Last updated: 13 September 2026

​

This Privacy Policy explains how personal data is processed in connection with the website https://www.hubhildenbrand.com/ and the services offered through it. It is intended in particular to provide the information required by the EU General Data Protection Regulation (GDPR) and applicable German data protection law. In this Privacy Policy, "we", "us" and "our" refer to Hub Hildenbrand.

​

1. Controller

The controller within the meaning of Article 4(7) GDPR is:

Hub Hildenbrand

Ebertystraße 44

10249 Berlin

Germany

Phone: +49 1590 133 68 65

Email: hub@hubhildenbrand.de

Website: https://www.hubhildenbrand.com/

​

2. General information on data processing

Personal data means any information relating to an identified or identifiable natural person. We process personal data only insofar as this is necessary to operate this website, communicate with you, send our newsletter, process orders and payments, provide requested services, protect the security of our systems, or comply with legal obligations.

Depending on the processing activity, we rely in particular on the following legal bases:

• Article 6(1)(a) GDPR - your consent, in particular for non-essential analytics, certain third-party content, the newsletter and, where separately consented to, individualized newsletter tracking;

• Article 6(1)(b) GDPR - steps taken at your request before entering into a contract and the performance of a contract, in particular for enquiries, orders, payment and delivery;

• Article 6(1)(c) GDPR - compliance with legal obligations, in particular statutory documentation, accounting, tax and data-protection accountability obligations;

• Article 6(1)(f) GDPR - our legitimate interests, in particular the secure, stable and efficient operation of the website and the proper handling of general business enquiries, provided that your interests or fundamental rights and freedoms do not override those interests.

Where information is stored on or accessed from your terminal device, Section 25 of the German Telecommunications Digital Services Data Protection Act (Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, TDDDG) also applies. Non-essential storage or access takes place only with your consent pursuant to Section 25(1) TDDDG. Consent is not required for storage or access that is strictly necessary to provide a digital service expressly requested by you, in accordance with Section 25(2) TDDDG.

​

3. Website provision and hosting by Wix

This website is created, operated and hosted using Wix. The service provider is Wix.com Ltd., Israel. For GDPR-related matters, Wix identifies Wix Online Platforms Limited, 1 Grant's Row, Dublin 2, D02 HX96, Ireland, as its EU representative.

When you access our website, Wix processes technical data needed to deliver and secure the website. This may include in particular:

• IP address and connection data;

• date and time of access;

• pages and files requested;

• referrer URL;

• browser type and version and operating system;

• device and technical usage information;

• security, diagnostic and error logs.

Wix also processes, on our behalf, personal data that visitors provide through Wix functions, for example newsletter subscription data, order data and customer data. Wix states that, in relation to such personal data of a Wix user's website visitors and customers ("Users-of-Users"), it generally acts as a processor on behalf of and under the instructions of the Wix user. The Wix Data Processing Agreement applies to processing carried out on our behalf in accordance with Article 28 GDPR.

The processing of connection and security data required to provide the website is based on Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable and technically reliable operation of the website. Data relating to orders or pre-contractual enquiries is additionally processed on the basis of Article 6(1)(b) GDPR.

Wix is an international provider. Personal data may be processed in Israel, the European Union, the United States and other countries. The European Commission has issued an adequacy decision for Israel. For transfers to other third countries, Wix states that it uses legally recognized transfer mechanisms, such as adequacy decisions, the EU-U.S. Data Privacy Framework where applicable, and Standard Contractual Clauses where required.

Further information: https://www.wix.com/about/privacy

​

4. SSL/TLS encryption

Our website is provided over an encrypted HTTPS connection. This protects data transmitted between your browser and our website against unauthorized reading in transit. You can generally identify an encrypted connection by "https://" in your browser's address bar.

​

5. Cookies, local storage and consent management with Usercentrics for Wix

Our website uses cookies and comparable technologies, including local storage. Some technologies are technically necessary for the website, shop, security functions or your privacy settings to work. Other technologies, in particular analytics technologies and certain external media, are used only after you have given the required consent.

