PRIVACY POLICY
Last updated: September 2026
1. General information
The protection of your personal data is important to us. This Privacy Policy explains which personal data is processed when you visit our website and use our services, the purposes for which such processing takes place and the rights available to you.
Personal data means any information relating to an identified or identifiable natural person.
2. Controller
The controller responsible for data processing on this website is:
EMS – Electronic Music School
Stefano Giachetta
Invalidenstr. 104
10115 Berlin
Germany
Phone: +49 (0)30 530 509 02
E-mail: info@em-school.com
3. Hosting and server log files
When you access our website, technical data is automatically processed by the web server. This may include in particular:
- IP address
- Date and time of access
- Requested page or file
- Referrer URL
- Browser type and browser version
- Operating system
- Host name of the accessing device
This processing is necessary to provide the website technically, ensure its stability and security and detect and prevent misuse and attacks.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest lies in the secure, stable and technically error-free operation of our website.
Server log files are deleted once they are no longer required for these purposes, unless statutory retention obligations or security reasons require longer storage.
4. SSL/TLS encryption
For security reasons and to protect the transmission of confidential information, this website uses SSL or TLS encryption.
An encrypted connection can generally be recognised by the website address beginning with “https”.
5. Cookies and similar technologies
Our website uses cookies and similar technologies.
Some of these technologies are technically necessary to provide the website and functions expressly requested by you. Other technologies may be used, for example, for analytics, reach measurement, advertising or the integration of external media.
Where the storage of information on your device or access to information already stored on your device is not strictly necessary, this takes place only after your prior consent pursuant to Section 25(1) TDDDG.
Where personal data is subsequently processed, the processing is based on your consent pursuant to Article 6(1)(a) GDPR.
Technologies that are strictly necessary may be used without consent pursuant to Section 25(2) TDDDG. Where applicable, the associated processing of personal data is based on Article 6(1)(f) GDPR.
You may withdraw or change your consent at any time with effect for the future via the privacy settings on this website.
6. Real Cookie Banner
We use the consent management system Real Cookie Banner to obtain, manage and document consent for cookies and similar technologies.
In particular, information about your consent decision is processed and stored.
The processing is carried out to comply with legal obligations pursuant to Article 6(1)(c) GDPR and on the basis of our legitimate interest in proper consent management pursuant to Article 6(1)(f) GDPR.
Technically necessary storage by the consent system is carried out within the scope of Section 25(2) TDDDG.
7. Contact by e-mail and contact form
If you contact us by e-mail or via a contact form, we process the information you provide, in particular your name, e-mail address and the content of your message, in order to process your enquiry.
Where your enquiry relates to a contract or pre-contractual measures, processing is based on Article 6(1)(b) GDPR.
For other enquiries, processing is based on Article 6(1)(f) GDPR. Our legitimate interest lies in processing and responding to incoming enquiries.
The data will be deleted when it is no longer required to process the enquiry and no statutory retention obligations prevent deletion.
8. Bookings, orders and contractual data
If you book or order a course, workshop, one-to-one coaching session, voucher, goods, digital content or another service through our website, we process the data required for the performance of the contract.
This may include in particular your name, address, e-mail address, telephone number, billing information, booked services, order information and payment information.
Processing is carried out pursuant to Article 6(1)(b) GDPR for the performance of pre-contractual measures and the respective contract.
Where statutory retention and documentation obligations apply, continued storage is based on Article 6(1)(c) GDPR.
9. Customer account
Where available, a customer account may be created on our website. The data stored there is processed for the administration of the customer account and for handling bookings and orders.
Processing is based on Article 6(1)(b) GDPR.
You may request deletion of your customer account unless statutory retention obligations require us to retain certain data contained in it.
10. Payment processing
Various payment methods may be offered for paid bookings and orders.
If you select an external payment service provider, the data necessary to process the payment will be transmitted to the payment provider you have selected.
Processing is generally based on Article 6(1)(b) GDPR for the performance of the contract concluded with you.
PayPal
If you pay via PayPal, payment processing is carried out by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg.
In particular, identity, contact, order and payment data may be transmitted to PayPal.
Stripe
Where Stripe is offered as a payment method and selected by you, payment processing is carried out by companies within the Stripe group, in particular Stripe Payments Europe Limited or the Stripe company responsible for the respective payment transaction.
This may involve processing your name, contact information, order information, payment data, IP address and other data required for payment processing and fraud prevention.
11. Newsletter
If you subscribe to our newsletter, we process your e-mail address and, where applicable, additional information voluntarily provided by you for the purpose of sending the newsletter.
Processing is carried out exclusively on the basis of your consent pursuant to Article 6(1)(a) GDPR.
You may withdraw this consent at any time with effect for the future, in particular by using the unsubscribe link contained in each newsletter.
The data stored for newsletter purposes will be deleted from the newsletter distribution list after you unsubscribe, unless another legal basis permits further storage.
12. Mailchimp
We use Mailchimp to send and manage our newsletter. Mailchimp is a service provided by The Rocket Science Group LLC d/b/a Mailchimp, an Intuit group company, USA.
In particular, your e-mail address and information relating to your newsletter subscription may be processed and – where the relevant functions are used – information about newsletter opens and link clicks.
