Rockhouse Salzburg Association
Schallmooser Hauptstraße 46
502 Salzburg, Austria
Phone: +43-()662-884914
Email: service@rockhouse.at
ZVR number: 462847203
The Rockhouse Salzburg Association (hereinafter “Rockhouse” or “we”) is the controller within the meaning of the General Data Protection Regulation (GDPR) for the processing of personal data on the website rockhouse.at and its subdomains.
Protecting your personal data is very important to us. We process your data solely on the basis of the applicable data protection provisions, in particular Regulation (EU) 2016/679 (GDPR) and the Austrian Data Protection Act (DSG).
We collect and process personal data only to the extent necessary to provide a functional website and our content and services, or if you have expressly consented.
Our website is operated on infrastructure from Amazon Web Services, Inc., 410 Terry Avenue North, Seattle, WA 98109, USA (AWS) and administered by Coder's Cantina e.U. (hereinafter the “technical operator”). The following AWS services are used:
Amazon CloudFront (Content Delivery Network)
Amazon S3 (file and media storage)
AWS Lambda (server-side processing)
Amazon CloudWatch Logs (logging, retention period: 180 days)
Processed data: Each time our website is accessed, technical access data (so-called server logs) is automatically collected:
IP address of the requesting device
Date and time of access
URL accessed and amount of data transferred
HTTP status code
Browser type and version as well as operating system
Referrer URL (referring page, if available)
Purpose: Ensuring operation, detecting and defending against attacks, technical administration.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure and stable operation of the website).
Retention period: 180 days in CloudWatch Logs, then automatic deletion.
Transfer to third countries: A data processing agreement pursuant to Art. 28 GDPR exists with Coder’s Cantina e.U. Coder’s Cantina e.U. is entitled to use Amazon Web Services as a sub-processor. Insofar as Amazon Web Services processes personal data in the course of hosting, this is done on the basis of the data protection agreements in place between Coder’s Cantina e.U. and Amazon Web Services.
Insofar as personal data is transferred to a third country, in particular the USA, in the course of using Amazon Web Services, this takes place on the basis of the applicable data protection safeguards pursuant to Art. 44 et seq. GDPR, in particular an adequacy decision or appropriate safeguards such as standard contractual clauses.
Our content is managed and delivered via the headless CMS and image service of b10cks.com, operated by Coder's Cantina e.U.. Technical connection data (IP address, timestamp) may be processed in the course of delivering content and images.
Purpose: Technical provision and delivery of website content.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the website).
A data processing agreement (DPA) pursuant to Art. 28 GDPR exists with Coder's Cantina e.U.
To analyse traffic and ensure sufficient server capacity, we use Umami Analytics operated by Coder's Cantina e.U.
Umami is a privacy-friendly analytics tool with the following features:
Cookie-free: No cookies are set.
No user profiles: No personal user profiles are created.
No sharing with third parties: All analytics data remains on our own infrastructure.
Only aggregated usage behaviour that cannot be traced back to individual persons is collected (e.g. page views, countries of origin, device types used).
As no personal data within the meaning of the GDPR is processed and no cookies are used, no consent is required for this service.
Purpose: Capacity planning and technical optimisation of the server infrastructure.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stable operation).
For the management of customer accounts (e.g. for ticket purchases and participation in competitions), we use the authentication service Clerk, Inc., 2 S Market St, Suite 700, San Jose, CA 95113, USA.
When registering and logging in, Clerk processes the following data:
Email address and (hashed) password for email registration
For Google login: name, email address and Google profile picture (according to the permissions you have granted to Google)
IP address, device information, session token
Timestamps of login and security events (audit log)
Provision of secure user accounts, authentication for protected areas (ticket purchase, competitions), protection against unauthorised access.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract or steps prior to entering into a contract); for Google login additionally Art. 6(1)(a) GDPR (consent through active selection of this login method).
Retention period: Account data is stored as long as the account is active. After deletion of the account, the data is deleted within 30 days, unless statutory retention obligations prevent this.
If you register or log in via “Sign in with Google”, you will be redirected to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google then transmits your Google profile (name, email address, profile picture) to Clerk. Only the data required for registration is transferred; Rockhouse does not gain access to any further Google account data. For processing by Google, the following applies: https://policies.google.com/privacy
Clerk is a US company. Data is transferred to the USA on the basis of standard contractual clauses (Art. 46(2)(c) GDPR). A data processing agreement (DPA) pursuant to Art. 28 GDPR exists with Clerk. Further information: https://clerk.com/privacy
Several contact forms are available on our website (e.g. general enquiries, band enquiries, cooperation enquiries). The data you enter (e.g. name, email address, message) is forwarded exclusively to Rockhouse by email.
Your form data is not automatically stored in a database.
We process your data solely to handle your request and do not contact you for any other purpose unless you have expressly consented.
Legal basis: Art. 6(1)(b) GDPR (initiation of a contract or pre-contractual measures) as well as Art. 6(1)(f) GDPR (legitimate interest in handling enquiries).
Retention period: Email correspondence is stored in accordance with the statutory retention periods (usually 7 years for business-relevant communication).
For the sale of tickets we use the ticketing platform vivenu GmbH, Königsallee 92a, 40212 Düsseldorf, Germany (SaaS service).
As part of a ticket order, vivenu processes the following data:
First and last name
Email address
Billing address (depending on the order)
Payment data (see section 7)
IP address, timestamp
Purpose: Processing ticket purchases, contract fulfilment, invoicing.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
Retention period: In accordance with statutory retention periods (7 years for accounting records).
