Privacy Policy

Last updated: October 31, 2026

1. Data Controller

The controller responsible for the processing of personal data through this website is:

Michel Isserstedt
Hauptstraße 24a
23883 Seedorf
Germany

Email: hello@vestlys.com

This Privacy Policy explains how VESTLYS collects, uses, stores and protects personal data when you visit our website, interact with our music releases or use our music-related links and services.

2. Scope of This Privacy Policy

This Privacy Policy applies to the VESTLYS website, its music release pages, smartlinks and related website functionality.

VESTLYS is operated from Germany and serves an international audience. Our processing of personal data is subject to applicable European and German data protection legislation, including the General Data Protection Regulation (GDPR) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

Additional privacy laws may apply depending on your location and the nature of our activities.

3. Website Hosting and Server Logs

Our website is hosted by Hostinger.

When you access our website, technical information may be processed by our hosting provider, including:

• IP address
• Date and time of access
• Requested pages and resources
• Browser type and version
• Operating system
• Referring website or URL
• Technical error and security information

This information is processed to deliver the website, maintain technical stability, detect security threats, prevent misuse and investigate technical problems.

The legal basis is Article 6(1)(f) GDPR, reflecting our legitimate interest in operating a secure and reliable website.

According to the hosting configuration currently available to us, the website server is located in Frankfurt am Main, Germany, while backup storage is located in France.

Hosting-related retention periods depend on the applicable technical configuration, contractual arrangements and operational requirements of the hosting provider. They are separate from the VESTLYS Analytics retention periods described below.

4. Contacting VESTLYS

If you contact us by email, we process the personal information you provide, including your email address, message and any additional information you voluntarily share.

We use this information exclusively to respond to your enquiry and manage the related communication.

Where your enquiry concerns a contract or steps taken before entering into a contract, processing is based on Article 6(1)(b) GDPR. Otherwise, processing may be based on Article 6(1)(f) GDPR, reflecting our legitimate interest in responding to enquiries.

We retain correspondence only for as long as necessary for the relevant purpose, unless statutory retention requirements or other legitimate grounds require longer storage.

5. Cookies and Consent Management

We use Real Cookie Banner to manage and document your privacy and cookie preferences.

When you first visit our website, you may be asked to accept optional services, reject them or make individual selections.

Strictly necessary technologies may be used without optional consent where legally permitted. Optional analytics technologies are used only after the required consent has been obtained.

Consent management may involve storing information about your choices, including technical identifiers and records necessary to demonstrate and respect those choices.

The legal basis for processing necessary to fulfil our consent-management and accountability obligations is Article 6(1)(c) GDPR. Where strictly necessary storage or access to information on your device is involved, the applicable exception under Section 25(2) TDDDG may apply.

You may withdraw or change your consent at any time by selecting Cookie Settings in the website footer.

Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. VESTLYS Analytics

We use VESTLYS Analytics, a self-hosted WordPress analytics solution, to understand how visitors interact with our website, music releases and streaming-service links.

VESTLYS Analytics includes an optional consent-based analytics mode (“Mode B”). This mode is activated only when the required consent has been obtained and the corresponding technical processing has been enabled.

The legal basis for consent-based analytics is Article 6(1)(a) GDPR. Where information is stored on or accessed from your device, the legal basis is your consent under Section 25(1) TDDDG.

6.1 Information We May Collect

Subject to your consent and the enabled functionality, VESTLYS Analytics may process:

• Pages visited and page-view events
• Music release pages and smartlinks accessed
• Music releases associated with individual interactions
• Clicks on links to music streaming services
• Activations of internal website links, recorded as an interaction category
• Referral sources and traffic channels
• Campaign information, including UTM parameters
• Estimated country, region and city, where a reliable local source is available
• General device, operating-system and browser categories
• Session information and pseudonymous browser identifiers
• Interaction sequences and navigation paths
• Visible activity and approximate engagement duration
• Technical timestamps associated with recorded events

These data help us understand which music releases attract interest, which promotional channels generate visits and which streaming platforms visitors choose.

A click on a streaming-service link does not establish that a track was played, saved or added to a playlist on the external platform.

6.2 Browser Identification

After valid consent, VESTLYS Analytics may store a browser identification cookie named va_browser.

The cookie has a configured lifetime of 30 days and supports the recognition of browser sessions and repeat interactions.

