Data Protection

Preamble

The following privacy policy is intended to inform you about the types of personal data (hereinafter also referred to simply as ‘data’) that we process, the purposes for which we do so, and the extent of such processing. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and, in particular, on our websites and within external online platforms, such as our social media profiles (hereinafter collectively referred to as the “online offering”).

The terms used are not gender-specific.

As at 8 November 2026

Table of Contents

• Preamble
• Data controller
• Overview of processing operations
• Relevant legal bases
• Security measures
• Transfer of personal data
• International data transfers
• Rights of data subjects
• Cookies and local storage in the browser
• Provision of the online service and web hosting
• Contact and enquiry management
• Newsletters and electronic notifications
• Embedded media content (two-click solution)
• Social media presence
• External shop
• Purchasing plug-ins via Paddle and licence management
• Voluntary contributions (tipping links)

Data controller

Rafael Biermann
An der Rennbahn 21
49492 Westerkappeln
Germany
Email address: info@timtechlor.de

Overview of processing operations

The following overview summarises the types of data processed and the purposes for which they are processed, and identifies the data subjects.

Types of data processed

• Inventory data.
• Contact details.
• Content data.
• Usage data.
• Meta data, communication data and procedural data.

Categories of data subjects

• Prospective customers.
• Communication partners.
• Users.

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Enquiries and communication.
• Sending the requested download (guide).
• Direct marketing via email (newsletters).
• Evidence of consent given.
• Managing and responding to enquiries.
• Security measures.
• Provision of our online services and user-friendliness.
• Information technology infrastructure.
• Marketing.

Relevant legal bases

Relevant legal bases under the GDPR: Below is an overview of the legal bases under the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection regulations may apply in your country or ours, depending on where you or we are resident or have our registered office. Should more specific legal bases apply in individual cases, we will inform you of these in the privacy policy.

• Consent (Article 6(1), first sentence, point (a) of the GDPR) – The data subject has given their consent to the processing of their personal data for a specific purpose or for several specific purposes.
• Performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR) – Processing is necessary for the performance of a contract to which the data subject is a party, or for the implementation of pre-contractual measures taken at the data subject’s request.
• Legal obligation (Article 6(1), first sentence, point (c) of the GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, unless such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require the protection of personal data.

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include, in particular, the Act on the Protection against the Misuse of Personal Data in Data Processing (Federal Data Protection Act – BDSG). The BDSG contains, in particular, specific provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, and the transfer of data, as well as automated decision-making in individual cases, including profiling. Furthermore, state data protection laws of the individual federal states may also apply.

Note regarding the applicability of the GDPR and the Swiss Data Protection Act (DSG): This privacy notice serves to provide information in accordance with both the Swiss Federal Act on Data Protection (Swiss DSG) and the General Data Protection Regulation (GDPR). For this reason, please note that, due to their broader geographical scope and clarity, the terms used in the GDPR are employed. In particular, instead of the terms ‘processing’ of ‘personal data’ used in the Swiss Data Protection Act, “overriding interest” and “personal data requiring special protection”, the terms used in the GDPR – “processing” of “personal data”, as well as “legitimate interest” and “special categories of data” – are used. However, the legal meaning of these terms continues to be determined in accordance with the Swiss Data Protection Act (DSG) within the scope of its application.

Security measures

In accordance with the statutory requirements, and taking into account the state of the art, the costs of implementation, the nature, scope, circumstances and purposes of the processing, and the varying likelihood and severity of threats to the rights and freedoms of natural persons, we implement appropriate technical and organisational measures to ensure a level of protection appropriate to the risk.

These measures include, in particular, safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, input of, disclosure of, and safeguarding of the availability of the data, and the segregation of data. Furthermore, we have established procedures to ensure that data subjects’ rights are upheld, that data is deleted and that appropriate action is taken in the event of a data breach. Furthermore, we take the protection of personal data into account right from the development and selection of hardware, software and procedures, in accordance with the principle of data protection by design and through privacy-friendly default settings.

