Privacy Policy
1. Data Protection at a Glance
Protecting your personal data is important to us. The following information explains which personal data is processed when you visit our website and use our services, for what purposes this processing takes place, and what rights you have.
Personal data means any information relating to an identified or identifiable person.
2. Controller
The controller responsible for data processing on this website is:
Kunstgriff e.V.
Auf dem Grethel 30
30457 Hannover
Germany
Email: info@kunstgriff-academy.de
Phone: +49 (0) 170 – 16 77 316
Represented by the Executive Board.
3. Hosting and Server Log Files
Our website is hosted by
goneo Internet GmbH.
When you access our website, the web server automatically processes information in so-called server log files. This includes in particular:
IP address
date and time of access
page or file accessed
HTTP status code
browser type and/or user agent
operating system used
referrer URL
This data is processed in order to provide our website technically, ensure its functionality and security, and identify and investigate technical disruptions and misuse. This data is not analysed for marketing purposes.
The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely, reliably and without technical errors.
Data stored in server log files is generally deleted after no more than seven days. If data is exceptionally stored for a longer period, IP addresses are removed or anonymised so that they can no longer be associated with the device used to access the website.
goneo processes personal data on our behalf as part of the hosting services.
4. Contacting Us
If you contact us by email or via a contact form, we process the personal data you provide, in particular your name, contact details and the content of your message, in order to respond to your enquiry and communicate with you.
If your enquiry relates to the initiation or performance of a contractual relationship, the processing is based on Art. 6(1)(b) GDPR.
For other enquiries, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in appropriately responding to enquiries addressed to us and communicating with interested parties, participants, partners and supporters.
The data will be deleted as soon as it is no longer required for processing your enquiry, provided that there are no statutory retention obligations or other legal grounds requiring further storage.
5. Applications for Masterclasses
We provide an online form for applications to our masterclasses.
As part of an application, the following personal data in particular may be processed:
name and address
contact details
date of birth
nationality
information about your musical and professional background
information about your studies and training
proposed course repertoire
uploaded application documents
links to audio or video recordings
information regarding accommodation and meals
other information you provide as part of your application
We process this data for the purpose of conducting the application and selection process and – if your application is successful – for preparing, organising and conducting the respective masterclass.
The legal basis is Art. 6(1)(b) GDPR insofar as processing is necessary in order to take steps at your request prior to entering into a contract or for the performance of a resulting contractual relationship.
If you provide additional information voluntarily and consent is required for its processing, the processing is based on Art. 6(1)(a) GDPR.
Recipients of Application Data
Application data is accessible only to persons who require it for the application, selection or organisational process. This may include, in particular, members of the Kunstgriff Academy team and the faculty responsible for the respective masterclass, insofar as their involvement in the selection process is necessary.
Data will only be disclosed to other parties where this is necessary for organising and conducting the masterclass, where you have given your consent, or where we are legally required to do so.
Required Information
Information marked as mandatory is required in order to process your application. Without this information, we may not be able to review or consider your application.
Any additional information is provided voluntarily.
Retention Period
Data and application documents collected as part of an unsuccessful application will be deleted as soon as they are no longer required for the application and selection process, provided that there are no statutory retention obligations or other legal grounds requiring further storage.
If you are accepted for a masterclass, the data required for conducting and administering the course will be stored for the duration of the contractual relationship and subsequently in accordance with applicable statutory retention periods.
Data will only be stored beyond these periods where there is a legal basis for doing so or where you have expressly consented to such storage.
6. Forms Using Fluent Forms
We use the WordPress plugin Fluent Forms for our contact and application forms.
Data submitted through our forms is stored in the database of our WordPress installation hosted by goneo. Depending on the configuration of the respective form, technical information such as your IP address, browser used, device type, time of submission and the page accessed may also be processed in addition to the information you enter.
This data is used exclusively for processing the respective enquiry or application and, where applicable, for organising and conducting our masterclasses.
Where form content is sent by email to the persons responsible for processing an enquiry or application, this is done only to the extent necessary for the respective purpose.
The legal basis depends on the purpose of the respective form and is set out in the sections above concerning contact enquiries and the application process.
Form data is currently not transferred to external CRM, spreadsheet, automation or marketing services.
7. FluentCRM
We use FluentCRM as a self-hosted WordPress plugin. FluentCRM operates within our WordPress installation; the data managed by it is stored on our server hosted by goneo.
