Legal Notice
Information pursuant to Section 5 DDG (German Digital Services Act)
STOLEN, represented by: Jürgen Plessing, Airach 2b, 78333 Stockach, Germany
Contact
Email: juergen@stolen.rocks
Responsible for content pursuant to Section 18 (2) MStV (German Interstate Media Treaty)
Jürgen Plessing, Airach 2b, 78333 Stockach, Germany
Consumer dispute resolution
We are neither willing nor obliged to take part in dispute resolution proceedings before a consumer arbitration board.
Liability for content and links
We create the content of this website with care, but we cannot guarantee that it is complete or up to date. The operators of external websites we link to (e.g. event organisers, social media) are responsible for their content. If we become aware of any legal violations, we will remove the content or links concerned immediately.
Copyright
Texts, photos, videos and music on this website are protected by copyright. Any use beyond the limits permitted by law requires our consent. [Third-party photos: add “Photos: [photographer’s name]”.]
Privacy Policy
1. Controller
The controller responsible for data processing on stolen.rocks is the contact named above.
2. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21). You may withdraw any consent you have given at any time with effect for the future (Art. 7 (3)). An informal email to us is sufficient.
You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg).
3. Hosting
This website is hosted by Namecheap. The host processes all data generated when you visit this website on our behalf. We have concluded a data processing agreement with the host pursuant to Art. 28 GDPR. The legal basis is our legitimate interest in secure and reliable operation (Art. 6 (1) (f) GDPR).
4. Server log files
When you access this website, the server automatically stores: IP address, date and time, page accessed, referrer URL, browser and operating system. This serves security and error analysis purposes (Art. 6 (1) (f) GDPR). Log files are deleted after 7 days.
5. Cookies and consent
We use technically necessary cookies, for example for the shopping cart and the volume setting of the music player (Section 25 (2) TDDDG, Art. 6 (1) (f) GDPR). All other cookies and external content are only loaded with your consent (Section 25 (1) TDDDG, Art. 6 (1) (a) GDPR). You can change your choice at any time via [link “Cookie settings”].
6. Merch shop and orders
When you place an order in our shop, we process your name, address, email address, phone number (optional), order and payment data in order to perform the contract (Art. 6 (1) (b) GDPR). Due to commercial and tax law obligations, we retain order data for up to 10 years (Art. 6 (1) (c) GDPR). The shop runs on WooCommerce on our own server.
For delivery, we pass your name and address on to shipping providers such as DHL / Deutsche Post. Payments are processed by payment providers such as PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Their privacy policies also apply.
7. Contact form and email
If you contact us via the contact form or by email, we store the information you provide (name, email address, event date, message) in order to process your enquiry. The legal basis is Art. 6 (1) (b) GDPR for booking enquiries, otherwise Art. 6 (1) (f) GDPR. We delete the data once your enquiry has been dealt with and no statutory retention obligation applies.
8. Spam protection (captcha)
Option A – Google reCAPTCHA: To protect against spam, we use reCAPTCHA provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. reCAPTCHA analyses, among other things, your IP address, mouse movements and time spent on the page. Data may be transferred to the USA; Google is certified under the EU-US Data Privacy Framework.
Option B – hCaptcha: To protect against spam, we use hCaptcha provided by Intuition Machines, Inc., USA. hCaptcha processes, among other things, your IP address and browser data. Data is transferred to the USA on the basis of the EU Standard Contractual Clauses.
Legal basis: our legitimate interest in a spam-free contact form (Art. 6 (1) (f) GDPR) or your consent, if requested via the consent tool (Art. 6 (1) (a) GDPR).
9. YouTube videos
We embed videos from YouTube (Google Ireland Limited, address above) in privacy-enhanced mode (youtube-nocookie.com) [switch this on the website]. A connection to YouTube is only established once you start a video or have given your consent. Your IP address and usage data are then transmitted to Google, possibly also to the USA (Data Privacy Framework). The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).
10. Concert dates via Bandsintown
We display our concert dates using a widget from Bandsintown (Bandsintown Group Inc., New York, USA). Your IP address is transmitted to Bandsintown in the process. The legal basis is your consent (Art. 6 (1) (a) GDPR).
11. Fonts
The fonts are stored locally on our server. No connection to Google is established.
12. Content delivery network
Some scripts are loaded via jsDelivr. Your IP address is transmitted to the operator in the process. The legal basis is our legitimate interest in fast delivery of the website (Art. 6 (1) (f) GDPR). [Check which plugin loads this and host it locally if possible.]
13. Music player
The music player (Sonaar MP3 Player) runs on our server and stores your volume and player settings in a cookie on your device. This is necessary for the function you have requested (Section 25 (2) TDDDG).
14. Links to Instagram and Facebook
We link to our profiles on Instagram and Facebook (Meta Platforms Ireland Ltd., Dublin). These are simple links; no data is transmitted until you click on them. Meta is responsible for data processing on these platforms.
15. Last updated
This privacy policy was last updated in October 2026.