This identifier is pseudonymous. It does not directly identify you by name, but pseudonymous information may still constitute personal data under the GDPR.

According to the documented analytics architecture, full IP addresses are not stored in the dedicated VESTLYS Analytics event tables. This does not exclude technical IP-address processing during network communication, hosting or consent management.

6.3 Location, Device, Campaign and Observation Information

With your Statistics consent, VESTLYS Analytics also classifies general operating system and browser families and records activations of internal website links as an interaction category. These interaction events do not include the destination URL, link text or the content of messages or forms. Streaming-service link clicks remain separate events and do not establish that a stream, purchase or pre-save was completed.

Where a current local geolocation database and a verified source address are available, our server uses your IP address transiently to estimate your country, region and city. The lookup runs locally on our hosting server. Visitor IP addresses are not transmitted to an external geolocation web service and are not stored in the VESTLYS Analytics database for this purpose. Separate hosting logs remain subject to the hosting information in this policy.

IP-based locations are estimates and can be inaccurate, especially for mobile networks, VPNs and shared networks. We do not request GPS or browser location permission and do not store coordinates or postal addresses. Missing or insufficiently reliable locations are recorded as unknown. Location and device categories may be reused within the observed session; they are not a location history. We use locally hosted MaxMind GeoLite City data for this classification.

Recognised referrers, registered campaign parameters and clearly labelled app environment hints help classify marketing sources. A missing referrer does not prove a direct visit, and an app environment does not prove that a particular ad was viewed. Only registered campaign combinations are accepted. We do not collect arbitrary URL parameters, advertising click IDs, raw referrer URLs or raw user-agent strings in the Analytics database.

New and returning browser statistics relate only to observations available within our existing retention period. They do not identify people or establish lifetime browsing history. The same browser can be newly observed and return later during one reporting period. No additional persistent identifier or fingerprint is introduced. Existing browser-cookie and session rules remain unchanged.

The existing retention limits remain unchanged: detailed consent-based events and sessions up to 30 days, hourly aggregates up to 90 days and daily aggregates up to 25 months. Identifiers are not kept longer to reconstruct older unique browser counts.

We display aggregated counts of documented Statistics decisions and changes from our existing consent-management records. We do not copy consent identities into Analytics profiles or treat unanswered banners as refusals. Observation rates refer to comparable measured page loads, not to the consent rate of all visitors. Refusing or withdrawing Statistics consent stops detailed B processing, including these additional location, device and interaction data. You can change your choice through Cookie Settings.

6.4 Consent, Rejection and Withdrawal

If you reject optional statistics services, the corresponding consent-based visitor, session and streaming-link analytics will not be performed.

If you withdraw consent, further consent-dependent collection is stopped and the associated browser identifier is removed according to the implemented consent-management logic.

Information lawfully collected before withdrawal is subject to the applicable retention periods and data protection rights.

You can change your decision at any time using the Cookie Settings link in the footer.

You can refuse Statistics or withdraw your consent at any time through Cookie Settings. This stops further consent-based B events and removes the Analytics browser cookie. The separately described limited server-side A statistics remain subject to their existing rules. Withdrawal does not automatically erase data lawfully collected before the withdrawal.

6.5 Internal Analytics Reports

We use an access-restricted internal dashboard and CSV exports to analyse the information described above. Reports may include individual event counts and small groups, as well as combinations of location, source, campaign, device, browser, page, music release and streaming-link information. Small counts are not guaranteed to be hidden.

These reports do not guarantee anonymity. Small groups and comparisons between reports may allow information about individuals to be inferred. The dashboard and CSV reports do not display IP addresses or raw browser, session or consent identifiers. Access controls, consent requirements and the retention periods described in this policy continue to apply.

Geographic counts may remain available within the aggregate retention periods. Unique browser and session figures cannot be reconstructed once the detailed records needed to calculate them have expired.

7. Limited Server-Side Website Statistics

We use a limited server-side statistics mode (“Mode A”) to count requests for our public pages, posts and music smartlinks, including requests made without Statistics consent. These figures help us assess overall use of our public content and music links.

Mode A records the public content reference, a technical timestamp and a random event reference, and produces statistical counts. It does not create browser identifiers, visitor profiles or sessions. Country, referral-source and campaign attribution are disabled in Mode A. Mode A does not perform streaming-link click tracking.