TLS/SSL encryption (https): To protect users’ data transmitted via our online services, we use TLS/SSL encryption. Secure Sockets Layer (SSL) is the standard technology for securing internet connections by encrypting the data transmitted between a website or app and a browser (or between two servers). Transport Layer Security (TLS) is an updated and more secure version of SSL. Hyper Text Transfer Protocol Secure (HTTPS) appears in the URL when a website is secured by an SSL/TLS certificate.

Transfer of personal data

In the course of our processing of personal data, it may happen that the data is transferred to or disclosed to other bodies, companies, legally independent organisational units or individuals. Recipients of this data may include, for example, service providers commissioned to carry out IT tasks or providers of services and content that are integrated into a website. In such cases, we comply with the legal requirements and, in particular, enter into appropriate contracts or agreements with the recipients of your data to ensure the protection of your data.

International data transfers

Data processing in third countries: Where we process data in a third country (i.e. outside the European Union (EU), the European Economic Area (EEA)), or where processing takes place in connection with the use of third-party services or the disclosure or transfer of data to other individuals, bodies or organisations, this is done solely in accordance with the relevant legal requirements. Where the level of data protection in the third country has been recognised by means of an adequacy decision (Article 45 of the GDPR), this serves as the basis for the data transfer. Otherwise, data transfers shall only take place if the level of data protection is otherwise ensured, in particular through standard contractual clauses (Article 46(2)(c) of the GDPR), explicit consent or in the case of transfers required by contract or by law (Article 49(1) of the GDPR). Furthermore, we will inform you of the legal basis for transfers to third countries in relation to the individual providers based in those countries, whereby adequacy decisions take precedence as the legal basis. Information on transfers to third countries and existing adequacy decisions can be found on the European Commission’s website: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_de.

EU-US Transatlantic Data Privacy Framework: Under the so-called ‘Data Privacy Framework’ (DPF), the European Commission has also recognised the level of data protection provided by certain US companies as adequate under the adequacy decision of 10 July 2023. You can find the list of certified organisations, as well as further information on the DPF, on the US Department of Commerce’s website at https://www.dataprivacyframework.gov/ (in English). We will inform you in our privacy policy which of the service providers we use are certified under the Data Privacy Framework.

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Articles 15 to 21 of the GDPR:

• Right to object: You have the right, on grounds relating to your particular situation, to object at any time to the processing of personal data concerning you carried out on the basis of Article 6(1)(e) or (f) of the GDPR; this also applies to profiling based on these provisions. Where personal data relating to you is processed for the purposes of direct marketing, you have the right to object at any time to the processing of your personal data for the purposes of such marketing; this also applies to profiling insofar as it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
• Right of access: You have the right to request confirmation as to whether the data in question is being processed, and to access this data, as well as to receive further information and a copy of the data in accordance with the statutory requirements.
• Right to rectification: In accordance with the statutory provisions, you have the right to request that data relating to you be completed or that any inaccurate data relating to you be rectified.
• Right to erasure and restriction of processing: In accordance with the statutory provisions, you have the right to request that data relating to you be erased without delay or, alternatively, in accordance with the statutory provisions, to request a restriction on the processing of such data.
• Right to data portability: You have the right to receive the data concerning you that you have provided to us in a structured, commonly used and machine-readable format, in accordance with the statutory requirements, or to request that it be transferred to another data controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place where the alleged infringement occurred, if you consider that the processing of your personal data infringes the provisions of the GDPR.

Cookies and local storage in the browser

Our website does not itself use cookies or any consent management tool (cookie banner). However, we do use your browser’s local storage (‘localStorage’) to store certain settings on your device. This information remains on your device and is not transferred to us or to third parties.

• Consent for external media (key tt-ext-media): If you tick ‘Always allow external media’ in the notice regarding embedded media, we will save this choice so that players from YouTube, SoundCloud and Spotify are loaded in future without asking you again. You may withdraw your consent at any time via ‘Reset media consent’ at the bottom of the page or by clearing your browser’s website data; legal basis: consent (Article 6(1), first sentence, point (a) of the GDPR; Section 25(1) of the TDDDG).
• Mouse pointer display setting (key tt-crosshair): This is only saved if you click the relevant toggle button on the page; legal basis: technically necessary storage to provide the expressly requested function (Section 25(2)(2) of the TDDDG).
• Web application “TT-303 Acid Machine” (/tt-303/): This browser-based application saves the presets, sequences, drum settings and MIDI output selection you create to your browser’s local storage. This data is not transmitted to our server. The application generates sound locally via Web Audio; optionally, it can control external devices via Web MIDI — your browser will ask for MIDI authorisation separately; no connection to MIDI devices will be established without your permission; legal basis: technically necessary storage (Section 25(2)(2) of the TDDDG) or the provision of the function you have expressly requested.

