Privacy Policy
Last updated: August 2026. This privacy policy applies to https://www.danovmusic.com as well as to all booking, brief and chat features of Danov Music Studio.
1. Controller
The controller in the meaning of the GDPR and other national data protection laws is:
Mykyta Bogdanov
Danov Music Studio
Bonifaziusstraße 16-18
13509 Berlin, Germany
Phone: +49 175 4137518
E-Mail: [email protected]
2. General information
We treat personal data confidentially and in accordance with the statutory data protection regulations (GDPR, German Federal Data Protection Act, German Telecommunications-Telemedia Data Protection Act) and this privacy policy. Personal data is any data that can be used to identify you personally (e.g. name, address, e-mail address, phone number, IP address).
Data transmission over the Internet may have security gaps. Complete protection against access by third parties is not possible. Our website therefore uses TLS encryption (HTTPS) throughout.
3. Data collection when visiting our website
3.1 Server log files
When you visit our website, our web server (Nginx, hosted on a VPS in the EU) automatically collects the following information that your browser transmits:
- IP address of the requesting device
- Date and time of the request
- Requested URL and HTTP status code
- Amount of data transferred
- Referrer URL and user agent (browser, operating system)
- Language preference
Legal basis: Art. 6 (1) (f) GDPR. Legitimate interest: ensuring stable operation, error analysis, defence against abuse (brute force, scraping, DDoS).
Storage duration: up to 14 days in the access logs, then automatic rotation and deletion. Individual entries may be retained longer in case of security-relevant incidents.
3.2 Cookies and similar technologies
We only use technically necessary cookies (CSRF token, session, language selection, cookie banner status). A detailed description of the cookies used, their purpose and storage duration can be found in our Cookie Policy.
Legal basis: § 25 (2) No. 2 TDDDG (strictly necessary) or Art. 6 (1) (f) GDPR.
4. Booking and brief form
4.1 Purpose of processing
When you submit a request via the booking form or the project brief, we process the data you provide (artist name, full name, e-mail, phone, preferred date, service type, project description) to handle your request, prepare an offer and, if applicable, conclude and perform a contract with you.
4.2 Legal basis
Art. 6 (1) (b) GDPR (pre-contractual measures / contract performance) and Art. 6 (1) (a) GDPR (consent given via the consent boxes you have selected).
4.3 Spam and abuse prevention
To prevent automated requests, we log the sender's IP address, check the request against a rate limit (max. 3 bookings per IP/hour) and detect duplicate submissions within a short time window. Suspicious attempts are stored in an internal spam log.
Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in abuse-free operation).
Storage duration: Spam log entries and the associated IP data are deleted as soon as they are no longer required for abuse prevention, at the latest after 6 months.
4.4 Storage duration
Booking and brief data is deleted as soon as the purpose of processing no longer applies — generally 12 months after the project has been completed or finally cancelled. If a contract is concluded, the statutory commercial and tax retention periods apply (generally 10 years, § 257 HGB, § 147 AO).
5. Cloudflare (CDN, reverse proxy and Turnstile)
Our website is delivered through the content delivery network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, acting as a reverse proxy. Technically this means that every request to www.danovmusic.com first passes through Cloudflare's servers before it reaches our web server. In doing so, Cloudflare processes your device's IP address, the date and time of the request, the requested URL, the user agent and technical connection data, and sets the cookies __cf_bm (bot management) and cf_clearance.
Two further functions run through the same service: Cloudflare Turnstile — a CAPTCHA alternative loaded on our forms and when the chat widget is opened, which checks whether a request comes from a real browser without showing an image puzzle — and email address obfuscation, which protects our contact addresses from automated harvesting by spam bots.
Legal basis: Art. 6 (1) (f) GDPR. Legitimate interest: secure, performant and abuse-free provision of the website (defence against DDoS attacks, bots and spam). For access to information on your device: § 25 (2) No. 2 TDDDG (strictly necessary).
Third-country transfer: Cloudflare is certified under the EU-US Data Privacy Framework. A data processing agreement pursuant to Art. 28 GDPR is in place with Cloudflare.
