Last updated: October 2026
1. Controller
Frank Hahn, Kreuzberg Audio
Straßmannstraße 18
10249 Berlin
Germany
Email: [email protected]
Phone: +49 171 2069066
No data protection officer has been appointed, as there is no legal obligation to do so.
2. Overview
This policy describes which personal data is processed when you visit kreuzberg-audio.com, buy or download a plugin, activate a license or contact us, for what purpose and for how long.
3. Legal bases
- Consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), for example for statistics, marketing and loading YouTube videos
- Contract and pre-contractual measures (Art. 6(1)(b) GDPR), for example purchases, demo downloads, licenses and support
- Legal obligation (Art. 6(1)(c) GDPR), for example retaining invoices for tax purposes
- Legitimate interest (Art. 6(1)(f) GDPR), for example server security, abuse prevention and advertising our own similar products to customers
4. Hosting and delivery
Hetzner
The website, shop, databases and license server run on our own server at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the data center in Nuremberg. We have a data processing agreement with Hetzner under Art. 28 GDPR.
Whenever a page is requested, the server processes access data: IP address, date and time, requested address, status code, amount of data transferred, referrer and browser identifier. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Access logs are deleted after 14 days.
Cloudflare
All requests pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare protects the site against attacks and delivers files faster. In doing so, Cloudflare processes the same access data as the server, including the IP address. The legal basis is our legitimate interest in a secure and fast website (Art. 6(1)(f) GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; in addition, the EU Standard Contractual Clauses from Cloudflare’s Data Processing Addendum apply.
On the “Forgot password” form we use Cloudflare Turnstile to block automated requests. Turnstile checks browser and device characteristics for this, without setting advertising cookies.
Cloudflare privacy policy: https://www.cloudflare.com/privacypolicy/
5. Fonts
The fonts Switzer and Outfit are hosted on our own server. No connection to Google Fonts or any other font provider is made when you load a page.
6. Cookies and consent
Consent management
To ask for and store your consent we use Real Cookie Banner, a plugin that runs on our server. We store your choice, a random identifier, date and time, and a checksum (hash) of your IP address as proof of consent (Art. 7(1) GDPR). We do not store the IP address itself. Your browser remembers your choice in a cookie for 365 days, after which we ask again. We keep the proof of consent for 36 months.
Without consent, the website loads no statistics, no marketing and no YouTube videos.
You can change or withdraw your choice at any time using the Cookie settings link at the bottom of every page.
Technically necessary cookies
For the cart, login, language selection and storing your cookie choice, we set cookies without which the shop does not work. The legal basis is Section 25(2) no. 2 TDDDG and Art. 6(1)(b) and (f) GDPR.
7. Statistics: Google Analytics
Only with your consent do we use Google Analytics 4 from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. It is only loaded by our cookie banner after you have given consent. Google Analytics sets cookies (_ga, _ga_*) and records page views, time on page, device, browser and approximate location. IP addresses are shortened within the EU before they are stored. The data is deleted 14 months after your last visit.
With the same consent we store in two cookies of our own (ka_quelle and ka_quelle_erst, 30 days each) which campaign or website brought you to us, and save this with any order you place, to measure how well our advertising works.
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Google LLC is certified under the EU-US Data Privacy Framework.
Google privacy policy: https://policies.google.com/privacy
8. Marketing: Meta Pixel
Only with your consent do we include the Meta Pixel from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. It reports to Meta that someone viewed a page, downloaded a demo or completed a purchase, with product, amount and currency. We do not send your name, email address or any other customer data to Meta. Meta can link the report to a logged-in Facebook or Instagram account. For this, we and Meta are joint controllers (Art. 26 GDPR).
The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework.
Meta privacy policy: https://www.facebook.com/privacy/policy/
9. YouTube videos
Videos on the product pages are first shown as a placeholder. Only when you click Load video does your browser load the video from youtube-nocookie.com, a service of Google Ireland Limited. From that click on, Google receives your IP address and browser data and may set cookies. The legal basis is your consent given by the click (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
10. Shop, demo downloads and invoices
For purchases and free demo downloads we use Easy Digital Downloads on our server. We process your name, email address, for purchases your billing address, your orders and the IP address when ordering and with every download. The legal basis is the contract (Art. 6(1)(b) GDPR).