You can delete all entries at any time via your browser’s settings (by clearing website or page data).

Provision of the online service and web hosting

We process users’ data in order to provide them with our online services. To this end, we process the user’s IP address, which is necessary to transmit the content and functions of our online services to the user’s browser or device.

• Types of data processed: usage data (e.g. web pages visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, consent status).
• Data subjects: users (e.g. website visitors, users of online services).
• Purposes of processing: Provision of our online services and user-friendliness; IT infrastructure (operation and provision of information systems and technical equipment); security measures.
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Further information on processing procedures, methods and services:

• Provision of our online services on leased storage space: To provide our online services, we use storage space, computing capacity and software that we lease from a server provider; Service provider: Contabo GmbH, Lauterbourg data centre (France, European Union); legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
• Collection of access data and log files: Access to our online service is logged in the form of so-called ‘server log files’. Server log files include the address and name of the web pages and files accessed, the date and time of access, the volume of data transferred, confirmation of successful access, browser type and version, the user’s operating system, the referrer URL (the page visited previously), the IP address and the requesting provider. The server log files may be used, on the one hand, for security purposes, e.g. to prevent server overload (particularly in the event of malicious attacks, known as DDoS attacks), and, on the other hand, to ensure server capacity and stability; legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR). Data erasure: The log data from the upstream web server is rotated daily and retained for up to approximately 52 days; the log data from the actual web server is rotated weekly and retained for up to approximately 12 months; it is then overwritten or deleted. Data that needs to be retained for evidential purposes is exempt from deletion until the respective incident has been fully resolved.
• Email hosting: The email accounts for our domain timtechlor.de (e.g. info@timtechlor.de, booking@timtechlor.de, newsletter@timtechlor.de, licenses@timtechlor.de) are hosted by webhoster.de AG (data centre in Frankfurt am Main, Germany); legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).
• Local fonts and scripts: The fonts and scripts used on our website are hosted on our own server. When you visit our pages, no connection is established with third-party font or script servers. We do not use a content delivery network (CDN).

Contact and enquiry management

When you contact us by email (e.g. info@timtechlor.de, booking@timtechlor.de or timtechlor@gmail.com), by post or via our social media profiles, as well as in the context of existing user and business relationships, the details provided by enquirers will be processed to the extent necessary to respond to enquiries and carry out any requested actions. We do not provide a contact form.

We delete enquiries and the data submitted with them once they are no longer required for processing and there are no statutory retention obligations preventing us from doing so.

• Types of data processed: contact details (e.g. email address); content data (e.g. message content); meta, communication and procedural data (e.g. timestamps).
• Data subjects: Communication contacts.
• Purposes of processing: contact enquiries and communication; managing and responding to enquiries.
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR); performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR).

Further information on processing procedures, methods and services:

• Email reception: Emails sent to our addresses on the timtechlor.de domain are processed on the servers of our email provider, webhoster.de AG (data centre in Frankfurt am Main). Emails sent to our additional address timtechlor@gmail.com are processed via the Gmail email service; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; website: https://www.google.com; privacy policy: https://policies.google.com/privacy; legal basis for transfers to third countries: EU-US Data Privacy Framework (DPF).

Newsletters and electronic notifications

We only send out newsletters and electronic notifications (hereinafter referred to as ‘newsletters’) with the recipients’ consent. This currently applies to the ‘Acid Season’ mailing list (free tools, updates and releases from Tim Techlor), which you can subscribe to at timtechlor.de/acid-season. The form asks for your email address and, optionally, your first name; the information entered is transmitted to our newsletter service via the subdomain newsletter.timtechlor.de.