Technical abuse protection temporarily processes the requesting IP address to derive minute-specific keyed hashes and request counters. These values are used only for abuse protection and are scheduled for deletion after 15 minutes. Full IP addresses are not stored in the dedicated Mode A event records. Hosting and consent-management processing are described separately.

To the extent that personal data are processed, we rely on Article 6(1)(f) GDPR. Our legitimate interests are to assess overall use of our public content and to protect the reliability of the statistics, subject to the safeguards described here. Mode A raw events are retained for up to one day; hourly and daily aggregates follow the retention periods in Section 8.

Rejecting or withdrawing Statistics consent stops consent-dependent Mode B collection. It does not disable this separately operated server-side Mode A. The shared page-delivery reference and duplicate-counting mechanism are described in Section 7.2.

7.2 Joint Page-Load Counting and Short-Lived Load Receipts

VESTLYS Analytics can combine the page-load counts from Modes A and B without counting the same delivered page twice. A smartlink load is also a page load; these figures must not be added together as if they represented separate visits.

For this purpose, an eligible delivered page receives a random reference specific to that page delivery. The reference is held with the loaded page and is not stored as an additional persistent cookie or browser profile. A keyed hash is used in a separate server-side load-receipt table, together with creation and expiry times and flags indicating whether the load has already been counted and whether an authorised B observation has occurred.

The load-receipt table does not contain browser, session, consent or A-event identifiers, IP addresses or user-agent strings. Its purpose is to prevent duplicate page-load counting, not to recognise a visitor across different page loads or devices. It does not join Mode A events to Mode B browser, session or consent records.

If Mode A lawfully counts a page before Statistics consent and you subsequently consent on that same loaded page, Mode B may record its consent-based page event, but the joint counter is not increased a second time for that delivery. Without an enabled Mode A, a B-only page load enters the joint counter only when valid Statistics consent allows B collection. A fresh page load receives a fresh delivery reference.

Rejecting or withdrawing Statistics consent prevents further consent-dependent B collection. It does not, by itself, control a separately enabled and lawfully authorised Mode A. Mode A is enabled only for the limited processing described in Section 7. A load receipt is not used as a replacement identifier to continue B tracking after rejection or withdrawal.

The page-delivery reference expires after no more than 23 hours and 50 minutes. Expired references are no longer accepted. Expired server-side receipts are selected for physical deletion by scheduled maintenance. The operational retention target is no more than 24 hours, including a ten-minute scheduling margin. This target depends on the maintenance scheduler running successfully; a failed or delayed scheduler can delay physical deletion. Expiry and physical deletion are distinct.

8. Analytics Data Retention

The documented VESTLYS Analytics configuration provides different retention periods depending on the category of data.

• Live activity information: approximately 10 minutes
• Certain security and rate-limiting information: approximately 15 minutes
• Data-minimised basic statistics: up to 24 hours
• Short-lived load receipts: expiry after at most 23 hours and 50 minutes; scheduled physical deletion with a 24-hour operational retention target as explained in Section 7.2
• Consent-based events and session information: generally 30 days
• Hourly statistical aggregates: generally 90 days
• Daily statistical aggregates: up to 25 months

Deletion is performed through scheduled maintenance processes. Actual deletion may be subject to technical execution intervals and processing delays.

These periods do not automatically apply to hosting logs, consent records, email correspondence or backup copies, which may be subject to separate retention requirements.

Aggregated information remains subject to applicable data protection requirements where individuals can still be identified.

9. Music Smartlinks and Streaming Platforms

VESTLYS provides music smartlinks that allow visitors to access our releases on external music platforms.

These may include Spotify, Apple Music, YouTube Music and other streaming services.

When you select an external streaming platform, your browser is directed to that provider. The external provider may then process your personal data under its own privacy policy.

With valid analytics consent, VESTLYS may record which streaming-service link was selected, together with the associated release and available campaign information.

We do not automatically receive information about your listening history, account identity, completed streams or purchases from these external platforms through our own smartlink tracking.

9.1 Limited Streaming-Link Redirection Counts

When you select a streaming service, your browser may first request a public VESTLYS redirection address before continuing to the configured destination. We count these redirection requests in separate daily totals by music release or artist-profile category and streaming provider. This limited counter operates independently of your Statistics consent; it does not enable the detailed Mode B analysis described in Section 6 when you reject or withdraw consent.