Further information: cloudflare.com/privacypolicy
6. Google Maps
We embed a map from the Google Maps service in the footer of our pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
The map is not loaded automatically. Initially you only see a preview with a corresponding notice; the map is loaded only once you click it and thereby give your explicit consent (two-click solution). No data is transmitted to Google before that click.
After your consent, Google processes your IP address, information about your browser and device and the page you accessed, and may set cookies or access information on your device. If you are simultaneously logged into a Google account, Google can associate the usage with your account.
Legal basis: Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (consent given by clicking the map preview). You can withdraw your consent at any time with effect for the future by reloading the page without clicking the map.
Third-country transfer: A transfer to the USA may take place. Google is certified under the EU-US Data Privacy Framework.
Further information: policies.google.com/privacy
7. AI chat "ADanov Manager"
Our chat assistant uses the API of OpenAI, L.L.C., 3180 18th Street, San Francisco, CA 94110, USA. When you actively use the chat, the content of your messages is transmitted to the OpenAI API to generate a response.
Conversation history is stored exclusively locally in your browser (IndexedDB). Our server keeps no personally identifiable chat logs.
Legal basis: Art. 6 (1) (a) GDPR (consent given by actively using the chat) or Art. 6 (1) (b) GDPR for pre-contractual enquiries.
Third-country transfer: Transfer to the USA. OpenAI is certified under the EU-US Data Privacy Framework. We recommend not entering particularly sensitive personal data (e.g. health data, financial data) into the chat.
Further information: openai.com/policies/eu-privacy-policy
8. Hosting and media files
The website is hosted on a VPS with a provider whose data centre is located in the EU. Media files (images, audio, video) are delivered via Cloudflare R2 (S3-compatible object storage). Provider: Cloudflare, Inc. Region: EU.
We have concluded data processing agreements with both providers in accordance with Art. 28 GDPR.
9. E-mail delivery
Confirmation and notification e-mails are sent via an SMTP provider based in the EU. E-mail addresses are used exclusively to respond to the respective enquiry.
10. Recipients of the data
Your data will only be passed on to third parties if this is necessary to perform the contract, if there is a legal obligation, or if you have expressly consented. Recipients are exclusively the data processors named in sections 5–9, and law-enforcement authorities upon request.
11. Your rights as a data subject
You have the following rights with regard to the personal data concerning you:
a) Right of access (Art. 15 GDPR)
You can request information about whether and which data we process about you.
b) Right to rectification (Art. 16 GDPR)
You have the right to have inaccurate data corrected or incomplete data completed.
c) Right to erasure (Art. 17 GDPR)
You can request the deletion of your data, provided no statutory retention obligations conflict with this.
d) Right to restriction of processing (Art. 18 GDPR)
You can request that the processing of your data be restricted.
e) Right to data portability (Art. 20 GDPR)
You have the right to receive your data in a structured, commonly used, machine-readable format.
f) Right to object (Art. 21 GDPR)
You can object at any time, on grounds relating to your particular situation, to processing based on Art. 6 (1) (e) or (f) GDPR. In the case of direct marketing, the objection is possible at any time without giving reasons.
g) Right to withdraw consent (Art. 7 (3) GDPR)
You can withdraw your consent at any time with effect for the future. The lawfulness of processing carried out up to the withdrawal remains unaffected.
h) Right to lodge a complaint (Art. 77 GDPR)
Without prejudice to any other remedy, you have the right to lodge a complaint with a supervisory authority. The competent authority for us is:
Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59-61, 10555 Berlin, Germany
E-Mail: [email protected]
i) No automated decision-making (Art. 22 GDPR)
No automated decision-making in individual cases, including profiling, takes place. We review every enquiry from the booking and brief form personally. The automated spam checks (rate limit, Turnstile) serve solely to fend off abusive requests and have no legal effect on you.
An informal message to the contact details given in section 1 is sufficient to exercise your rights.
12. Updates and changes
We reserve the right to update this privacy policy so that it always complies with current legal requirements or to reflect changes to our services. The version available at the time of your visit applies.
