Last updated: June 2026

​​

This Privacy Policy explains how Areo Studios e. K. processes personal data when you visit this website, use the online shop, contact us, place an order, subscribe to communications, or interact with our online services.

​

1. Controller

The controller responsible for the processing of personal data on this website is:

Areo Studios e. K.
Owner / Proprietor: Alexander Bagdahn
38114 Braunschweig
Germany

E-mail: areo.artist@gmail.com
Website: www.areomusic.com

​

2. Privacy contact

For all questions regarding data protection and the processing of your personal data, you may contact us at:

Areo Studios e. K.
Alexander Bagdahn
Hermannstraße 6
38114 Braunschweig
Germany

E-mail: areo.artist@gmail.com

No external Data Protection Officer has been appointed. If a legal obligation to appoint a Data Protection Officer arises in the future, this Privacy Policy will be updated accordingly.

​

3. General principles of processing

We process personal data only where permitted by applicable data protection law, in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG), where applicable.

Personal data means any information relating to an identified or identifiable natural person. This may include, for example, your name, e-mail address, postal address, IP address, order data, payment-related information, communication content, and technical usage data.

We process personal data only for defined purposes, only to the extent necessary, and only for as long as required for the respective purpose or by statutory retention obligations.

​

4. Legal bases for processing

Depending on the specific processing activity, we process personal data on one or more of the following legal bases:

• Article 6(1)(a) GDPR, where you have given consent, for example for newsletters, analytics cookies, or marketing cookies.

• Article 6(1)(b) GDPR, where processing is necessary for the performance of a contract or pre-contractual measures, for example when you place an order in the online shop.

• Article 6(1)(c) GDPR, where processing is necessary to comply with legal obligations, for example tax and accounting obligations.

• Article 6(1)(f) GDPR, where processing is necessary for our legitimate interests, provided that your interests or fundamental rights and freedoms do not override those interests. Legitimate interests may include website security, fraud prevention, technical operation, customer communication, and the improvement of our services.

​

5. Visiting the website and server log files

When you visit this website, technical access data may be processed automatically by our hosting provider and/or server systems. This may include:

• IP address

• Date and time of access

• Requested page or file

• Amount of data transferred

• Browser type and browser version

• Operating system

• Referrer URL

• Access status or error messages

• Internet service provider

This data is processed to ensure the technical delivery, stability, and security of the website, to detect misuse, and to maintain the proper operation of our online services.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure and reliable operation of the website.

Server log files are generally stored only for as long as necessary for security and technical purposes and are then deleted or anonymised, unless longer storage is required due to a security incident, legal obligation, or the establishment, exercise, or defence of legal claims.

​

6. Hosting and technical service providers

This website is hosted and technically operated with the support of external service providers. These providers may process technical data, including IP addresses, server log files, and website usage data, to make the website available and secure.

Where service providers process personal data on our behalf, they are engaged as processors within the meaning of Article 28 GDPR, where required.

If the hosting or shop infrastructure provider is located outside the European Economic Area, personal data may be transferred to a third country. In such cases, we ensure that appropriate safeguards are in place, such as an adequacy decision by the European Commission or standard contractual clauses, where required.

Hosting / shop provider: [insert provider, e.g. Shopify, Wix, Squarespace, Webflow, IONOS, Strato or other provider]

​

7. Contact by e-mail or contact form

If you contact us by e-mail or through a contact form, we process the personal data you provide, such as your name, e-mail address, message content, and any additional information you choose to submit.

We process this data to respond to your request, communicate with you, and handle your inquiry.

The legal basis is Article 6(1)(b) GDPR if your request relates to a contract or pre-contractual measures. In all other cases, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in responding to inquiries and maintaining communication with users, customers, business partners, and interested parties.

Contact inquiries are stored for as long as necessary to process the respective inquiry. If the communication relates to a contract, order, invoice, or legal matter, longer statutory retention periods may apply.

