Privacy Policy
Protecting your personal data matters to us. We process it solely in accordance with the applicable law, in particular the General Data Protection Regulation (GDPR), the Austrian Data Protection Act (DSG) and the Austrian Telecommunications Act 2021 (TKG 2021). This policy explains which data is processed when you visit this website.
Controller
Bel Canto Music & Cultural Initiatives GmbH, Aegidigasse 12/24, 1060 Vienna, Austria
Email: office@bel-canto.at
At a glance
This website uses no advertising, tracking or social media services and does not embed any external content. Fonts, images and scripts are delivered from the same server as the page itself. The only data processed are the technically necessary access data, aggregated visitor statistics provided by our hosting provider, a few technically necessary entries in your browser's storage and – if you write to us – your email. We only share data with the service providers named here or where we are legally required to do so. No automated decision-making, including profiling, takes place.
Hosting and access data
This website is hosted by a hosting provider based in the USA. For delivery, the provider uses the network of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA ("Cloudflare") as a sub-processor.
Each time the website is accessed, the following access data is processed automatically: IP address and the approximate location derived from it, date and time of access, the page or file requested, the previously visited page (referrer), browser type and version, operating system, and technical status and error codes.
The purpose is to deliver the website and to ensure its stability and security, in particular to defend against attacks and misuse. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in providing the website securely, reliably and without errors.
The hosting provider processes this data as our processor; a data processing agreement pursuant to Art. 28 GDPR is in place with it. Where the provider additionally processes access data for its own purposes, such as the security and development of its services, it does so under its own responsibility.
Access data is stored only for as long as necessary for these purposes and is then deleted or anonymised. It is retained for longer only where this is necessary to investigate a specific security incident.
Visitor statistics provided by our hosting provider
Our hosting provider automatically compiles aggregated visitor statistics for us from the access data, for example on the number of visits and page views, visit duration, referring websites, device types and countries of origin. We only see aggregated figures, not information about individual persons. No additional scripts are loaded into the website for this purpose.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in understanding, in aggregated form, how our website is used. The underlying access data is deleted as described in the section "Hosting and access data".
Cookies and browser storage
We do not set any cookies ourselves. To function, the website only stores the following entries in your browser's storage:
- "stf-gate" (localStorage): remembers that you have unlocked access to the website so that you do not have to enter the access code again.
- "stf-audio" (localStorage): stores your audio setting (music on or off) and the point at which the music last played.
- "stf-audio-off" (sessionStorage): remembers for your current visit that you have switched the music off; it is deleted automatically when you close the tab.
These entries remain on your device and are not transmitted to us or to third parties. The localStorage entries remain until you delete them in your browser settings.
To protect against automated attacks, Cloudflare may additionally set a technically necessary security cookie ("__cf_bm"), which expires after 30 minutes of inactivity. It serves only to distinguish human visitors from bots; it is not used to track you across websites.
No consent is required for these entries because they are strictly necessary to provide the service you have expressly requested (Section 165(3) TKG 2021). Where personal data is processed in this context, the legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in a functional and secure website.
Contact by email
If you email us, we process your email address, your name (if provided), the content of your message including any attachments, and the time of your message in order to handle and respond to your enquiry.
The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a collaboration or contract, such as a partnership or sponsorship; otherwise Art. 6(1)(f) GDPR, our legitimate interest being to respond to your enquiry. Providing your data is voluntary; without it, however, we cannot reply to you.
Our emails are stored by World4You Internet Services GmbH, Wolfgang-Pauli-Straße 2, 4020 Linz, Austria, acting as our processor.
We delete your enquiry once it has been fully dealt with and no further correspondence is expected. Where correspondence is relevant for business or tax purposes, we retain it for the statutory retention period, usually seven years (Section 132 of the Austrian Federal Fiscal Code – BAO, Section 212 of the Austrian Commercial Code – UGB).
Transfers to the USA
The hosting provider and Cloudflare are based in the USA. Transfers to the hosting provider are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Cloudflare is additionally certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR).
Data security
The connection to this website is encrypted throughout using TLS, indicated by "https://" in the address bar. We and our service providers take appropriate technical and organisational measures to protect your data.
Your rights
Under the GDPR you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), each subject to the statutory requirements. Simply contact us at office@bel-canto.at.
If you believe that the processing of your data infringes data protection law, you may lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at. You may also contact the supervisory authority of the EU member state in which you live or work.
Right to object (Art. 21 GDPR)
Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object to this processing at any time on grounds relating to your particular situation. We will then no longer process your data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An informal message to office@bel-canto.at is sufficient.
Changes
We will update this privacy policy if the website or the legal situation changes. The version published here applies.
Last updated: September 2026