Privacy Policy

This page explains what data comes up when you visit randolt.com, who receives it and what your rights are. Each section starts with the legal details, followed by the explanation. The German version is the legally binding one; this English translation is provided for convenience only.

The short version

There are no accounts, no logins and no shop on randolt.com. We collect as little data as possible:

  • To deliver the site to you, our host Cloudflare processes technical data such as your IP address.
  • Players from Spotify, Apple Music, YouTube and TikTok only load once you agree.
  • We only count visitors if you agree – and without cookies.
  • We only get your email address if you subscribe to the newsletter or write to us.
  • We don’t sell data and don’t show ads. On the website we don’t build profiles about you; only in the newsletter do we see whether you opened an email and which link you clicked.

You can change your consent at any time via the “Privacy settings” button – at the bottom of every page or in the menu.

You are not obliged to give us any data. Without the technical access data (see “Hosting”), however, the site cannot be displayed; everything else is optional.

Who is responsible

Controller within the meaning of the General Data Protection Regulation (GDPR):

Peter Faust
Randolt Records (sole proprietorship)
Schmittstr. 4
53123 Bonn
Germany

Email: info@randolt.com – more details in the Legal Notice.

Hosting at Cloudflare

Provider: Cloudflare, Inc., USA – processor under Art. 28 GDPR
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in a secure, working website
Retention: We keep no access logs for normal page views. Requests to our interfaces for fan polls and newsletter sign-up are logged by Cloudflare for troubleshooting for seven days (Workers Logs), without your email address.
USA: Cloudflare may also process data in the USA. It is bound to EU data protection standards – through the EU-US Data Privacy Framework and model contracts set by the EU (Standard Contractual Clauses). This applies to all Cloudflare services on this page.

To deliver a page to you, Cloudflare necessarily receives your IP address, the page requested, the page you came from, date and time, and details about your browser and operating system. Cloudflare only uses this data on our behalf: to deliver the site and to protect it against attacks. Images and audio previews (cdn.randolt.com) are also hosted at Cloudflare. The connection is always encrypted (HTTPS). We serve our fonts ourselves – no Google Fonts or similar services.

Provider: Cloudflare Zaraz (Cloudflare, Inc., see above)
Legal basis: Art. 6(1)(c) in conjunction with Art. 7(1) GDPR – we must be able to demonstrate your consent; Section 25(2) no. 2 TDDDG
Retention: twelve months from your most recent choice (cookie cf_consent)

On your first visit, a window asks whether you agree to “Statistics” and “Embedded players”. A small cookie remembers your choice so that we don’t ask again on every visit. You can change it at any time via the “Privacy settings” button.

Visitor statistics (Cloudflare Web Analytics)

Provider: Cloudflare, Inc. (see above)
Legal basis: your consent, “Statistics” category – Art. 6(1)(a) GDPR, Section 25(1) TDDDG
Retention: up to six months at Cloudflare

Only with your consent does a small script load. It reports which page you open, which website you came from, your country, roughly your device, browser and operating system, and the loading time. We only see totals – no individual visitors, no IP addresses. The script sets no cookies, stores nothing in your browser and doesn’t follow you across other websites.

Players from Spotify, Apple Music, YouTube and TikTok

Legal basis: your consent, “Embedded players” category – Art. 6(1)(a) GDPR, Section 25(1) TDDDG
Third countries: the providers may process data outside the EU, mainly in the USA, and in TikTok’s case also in China. They are bound to EU data protection standards – through model contracts set by the EU (Standard Contractual Clauses) or the EU-US Data Privacy Framework
Providers:

Without your consent you only see a placeholder in these spots, and no data is sent. With your consent, your browser connects directly to the provider. The provider then receives at least your IP address and may set its own cookies. What it does with this is governed by its own privacy policy.

For embedding the player and transmitting your data to the provider, we and the provider are joint controllers (Art. 26 GDPR). The provider alone is responsible for everything it does with the data afterwards.

What is stored in your browser

Legal basis: Section 25(2) no. 2 TDDDG – strictly necessary for the function you asked for, so no consent is needed; Art. 6(1)(f) GDPR

  • cf_consent (cookie) – your choice under Privacy settings; twelve months from your most recent choice
  • streaming-platform (local storage) – whether you chose the Spotify or the Apple Music player; only created when you switch, stays until you delete it
  • rp_voted:<poll ID> (local storage) – that you have already voted in a fan poll; stays until you delete it
  • rp_v (cookie) – random ID for fan polls, valid for one year; see Fan polls

You can delete cookies and local storage in your browser at any time. The site keeps working afterwards but no longer remembers your choices.

If you write to us

Legal basis: Art. 6(1)(b) GDPR (enquiries about a possible contract) or Art. 6(1)(f) GDPR (legitimate interest in answering enquiries)
Recipient: Microsoft Ireland Operations Limited, Ireland (mailbox, Microsoft 365) – processor under Art. 28 GDPR
USA: Microsoft may also process data in the USA and is bound to EU data protection standards – through the EU-US Data Privacy Framework and model contracts set by the EU (Standard Contractual Clauses)
Retention: until your enquiry is resolved, unless the law requires longer retention

Clicking an email address opens your own email program; there is no contact form. Your email arrives in our mailbox at Microsoft 365. We use your name, address and message only to reply to you.

