Privacy policy

This privacy policy is a courtesy translation for international visitors. Only the German version (available via the language switcher) is legally authoritative. — Maßgeblich ist die deutsche Fassung.

1. Controller

The controller responsible for data processing on this website is:

Florale
represented by Leander Dietrich
Im Wiesengrund 6, 76889 Klingenmünster, Germany
E-mail: info@florale.band
Phone: +49 151 41331250

We have not appointed a data protection officer; the statutory requirement to do so (Art. 37 GDPR, § 38 BDSG) does not apply.

2. Our principle: data minimisation

This website is deliberately built to collect as little data as possible. There is no analytics tracking, no advertising networks and no marketing cookies. Personal data is only processed where technically necessary to operate the site, or where you actively provide it to us.

3. Hosting and server log files

This website is hosted on a server operated by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. Processing takes place in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place with netcup.

When you visit the website, the web server automatically processes the following data in log files (server logs):

• IP address of the requesting device
• Date and time of access
• requested address (URL)
• HTTP status code and volume of data transferred
• browser type, version and operating system (user agent)
• previously visited page (referrer), if sent by your browser

Processing serves the technical delivery of the website, IT security (e.g. detecting attacks) and error analysis. The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest lies in the secure and stable operation of the website. Log data is not evaluated, not merged with other data sources and is deleted automatically – normally after no more than 14 days.

4. Cookies and local storage

This website only uses technically necessary cookies and storage – no tracking, advertising or reach-measurement technologies.

In addition, the internal area (HUB) stores display preferences such as your chosen list or grid view in your browser’s local storage (localStorage). This data never leaves your device and only concerns signed-in users.

The legal basis is § 25 para. 2 no. 2 TDDDG in conjunction with Art. 6 para. 1 lit. f GDPR: the storage is required to provide the functions you expressly requested (language selection, HUB login).

You can configure your browser to block cookies or delete them when it closes. Language selection and the HUB login may then be limited.

5. Contact form and e-mail

When you write to us via the contact form, we process the data you enter – name, e-mail address, subject and your message, plus the language in which you used the website – in order to answer your enquiry. The data is stored in a database on our own server (see “Hosting”).

The legal basis is Art. 6 para. 1 lit. b GDPR where your enquiry relates to entering into a contract (e.g. booking requests), otherwise Art. 6 para. 1 lit. f GDPR; our legitimate interest is the effective handling of enquiries addressed to us.

To protect against spam, the form uses a hidden check field (“honeypot”) and a short-lived limit on requests per IP address. This IP data is only held transiently in memory and is not stored permanently.

Your details remain with us until your request has been fully handled and no statutory retention obligations apply, or until you request their deletion. No data is passed on to third parties.

The same applies when you contact us by e-mail or phone.

Newsletter

You can subscribe to our newsletter via the form in the footer. We process your e-mail address and – optionally – your name and the language you used the site in. Sign-up uses a double opt-in procedure: you first receive an e-mail with a confirmation link and your address only becomes active after you click it, so nobody can subscribe someone else's address.

Newsletters are sent using the open-source softwareListmonk hosted on our own server (netcup, Germany). The e-mails themselves are routed through a mailbox atIONOS SE (Elgendorfer Str. 57, 56410 Montabaur, Germany) under a data processing agreement (Art. 28 GDPR). We do not share your data with any other third parties.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). You may withdraw it at any time with future effect — via the unsubscribe link in every newsletter e-mail or by e-mailing us. On unsubscribe your address is deleted from the list; confirmation logs are kept only as proof of consent.

6. Images and media files (Cloudflare R2)

Gallery photos and selected event and press images are loaded from object storage provided by Cloudflare Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare R2”). Your browser connects directly to Cloudflare; in particular your IP address and the requested file are transmitted.

The files are stored within the European Union (the R2 service’s EU jurisdiction). As delivery may run over Cloudflare’s worldwide network, it cannot be technically ruled out that requests are also processed outside the EU. Cloudflare is certified under the EU-US Data Privacy Framework, and a data processing agreement is in place.

The legal basis is Art. 6 para. 1 lit. f GDPR; our legitimate interest is the fast and reliable delivery of image files.

7. Embedded third-party content: YouTube and Google Maps

Videos and maps on this website only load after you explicitly click “Play” or “Load map”. Until then, no connection to Google is established.

YouTube

A video is embedded on the home page. The preview image is hosted on our own server, so no data reaches Google when the page loads. Only when you click to start the video does your browser connect to YouTube (provider: Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland). We use the extended privacy mode (youtube-nocookie.com), in which YouTube does not set tracking cookies; nevertheless, Google technically receives your IP address and may process further data – especially if you are signed in to Google.

The legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG, which you give by clicking the play button.

Google Maps

Individual event pages may offer an interactive map (Google Maps). The map is disabled by default; no connection to Google is made. Only when you select “Load map” does your browser connect to Google Maps. Google (Google Ireland Ltd., Dublin) then processes your IP address, may set cookies and may collect usage data; if you are signed in to Google, Google may associate this usage with your account.

The legal basis is your consent pursuant to Art. 6 para. 1 lit. a GDPR in conjunction with § 25 para. 1 TDDDG. Alternatively, you can open the location directly at Google via the “Open in Google Maps” link.

Google LLC is certified under the EU-US Data Privacy Framework. Details of Google’s processing are available in Google’s privacy policy at policies.google.com/privacy.

8. Internal area “Florale HUB”

A protected area (HUB) exists for band members and promoters. On sign-in we process your name, e-mail address and role (band/booker) as well as the login cookie “florale_hub_auth” (7 days, httpOnly). The legal basis is Art. 6 para. 1 lit. b GDPR. This data is never displayed publicly and is not shared with third parties.

9. Social media and external links

We link to our profiles on Instagram, Facebook and YouTube and, where applicable, to individual events’ ticket vendors. These are simple links: your browser only connects to the service once you click them; no data flows before that.

We operate some of our profiles jointly with the respective platform provider (Instagram and Facebook: Meta Platforms Ireland Ltd.; YouTube: Google Ireland Ltd.). When you visit our profiles, the platforms also process your data for their own purposes such as statistics and advertising, over which we have only limited influence. The privacy policy of the respective provider applies.

10. Your rights

You have the right at any time to:

• free access to your stored personal data (Art. 15 GDPR)
• rectification of inaccurate data (Art. 16 GDPR)
• erasure of your data (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object to processing based on legitimate interests (Art. 21 GDPR)
• withdraw given consent with effect for the future (Art. 7 para. 3 GDPR)
• lodge a complaint with a supervisory authority (Art. 77 GDPR)

The authority responsible for us is the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, datenschutz.rlp.de. You may, however, contact any other data protection supervisory authority, in particular the one for your place of residence or work.

For any questions about data protection you can reach us at info@florale.band.

11. Encryption

This website uses TLS encryption (HTTPS). Data you transmit to us cannot be read by third parties.

12. No profiling

No automated decision-making including profiling within the meaning of Art. 22 GDPR takes place.

Last updated: September 2026.