The service is used on the basis of your consent pursuant to Article 6(1)(a) GDPR.
Data may also be processed in the United States. Mailchimp and the Intuit group use recognised transfer mechanisms for international data transfers, in particular the EU-U.S. Data Privacy Framework and, where required, Standard Contractual Clauses.
13. Google Tag Manager
We use Google Tag Manager, a service provided by Google Ireland Limited, to technically manage certain website tags and services.
Google Tag Manager may be used to control analytics, advertising and conversion services.
Services requiring consent may only be activated through Google Tag Manager after you have provided the corresponding consent via our consent management system.
Where information is stored on or accessed from your device or personal data is processed, this is based on your consent pursuant to Section 25(1) TDDDG and Article 6(1)(a) GDPR.
14. Google Analytics
After you have provided your consent, we use Google Analytics for statistical analysis and to improve our website.
The provider for users in the European Economic Area is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
This may involve processing information about pages viewed, interactions, referral sources, device and browser information, approximate location and technical identifiers.
Your IP address may also be processed as part of the technical provision of the service.
Google Analytics is activated only after you have given your consent.
The legal basis is Article 6(1)(a) GDPR and, for the storage of or access to information on your device, Section 25(1) TDDDG.
You may withdraw your consent at any time with effect for the future via the privacy settings on this website.
15. Google Ads and conversion tracking
After you have provided your consent, we may use Google Ads and the associated conversion tracking to measure the effectiveness of our advertising campaigns.
This may allow us to determine whether a user performed certain actions on our website after clicking an advertisement, such as making a booking or submitting an enquiry.
The provider is Google Ireland Limited.
Processing takes place only after your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.
16. Meta Pixel
After you have provided your consent, we may use the Meta Pixel to measure the effectiveness of advertisements on platforms such as Facebook and Instagram.
The provider for users in the European Economic Area is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland.
This may involve processing your IP address, browser and device information, pages viewed and interactions with our website.
If you are logged into Facebook or Instagram, Meta may be able to associate information with your user account.
Processing takes place only after your consent pursuant to Article 6(1)(a) GDPR and Section 25(1) TDDDG.
17. YouTube
Videos provided by YouTube may be embedded on our website.
The provider for users in the European Economic Area is Google Ireland Limited.
When an embedded YouTube video is loaded, your IP address, browser and device information and information about the page you visited may in particular be transmitted to Google or YouTube.
Where consent is required, YouTube videos are loaded only after you have provided your consent.
The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.
18. Google Maps
Google Maps may be embedded on individual pages, for example to display our locations.
The provider for users in the European Economic Area is Google Ireland Limited.
When a map is loaded, your IP address, browser and device information as well as location and usage information may in particular be transmitted to Google.
Where consent is required, Google Maps will only be loaded after you have provided your prior consent.
The legal basis is Article 6(1)(a) GDPR and Section 25(1) TDDDG.
19. Social media and external platforms
Our website contains links to external platforms such as Instagram, Facebook, TikTok, YouTube and other online services.
In the case of a simple external link, data is generally transmitted to the respective provider only when you open the link and leave our website.
Where third-party content is embedded directly into our website and consent is required, such content is loaded only after you have provided your consent.
The respective provider is generally responsible for subsequent data processing on the external platform.
20. Recipients of personal data
Personal data may be transmitted to service providers that support us with hosting, technical maintenance, payment processing, communication, newsletter distribution, analytics or other services required to operate our offering.
Where a service provider acts as a processor, processing is carried out on the basis of an appropriate agreement pursuant to Article 28 GDPR.
21. Transfers to third countries
Some of the service providers we use may process personal data outside the European Union or European Economic Area.
Such transfers take place only where the requirements of Articles 44 et seq. GDPR are met.
Relevant safeguards may include an adequacy decision by the European Commission, the EU-U.S. Data Privacy Framework or Standard Contractual Clauses approved by the European Commission.
22. Storage period
We store personal data only for as long as necessary for the respective processing purpose.
Where statutory retention, documentation or evidence obligations apply, the relevant data will be stored for the legally prescribed period.
After the purpose of processing ceases to apply and statutory retention periods have expired, the data will be deleted or anonymised.
23. Your rights
Subject to the statutory requirements, you have in particular the right to:
- obtain information about the personal data we process about you,
- have inaccurate data corrected,
- request deletion of your personal data,
- request restriction of processing,
- receive data portability where the statutory requirements are met,
- object to certain processing activities,
- withdraw consent at any time with effect for the future.
To exercise your rights, you may contact us at info@em-school.com.
24. Right to lodge a complaint
You have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
The supervisory authority responsible for our registered office in Berlin is:
Berlin Commissioner for Data Protection and Freedom of Information
Alt-Moabit 59–61
10555 Berlin
Germany
E-mail: mailbox@datenschutz-berlin.de
25. Automated decision-making
As a general rule, we do not carry out exclusively automated decision-making, including profiling, within the meaning of Article 22 GDPR.
26. Changes to this Privacy Policy
We reserve the right to amend this Privacy Policy if our website, the services used or applicable legal requirements change.
Last updated: September 2026