For every purchase we create a PDF invoice and send it by email. We keep invoices and order data for ten years (Section 147 AO, Section 257 HGB, Art. 6(1)(c) GDPR).
We delete the IP address in orders and in the download log after twelve months.
11. Payment
Stripe
Card payments, Apple Pay and Google Pay are processed by Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. The card input fields come directly from Stripe; card data never reaches our server. Stripe receives your name, email address, amount, IP address and device data for fraud detection. The legal basis is the contract (Art. 6(1)(b) GDPR). Stripe, Inc. is certified under the EU-US Data Privacy Framework.
Stripe privacy policy: https://stripe.com/privacy
PayPal
If you pay with PayPal, you are redirected to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. PayPal receives your name, email address, amount and order number. The legal basis is the contract (Art. 6(1)(b) GDPR).
PayPal privacy policy: https://www.paypal.com/legalhub/privacy-full
12. License activation
Our plugins check the serial number on activation and occasionally afterwards via our own license server on the same Hetzner server. They transmit the serial number, a device identifier derived from the hardware, the plugin version and the operating system. The server logs the IP address and the browser or program identifier. The legal basis is the contract (Art. 6(1)(b) GDPR), since a license is valid for a limited number of computers.
We store the serial number and device identifiers for as long as the license exists. In the activation logs we delete the IP address and program identifier after twelve months.
13. Emails
Sending
We send order confirmations, serial numbers, invoices and newsletters via SendGrid, a service of Twilio Inc., 101 Spear Street, San Francisco, CA 94105, USA. SendGrid receives the recipient address and the content of the email and reports delivery, bounces and unsubscribes to us. SendGrid does not count opens or clicks; the links in our emails lead directly to us. We have a data processing agreement with Twilio including the EU Standard Contractual Clauses, and Twilio is certified under the EU-US Data Privacy Framework.
We keep delivery errors reported by SendGrid for 90 days to identify invalid addresses.
Newsletter
We manage newsletters with FluentCRM on our own server. For the newsletter we need your consent, which you give via a confirmation email (double opt-in). We store your email address, name, the time of signup and confirmation, and the IP address at that time. FluentCRM records on our server whether a newsletter was opened and which link in it was clicked, using a small image and links that briefly pass through kreuzberg-audio.com. This shows us which topics are of interest.
Advertising to customers
If you have bought a plugin from us, we send information about our own similar plugins to the email address you provided (Section 7(3) UWG, Art. 6(1)(f) GDPR). You can object to this at any time, using the unsubscribe link in every email or by writing to [email protected], without incurring any costs other than transmission costs at basic rates.
Your address stays on the mailing list until you unsubscribe. After you unsubscribe we keep the address on a block list so that we no longer send you anything.
14. Support and contact
We handle requests by email, contact form or support portal with Fluent Support and Fluent Forms on our own server. We store your name, email address and your message including attachments. The legal basis is the contract or our legitimate interest in answering you (Art. 6(1)(b) and (f) GDPR). We delete requests including attachments three years after the last contact.
15. Our own analysis of the order process
To find errors in the order process, we log on our server which steps in the shop are requested. We store the IP address and session only as a checksum (hash), not in plain text. The entries are deleted after 90 days. The legal basis is our legitimate interest in a working shop (Art. 6(1)(f) GDPR).
16. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).
Right to object (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. You can object to advertising to customers at any time without giving reasons.
For any request, send an email to [email protected].
17. Right to lodge a complaint
You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit), Alt-Moabit 59-61, 10555 Berlin, Germany, https://www.datenschutz-berlin.de
18. Retention periods at a glance
| Data |
Period |
| Invoices and order data |
10 years |
| IP address in orders and download log |
12 months |
| License and device identifiers |
as long as the license exists |
| IP address in activation log |
12 months |
| Server access logs |
14 days |
| Delivery errors from SendGrid |
90 days |
| Order process analysis |
90 days |
| Support requests |
3 years after last contact |
| Cookie banner proof of consent |
36 months |
| Newsletter and advertising to customers |
until you unsubscribe |
| Google Analytics |
14 months after the last visit |
19. Security
All connections are encrypted with TLS. Backups are encrypted, stored on storage provided by Hetzner Online GmbH in Germany and deleted after 30 days.
20. Changes
We update this policy when services or the legal situation change. The version on this page applies.
Last updated: October 2026