers’ servers. We do not load it automatically: the respective player is only loaded once you click on the preview (“Play playlist”, “Play video”). Only then does your browser connect to the provider, and your IP address and technical details (browser, device, page visited) are transmitted there. By clicking, you consent to this transmission (Art. 6(1)(a) GDPR).

Spotify

The provider is Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. The player may use cookies and similar technologies and may assign data to your account, in particular if you are logged in to Spotify. Processing may also take place in third countries such as the USA. Further information: https://www.spotify.com/de/legal/privacy-policy/

YouTube

We embed videos in enhanced privacy mode (youtube-nocookie.com). The provider is YouTube, LLC, 901 Cherry Ave., San Bruno, CA 94066, USA; for the European area, Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible. After the click, YouTube may collect data such as IP address, browser and the page visited, and may set cookies. If you are logged in to Google or YouTube, the use may be assigned to your account. Google is a participant in the EU-US Data Privacy Framework and additionally uses standard contractual clauses. Further information: https://policies.google.com/privacy?hl=de

If you do not want data to be transmitted to these providers, simply do not click on the content. You can withdraw your consent at any time by leaving the page and deleting cookies in your browser.

The fonts used on our website (Montserrat, Open Sans and Oswald) are stored on our own server and delivered from there. When a page is loaded, no connection is made to servers of Google or other font providers, and no data is transmitted to them. The information in the section “Hosting and technical operation” applies.

For registrations and applications for orchestra projects (for example to play in the orchestra or choir), we link to Google Forms forms. These forms open on Google’s pages (forms.gle). The data you enter there (for example name, contact details, instrument, information about your experience and, where applicable, a link to a video) is processed by Google and made available to us. Google’s privacy policy applies: https://policies.google.com/privacy?hl=de

We process your details in order to review your registration and to organise the project (Art. 6(1)(b) GDPR, pre-contractual measures, and Art. 6(1)(a) GDPR, insofar as you provide voluntary information). We delete the data when it is no longer required for this purpose.

Our website contains links to external sites, for example to the ticket shops (fmz.ditix.shop, sueddeutsches-sinfonieorchester.ditix.shop, Easyticket, Liederhalle Stuttgart) and to other offerings such as Junge Solisten Stuttgart or IMSLP. When you click on them, you leave our website. From that point on, the privacy provisions of the respective provider apply. Tickets are purchased exclusively there. We have no influence on the data processing of these providers.

We have a presence on Facebook and Instagram. On our website we use only simple links for this (icons in the header and footer). No plug-ins, pixels or scripts from these providers are embedded. Data is only transmitted when you click on one of these links and thereby open the page of the respective network.

The provider of both services for the European area is Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Meta also processes data in the USA and is a participant in the EU-US Data Privacy Framework. You can find out what data Meta processes there when our pages are visited and how you can object in Meta’s privacy policy: https://www.facebook.com/privacy/policy/ and https://privacycenter.instagram.com/policy/

For data collected when our profiles (fan pages) are visited, we and Meta are, according to the case law of the European Court of Justice, partly jointly responsible (Art. 26 GDPR). You can find Meta’s agreement at https://www.facebook.com/legal/controller_addendum

We do not use cookies for analysis or advertising on our website and do not use any tracking or statistics services. The only technically necessary storage is in the browser: the newsletter pop-up on the home page remembers in your browser, for the duration of your visit (session storage), that it has already been displayed. This information does not leave your device and is deleted when you close the browser.

Cookies and similar technologies may be set by the respective providers when the embedded content (Spotify, YouTube) and the Brevo form are loaded; see the sections above. You can manage, block or delete cookies in your browser at any time. You will find out how this works in your browser’s help.

In its general sections, this privacy policy is based on a version created with the Data Protection Generator for Germany by AdSimple and has been adapted for the new website. All texts are protected by copyright.