Privacy information

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

Phone: Show numberEmail: Show address

2. Hosting and technical log data

The production website hardyhardwich.de is hosted by netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany. Netcup processes the data required to provide and operate the website on my behalf. A data-processing agreement under Article 28 GDPR is concluded with the provider.

When a page is requested, the infrastructure may process the IP address, date and time, requested URL, referrer, browser, device and operating-system information, amount of data transferred, as well as status and security logs. This is necessary to deliver the website, maintain stability, defend against attacks and investigate errors.

The legal basis is Article 6(1)(f) GDPR. The legitimate interest is the secure, reliable and abuse-resistant operation of the website. Technical logs are deleted or anonymised once they are no longer required for these purposes and no legal or security-related reason prevents this. The specific period depends on the hosting configuration and necessary security measures.

Further information about the host: netcup GmbH privacy policy.

3. Enquiry form and email contact

On hardyhardwich.de, the enquiry form is transmitted over encrypted HTTPS to a server-side PHP function. After successful validation, the server passes the enquiry through an authenticated, TLS-protected connection to the Netcup mailbox. No separate form provider is used and no external email app opens on the visitor's device.

The data processed is the contact and event information you enter, in particular your name, email address, optional phone number, type and date of event, venue, approximate guest count, music wishes and voluntary notes. Required fields are marked. Please do not provide sensitive data that is not needed for the enquiry.

The processing is used to answer your enquiry and to take steps towards or perform a possible contract. The legal basis is Article 6(1)(b) GDPR. For other messages, the legal basis is Article 6(1)(f) GDPR; the legitimate interest is reliable business communication.

If you select the corresponding option, you receive a confirmation at the address provided, including the submitted details for comparison. No customer copy is sent without this voluntary selection. The enquiry is not stored in an additional website database; after delivery it is held in the email accounts involved. Once the mail server has accepted an enquiry, the server retains only a non-reversible verification value, a random request identifier and the technical delivery status for no more than 24 hours. This lets the browser confirm an already completed delivery after an interrupted connection without sending the enquiry twice.

Enquiries that do not lead to a booking are deleted once they have been fully dealt with and there is no legitimate reason to retain them. If a contract is concluded, contract and accounting data is retained for the applicable statutory periods.

A requested customer copy is sent as a separate message through the same authenticated mail server. Acceptance by the outgoing server can be confirmed technically; final inbox or spam-folder placement is controlled by the receiving provider.

4. Protection against automated entries

The form uses two invisible honeypot fields, a signed and expiring one-time check, a minimum completion time, a security question, strict field and size validation, request-origin and method checks, and server-side repetition limits. For rate limiting, the IP address and browser identifier, and separately the supplied email address, are converted with a secret key into non-reversible HMAC values and temporarily stored with short timing information. An anonymous overall counter also limits distributed mass submissions. These data are used solely to prevent abuse and not for advertising or analytics.

No external CAPTCHA service is loaded. Unusually frequent or technically invalid submissions may be rejected temporarily.

5. Local storage and cookies

This website uses no analytics or advertising cookies. Your choice of light or dark appearance is stored under hardy-theme in the browser’s local storage. The key hardy-testimonial-start stores only which genuine testimonial is shown first on the next visit. After an enquiry, hardy-last-enquiry stores a timestamp for the current session to limit immediate repetitions.

Storage is used only for website functions you request and to protect the form. The legal basis for processing personal data is Article 6(1)(f) GDPR. Access to the device is necessary to provide the requested functions under Section 25(2)(2) TDDDG. The entries are not used for analytics or advertising.

6. Display of contact details

The phone number and email address are assembled locally in the browser only after a deliberate interaction in the general website areas. One tap or click on “Call” displays the number and passes it directly to a phone application configured on the device. In the legal notice, both details can be shown with one click and used directly. No personal data is transmitted in this process. This technical obfuscation discourages simple automated harvesting, but it is not encryption and cannot completely prevent targeted extraction.

7. External social-media and music platforms

This website links to external services, including Instagram, Facebook, hearthis.at, Mixcloud, the Google business profile, and ticketing, event and venue websites. WhatsApp opens only after an explicit contact action. No feeds, tracking pixels, players or scripts from these platforms are loaded automatically. The visible preview images are served from local website files.

Only when you choose a clearly labelled external link do you leave this website. From that point, the relevant provider processes data under its own responsibility and privacy terms. The data processed may depend in particular on whether you are signed in to that platform.

8. Downloads

The PDF planning tools can be downloaded without registration. Information entered in the fillable PDFs remains locally in the file unless you share it yourself.

9. Recipients, security and no automated decisions

Recipients are limited to service providers required for technical or organisational purposes, particularly Netcup as hosting and email provider, the email address you provide for the optional customer copy, and other recipients where required to deal with the enquiry, perform a contract or comply with the law. There is no automated decision-making or profiling.

The website is delivered over HTTPS; transfer to the Netcup mail server is authenticated and TLS-protected with certificate verification. TLS protects each transmission link but is not end-to-end encryption of the full email conversation. Please do not submit special categories of personal data or other sensitive information that is unnecessary for an event enquiry.

10. Your rights

Within the scope of the law, you have rights including access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18), data portability (Article 20) and objection to processing based on legitimate interests (Article 21).

The competent authority is the Brandenburg State Commissioner for Data Protection and Access to Information, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, www.lda.brandenburg.de.

11. Providing information and updates

You are not legally required to provide information through this website. Without the contact and event details marked as required, however, it may not be possible to answer a specific enquiry.

This notice will be updated whenever the hosting, form delivery, integrated services or data processing changes.