We use Usercentrics for Wix to manage your privacy choices. The relevant provider is Usercentrics GmbH, Sendlinger Straße 7, 80331 Munich, Germany. In connection with consent management, Usercentrics may process information such as the date and time of your visit and your consent or refusal, as well as device information. Your choice is stored so that it can be respected on subsequent page views and so that we can demonstrate whether consent was given or refused.

The processing of consent records serves our accountability and documentation obligations, in particular under Article 7(1) GDPR, and is based on Article 6(1)(c) GDPR. To the extent that storing your consent choice requires storage on or access to your terminal device, this is strictly necessary to provide the consent-management function you requested and is therefore covered by Section 25(2) TDDDG.

According to the information Usercentrics recommends for privacy notices, consent data is generally stored for one year and stored within the European Union. Usercentrics acts as a processor for the relevant consent-management processing.

You may change or withdraw a consent at any time with effect for the future by reopening the Privacy Settings / Cookie Settings available on our website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Further information: https://usercentrics.com/privacy-policy/

​

6. Website analytics with Wix Analytics

Wix provides analytics functions that allow us to evaluate the use and reach of our website. Depending on the function, data such as page views, interactions, technical device and browser information, timestamps and approximate geographic information may be processed.

Where Wix Analytics uses non-essential cookies, local storage or comparable identifiers for traffic or behavior analytics, we use those functions only after your consent. The legal bases are Article 6(1)(a) GDPR and, where information is stored on or accessed from your terminal device, Section 25(1) TDDDG.

Certain Wix shop, sales or customer reports may also be generated from order, transaction or customer data that is processed independently of analytics consent because it is required to perform a contract, administer the shop, comply with legal obligations or maintain our business records. Such processing is governed by the respective legal basis described elsewhere in this Privacy Policy and is not made dependent on analytics consent.

You can withdraw your analytics consent at any time through our Privacy Settings / Cookie Settings.

Further information: https://www.wix.com/about/privacy

​

7. Google Analytics 4 and Google tag

We use Google Analytics 4 (GA4) to measure reach and statistically analyze the use of our website. The technical integration is made through the Google tag. For users in the European Economic Area, the relevant Google entity is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google LLC and other Google group companies may also be involved in providing the service.

Google Analytics may process in particular:

• page views and navigation paths;

• interactions with the website;

• date, time and session information;

• browser, device and operating-system information;

• approximate location information;

• online identifiers and, depending on your consent and configuration, cookies or comparable identifiers.

According to Google, Google Analytics does not log or store individual IP addresses of users in the EU, Switzerland or the United Kingdom. IP addresses are used for the technical derivation of coarse location information and are then immediately discarded.

Google Analytics is used on our website only after your prior consent. The legal bases are Article 6(1)(a) GDPR and Section 25(1) TDDDG where information is stored on or accessed from your terminal device.

The retention of user-level and event-level data depends on the retention setting configured for our GA4 property. For standard GA4 properties, Google currently provides retention settings of two or fourteen months for the relevant user-level data; standard aggregated reports may be unaffected by this setting.

Google may also process data in third countries, including the United States. Where applicable, transfers are based on an adequacy decision, in particular the EU-U.S. Data Privacy Framework for certified recipients, or on appropriate safeguards such as Standard Contractual Clauses.

You can withdraw your consent at any time through our Privacy Settings / Cookie Settings.

Further information:

https://policies.google.com/privacy

https://support.google.com/analytics/answer/12017362

​

8. Embedded YouTube videos

Our website, in particular the "Video" section, contains embedded content from YouTube. For users in the European Economic Area, the relevant Google entity is generally Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. YouTube is a service of the Google group.

When an embedded YouTube video or related external content is loaded or activated, data may be transmitted to Google/YouTube, including your IP address, browser and device information, the page you visited, the time of access and information about your interaction with the video. If you are signed in to a Google account, Google may be able to associate the interaction with your account.

Non-essential YouTube content is intended to be controlled through our consent management. Where the content is blocked before consent, a connection to YouTube is established only after you have given the relevant consent or actively enabled the content. The legal bases for loading non-essential embedded YouTube content are Article 6(1)(a) GDPR and, where information is stored on or accessed from your terminal device, Section 25(1) TDDDG.