Fan polls

Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in fair, unmanipulated polls; the rp_v cookie is strictly necessary for the vote you asked for (Section 25(2) no. 2 TDDDG)
Provider: Cloudflare – database (D1) and bot protection (Turnstile), see above
Retention: individual votes 90 days after the poll closes, then only the overall result; cookie one year; technical logs of voting requests seven days

On some song pages you can vote which version of a song you like better. Taking part is optional. To stop people voting several times or manipulating polls with bots, we store:

  • a random ID in the cookie rp_v – created when you first play a poll preview; it makes sure each browser counts once per poll and doesn’t reveal who you are
  • your vote – together with the ID and your IP address, both only in pseudonymised form (hashed with a secret key; the IP version changes daily), how long you listened to each version and stayed on the page, which website you came from, your country, your network provider and roughly your device type, operating system and browser
  • a bot check – Cloudflare Turnstile checks browser signals to make sure a human is voting; usually you won’t notice anything

If you don’t want this, simply don’t vote.

Newsletter

Legal basis: your consent – Art. 6(1)(a) GDPR; we keep proof of your sign-up under Art. 6(1)(c) in conjunction with Art. 7(1) GDPR
Provider: Three Hearts Digital Ltd (EmailOctopus), 86-90 Paul Street, London EC2A 4NE, United Kingdom – processor under Art. 28 GDPR
Storage and third countries: The contact list is stored at Amazon Web Services in the EU (mainly Ireland). The EU has issued an adequacy decision for the United Kingdom. Some of EmailOctopus’s service providers are based in the USA (a small share of email delivery, spam and fraud screening, profile images based on the hashed address) and are bound through the EU-US Data Privacy Framework or model contracts set by the EU – list of sub-processors (external)
Retention: until you unsubscribe. After that your entry stays, marked as “unsubscribed”. We won’t send you anything any more; the entry only makes sure we don’t add you again by mistake, for example when moving contacts over from feature.fm (Art. 6(1)(f) GDPR). If you don’t confirm your sign-up, you won’t receive any newsletters, and we delete the entry automatically after 30 days.

If you subscribe to the newsletter, we send you emails from Randolt: new songs, fan polls and now and then the story behind a song. For this we store:

  • your email address
  • when you signed up and confirmed
  • where you signed up – for example at a particular poll or in the menu, so that we can, say, send you the result of exactly that poll

Signing up takes two steps (double opt-in): after you enter your address you get an email with a confirmation link. Only once you click it are you subscribed.

Bot protection: As soon as you use the form, Cloudflare Turnstile (Cloudflare, Inc., see “Hosting at Cloudflare”) loads and checks browser signals to make sure a human is filling in the form; usually you won’t notice anything. This stops bots from entering other people’s addresses and filling their inboxes with confirmation emails. The legal basis is our legitimate interest in preventing such abuse (Art. 6(1)(f) GDPR).

Opens and clicks: In our newsletters, EmailOctopus counts whether an email was opened and which link was clicked. For this, each email contains an invisible image, and links briefly pass through EmailOctopus. We use this to see what you’re interested in. If you don’t want this, turn off loading images in your email program or unsubscribe.

Unsubscribing: Every email has an unsubscribe link at the bottom. One click is enough. You can also write to newsletter@randolt.com. We read these emails by hand, so it may take a few days. The link is quicker.

Fans from feature.fm: Before this form existed, fans could sign up for emails from Randolt on our pages at feature.fm (pre-saves and the Randolt page). We have moved these contacts – email address, sign-up date, country and which page you came through – into our list at EmailOctopus (Art. 14 GDPR). The legal basis is the consent you gave there. You can unsubscribe the same way, with one click.

Your rights

You can ask us at any time for:

  • Access to the data we hold about you (Art. 15 GDPR)
  • Correction of wrong data (Art. 16 GDPR)
  • Erasure (Art. 17 GDPR)
  • Restriction of processing (Art. 18 GDPR)
  • A copy of your data in a common format (Art. 20 GDPR)

You can withdraw consent at any time for the future (Art. 7(3) GDPR); what happened before remains lawful. Just write to info@randolt.com.

Good to know: Because there are no accounts here and we don’t track you on the website, we usually hold no data we can link to you – typically only emails you sent us yourself, and your address if you subscribed to the newsletter. Fan poll votes are stored in pseudonymised form; without further information from you, we cannot link them to you (Art. 11 GDPR). If you tell us the value of your rp_v cookie, we can find your vote. No automated decision-making or profiling (Art. 22 GDPR) takes place.

Right to object

Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you can object to this at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then stop processing the data unless we have compelling legitimate grounds that override your interests, or the processing serves to establish, exercise or defend legal claims. An informal objection to info@randolt.com is enough.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW) – ldi.nrw.de (external). You may also contact the authority where you live.

Changes

If a new service is added or something changes, we update this policy. The version on this page always applies; the date of the last change is shown above.