Privacy

As of 2026-05-29. Describes the data processing as actually implemented; the final legal wording will be agreed upon with the data protection lawyer.

Controller

Clesk Digital GmbH
Siegen, Deutschland
Contact: privacy@futurewax.eu

What we process

• Account data: Email, password hash, verification status (FastAPI-Users).
• Artist profile: Display name, slug, bio, branding (colors, logo, header, social links).
• Content: Uploaded audio files and cover images (Hetzner Object Storage, bucket encryption at rest).
• Orders: Product snapshot, quantity, price, delivery address, status — retained for 10 years (GoBD).
• Auth cookie: fw-auth (HttpOnly, SameSite=Lax) — no tracking.

What we do NOT process

• No tracking cookies, no Google Analytics, no marketing pixels.
• Sentry error reports without PII (PII scrubber, EU cluster).
• No data sharing with third parties except necessary service providers (hosting, payment).

Data processors (DPA)

• Hetzner Online GmbH (hosting, object storage, DPA in place).
• Mollie B.V. (payment, DPA pending, ADR-025).
• Sentry (error tracking, EU cluster, DPA in place).

Your rights

• Access & export (Art. 15 + 20): JSON export in the Artist dashboard.
• Erasure (Art. 17): Account deletion in the Artist dashboard. PII is anonymised; order records are retained for 10 years in accordance with GoBD.
• Rectification (Art. 16): directly in your profile.
• Complaint: State Commissioner for Data Protection NRW (LDI NRW).

Retention periods

See Retention matrix: magic links 30 days, pending files 24 h, orders 10 years (GoBD).