Google may process data in the United States and other third countries. The safeguards described in the section "International data transfers" apply accordingly.

Further information: https://policies.google.com/privacy

​

9. Newsletter subscription and double opt-in

You can subscribe to the Hub Hildenbrand newsletter through forms on our website. Depending on the form, we process your email address and, where provided, your first name and/or last name.

The newsletter contains information about our artistic work, concerts, releases, projects and related news. We send the newsletter on the basis of your consent pursuant to Article 6(1)(a) GDPR.

We use a double opt-in procedure. After you submit the subscription form, a confirmation email is sent to the address provided. The subscription is activated only after the confirmation link has been used. In connection with the double opt-in procedure, technical proof data such as the date and time of registration and confirmation and, where recorded by the systems involved, the IP address may be stored. This serves to document consent and prevent misuse. To the extent necessary to demonstrate consent, the legal basis is Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR; security and abuse-prevention processing may additionally be based on Article 6(1)(f) GDPR.

You may withdraw your consent and unsubscribe at any time with effect for the future, in particular by using the unsubscribe link contained in each newsletter or by emailing hub@hubhildenbrand.de. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

After you unsubscribe, your data is no longer used for newsletter marketing. We may retain limited suppression and proof data where necessary to ensure that no further newsletter is sent against your wishes, to demonstrate previous consent, or to establish, exercise or defend legal claims.

​

10. Newsletter and CRM service Brevo

For newsletter creation and delivery and for managing newsletter contacts, we use Brevo. Depending on the contractual entity assigned to our account, the service may be provided by a German Brevo group entity such as Brevo GmbH or Sendinblue GmbH, Berlin, Germany, or another Brevo group entity identified in our contractual documents.

For confirmed newsletter subscribers, we transfer the data required for newsletter management to Brevo, in particular your email address and, where provided, your name, together with subscription, consent and communication data. Brevo processes this data on our behalf for newsletter and CRM purposes to the extent governed by our instructions. Brevo provides a Data Processing Agreement for such processing.

According to Brevo, the hosting servers on which its databases are processed and stored are located within the European Union, in particular with infrastructure in France, Germany and Belgium. Brevo may nevertheless use group companies and sub-processors for support and service provision. Where a transfer to a third country occurs, the requirements described in the section "International data transfers" apply.

The legal basis for sending the newsletter remains your consent under Article 6(1)(a) GDPR. The use of Brevo as a processor does not replace or broaden the purpose for which you gave consent.

Further information:

https://www.brevo.com/legal/privacypolicy/

https://help.brevo.com/hc/en-us/articles/360001005510-Data-storage-location

​

11. Individualized newsletter open and click tracking

Brevo can technically measure whether a newsletter has been opened and whether links in a newsletter have been clicked. This may involve tracking pixels and individualized links and may allow those interactions to be associated with a particular newsletter contact.

We use individual-level open and click tracking only where you have given a separate consent for this purpose. Consent to individualized tracking is not a condition for receiving the newsletter.

Where you have consented, the following data may in particular be processed:

• whether and when a newsletter was opened;

• whether and when a link was clicked;

• technical information generated in connection with the interaction;

• association of these interactions with your newsletter contact record.

The purpose is to evaluate and improve our newsletters and, where covered by your consent, to adapt content to recipients' interests. The legal basis is your separate consent under Article 6(1)(a) GDPR and, to the extent that tracking involves storage of or access to information on your terminal device, Section 25(1) TDDDG.

You can withdraw this tracking consent at any time with effect for the future without unsubscribing from the newsletter itself. Where available, you can use Brevo's per-contact pixel-tracking consent management or contact us at hub@hubhildenbrand.de. Contacts for whom the required tracking consent has not been obtained should not be subjected to individualized open and click tracking.

​

12. Contact by email and telephone

If you contact us by email or telephone, we process the data you provide, in particular your name, contact details, the content of your message and any other information you voluntarily provide.

