Privacy policy
Last updated: September 2026
1. Controller and contact
The controller responsible for personal data processed on this website is:
Selin Schönbeck · Then Comes The Night
Ziegelhüttenstraße 28/1
88499 Riedlingen, Germany
Telephone: +49 174 5405261
Email: info@thencomesthenight.com
2. Website access and hosting
Our hosting provider is Host Europe GmbH, c/o Spaces, Gertrudenstraße 30–36, 50667 Cologne, Germany. When pages and files are requested, the server processes data such as IP address, date and time, requested address, status code, data volume, browser and operating system information, and, where applicable, the referring page. This is needed to deliver content, identify errors and defend against attacks. Our hosting provider receives this data.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is secure and reliable operation. Logging and retention depend on the hosting product used. Host Europe’s webhosting documentation specifies 14 days for access logs and 7 days for error logs. In specific security incidents, necessary data may be retained until the incident has been resolved and for establishing or defending legal claims. Provider information: Host Europe privacy policy.
The website uses HTTPS. Our own images, music files, documents and design assets are delivered through our hosting. The information above also applies when these files are requested.
3. Cookies, language and video choices
We do not use our own advertising tracking or Google Analytics on this website. The selected language, German or English, is carried in the page address without a language cookie.
If you allow YouTube, we store your choice under “tctn-youtube-consent-v1” in your browser’s session storage. It applies to this browser tab, is not used for profiling and can be reset using “Video privacy” in the footer. Depending on your browser’s session restore feature, the choice may be restored when reopening a session. Storage is used solely to implement the video choice you requested (Section 25(2)(2) TDDDG); loading the optional service itself is based on consent.
The protected WordPress administration area may store technically necessary login and security settings. Ordinary visits do not require an account.
4. Videos
The homepage video “Headbangers Heaven” is delivered directly from our own webhosting. The built-in browser player does not connect to YouTube and does not require YouTube consent. The information under “Website access and hosting” applies to these requests. The video may start automatically with sound muted; playback and sound can be controlled in the player.
Other videos are embedded from YouTube and initially blocked. Preview images are delivered from our own hosting. We load the YouTube player only after you choose “Allow YouTube for this visit”. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. These videos start after consent and selection.
Google receives information including your IP address, device and browser details, the page visited and video usage. Cookies or similar storage technologies may be used. Google may process this data for analytics, personalisation and advertising and associate it with a Google account if you are signed in. We use youtube-nocookie.com for embedding; this does not prevent all data processing by Google.
Consent is optional. The legal bases are Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, Section 25(1) TDDDG. You can use the website without consent or open an external YouTube link. You may withdraw consent for the future using “Video privacy” in the footer. Embedded players are then removed. This does not automatically delete data already transmitted to Google or storage set by Google; where applicable, use your browser or Google settings to manage it.
Data may be processed in the USA. Google describes transfer mechanisms including the EU-US Data Privacy Framework and standard contractual clauses. For recipients, retention, settings and transfer safeguards, see Google’s privacy policy and data transfer information.
5. Instagram posts
“Behind the scenes” displays public posts from the band profile “thencomesthenight_official”. We use the free Smash Balloon Instagram Feed extension. The server retrieves posts through the authorised Instagram connection and caches display data. This server-side retrieval is independent of website visitors’ Instagram accounts.
We use privacy mode with locally delivered post images. Viewing the locally stored preview does not connect your browser to Instagram. Opening a post or the profile takes you to Instagram, a service provided by Meta Platforms Ireland Limited, where Meta’s privacy rules apply. The legal basis for displaying posts on this website is Article 6(1)(f) GDPR; our legitimate interest is providing current information about the band’s music and activities. Further information: Instagram/Meta privacy policy.
6. External links and shops
Social buttons and links to services such as Bandcamp, Spreadshop, Spotify, Apple Music, Facebook, Instagram, TikTok, Deezer and YouTube are external links. Normal links do not load content from the destination merely by being displayed. When you open one, its provider processes the data associated with your visit under its own responsibility. Purchases in linked shops are subject to their own terms and privacy notices.
7. Email and telephone enquiries
If you contact us, we process your contact details and enquiry to respond. The legal basis is Article 6(1)(b) GDPR where the enquiry relates to preparing or performing a contract, otherwise Article 6(1)(f) GDPR based on our legitimate interest in communication. If you contact an external representative listed on Booking, that recipient is responsible for the processing they perform.
We delete enquiries once completed and no longer needed. Statutory retention duties, particularly for business correspondence and contractual documents, and necessary retention for legal claims remain unaffected. The website does not offer a public contact form or public comments.
8. Your rights
Subject to the applicable conditions, you have rights of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction (Article 18) and data portability (Article 20). You may withdraw consent at any time for the future without affecting the lawfulness of earlier processing (Article 7(3)).
Objection: You may object to processing based on Article 6(1)(f) GDPR on grounds relating to your particular situation (Article 21). Please use the contact details above.
You may complain to a data protection supervisory authority (Article 77), particularly where you usually live or where an alleged infringement occurred. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg: www.baden-wuerttemberg.datenschutz.de.
You are not required to provide data beyond that technically necessary to access the website. Without contact details, we may be unable to answer personal enquiries. We do not make solely automated decisions on this website that have legal or similarly significant effects.