Where data from our forms is processed within WordPress using FluentCRM, this is done exclusively for the respective purposes described in this Privacy Policy. As FluentCRM is used as a self-hosted application, this data is not automatically transferred to the plugin provider's servers.
Data is only used for newsletters or other forms of electronic direct marketing where there is an appropriate legal basis, in particular where the necessary consent has been given.
8. Cookies and Technically Necessary Functions
Our website uses technically necessary cookies and/or comparable technologies insofar as these are required for the secure operation of the website or for functions expressly requested by you.
Where information is stored on your device or information already stored on your device is accessed, technically necessary technologies are used on the basis of Section 25(2) TDDDG. Any subsequent processing of personal data is based, where applicable, on Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a secure and functional website.
Should we use technologies in the future that require consent, these will only be used after you have expressly given your consent. In this case, the legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future.
9. Instagram Feed
We display content from our Instagram profile on our website using the WordPress plugin Smash Balloon Instagram Feed.
The Instagram feed is configured to use the plugin's privacy-friendly features. Images displayed in the feed are stored locally on our web server and delivered to your browser from there. As a result, simply accessing a page containing the Instagram feed does not cause images to be loaded directly into your browser from Instagram's Content Delivery Network.
If you click on a link to a post or to our Instagram profile, you leave our website and establish a connection to Instagram. The respective provider is responsible for any subsequent processing of data on its platform.
For users in the European Union, Instagram is provided by:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
10. External Links and Google Maps
Our website contains links to external websites and services, in particular Google Maps and social media services.
Where these services are accessed solely via an external link, simply visiting our website does not result in data being transferred to the respective external provider as a result of that link.
Only when you click on such a link do you leave our website and establish a connection to the respective provider. The respective provider is responsible for the processing of personal data that subsequently takes place there.
11. Data Backups
To secure our website and protect against data loss, we create technical backups of our WordPress installation. These backups are stored on the web space provided by our hosting provider.
These backups are currently not stored with external cloud storage services such as Google Drive, Dropbox, Microsoft OneDrive or comparable providers.
The backups are used exclusively to restore the website in the event of a technical error, data loss or security incident.
The legal basis for processing personal data that may form part of a backup is Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the availability, integrity and recoverability of our website and the data stored on it.
12. Data Retention
Unless a more specific retention period is stated in this Privacy Policy, we store personal data only for as long as it is required for the respective purpose of processing.
Where statutory retention obligations apply, the relevant data will be stored for the duration of these periods and subsequently deleted.
Where processing is based on your consent, we generally process the relevant data until you withdraw your consent, unless another legal basis permits or requires further storage.
13. Recipients of Personal Data
Personal data is generally made accessible only to those internal and external parties that require it for the respective purpose of processing.
This includes, in particular, our hosting provider goneo Internet GmbH and, as part of the application process, the persons involved in the selection, organisation and delivery of the respective masterclass.
Personal data will only be disclosed to other third parties where there is a legal basis for doing so, where disclosure is necessary for the performance of a contractual relationship, or where you have given your consent.
14. Your Rights
Subject to the applicable statutory requirements, you have in particular the following rights:
right of access to your personal data pursuant to Art. 15 GDPR
right to rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR
right to erasure of your personal data pursuant to Art. 17 GDPR
right to restriction of processing pursuant to Art. 18 GDPR
right to data portability pursuant to Art. 20 GDPR
right to object to processing pursuant to Art. 21 GDPR
right to withdraw consent pursuant to Art. 7(3) GDPR
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal.
Right to Object
Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
15. Right to Lodge a Complaint with a Supervisory Authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
The supervisory authority responsible for us is:
The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hannover
Germany
Phone: +49 (0) 511 120-4500
Email: poststelle@lfd.niedersachsen.de
16. SSL/TLS Encryption
For security reasons, this website uses SSL/TLS encryption. This protects data transmitted through our website against access by unauthorised third parties during transmission.
You can identify an encrypted connection, in particular, by the fact that your browser's address bar begins with “https://”.
17. Automated Decision-Making
We do not use decision-making based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR in connection with the processing activities described on this website.
18. Changes to this Privacy Policy
We may update this Privacy Policy if legal requirements, our website or the technical services we use change.
The version published on this website at the relevant time applies.
Last updated: August 2026
Protecting your personal data is important to us. The following information explains which personal data is processed when you visit our website and use our services, for what purposes this processing takes place, and what rights you have.
Personal data means any information relating to an identified or identifiable person.
2. Controller
The controller responsible for data processing on this website is:
Kunstgriff e.V.