If your contact concerns entering into or performing a contract, the legal basis is Article 6(1)(b) GDPR. In other cases, the processing is based on Article 6(1)(f) GDPR. Our legitimate interest is the proper handling of enquiries and communication with interested persons, event organizers, media representatives, business partners and other contacts.

The data is generally deleted once the relevant enquiry has been conclusively dealt with, unless statutory retention obligations or other lawful reasons require or justify longer retention.

​

13. Business email communication via Microsoft 365 / Exchange Online

We use Microsoft 365 / Exchange Online for business email communication. For customers in the European region, services are generally provided through Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland; other Microsoft group companies may be involved in service delivery.

If you send us an email, Microsoft systems may process in particular the sender and recipient addresses, subject line, message content, attachments, timestamps and technical transport and security information.

The legal basis depends on the purpose of the communication: Article 6(1)(b) GDPR for contractual or pre-contractual communications and Article 6(1)(f) GDPR for other business communications. Microsoft provides a Data Protection Addendum for its online services.

Microsoft operates an EU Data Boundary for many Microsoft cloud services, including Microsoft 365, under which customer data and personal data for in-scope services are generally stored and processed within the EU/EFTA. Microsoft states that limited transfers or processing outside that region may still occur in specific circumstances, for example for certain service operations, security or pseudonymized operational data. Where personal data is transferred to a third country, the applicable transfer safeguards are used.

Further information:

https://privacy.microsoft.com/

https://www.microsoft.com/en/trust-center/privacy/european-data-boundary-eudb

​

14. Orders in our online store

You can order physical recordings and other offered items through our Wix store. Depending on the information you provide, we process in particular:

• first and last name;

• billing and delivery address;

• email address and, where provided or required, telephone number;

• ordered items, quantities and prices;

• order, delivery and payment status;

• transaction and payment references;

• correspondence relating to the order.

Processing is necessary to initiate and perform the purchase contract, including order confirmation, payment, shipping, customer communication and, where applicable, returns or refunds. The legal basis is Article 6(1)(b) GDPR. Where we are legally required to retain order, invoice or accounting data, processing is based on Article 6(1)(c) GDPR.

We use Wix Stores and related Wix functions for the technical processing of shop orders. The information in the section on Wix therefore also applies.

Order, invoice and accounting data is retained in accordance with applicable commercial and tax-law retention obligations and deleted thereafter unless another legal basis requires or permits further retention.

​

15. Payment processing

Depending on the payment method currently offered in our checkout, different payment service providers may be involved. They receive only the data required for the selected payment method. This may include your name, billing details, amount, currency, order and transaction information, technical connection data and payment information required for the chosen method.

The transfer is necessary to carry out the payment method you selected and is based on Article 6(1)(b) GDPR. Payment service providers may also process data under their own responsibility, for example for fraud prevention, payment-security checks, compliance with anti-money-laundering, regulatory or tax obligations, or the enforcement of their own contractual rights. Their own privacy notices apply to such processing.

​

Wix Payments and card payments

We use Wix Payments for credit and debit card payments. According to Wix's current regional information for Germany, the underlying payment processing services for Wix Payments may involve Adyen and Stripe, including their relevant affiliates and acquiring banks. Wix may allocate a processor depending on the transaction or transaction type.

Card networks may also be involved in card transactions, including, where accepted in the checkout, Visa, Mastercard, American Express, Maestro, Diners Club, Discover, UnionPay, JCB or other supported card brands. We generally do not receive your full card details; we receive information such as the payment status, transaction references and information needed to process the order.

Further information:

https://www.wix.com/about/terms-of-payments

https://www.wix.com/about/privacy

​

PayPal

If you choose PayPal, the data required to process the payment is transmitted to PayPal. For customers in the European Economic Area, the relevant provider is generally PayPal (Europe) S.a r.l. et Cie, S.C.A., Luxembourg.

Further information: https://www.paypal.com/de/legalhub/paypal/privacy-full

​

Klarna

If you choose Klarna, the data required for the payment and, where applicable, eligibility, identity, fraud-prevention or credit-related checks offered by Klarna is transmitted to Klarna Bank AB (publ), Stockholm, Sweden. The exact processing depends on the Klarna payment method selected. Klarna processes certain data under its own responsibility.