Further information: https://vivenu.com/privacy
Payment processing as part of ticketing is handled via vivenu and carried out by the following payment service providers:
Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland
Stripe processes payment data (credit card, SEPA direct debit, etc.) to process the transaction. Processing is carried out in accordance with PCI-DSS standards.
Further information:https://stripe.com/de/privacy
Klarna Bank AB, Sveavägen 46, 111 34 Stockholm, Sweden
Klarna offers buy-now-pay-later options and carries out a credit check for this purpose. Klarna processes personal and transaction-related data independently as a separate controller.
Further information:https://www.klarna.com/de/datenschutz/
Legal basis (both services): Art. 6(1)(b) GDPR (performance of a contract).
For sending our newsletter, we use Brevo SAS (formerly Sendinblue), 7 rue de Madrid, 75008 Paris, France.
Newsletter sign-up takes place via the double opt-in process: After entering your email address, you will receive a confirmation email. The newsletter is only activated after you confirm the link it contains. This serves as proof of your consent.
Required information: Email address. Additional information (e.g. first name) is voluntary and used for personal addressing.
The following statistical data may be collected as part of sending the newsletter:
Open rate (whether and when a newsletter was opened)
Click rate (which links were clicked)
This data is used to optimise our newsletter communication.
You can withdraw your consent and unsubscribe from the newsletter at any time — either via the unsubscribe link at the end of each newsletter or by email to service@rockhouse.at.
Legal basis: Art. 6(1)(a) GDPR (consent).
Retention period: Your data will be stored until you unsubscribe and then deleted, unless statutory retention obligations prevent this.
Transfer to third countries:Brevo is a European company; processing takes place predominantly within the EU/EEA. Further information: https://www.brevo.com/de/datenschutzrichtlinien/
A data processing agreement (DPA) pursuant to Art. 28 GDPR exists with Brevo.
Videos are embedded on our website viaYouTube(Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We use only the enhanced privacy mode (cookie-less embed, youtube-nocookie.com). In this mode, no cookies are set and no personal data is transmitted to Google as long as you do not actively start the video.
Only when a video is actively played is data (including the IP address) transmitted to YouTube servers. In this case, Google’s privacy policy applies:https://policies.google.com/privacy
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing multimedia content).
Spotify widgets (iFrames) may be embedded on individual pages, loading content from Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden .
Please note: When a page with a Spotify widget is loaded, a connection to Spotify’s servers is automatically established. Your IP address and device information may be transmitted to Spotify, regardless of whether you actively play music. Spotify may use this data for recognition if you are logged in to Spotify.
If you want to avoid this, we recommend logging out of your Spotify account before visiting our website or blocking third-party content in your browser.
Further information:https://www.spotify.com/de/legal/privacy-policy/
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing music content).
The footer and text posts contain links to our profiles on the following platforms:
Platform | Operator | Privacy policy |
|---|---|---|
Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland | ||
Meta Platforms Ireland Ltd. | ||
YouTube | Google Ireland Ltd., Dublin | |
Spotify | Spotify AB, Stockholm |
These links are simple external hyperlinks. Clicking them will take you directly to the respective external platform. Rockhouse has no influence over the data processing of these platforms and accepts no liability for it. The respective platform operator is responsible for the processing of personal data taking place there.
To administer competitions, we process the following data of participants:
Name, email address
Place of residence (for postal prizes: full postal address)
Competition entry (e.g. answer, rhyme)
The data is used exclusively for administering the competition, notifying the winners, and complying with tax retention obligations.
Retention period: Data of participants who do not win will be deleted after the competition has ended, unless statutory retention obligations apply. Data of winners will be stored for as long as necessary to process the prize and to comply with statutory documentation and retention obligations.
Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 6(1)(b) GDPR (performance of a contract).
Competitions conducted via Facebook or Instagram are not connected to these platforms and are neither sponsored nor supported by them. The organiser is exclusively the Rockhouse Salzburg Association.
Our website uses cookies only to the extent strictly necessary for technical operation (e.g. session cookies for the ticket purchase process via vivenu and authentication cookies for logged-in customer accounts via Clerk). The web analytics tool we use (Umami) is completely cookie-free.
You can disable cookie storage in your browser or delete cookies already stored. Please note that this may limit certain functions (in particular the ticket purchase process).
Under the GDPR, you have the following rights:
Right of access (Art. 15 GDPR): You may request information about the data stored about you.
Right to rectification (Art. 16 GDPR): You may request correction of inaccurate data.
Right to erasure (Art. 17 GDPR): Under certain conditions, you may request deletion of your data.
Right to restriction of processing (Art. 18 GDPR): You may request restriction of processing.
Right to data portability (Art. 20 GDPR): You may receive your data in a structured, commonly used format.
Right to object (Art. 21 GDPR): You may object at any time to the processing of your data based on legitimate interest (Art. 6(1)(f) GDPR).
Right to withdraw consent (Art. 7(3) GDPR): Any consent given may be withdrawn at any time with effect for the future.
To assert your rights, please contact us by email at:service@rockhouse.at
If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the competent supervisory authority.
Competent supervisory authority in Austria:
Austrian Data Protection Authority
Barichgasse 40–42
103 Vienna
Phone: +43 1 52 152-
Email:dsb@dsb.gv.at
Website:https://www.dsb.gv.at
We use technical and organisational security measures to protect your data against loss, manipulation and unauthorised access. Our security measures are continuously adapted in line with technological developments. Data transmission between your browser and our website is encrypted (TLS/HTTPS).
This privacy policy is current as ofJune 2026and reflects Austrian and European data protection law applicable at the time of publication.
We reserve the right to amend this privacy policy in the event of changes in the legal situation or changes to our data processing procedures. The current version is available on our website at https://www.rockhouse.at/de/datenschutz.