Privacy Policy

Last revised: 26 September 2026

Controller

Merlin Niklasch, Grünberger Str. 85, 10245 Berlin, Germany. For privacy enquiries and to exercise your rights: info@voidqueen.com.

Hosting through ChatGPT Sites — review open

This website is publicly accessible through ChatGPT Sites; the publishing account uses ChatGPT Plus. Necessary access data, such as IP address, requested page, time and browser information, serves to deliver and secure the website. The intended basis is Article 6(1)(f) GDPR, our legitimate interest in a secure, functioning website.

The Sites DPA applicable to Plus forms part of the Sites terms. For EEA customers it identifies OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland. It provides for international transfers using standard contractual clauses or adequacy decisions. Sites does not promise a specific data location; exclusively European processing is not assured. A band member authorised by Merlin Niklasch manages the site through their Plus account. Merlin Niklasch determines the purposes and handling of visitor data and remains the controller. Sites-specific log/analytics retention periods, recipients and transfer arrangements still require review; the privacy review is not complete. Sites DPA.

Domain and DNS

Hostinger manages the domain and DNS records that make the website reachable. Hostinger does not provide web hosting for the new website. Email processing, described below, is a separate service.

Visitor statistics — unresolved

Our own website code includes neither WP Statistics nor Google Analytics. ChatGPT Sites automatically records Unique Visitors and Page Views and displays these metrics over time, without an analytics script added by us. Sites documentation.

The public documents reviewed do not specify how visitors are distinguished, whether cookies or other device storage are used, how long raw data/identifiers are retained, or whether collection can be disabled or withheld until consent. Aggregate totals alone do not prove anonymous collection. These details and the appropriate legal basis remain unresolved; the privacy review is not complete. Removing embedded videos does not disable this platform analytics.

Email and contact form

When you contact us, we process your name, email address, message and technical email metadata to respond to your enquiry. All four band members can access the shared mailbox. Please provide only information needed for your enquiry.

Selecting “Send message” sends your name, email address and message to our website server. It validates the entries and forwards them to info@voidqueen.com through the Hostinger Mail API. Hostinger also saves a copy in the Sent folder. Our website has no message database and does not log message content. If delivery fails, your entries remain in the open form so that you can open an email draft or copy the message and send it yourself. Providing information is voluntary, but we need appropriate contact and message details to deal with your enquiry. Without suitable contact details we cannot reply.

Our info@voidqueen.com mailbox uses Hostinger Starter Business Email. The published terms generally identify HOSTINGER INTERNATIONAL LIMITED, 61 Lordou Vironos str., 6023 Larnaca, Cyprus, as contracting entity for customers resident in Germany, unless a specific agreement provides otherwise. The DPA incorporated into the terms also covers email services. Hostinger terms, Hostinger DPA.

Hostinger processes messages and delivery/connection data as a processor for email services and may engage contractually bound subprocessors. Recipients include providers of technical infrastructure and email operations. The DPA limits their access to what is required to provide the services and requires corresponding safeguards. It also includes the general subprocessor list. Processing outside the EEA is possible; exclusively European processing is not promised. The DPA provides in particular for EU standard contractual clauses for applicable third-country transfers, unless another transfer basis provided for in the DPA applies. The linked DPA contains the contractual provisions and references to these safeguards.

Hostinger states that delivery and mailbox access logs are available in the customer panel for 30 days. This access period is not a general deletion deadline for all internal logs or backups. Contractually permitted retention of such operational data depends on what is necessary to provide the email service or required by law. The deletion rule below covers message copies we manage; provider backups are subject to its separate deletion procedures. This does not promise a particular maximum backup period.

For booking or contractual enquiries, Article 6(1)(b) GDPR applies where you are the contracting party or request pre-contractual steps. Other enquiries, including communications with representatives of venues, are processed under Article 6(1)(f) GDPR, our legitimate interest in answering enquiries and organising band communications.

We delete completed general enquiries within six months of closing the matter. This covers copies we manage in the inbox, Sent, Trash and any local band email storage. We carry out this procedure ourselves; the website does not automatically delete mailbox contents. Messages subject to legal retention requirements are kept for the applicable statutory period under Article 6(1)(c) GDPR. Documents necessary for specific legal claims may be retained as required, taking applicable limitation periods into account, under Article 6(1)(f) GDPR. They are then deleted. Provider backups follow the separate procedures described above.

Protecting the contact form

For direct form delivery, we limit submission attempts to prevent automated abuse and mailbox overload under Article 6(1)(f) GDPR. We derive a code from the supplied email address using a secret server-side key; it changes for each 15-minute window. This code is pseudonymous, not anonymous. The protection database contains only these codes with counters and aggregate window/daily counters, with no names, plaintext email addresses, IP addresses or message content.

Codes are used for limiting attempts only within their 15-minute window. Expired codes are removed on the next formally valid form attempt; if no further attempt occurs, they may remain stored until then. Aggregate counters are replaced on an accepted attempt in the next window or UTC day. No ongoing submission history is created. Failed delivery attempts also count towards protection. The Sites website uses a shared Sites database for this protection. Its backup and deletion periods remain open. This protection sets no cookies, uses no fingerprinting and adds no external captcha provider. If the form is blocked, you can still email us directly.

YouTube

This website does not embed a YouTube player. “Watch DOWNTOWN” and the YouTube icon are external links. Our website code does not load YouTube content through these links before you click them. Opening a link takes you to YouTube, where Google processes data under its Privacy Policy.

External links, photographs and fonts

Instagram, Spotify, TikTok and YouTube are ordinary external links. Following a link opens the platform, where its own privacy information applies. Our social icons do not load platform plugins. Photographs are served by this website. We use system fonts, with no Google Fonts downloads.

Cookies and browser storage

Our own website code sets no analytics or marketing cookies. The legal-page and EPK language choices also need no cookie. Whether the hosting platform uses cookies or other browser storage remains open. See Cookies.

Your rights

Subject to the relevant legal conditions, you may request access, correction, deletion, restriction of processing and data portability (Articles 15–20 GDPR). You may withdraw consent at any time for future processing, without affecting the lawfulness of processing before withdrawal.

For processing based on Article 6(1)(f) GDPR, you may object for reasons relating to your particular situation (Article 21 GDPR). We will stop that processing unless we demonstrate overriding compelling legitimate grounds or need the data for legal claims. You may object to direct marketing at any time without giving such reasons.

You may complain to a supervisory authority, particularly where you normally live or work, or where an alleged infringement occurred. In Berlin this is the Berlin Commissioner for Data Protection and Freedom of Information.

We do not make solely automated decisions about you with legal or similarly significant effects.