Privacy Policy

At a glance

• This website shows promotional pages for music releases. You don't need an account, and we don't ask you for your name, email address or any other details.
• Delivering the page needs your IP address and basic browser information. Our hosting provider processes them for us. We don't keep logs of your visits.
• Only if you accept marketing cookies do we measure our advertising with Meta (Facebook, Instagram) and load the embedded Spotify player. If you decline, neither happens.
• You can change your choice at any time with the cookie icon in the bottom left corner of every page or the "Cookie settings" link at the bottom.

1. Who is responsible

Responsible for the processing of personal data on this website (the "controller") is:
Lunar X GmbH, represented by its managing director Clemens Semelmayer
Zionskirchstraße 73a, 10119 Berlin, Germany
Email: music@lunar-x.com
Further company details are in our imprint.

This policy covers all pages of this website: our landing pages, which present an artist's music and link to music streaming services, and this privacy policy and our imprint. It does not cover the websites and apps you reach through the links on our pages. They have their own privacy policies.

2. Visiting a page

When you open one of our pages, your browser sends us technical information that is needed to deliver it: your IP address, the date and time, the address of the page you requested, the page you came from (referrer) and your browser's identification (user agent, which includes the browser and operating system).

We use this information only to deliver the page and to protect the website against attacks and misuse. Requests pass a firewall that filters known attack patterns and limits how many requests one IP address can make within a few minutes; our server sets a similar limit for the tracking requests described in section 4. These counts only serve these limits and expire after a few minutes. We don't keep logs of your visits.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is a secure, reliable website.

Hosting. The website is run by a hosting provider that processes this data on our behalf under a data processing agreement (Art. 28 GDPR). Our servers are in the EU. To load pages quickly worldwide, they are delivered through a content delivery network whose locations also include countries outside the EU; see section 7.

3. Cookie consent

On your first visit, a banner asks whether you accept marketing cookies. It is provided by Cookiebot, a service of Usercentrics A/S, Havnegade 39, 1058 Copenhagen K, Denmark, which processes data for us under a data processing agreement.

Your choice is stored in a cookie on your device, so the banner doesn't come back on every page. Because all our pages share this website's address, your choice applies to all of them. As proof of your consent, Cookiebot also records your choice together with a shortened IP address, the date and time, your browser's identification, the page address and a random consent key. These records are stored by Usercentrics in the EU and deleted after 12 months.

Legal basis: Art. 6(1)(c) GDPR together with Art. 7(1) GDPR (we must be able to prove consent). Storing the consent cookie is necessary for the service you request (§ 25(2) no. 2 TDDDG).

Changing your choice. After your first choice, a small cookie icon appears in the bottom left corner of every page. Use it to change or withdraw your consent at any time. You can also reopen the banner by clicking the placeholder of the Spotify player or the "Cookie settings" link at the bottom of every page. Withdrawing doesn't affect the lawfulness of processing before the withdrawal.

4. Advertising measurement with Meta

We advertise our music releases on Facebook and Instagram. To measure and improve these campaigns, our pages use two tools from Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"): the Meta Pixel and the Conversions API. Both are only active if you accept marketing cookies.

What is recorded. We tell Meta when a page is viewed and when you click one of the music service buttons or the artist's social media links. Each of these events has its own name, for example "SpotifyClick". If you accept marketing cookies through the placeholder of the Spotify player, we also tell Meta that ("SpotifyPlayerUnlock"), and when you start the player on our page, once per page view ("SpotifyEmbedPlay"). We don't send Meta your name, email address, phone number or any other contact details, and we don't send which tracks you play.

• Meta Pixel (in your browser): Meta's script sends the event together with your IP address, your browser's identification, the page address, the page you came from and technical details such as screen size. It sets the cookie _fbp (a browser ID, stored for 90 days) and, if you came from a Meta ad, _fbc (the ad click ID, stored for 90 days). Meta's script also keeps ad click IDs in your browser's local storage (multiFbc, up to 90 days). If you are logged in to Facebook or Instagram in the same browser, Meta can also read its own cookies and link the event to your account.
• Conversions API (from our server): when you click a music service button or a social media link, accept through the player's placeholder or start the player, our server sends the same event directly to Meta: the event name and ID, the time, the page address, your IP address, your browser's identification and the two cookie values above. This lets Meta count clicks even when the browser blocks the script. Both copies carry the same event ID, so Meta counts each click only once. We don't store this data ourselves.