Further information: https://www.klarna.com/international/privacy-policy/

​

Alipay / Stripe

Where Alipay is offered in our checkout and selected by you, the technical payment processing in our current configuration is provided through Stripe. Data required for the transaction is transmitted to Stripe and to the entities involved in the Alipay payment process.

Further information:

https://stripe.com/privacy

https://global.alipay.com/docs/ac/privacy

​

16. Shipping with Deutsche Post and DHL

To fulfil store orders, we disclose the data required for delivery to the shipping provider used for the relevant shipment. We use in particular services of Deutsche Post AG and DHL Paket GmbH.

The data disclosed generally includes the recipient's name and delivery address and, where required for a particular shipping or notification service, further contact and shipment information. The disclosure is necessary to perform the purchase contract and is based on Article 6(1)(b) GDPR.

Further information:

https://www.deutschepost.de/en/f/footer/data-protection.html

https://www.dhl.de/en/toolbar/footer/data-protection.html

​

17. External links, downloads and third-party platforms

Our website contains links to external websites and services. These include links to social-media and music platforms and to externally hosted files or offers, for example Facebook, Instagram, YouTube, TikTok, Spotify, Bandcamp, Google Drive, Dropbox, Blackbird Music and Guitar Academia.

With a normal external link, a connection to the third-party provider is generally established only when you click the link. At that point, data such as your IP address, browser and device information, the previously visited page (referrer), and the time and destination of the request may be transmitted to the third-party provider. From that point onward, the external provider is responsible for its own processing under its privacy policy.

The separate section on embedded YouTube videos applies in addition to YouTube content embedded directly on our website.

External websites and services are not governed by this Privacy Policy. Please review the privacy information provided by the respective external service.

​

18. Social-media profiles

We maintain professional and artistic profiles on social-media platforms, in particular Facebook, Instagram, TikTok and YouTube. If you visit these profiles or interact with us there, both we and the respective platform operator may process personal data.

We process information that you provide to us through the platform or publicly share with our profile, such as your profile name, messages, comments and other interactions. The processing is carried out for public relations, communication with interested persons and presentation of our artistic work. The legal basis is Article 6(1)(f) GDPR; where the communication concerns entering into or performing a contract, Article 6(1)(b) GDPR applies.

The platform operators also process data under their own responsibility, for example for operation of the platform, security, analytics and advertising. For Facebook and Instagram pages, Meta may provide us with aggregated statistics or "Insights" about use of our profiles. To the extent that we and a platform operator are joint controllers for specific processing within the meaning of Article 26 GDPR, the respective platform's joint-controller arrangement applies.

The principal platform operators are:

• Facebook and Instagram: Meta Platforms Ireland Limited, Dublin, Ireland - https://www.facebook.com/privacy/policy/

• TikTok: TikTok Technology Limited, Dublin, Ireland - https://www.tiktok.com/legal/page/eea/privacy-policy/en

• YouTube: Google Ireland Limited, Dublin, Ireland - https://policies.google.com/privacy

Use of these platforms may involve processing in third countries. Please refer to the respective platform's privacy information for details.

​

19. Recipients and processors

Personal data is disclosed only to recipients that need it for the relevant purpose. Depending on the processing activity, recipients may include in particular:

• Wix as website, hosting, shop and platform provider;

• Usercentrics for consent management;

• Google for Google Analytics and YouTube where you have given the required consent;

• Brevo for newsletter delivery and CRM;

• Microsoft for business email communication;

• payment service providers, acquiring banks and card networks for payment processing;

• Deutsche Post and DHL for delivery of orders;

• public authorities, courts or other recipients where disclosure is required by law or necessary for the establishment, exercise or defence of legal claims.

Where a service provider processes personal data solely on our behalf, we enter into the arrangements required by Article 28 GDPR where legally required. Some recipients, especially payment providers and social-media platforms, process certain personal data as independent controllers or, for specific operations, as joint controllers.