The separate counter stores only the calendar day, public release or artist-profile category, streaming provider and number of requests. It does not store IP addresses or IP hashes, browser, session or consent identifiers, precise click times, referral sources, campaigns or location data. It does not set an additional cookie or use a visitor-specific tracking code. We do not combine these totals with individual browsing histories or hosting logs to identify visitors. Technical connection data are nevertheless processed to deliver the redirection and protect the service, as described in Section 3. This does not mean that all processing during a request is anonymous.

Our purpose is to understand overall interest in our music links and the streaming services selected. To the extent that personal data are processed for this limited operation, we rely on Article 6(1)(f) GDPR and our legitimate interest in these limited statistics and reliable delivery of the selected link. We use immediate daily aggregation instead of identifying visitors or creating profiles. Daily totals are retained for up to 25 months for comparisons across music releases and reporting years and are subject to scheduled deletion as described in Section 8. Authorised operators can view the totals in the protected internal dashboard and CSV exports, including small counts.

The counter measures requests, not unique people, confirmed arrivals at a streaming service or completed streams. Repeated and automated requests may be included. Its figures overlap with consent-based streaming-link events and must not be added to them. A failure to record a count does not intentionally block the onward redirection.

You may object to processing based on legitimate interests by contacting hello@vestlys.com, as explained in Section 13. This counter has no browser-specific opt-out switch and does not use a new identifier to provide one. Where a justified objection cannot otherwise be given effect, we will suspend the limited counter while resolving the matter. Cookie Settings continues to control the separate, optional Mode B analysis.

10. Social Media and External Websites

Our website may contain links to Instagram, Facebook, Threads, TikTok, YouTube and other external websites.

Ordinary external links do not, by themselves, require us to establish a connection to those services merely because you visit our website.

When you actively follow an external link, the destination provider may collect information according to its own privacy practices.

If embedded media, third-party tracking technologies or additional integrations are introduced in the future, the relevant processing and consent requirements will be assessed separately.

11. Service Providers and International Data Transfers

We use technical service providers where necessary to operate, maintain and secure our website.

These include our hosting provider, Hostinger, and other providers involved in the technical operation of the website or associated communications.

Where a provider processes personal data on our behalf, the requirements of Article 28 GDPR concerning data processing agreements apply.

VESTLYS Analytics is designed to process its own analytics data within our WordPress hosting environment rather than automatically transferring that data to an external analytics provider such as Google Analytics.

Depending on the services used and the contractual arrangements of our providers, personal data may be processed outside the European Union or European Economic Area.

Where such transfers occur, the applicable requirements of Chapter V GDPR, including Articles 44 et seq., must be satisfied. Appropriate safeguards may include an adequacy decision or applicable standard contractual clauses together with any necessary supplementary measures.

12. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and misuse.

These measures include encrypted HTTPS connections and access controls within the systems used to operate our website.

However, no internet-based system can guarantee absolute security.

13. Your Privacy Rights

Subject to the applicable legal requirements, you have the following rights under the GDPR:

• Right of access – Article 15 GDPR
• Right to rectification – Article 16 GDPR
• Right to erasure – Article 17 GDPR
• Right to restriction of processing – Article 18 GDPR
• Right to data portability – Article 20 GDPR
• Right to object to certain processing – Article 21 GDPR
• Right to withdraw consent – Article 7(3) GDPR

To exercise your rights, please contact hello@vestlys.com.

For pseudonymous analytics data, identifying records relating to a particular individual may be technically limited. We will assess requests in accordance with our legal obligations.

You also have the right to lodge a complaint with a competent data protection supervisory authority under Article 77 GDPR.

The supervisory authority responsible for our location in Schleswig-Holstein is:

Unabhängiges Landeszentrum für Datenschutz Schleswig-Holstein (ULD)
Website: www.datenschutzzentrum.de

Objection to Processing Based on Legitimate Interests

Where we process personal data on the basis of Article 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation by contacting hello@vestlys.com. We will stop the processing concerned unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims.

Mode A does not maintain a browser profile or provide a browser-specific opt-out switch. Cookie Settings controls optional Mode B analytics. We will assess objections and the measures required to give effect to them without introducing additional tracking identifiers.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our website, technologies, services or applicable legal requirements.

The version published on this website is the current version.