Double opt-in procedure: After signing up, you will receive an email containing a confirmation link. You will only be subscribed to the newsletter once you have clicked on this link. In the same email, we will send you the requested download link for the ‘Acid Under Control’ guide; you will receive the guide even if you do not confirm your subscription to the newsletter. We store the time of registration and confirmation, as well as the IP address used during confirmation, in order to be able to verify your consent. If you leave the name field blank, we will use the placeholder ‘Techlorian’. We automatically delete registrations that are not confirmed within 30 days.

Mailing service and hosting: Recipients are managed using the ‘listmonk’ software, which we operate ourselves on our server (Contabo GmbH, data centre in France, EU); the data is not transferred to the software manufacturer. Emails are sent via the mail server of our email provider, webhoster.de AG, which has a data centre in Frankfurt am Main. The public pages of the newsletter service (subscription, unsubscription, settings) may set technically necessary cookies or session data; beyond that, session data is only required in the admin area.

Analysis: We analyse opens and clicks only in aggregated form (total figures per mailing) and do not create profiles of individual recipients.

Withdrawal of consent and unsubscribing: You may withdraw your consent at any time by using the unsubscribe link in every email or by sending a message to newsletter@timtechlor.de. Once you have unsubscribed, we will delete your data, unless we are required to retain it for up to three years as evidence of consent previously given.

• Types of data processed: Inventory data (email address, name (optional)); metadata, communication data and procedural data (e.g. IP address, times of registration and confirmation, consent status).
• Data subjects: Communication contacts; newsletter recipients.
• Purposes of processing: sending the requested guide; direct marketing by email (newsletter); proof of consent.
• Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR); legitimate interests for the purpose of providing evidence of consent (Article 6(1), first sentence, point (f) of the GDPR).

Embedded media content (two-click solution)

We embed third-party media content (players from YouTube, SoundCloud and Spotify) on our website. Simply visiting our pages does not establish a connection with these providers. Only when you select a media section or a player will a notice appear stating that, when the player is loaded, your IP address and technical data will be transmitted to the relevant provider and that the provider may set cookies. Only when you then select ‘Load player’ will the content be loaded from the provider’s server.

Optionally, you can grant permanent consent by selecting ‘Always allow external media’; we store this choice in your browser’s local storage (see the section ‘Cookies and local storage in the browser’). You can withdraw your consent at any time by clicking ‘Reset media consent’ at the bottom of the page or by clearing your website data.

This integration requires third-party providers to process users’ IP addresses, as they cannot send the content to users’ browsers without them. Third-party providers may also set their own cookies and process usage data for statistical or marketing purposes; we have no control over this.

• Types of data processed: usage data (e.g. web pages visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, consent status).
• Data subjects: users (e.g. website visitors, users of online services).
• Purposes of processing: To provide our online services and ensure user-friendliness.
• Legal basis: Consent (Article 6(1), first sentence, point (a) of the GDPR); Section 25(1) of the TDDDG.

Further information on processing procedures, methods and services:

• YouTube videos (enhanced privacy mode): video content; YouTube videos are embedded via a specific domain (identifiable by the component ‘youtube-nocookie’) in what is known as ‘enhanced privacy mode’, which, according to the provider, means that no cookies are set to personalise video playback; nevertheless, information regarding users’ interaction with the video (e.g. remembering the last playback position) may be stored; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; website: https://www.youtube.com; privacy policy: https://policies.google.com/privacy; basis for transfer to a third country: EU-US Data Privacy Framework (DPF).
• SoundCloud: Music hosting and embedded player; service provider: SoundCloud Global Limited & Co. KG, Rheinsberger Str. 76/77, 10115 Berlin, Germany; website: https://soundcloud.com. Privacy policy: https://soundcloud.com/pages/privacy.
• Spotify: music streaming and embedded player; service provider: Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden; website: https://www.spotify.com/de. Privacy policy: https://www.spotify.com/de/legal/privacy-policy/.

Social media presence

We maintain an online presence on social media platforms and, in this context, process users’ data in order to communicate with users active on those platforms or to provide information about us. Our website merely contains links to these profiles; no plugins or content from these providers are loaded. You are only redirected to the respective provider’s site when you click on the link.