​

8. Online shop and orders

When you place an order in our online shop, we process the personal data necessary to process and fulfil your order. This may include:

• Name

• Billing address

• Shipping address

• E-mail address

• Order details

• Product selection

• Payment status

• Delivery status

• Customer communication

• Invoice and accounting data

The purpose of processing is to process your order, deliver purchased products, handle payment, provide customer service, process returns or complaints, and comply with legal obligations.

The legal basis is Article 6(1)(b) GDPR for order fulfilment and Article 6(1)(c) GDPR for statutory tax, accounting, and commercial retention obligations. Where necessary, Article 6(1)(f) GDPR may also apply, for example for fraud prevention, legal defence, or internal administrative purposes.

Order and invoice data may be stored for the duration of statutory retention periods. Depending on the type of document, commercial and tax-related retention obligations may apply for several years.

​

9. Customer account

If the online shop allows you to create a customer account, we process the data required to create and manage that account. This may include your name, e-mail address, password, order history, billing address, shipping address, and account settings.

The purpose of processing is to provide account functionality, allow easier future orders, display past orders, and manage customer data.

The legal basis is Article 6(1)(b) GDPR.

You may request deletion of your customer account at any time, unless statutory retention obligations or legitimate legal interests prevent immediate deletion of certain data.

If no customer account functionality is offered, this section does not apply.

​

10. Payments

Depending on the payment methods offered in the online shop, payment-related data may be processed by external payment service providers. This may include, depending on the selected payment method:

• Name

• Billing address

• E-mail address

• Order amount

• Transaction ID

• Payment status

• Payment method

• Payment provider account details

• Bank or card-related data, where applicable

Payment data is processed for the purpose of handling payment transactions, confirming successful payments, preventing fraud, and fulfilling the purchase contract.

The legal basis is Article 6(1)(b) GDPR. Where processing is required for accounting or tax purposes, Article 6(1)(c) GDPR also applies. Fraud prevention may additionally be based on Article 6(1)(f) GDPR.

Depending on the selected payment method, payment data may be transmitted to payment service providers such as:

[insert payment providers actually used, e.g. PayPal, Stripe, Shopify Payments, Klarna, Apple Pay, Google Pay, credit card provider, bank transfer provider]

We generally do not receive full credit card details. Such data is usually processed directly by the respective payment service provider.

​

11. Shipping and fulfilment

If physical products are ordered, we transmit the data required for delivery to shipping and fulfilment providers. This may include:

• Name

• Shipping address

• E-mail address, if required for tracking notifications

• Telephone number, if required for delivery

• Order and shipment details

The purpose is to deliver your order and provide shipment tracking where available.

The legal basis is Article 6(1)(b) GDPR.

Shipping providers may include:

[insert shipping providers actually used, e.g. DHL, Deutsche Post, UPS, DPD, Hermes, fulfilment provider]

​

12. Returns, complaints, and customer service

If you contact us regarding returns, complaints, defects, refunds, or other customer service matters, we process the personal data necessary to handle your request. This may include contact details, order details, payment status, product information, communication content, and supporting documents or images you provide.

The legal basis is Article 6(1)(b) GDPR where the processing relates to the performance or reversal of a contract. Legal obligations may be based on Article 6(1)(c) GDPR. In addition, Article 6(1)(f) GDPR may apply where processing is necessary for documentation, legal defence, or fraud prevention.

​

13. Newsletter and marketing e-mails

If you subscribe to a newsletter or marketing e-mails, we process your e-mail address and, where applicable, your name, consent status, subscription time, IP address, and confirmation data.

Newsletter and marketing e-mails are sent only with your consent, unless legally permitted otherwise.

The legal basis is Article 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future. You can unsubscribe by using the unsubscribe link in the respective e-mail or by contacting us directly.

To document consent, we may store subscription and confirmation data. This is based on Article 6(1)(f) GDPR. Our legitimate interest lies in being able to demonstrate that consent was validly obtained.

Newsletter provider: [insert provider actually used, e.g. Mailchimp, Klaviyo, Shopify Email, Brevo, or other provider]

If no newsletter or marketing e-mails are offered, this section does not apply.