Auf dem Grethel 30
30457 Hannover
Germany
Email: info@kunstgriff-academy.de
Phone: +49 (0) 170 – 16 77 316
Represented by the Executive Board.
3. Hosting and Server Log Files
Our website is hosted by
goneo Internet GmbH.
When you access our website, the web server automatically processes information in so-called server log files. This includes in particular:
IP address
date and time of access
page or file accessed
HTTP status code
browser type and/or user agent
operating system used
referrer URL
This data is processed in order to provide our website technically, ensure its functionality and security, and identify and investigate technical disruptions and misuse. This data is not analysed for marketing purposes.
The legal basis for this processing is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing our website securely, reliably and without technical errors.
Data stored in server log files is generally deleted after no more than seven days. If data is exceptionally stored for a longer period, IP addresses are removed or anonymised so that they can no longer be associated with the device used to access the website.
goneo processes personal data on our behalf as part of the hosting services.
4. Contacting Us
If you contact us by email or via a contact form, we process the personal data you provide, in particular your name, contact details and the content of your message, in order to respond to your enquiry and communicate with you.
If your enquiry relates to the initiation or performance of a contractual relationship, the processing is based on Art. 6(1)(b) GDPR.
For other enquiries, processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in appropriately responding to enquiries addressed to us and communicating with interested parties, participants, partners and supporters.
The data will be deleted as soon as it is no longer required for processing your enquiry, provided that there are no statutory retention obligations or other legal grounds requiring further storage.
5. Applications for Masterclasses
We provide an online form for applications to our masterclasses.
As part of an application, the following personal data in particular may be processed:
name and address
contact details
date of birth
nationality
information about your musical and professional background
information about your studies and training
proposed course repertoire
uploaded application documents
links to audio or video recordings
information regarding accommodation and meals
other information you provide as part of your application
We process this data for the purpose of conducting the application and selection process and – if your application is successful – for preparing, organising and conducting the respective masterclass.
The legal basis is Art. 6(1)(b) GDPR insofar as processing is necessary in order to take steps at your request prior to entering into a contract or for the performance of a resulting contractual relationship.
If you provide additional information voluntarily and consent is required for its processing, the processing is based on Art. 6(1)(a) GDPR.
Recipients of Application Data
Application data is accessible only to persons who require it for the application, selection or organisational process. This may include, in particular, members of the Kunstgriff Academy team and the faculty responsible for the respective masterclass, insofar as their involvement in the selection process is necessary.
Data will only be disclosed to other parties where this is necessary for organising and conducting the masterclass, where you have given your consent, or where we are legally required to do so.
Required Information
Information marked as mandatory is required in order to process your application. Without this information, we may not be able to review or consider your application.
Any additional information is provided voluntarily.
Retention Period
Data and application documents collected as part of an unsuccessful application will be deleted as soon as they are no longer required for the application and selection process, provided that there are no statutory retention obligations or other legal grounds requiring further storage.
If you are accepted for a masterclass, the data required for conducting and administering the course will be stored for the duration of the contractual relationship and subsequently in accordance with applicable statutory retention periods.
Data will only be stored beyond these periods where there is a legal basis for doing so or where you have expressly consented to such storage.
6. Forms Using Fluent Forms
We use the WordPress plugin Fluent Forms for our contact and application forms.
Data submitted through our forms is stored in the database of our WordPress installation hosted by goneo. Depending on the configuration of the respective form, technical information such as your IP address, browser used, device type, time of submission and the page accessed may also be processed in addition to the information you enter.
This data is used exclusively for processing the respective enquiry or application and, where applicable, for organising and conducting our masterclasses.
Where form content is sent by email to the persons responsible for processing an enquiry or application, this is done only to the extent necessary for the respective purpose.
The legal basis depends on the purpose of the respective form and is set out in the sections above concerning contact enquiries and the application process.
Form data is currently not transferred to external CRM, spreadsheet, automation or marketing services.
7. FluentCRM
We use FluentCRM as a self-hosted WordPress plugin. FluentCRM operates within our WordPress installation; the data managed by it is stored on our server hosted by goneo.
Where data from our forms is processed within WordPress using FluentCRM, this is done exclusively for the respective purposes described in this Privacy Policy. As FluentCRM is used as a self-hosted application, this data is not automatically transferred to the plugin provider's servers.
Data is only used for newsletters or other forms of electronic direct marketing where there is an appropriate legal basis, in particular where the necessary consent has been given.