We would like to point out that this may involve the processing of users’ data outside the European Union. This may entail risks for users, as it could, for example, make it more difficult for them to enforce their rights.

Furthermore, users’ data within social networks is generally processed for market research and advertising purposes. For example, usage profiles can be created on the basis of users’ behaviour and the interests derived from it. These user profiles can in turn be used, for example, to display adverts both within and outside the networks that are presumed to correspond to users’ interests. For these purposes, cookies are usually stored on users’ computers, in which their usage behaviour and interests are recorded. Furthermore, data may also be stored in the usage profiles regardless of the devices used by users (in particular, if users are members of the respective platforms and are logged in to them).

For a detailed explanation of the various forms of data processing and the options for objecting (opt-out), please refer to the privacy policies and information provided by the operators of the respective networks.

We would also like to point out that, in the case of requests for information and the exercise of data subjects’ rights, these can most effectively be addressed with the service providers themselves. Only the service providers have access to users’ data and can take appropriate action and provide information directly. Should you nevertheless require assistance, please do not hesitate to contact us.

• Types of data processed: contact details (e.g. email address, telephone numbers); content data (e.g. entries in online forms); usage data (e.g. webpages visited, interest in content, access times); meta, communication and procedural data (e.g. IP addresses, time stamps, identification numbers, consent status).
• Data subjects: users (e.g. website visitors, users of online services).
• Purposes of processing: enquiries and communication; marketing.
• Legal basis: Legitimate interests (Article 6(1), first sentence, point (f) of the GDPR).

Further information on processing procedures, methods and services:

• Instagram: social network; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; website: https://www.instagram.com. Privacy policy: https://instagram.com/about/legal/privacy.
• Facebook Pages: Profiles within the Facebook social network; service provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; website: https://www.facebook.com; privacy policy: https://www.facebook.com/about/privacy; basis for transfers to third countries: EU-US Data Privacy Framework (DPF), Standard Contractual Clauses (https://www.facebook.com/legal/EU_data_transfer_addendum); further information: We are jointly responsible with Meta Platforms Ireland Limited for the collection (but not the further processing) of data relating to visitors to our Facebook page; this data includes information on the types of content that users view or interact with, as well as information about the devices used by users (e.g. IP addresses, operating system, browser type, language settings, cookie data). On this basis, Facebook provides us with aggregated statistics (‘Page Insights’). We have entered into a specific agreement with Facebook (‘Information on Page Insights’, https://www.facebook.com/legal/terms/page_controller_addendum), which specifically sets out the security measures Facebook must observe and in which Facebook has agreed to fulfil the rights of data subjects (for example, users may submit requests for information or erasure directly to Facebook).
• YouTube: social network and video platform; service provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; privacy policy: https://policies.google.com/privacy; legal basis for transfers to third countries: EU-US Data Privacy Framework (DPF). Option to object (opt-out): https://myadcenter.google.com/personalizationoff.
• SoundCloud: music platform; service provider: SoundCloud Global Limited & Co. KG, Rheinsberger Str. 76/77, 10115 Berlin, Germany; website: https://soundcloud.com; privacy policy: https://soundcloud.com/pages/privacy.
• Spotify: music platform; service provider: Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden; website: https://www.spotify.com/de; privacy policy: https://www.spotify.com/de/legal/privacy-policy/.
• Audiomack: music platform (provider based in the USA); website: https://audiomack.com. When you open the link, the provider’s privacy policy applies.
• GitHub: platform for software projects; service provider: GitHub Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA; website: https://github.com; privacy policy: https://docs.github.com/site-policy/privacy-policies/github-privacy-statement; when you click on the link, the provider’s privacy policy applies.

External shop

On our website, we provide a link to an external online shop at shop.timtechlor.de. We do not operate this shop; it is provided by the service provider SumUp (Shops service at shops.sumupstore.com). No data is transferred to SumUp unless you click on the link. As soon as you visit the shop, the provider’s privacy policy applies; the processing of your data within the shop (e.g. order, contact and payment details) is solely the provider’s responsibility.