​

14. Cookies and similar technologies

This website may use cookies and similar technologies. Cookies are small text files stored on your device. Similar technologies may include pixels, local storage, session storage, tags, or tracking scripts.

We distinguish between:

​

Technically necessary cookies

These cookies are required for the technical operation of the website and online shop. They may be necessary, for example, for:

• Shopping cart functionality

• Checkout process

• Language or region settings

• Security functions

• Consent management

• Session management

The legal basis for the processing of personal data is Article 6(1)(f) GDPR, unless the cookie is required to perform a contract, in which case Article 6(1)(b) GDPR may apply. Under Section 25(2) TDDDG, consent is not required where the storage of or access to information on your device is strictly necessary to provide a digital service expressly requested by you.

​

Non-essential cookies

Non-essential cookies, such as analytics, marketing, tracking, or personalization cookies, are used only with your consent.

The legal basis is Article 6(1)(a) GDPR. Under Section 25(1) TDDDG, storage of or access to information on your device generally requires consent unless an exception applies.

You can withdraw or change your consent at any time through the cookie settings or consent management tool, where available.

Consent management tool: [insert tool if used, e.g. Cookiebot, Usercentrics, Shopify consent tool, Wix consent banner, etc.]

 

15. Analytics and website optimisation

If analytics tools are used, we may process usage data to understand how visitors interact with the website and to improve the website, shop, content, and user experience.

Depending on the tool, this may include:

• Page views

• Click behaviour

• Device information

• Browser information

• Referrer URL

• Approximate location

• IP address, where applicable

• Session duration

• Conversion events

Analytics tools are used only with your consent where required.

The legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Analytics tools used: [insert tools actually used, e.g. Google Analytics, Shopify Analytics, Meta Pixel, TikTok Pixel, Google Tag Manager, etc.]

If no analytics tools requiring consent are used, this section may be removed or adjusted.

​

16. Advertising, retargeting, and conversion tracking

If advertising or conversion tracking tools are used, personal data may be processed to measure the performance of advertising campaigns, understand conversions, and display relevant advertising on external platforms.

Depending on the tool, data may be transmitted to advertising partners and platform providers. This may include cookie IDs, device identifiers, IP address, browser data, usage behaviour, purchase events, and conversion data.

Such tools are used only with your consent where required.

The legal basis is Article 6(1)(a) GDPR. You may withdraw your consent at any time with effect for the future.

Advertising / tracking tools used: [insert tools actually used, e.g. Meta Pixel, Google Ads Conversion Tracking, TikTok Pixel, Pinterest Tag]

If no advertising or retargeting tools are used, this section does not apply.

​

17. Embedded content and external media

This website may include embedded content or links to third-party platforms, such as music streaming services, video platforms, social media platforms, or external shops.

This may include, for example:

• Spotify

• SoundCloud

• YouTube

• Instagram

• TikTok

• Facebook

• Bandcamp

• Beatport

• Apple Music

• Link-in-bio services

When embedded content is loaded, the respective third-party provider may receive technical data, including your IP address, browser information, device information, referrer URL, and information about your interaction with the embedded content. If you are logged into the respective third-party account, the provider may be able to associate your visit with your account.

Where required, embedded third-party content is loaded only after your consent.

The legal basis is Article 6(1)(a) GDPR where consent is required. Otherwise, the legal basis may be Article 6(1)(f) GDPR. Our legitimate interest lies in presenting music, videos, social media content, and artist-related content in an accessible and user-friendly way.

Please note that external platforms process data under their own responsibility and according to their own privacy policies.

​

18. Social media profiles

We maintain profiles on social media and music platforms to communicate with fans, customers, business partners, and interested users, and to provide information about releases, merchandise, events, and related content.

When you interact with our social media profiles, the respective platform provider may process personal data independently. This may include profile data, interaction data, messages, comments, likes, shares, usage behaviour, and technical data.

We process data from social media interactions only to communicate with you, respond to messages or comments, and manage our public presence.

The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in public communication, promotion of our artistic and commercial activities, and interaction with fans, customers, and interested users.