​

20. International data transfers

Some service providers we use belong to international groups. Personal data may therefore be processed outside the European Union or European Economic Area.

A transfer takes place only where the requirements of Articles 44 et seq. GDPR are met. Depending on the recipient and destination, transfers may in particular be based on:

• an adequacy decision of the European Commission, for example for Israel;

• the EU-U.S. Data Privacy Framework, where the relevant U.S. recipient is validly certified;

• Standard Contractual Clauses approved by the European Commission, together with supplementary measures where required;

• or another transfer mechanism permitted by the GDPR.

Information about the safeguards used for a particular transfer can be requested at hub@hubhildenbrand.de.

​

21. Retention periods

We retain personal data only for as long as necessary for the relevant purpose. Data is then deleted or anonymized unless statutory retention obligations, accountability requirements or other lawful grounds justify further retention.

In particular, the following criteria apply:

• technical log and security data: only for as long as required for operation, security, troubleshooting and abuse prevention;

• contact enquiries: until the matter has been conclusively handled, and thereafter only where legal or legitimate reasons justify further retention;

• newsletter data: generally until withdrawal or unsubscribe; limited proof and suppression data may be retained longer where necessary;

• order, invoice and payment data: in accordance with applicable commercial and tax-law retention periods;

• Usercentrics consent records: according to Usercentrics' recommended disclosure, generally one year;

• Google Analytics user-level and event-level data: according to the retention period configured for our GA4 property;

• business email data: for as long as required for the communication, contractual relationship or applicable legal retention obligations.

​

22. Your rights

Subject to the statutory conditions, you have in particular the following rights under the GDPR:

• right of access to personal data we process about you (Article 15 GDPR);

• right to rectification of inaccurate data and completion of incomplete data (Article 16 GDPR);

• right to erasure (Article 17 GDPR);

• right to restriction of processing (Article 18 GDPR);

• right to data portability, where the legal requirements are met (Article 20 GDPR);

• right to object to processing based on Article 6(1)(e) or (f) GDPR (Article 21 GDPR);

• right to withdraw consent at any time with effect for the future (Article 7(3) GDPR).

To exercise your rights, you may contact us at hub@hubhildenbrand.de.

​

Right to object under Article 21 GDPR

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right, on grounds relating to your particular situation, to object at any time to that processing. We will then no longer process the personal data concerned unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you may object to such processing at any time.

​

23. Right to lodge a complaint with a supervisory authority

Under Article 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement.

The supervisory authority responsible for us is in particular:

Berliner Beauftragte für Datenschutz und Informationsfreiheit

Alt-Moabit 59-61

10555 Berlin

Germany

Phone: +49 30 13889-0

Email: mailbox@datenschutz-berlin.de

https://www.datenschutz-berlin.de/

​

24. Automated decision-making and profiling

We do not make decisions through this website that are based solely on automated processing, including profiling, and that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

Statistical reach measurement and, where separately consented to, newsletter tracking are used to analyze and improve our communications and do not constitute automated decision-making within the meaning of Article 22 GDPR.

​

25. Requirement to provide data

For purely informational use of our website, you generally do not need to actively provide us with personal data.

For certain services, however, specific information is required:

• for the newsletter, at least a valid email address;

• for an order, the information required for contract performance, payment and delivery;

• when contacting us, the information necessary to handle your enquiry.

If you do not provide the information required for a particular service, we may be unable to provide that service.

​

26. Data security

We take appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration and disclosure. These measures include encrypted HTTPS connections and the security functions of the platform and service providers we use.

Please note that transmission of data over the internet can never be completely risk-free. In particular, ordinary email communication may not be end-to-end encrypted in every case, depending on the systems involved. Please avoid sending highly confidential information by unprotected email where possible.

​

27. Changes to this Privacy Policy

We update this Privacy Policy when our website, the services we use or the applicable legal requirements change. The version published on this website at the relevant time is the current version.

This English-language Privacy Policy is intended to provide the privacy information for English-speaking visitors to our website. Mandatory rights under applicable law remain unaffected.

​

Last updated: 13 September 2026