• Service provider: SumUp (shop service at shops.sumupstore.com); website: https://www.sumup.com. The privacy policy displayed in the shop is the one that applies.

Purchasing plug-ins via Paddle and licence management

We sell the paid TimTechlor plug-ins (VST3/CLAP) via Paddle. Paddle acts as the reseller and contractual partner for the purchase (Merchant of Record) and processes the data you enter at checkout (in particular your email address, country, postcode, payment details and, where applicable, VAT number) under its own responsibility in order to process the payment, handle invoices and tax matters, prevent fraud and issue refunds. We do not receive payment details such as card numbers.

Checkout on our website: The checkout appears as a Paddle pop-up window on our site. We only load the Paddle script this requires (cdn.paddle.com) once you click the “Buy” button; no data is transmitted to Paddle before this. Once you have clicked the button, Paddle processes technical data such as your IP address and browser details, and may set cookies or local storage required for the checkout process.

What we receive from Paddle and why: Following your purchase, Paddle sends us the transaction ID, the price tier purchased, your email address and, if provided, your name. We use this information to issue your licence key, send it to you by email (via the mail server of webhoster.de AG, Frankfurt am Main) and display it on the page immediately after purchase. Your email address forms part of the licence key and is displayed in the plug-in as ‘Licensed to …’. We store the licence data (licence ID, email address, name, price tier, transaction ID, date of issue) on our server (Contabo GmbH, data centre in the EU) so that we can resend keys if they are lost, deal with transfers and refunds, and inform you about the release of new plug-ins that are included in your licence.

Retention period: For as long as your licence remains valid. Following a refund or at your request, we will delete the licence data, unless we are required to retain it for longer due to statutory retention obligations or to prevent misuse. The data stored by Paddle is governed by its privacy policy.

Licence verification within the plug-in: The plug-ins verify the licence key exclusively on your computer. No data is transferred to us or to third parties during this process.

• Types of data processed: basic customer data (e.g. name, email address); contract details (e.g. licence ID, price tier, transaction ID); payment details (Paddle only); metadata, communication and procedural data (e.g. IP address at checkout, only via Paddle).
• Data subjects: customers; prospective customers.
• Purposes of processing: Provision of contractual services (licensing and licence management); payment processing (Paddle); customer service.
• Legal basis: performance of a contract and pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR); legal obligation (Article 6(1), first sentence, point (c) of the GDPR); legitimate interests in preventing misuse (Article 6(1), first sentence, point (f) of the GDPR).
• Service provider: Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom (for buyers in the USA and Canada, the relevant Paddle company); website: https://www.paddle.com; privacy policy: https://www.paddle.com/legal/privacy. Legal basis for data transfers to the United Kingdom: adequacy decision by the European Commission (Article 45 of the GDPR); for any onward transfers, Paddle’s own information applies.

The terms and conditions of purchase and the licence are set out in our Terms and Conditions and Licence Terms.

Voluntary contributions (tipping links)

On the /acid-season/ page, we provide links to services through which you can voluntarily give us a tip. These are simple links; we do not embed any content, scripts or buttons from these providers. As long as you do not click on a link, no data is transferred to the respective provider. If you access a service, the provider will process your data (e.g. contact and payment details) under its own responsibility in accordance with its privacy policy.

For each payment, we receive the details provided to us by the provider, which usually include the name or username, the amount, the date and time, and any accompanying message. We use these details solely to match the payment to the relevant transaction and retain them to the extent required by tax legislation.

• Legal basis: performance of a contract or pre-contractual enquiries (Article 6(1), first sentence, point (b) of the GDPR); legal obligation (Article 6(1), first sentence, point (c) of the GDPR).
• PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg; privacy policy: https://www.paypal.com/de/legalhub/privacy-full.
• SumUp: tips via the shop at shop.timtechlor.de; the information in the “External shop” section applies.
• Ko-fi: Ko-fi Labs Limited, United Kingdom; privacy policy: https://more.ko-fi.com/privacy.
• GitHub Sponsors: GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA; privacy policy: https://docs.github.com/de/site-policy/privacy-policies/github-general-privacy-statement.