For details on processing by the platform providers, please refer to the privacy policies of the respective platforms.

​

19. Business partners, labels, distributors, and professional communication

If you contact us as a business partner, label, distributor, artist, service provider, promoter, press contact, or other professional contact, we may process your contact details and communication data.

This may include your name, company, role, e-mail address, telephone number, project details, communication content, contract data, and billing information.

The legal basis is Article 6(1)(b) GDPR if the processing relates to a contract or pre-contractual measures. Otherwise, the legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in maintaining business communication and managing professional relationships.

​

20. Recipients of personal data

Personal data may be disclosed to the following categories of recipients where necessary:

• Hosting providers

• Shop platform providers

• Payment service providers

• Shipping and fulfilment providers

• IT service providers

• Newsletter providers

• Analytics and marketing providers, where consent has been given

• Tax advisors, accountants, and legal advisors

• Public authorities, where legally required

• Banks and financial service providers

• Customer support and communication tools

Personal data is disclosed only where necessary, legally permitted, or based on your consent.

​

21. International data transfers

Some service providers may process personal data outside the European Economic Area. Where this occurs, we ensure that the legal requirements for international data transfers are met.

This may include:

• An adequacy decision by the European Commission

• EU Standard Contractual Clauses

• Additional safeguards, where required

• Your explicit consent, where applicable

The specific transfer mechanism depends on the respective provider and processing activity.

​

22. Storage and deletion

We store personal data only for as long as necessary for the purposes for which it was collected, unless statutory retention obligations, contractual obligations, legitimate interests, or legal claims require longer storage.

Typical storage periods may include:

• Server log files: short-term storage for technical and security purposes

• Contact inquiries: for the duration of processing the inquiry and, where applicable, for documentation purposes

• Order and contract data: for the duration of the contractual relationship and statutory retention periods

• Invoice and accounting data: according to statutory commercial and tax retention obligations

• Newsletter consent data: for as long as necessary to document consent

• Cookie consent records: for the duration required to document consent choices

After expiry of the relevant retention period, personal data is deleted or anonymised unless further processing is legally permitted.

​

23. Your rights

As a data subject, you have the following rights under the GDPR, subject to the applicable legal requirements:

• Right of access under Article 15 GDPR

• Right to rectification under Article 16 GDPR

• Right to erasure under Article 17 GDPR

• Right to restriction of processing under Article 18 GDPR

• Right to data portability under Article 20 GDPR

• Right to object under Article 21 GDPR

• Right not to be subject to a decision based solely on automated processing, including profiling, under Article 22 GDPR

If processing is based on your consent, you may withdraw your consent at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

To exercise your rights, please contact us at:

areo.artist@gmail.com

​

24. Right to object

If we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

If your personal data is processed for direct marketing purposes, you have the right to object to such processing at any time. If you object to processing for direct marketing purposes, we will no longer process your personal data for such purposes.

​

25. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data violates applicable data protection law.

The competent supervisory authority for Areo Studios e. K. is generally:

The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hanover
Germany

E-mail: poststelle@lfd.niedersachsen.de
Phone: +49 511 120-4500

You may also contact another competent supervisory authority.

​

26. Obligation to provide personal data

When you place an order, certain personal data is required to conclude and perform the contract. Without this data, we may not be able to process your order, deliver products, issue invoices, or provide customer support.

For purely voluntary services, such as newsletters or non-essential cookies, you are not required to provide personal data. If you do not provide consent, the respective optional service may not be available or may be limited.

​

27. Automated decision-making​

We do not use personal data for automated decision-making within the meaning of Article 22 GDPR.

If payment, fraud prevention, or risk assessment tools used by external payment providers involve automated procedures, these are generally carried out by the respective provider under its own responsibility. Please refer to the privacy information of the selected payment provider.

​

28. Data security

We use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction.

This includes, where available, encrypted transmission via SSL/TLS, access restrictions, secure account management, and careful selection of technical service providers.

Please note that data transmission over the internet can never be guaranteed to be completely secure.

​