Joint responsibility. For collecting this data on our pages and transmitting it to Meta, we and Meta are jointly responsible (Art. 26 GDPR). We have agreed with Meta how responsibilities are shared, in Meta's Controller Addendum. We are responsible for informing you and for obtaining your consent; Meta is responsible for the security of its tools and for handling your rights concerning the data it holds. You can contact either of us. What Meta does with the data after receiving it, for example to deliver ads and improve its products, Meta decides alone; see Meta's Privacy Policy.

Legal basis: your consent, Art. 6(1)(a) GDPR, and for the cookies § 25(1) TDDDG. If you withdraw your consent, our pages stop sending events, tell the Meta Pixel to stop processing and delete the cookies _fbp and _fbc and the storage entry multiFbc. Our server also refuses events from browsers without your consent.

5. Embedded Spotify player

Our pages can show the playlist in Spotify's embedded player. The player is provided by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden, and is only loaded if you accept marketing cookies. Until then, you see a placeholder with the playlist cover, which comes from our own servers, so nothing is loaded from Spotify.

The player tells our page when playback starts; we use this only for the event described in section 4. When the player loads, your browser connects to Spotify. Spotify receives your IP address, your browser's identification and the address of our page, and can set or read its own cookies. If you are logged in to Spotify, Spotify can link this to your account. For loading the player on our page and the data sent to Spotify in the process, we and Spotify are jointly responsible (Art. 26 GDPR); we are responsible for informing you and for obtaining your consent. What Spotify does with the data afterwards, Spotify decides alone; see Spotify's Privacy Policy and Cookie Policy.

Legal basis: your consent, Art. 6(1)(a) GDPR and § 25(1) TDDDG.

6. Links to music services and social networks

Our pages link to Spotify, Apple Music, Deezer and YouTube, and to the artist's Instagram, Facebook and YouTube profiles. The links themselves send nothing to these services. When you click a link, you go to their website or app, and their privacy policies apply from then on. The Spotify and Apple Music links contain a parameter that asks their website to open the app; it contains no personal data. If you have accepted marketing cookies, the click itself is recorded as described in section 4.

7. Recipients and transfers outside the EU

Your data is received by the service providers and partners described above: our hosting provider, Usercentrics (cookie consent), Meta (only with consent) and Spotify (only with consent). We don't sell your data.

Some of them process data in the United States or give access from there: our hosting provider and Meta Platforms, Inc. are certified under the EU-US Data Privacy Framework, for which the European Commission has decided that the level of data protection is adequate (Art. 45 GDPR). Where a transfer isn't covered by that decision, the providers use the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Information on Spotify's transfers is in Spotify's Privacy Policy.

8. Overview: legal bases and storage periods

9. Your rights

Under the GDPR, you have the right to:

• access the personal data we hold about you (Art. 15),
• have incorrect data corrected (Art. 16),
• have your data deleted (Art. 17),
• restrict processing (Art. 18),
• receive your data in a portable format (Art. 20),
• withdraw your consent at any time with effect for the future (Art. 7(3)), using the cookie icon in the bottom left corner.

Right to object (Art. 21 GDPR): where we process your data based on our legitimate interests (section 2), you can object at any time for reasons arising from your particular situation. We will then stop unless we can show compelling legitimate grounds, or the processing serves to establish, exercise or defend legal claims.

To exercise your rights, write to music@lunar-x.com. As we don't know your name and don't keep logs of your visits, we usually can't identify you (Art. 11 GDPR). For your cookie consent, include the consent ID shown in the cookie list at the end of this page, so we can find your record. Data that Meta holds about you is available from Meta directly, for example under "Your activity off Meta technologies" in your Facebook or Instagram account.

You also have the right to lodge a complaint with a data protection authority (Art. 77 GDPR), in particular in the EU country where you live or work or where an infringement is suspected. The authority responsible for us is: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.

10. Other information

No obligation. You don't have to provide any data. Without marketing consent, you can use all pages; only the Spotify player isn't loaded, and you can still open the playlist through the buttons.

No automated decisions. We don't make decisions about you based solely on automated processing (Art. 22 GDPR). Meta uses the data it receives to build advertising profiles and decide which ads to show; see Meta's Privacy Policy.

Children. Our pages are not aimed at children under 16, and we don't knowingly process their data.

Security. All pages are delivered over an encrypted connection (HTTPS). Access to our systems is restricted, and requests pass a firewall and rate limiting.

Changes. We update this policy when our pages or the law change. The current version is always on this page, with its date at the top.

11. Contact

For questions about this policy or about your data, write to music@lunar-x.com or to Lunar X GmbH, Zionskirchstraße 73a, 10119 Berlin, Germany.

12. Cookies used on this website

The following list is generated by Cookiebot and always shows the cookies currently in use, with their purpose, provider and storage period, as well as your current consent.