8. Cookies and Technically Necessary Functions
Our website uses technically necessary cookies and/or comparable technologies insofar as these are required for the secure operation of the website or for functions expressly requested by you.
Where information is stored on your device or information already stored on your device is accessed, technically necessary technologies are used on the basis of Section 25(2) TDDDG. Any subsequent processing of personal data is based, where applicable, on Art. 6(1)(f) GDPR. Our legitimate interest lies in providing a secure and functional website.
Should we use technologies in the future that require consent, these will only be used after you have expressly given your consent. In this case, the legal basis is Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR.
You may withdraw your consent at any time with effect for the future.
9. Instagram Feed
We display content from our Instagram profile on our website using the WordPress plugin Smash Balloon Instagram Feed.
The Instagram feed is configured to use the plugin's privacy-friendly features. Images displayed in the feed are stored locally on our web server and delivered to your browser from there. As a result, simply accessing a page containing the Instagram feed does not cause images to be loaded directly into your browser from Instagram's Content Delivery Network.
If you click on a link to a post or to our Instagram profile, you leave our website and establish a connection to Instagram. The respective provider is responsible for any subsequent processing of data on its platform.
For users in the European Union, Instagram is provided by:
Meta Platforms Ireland Limited
Merrion Road
Dublin 4
D04 X2K5
Ireland
10. External Links and Google Maps
Our website contains links to external websites and services, in particular Google Maps and social media services.
Where these services are accessed solely via an external link, simply visiting our website does not result in data being transferred to the respective external provider as a result of that link.
Only when you click on such a link do you leave our website and establish a connection to the respective provider. The respective provider is responsible for the processing of personal data that subsequently takes place there.
11. Data Backups
To secure our website and protect against data loss, we create technical backups of our WordPress installation. These backups are stored on the web space provided by our hosting provider.
These backups are currently not stored with external cloud storage services such as Google Drive, Dropbox, Microsoft OneDrive or comparable providers.
The backups are used exclusively to restore the website in the event of a technical error, data loss or security incident.
The legal basis for processing personal data that may form part of a backup is Art. 6(1)(f) GDPR. Our legitimate interest lies in ensuring the availability, integrity and recoverability of our website and the data stored on it.
12. Data Retention
Unless a more specific retention period is stated in this Privacy Policy, we store personal data only for as long as it is required for the respective purpose of processing.
Where statutory retention obligations apply, the relevant data will be stored for the duration of these periods and subsequently deleted.
Where processing is based on your consent, we generally process the relevant data until you withdraw your consent, unless another legal basis permits or requires further storage.
13. Recipients of Personal Data
Personal data is generally made accessible only to those internal and external parties that require it for the respective purpose of processing.
This includes, in particular, our hosting provider goneo Internet GmbH and, as part of the application process, the persons involved in the selection, organisation and delivery of the respective masterclass.
Personal data will only be disclosed to other third parties where there is a legal basis for doing so, where disclosure is necessary for the performance of a contractual relationship, or where you have given your consent.
14. Your Rights
Subject to the applicable statutory requirements, you have in particular the following rights:
right of access to your personal data pursuant to Art. 15 GDPR
right to rectification of inaccurate data or completion of incomplete data pursuant to Art. 16 GDPR
right to erasure of your personal data pursuant to Art. 17 GDPR
right to restriction of processing pursuant to Art. 18 GDPR
right to data portability pursuant to Art. 20 GDPR
right to object to processing pursuant to Art. 21 GDPR
right to withdraw consent pursuant to Art. 7(3) GDPR
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent prior to its withdrawal.
Right to Object
Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.
15. Right to Lodge a Complaint with a Supervisory Authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes applicable data protection law.
The supervisory authority responsible for us is:
The State Commissioner for Data Protection of Lower Saxony
Prinzenstraße 5
30159 Hannover
Germany
Phone: +49 (0) 511 120-4500
Email: poststelle@lfd.niedersachsen.de
16. SSL/TLS Encryption
For security reasons, this website uses SSL/TLS encryption. This protects data transmitted through our website against access by unauthorised third parties during transmission.
You can identify an encrypted connection, in particular, by the fact that your browser's address bar begins with “https://”.
17. Automated Decision-Making
We do not use decision-making based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR in connection with the processing activities described on this website.
18. Changes to this Privacy Policy
We may update this Privacy Policy if legal requirements, our website or the technical services we use change.
The version published on this website at the relevant time applies.
Last updated: August 2026
