// LEGAL

Privacy Statement

Last updated: 31 July 2026This privacy policy explains what personal data is collected when you visit xandergreat.com (the “website”), why it is collected, and what rights you have. We take the protection of your personal data seriously and process it only in accordance with the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

1. Who we are

The controller responsible for data processing on this website is:

Alexander Gross
A-4600 Wels
Austria

Email: [email protected]

The controller is currently an individual (natural person). No Data Protection Officer is required by law, and none has been appointed. For any privacy-related questions or to exercise your rights (see section 10), contact us at the email address above.

2. What personal data we collect and why

2.1 Server log files

When you access the website, our hosting provider automatically collects technical information that your browser transmits. This includes:

  • your IP address (typically shortened/anonymised where possible),
  • the date and time of the request,
  • the page or file requested,
  • the referring URL,
  • your browser type and version, and your operating system.

This data is stored in server log files. It is necessary for delivering the website, ensuring stability and security, and defending against abuse.

  • Purpose: operation, security, and technical delivery of the website.
  • Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and functional website).
  • Retention: log files are kept for a short period for security purposes and then deleted or anonymised.

2.2 Contact and booking forms

The website provides contact and booking forms (powered by the FluentForms plugin). When you submit a form, we process the data you enter — typically your name, email address, and the content of your message (for booking enquiries this may include event details you choose to provide).

We use this data solely to respond to your enquiry and to handle any booking request. Form submissions are delivered to us by email.

  • Purpose: responding to your enquiry; initiating or handling a booking.
  • Legal basis: Art. 6(1)(b) GDPR (steps taken at your request prior to a contract) and/or Art. 6(1)(f) GDPR (our legitimate interest in answering enquiries).
  • Retention: we keep enquiry and booking correspondence for as long as needed to process your request and, where a business relationship follows, for the duration required by applicable statutory retention obligations. Data no longer needed is deleted.

2.3 Comments and user accounts

The website does not offer a public comment function, and visitors cannot register for user accounts. Accounts exist only for the website administrator.

2.4 Media

Media files (images, audio) published on the website are provided by us as the operator. Visitors cannot upload media.

3. Cookies and consent management

A cookie is a small text file stored on your device by your browser. We use cookies and comparable technologies as follows:

  • Strictly necessary cookies — required for the website and the consent banner to function (for example, a cookie that stores your cookie choices, and a language-preference cookie set by our multilingual plugin, Polylang). These are set on the basis of Art. 6(1)(f) GDPR and do not require consent.
  • Cookies set by embedded third-party content (see section 4) are only loaded after you have given consent via our cookie banner.

We use the Complianz consent-management tool to display the cookie banner, record your consent, and control when non-essential services are loaded. You can change or withdraw your consent at any time via the privacy/cookie settings link available on the website.

  • Legal basis for non-essential cookies: Art. 6(1)(a) GDPR (your consent), in conjunction with § 165(3) of the Austrian Telecommunications Act (TKG).

4. Embedded third-party content

Some pages embed media from external platforms. When such an embed loads, your IP address and technical request data are transmitted to the relevant provider, and the provider may set cookies. These embeds are only loaded after you consent via the cookie banner (see section 3).

Service Used for Provider Privacy policy
YouTube (privacy-enhanced youtube-nocookie.com mode) Video players for sets Google Ireland Ltd. / Google LLC, USA https://policies.google.com/privacy
SoundCloud Audio player for sets SoundCloud Global Ltd. & Co. KG, Berlin, Germany https://soundcloud.com/pages/privacy
Mixcloud Audio player for sets Mixcloud Ltd., London, United Kingdom https://www.mixcloud.com/privacy/
Twitch Live-stream player for events Twitch Interactive, Inc. (Amazon), USA https://www.twitch.tv/p/legal/privacy-notice/

We use YouTube in its privacy-enhanced (“no-cookie”) mode, which means YouTube does not store cookies for personalised advertising unless you play a video.

  • Legal basis: Art. 6(1)(a) GDPR (your consent).

We have no influence over the data processing carried out by these providers. For details, please consult their privacy policies linked above.

5. Analytics and tracking

We do not use web analytics services (such as Google Analytics), tracking pixels, or advertising networks on this website. We do not build user profiles and do not carry out any automated decision-making or profiling.

6. Who we share your data with

We do not sell your personal data and share it only where necessary to operate the website:

  • Hosting provider: the website runs on a virtual server at Hetzner Online GmbH, Germany, which stores the data on our behalf as a processor under a data-processing agreement (Art. 28 GDPR). Servers are located in the EU. See https://www.hetzner.com/legal/privacy-policy.
  • Email delivery: messages submitted through our forms are transmitted by email so we can read and reply to them.
  • Embedded content providers: see section 4 — only after your consent.

We may also disclose data where we are legally obliged to do so (for example, to authorities in response to a lawful request).

7. Where your data is sent (international transfers)

Our website and hosting are located within the EU/EEA (Germany), so hosting does not involve a transfer to a third country.

However, if you consent to the third-party embeds in section 4, data may be transferred to providers in the United States (YouTube/Google, Twitch/ Amazon) or the United Kingdom (Mixcloud):

  • Transfers to the UK are covered by the European Commission’s adequacy decision, which recognises an equivalent level of data protection.
  • Transfers to the US rely on appropriate safeguards, in particular the EU–US Data Privacy Framework (where the provider is certified) and/or the European Commission’s Standard Contractual Clauses.

These transfers only occur if you have given your consent (Art. 49(1)(a) GDPR where applicable). You can withhold or withdraw consent at any time.

8. How long we retain your data

We keep personal data only as long as necessary for the purposes described above:

  • Server log files: short-term, for security and troubleshooting.
  • Form enquiries and booking correspondence: for as long as needed to handle your request, and thereafter only where statutory retention obligations apply.
  • Consent records: stored for as long as required to demonstrate that consent was given, and in line with the retention period of the consent tool.

Once data is no longer needed and no legal obligation requires its retention, it is deleted or anonymised.

9. How we protect your data

We use appropriate technical and organisational measures to protect your data, including:

  • TLS/SSL encryption for all data transmitted between your browser and the website (recognisable by https:// in the address bar),
  • server infrastructure hosted in a secure EU data centre,
  • protection against automated login abuse (failed administrator login attempts, including the IP address, may be logged temporarily for security).

No method of transmission over the internet is completely secure, but we take reasonable steps to safeguard your data.

10. Your rights

Under the GDPR you have the following rights regarding your personal data:

  • Right of access (Art. 15) — to obtain confirmation of, and a copy of, the data we hold about you.
  • Right to rectification (Art. 16) — to have inaccurate data corrected.
  • Right to erasure (Art. 17) — to have your data deleted, subject to legal retention obligations.
  • Right to restriction of processing (Art. 18).
  • Right to data portability (Art. 20) — to receive your data in a structured, machine-readable format.
  • Right to object (Art. 21) — to object to processing based on our legitimate interests.
  • Right to withdraw consent (Art. 7(3)) — where processing is based on consent, you may withdraw it at any time with effect for the future.

To exercise any of these rights, contact us at [email protected].

You also have the right to lodge a complaint with a supervisory authority. In Austria this is:

Österreichische Datenschutzbehörde (Austrian Data Protection Authority) Barichgasse 40–42, 1030 Vienna, Austria Web: https://www.dsb.gv.at

11. Changes to this privacy policy

We may update this privacy policy to reflect changes to the website, our data processing, or legal requirements. The current version, with its “last updated” date, always applies. Please review this page periodically.