Privacy policy
This English text is for convenience. The German version is legally authoritative. Datenschutzerklärung
At a glance
- We process only what we need to reply, book sessions and deliver studio work.
- No marketing lists, no data sales, no AI training on your recordings.
- Session files stay in our archive for up to 24 months unless agreed otherwise.
- Questions and rights requests: [email protected] — we usually reply within 2 business days.
1. Who is responsible
Nobodyluno GmbH (limited liability company (GmbH)) at Lerchenfelder Straße 14, 1080 Wien — district Josefstadt — is the controller for personal data on nobodyluno.click and in our Josefstadt studio. UID ATU67188759, register entry FN 525382 w, court Handelsgericht Wien. Managing director: Lukas Gruber.
For privacy matters: [email protected] and 01 890 4523. We are below the statutory threshold for appointing a data protection officer.
Company particulars: legal notice. Session booking and payment: terms and conditions.
2. Scope
This text applies if you browse our site, use the contact form, write to us, call us, or book studio time in Vienna — including vocal recording, mixing, mastering, podcast production and music production.
Corporate clients who invite guests remain responsible for how those recordings are published. In that case Nobodyluno processes on their instructions under the data processing agreement; guest-facing notices should come from the client.
3. Data we collect
Contact form: your name, email, optional phone, chosen service, optional date wish and free-text project notes. Marked mandatory fields are required for a useful answer.
Projects and billing: invoice address, project or artist name, calendar planning, message history, bank transfer references. In-studio card payments run on the bank terminal — PAN data never enters our systems.
Session media: vocals and instruments can identify performers; we treat them as personal data and keep them within the booked scope.
Hosting logs: World4You Internet Services GmbH records technical access data (IP, timestamp, URL, user agent) to keep the site available. The cookie banner stores your choice locally without profiling.
We do not ask for health data or other special categories. Rescheduling for illness needs no medical paperwork — a brief note is enough.
4. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Enquiries and quotes | Form fields, emails | Art. 6(1)(b) GDPR — steps before a contract | 36 months from last message |
| Performing studio contracts | Contact, project, timetable | Art. 6(1)(b) GDPR | Until general civil limitation ends (typically three years), plus statutory holds |
| Working copies of sessions | Multitracks, exports | Art. 6(1)(b) GDPR | 24 months after the final session day, then wipe unless you purchase extended storage |
| Tax records | Invoices, payments | Art. 6(1)(c) GDPR — § 132 BAO | Seven fiscal years |
| Legal defence | Case files, correspondence | Art. 6(1)(f) GDPR | Through appeal windows |
| Site security | Host logs | Art. 6(1)(f) GDPR | Per World4You Internet Services GmbH rotation policy |
| Remembering cookie consent | nbdl_consent_v1 value | Art. 6(1)(c) and (f) GDPR | 182 days |
We neither monetise address lists nor run newsletter campaigns. Should we ever need a further purpose, we either show a clear link to the original reason or request fresh consent.
Legitimate-interest processing is documented internally; you may object and receive the main points of our balancing test.
5. Voice, image, minors and artificial intelligence
Performers control how their likeness and voice appear publicly. Nobodyluno will not post clips, behind-the-scenes photos or client names online without written approval.
Session takes are never fed into machine-learning pipelines, benchmark sets or synthetic voice tools unless the performer signs a separate release.
Self-service booking online is limited to users aged 16+; minors attend with a guardian’s agreement. The web form targets adult project owners.
6. Recipients and processors
Internal access is limited to studio staff with a need to know — today that is a compact team working in 3 treated rooms.
External parties may receive data only as needed:
- World4You Internet Services GmbH, Hauptstraße 35, 3252 Pettenbach, Österreich — site hosting and backups within the EU/EEA;
- FormSubmit (formsubmit.co) — relays form payloads to [email protected];
- tax adviser and house bank — invoicing and settlement;
- public bodies — when disclosure is mandatory.
Processors sign Article 28 GDPR terms. Corporate production workflows: see the data processing agreement.
7. Transfers outside the EEA
Primary systems sit in Austria or the EU. FormSubmit routing can touch US infrastructure when you submit the form; we rely on Art. 49(1)(b) GDPR because you initiate that communication.
Skip the form and write [email protected] or dial 01 890 4523 if you prefer to stay on EU routes only. Price lists live on services; practical questions on FAQ.
8. Security
Measures include TLS for the public site, role-based access to drives, encrypted laptops, and locked studio doors outside Mon–Fri 10–20, Sat 10–16. Archive expiry triggers deletion of working copies where law allows.
Personal data incidents with risk to individuals are reported to the Austrian DSB within 72 hours; affected users hear from us directly when impact is serious. Please use secure channels when sending large files; we harden storage once material arrives.
9. Your rights
Under the GDPR you can ask for access, correction, deletion, restriction, portability (where applicable), objection to interest-based processing, and withdrawal of any consent previously given (Arts. 15–21 and 7(3)).
Send requests to [email protected] or our postal studio address. Standard response time is one month, extendable by two months for difficult cases — we will explain why. Requests are free unless clearly abusive.
Supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Wien — www.dsb.gv.at. We appreciate a heads-up before you file a complaint; most concerns clear up in one exchange.
10. Cookies and similar technologies
We do not deploy audience analytics, ad pixels or social widgets. The consent manager writes nbdl_consent_v1 for 182 days so the banner does not reappear on every click.
Accept, reject and granular choices carry equal weight; non-essential categories are presently unused. Reopen the panel via or read cookie policy.
11. Links to other websites
Outbound links (including the map linked from contact and OpenStreetMap) follow third-party policies outside our control.
12. Status and changes
This document is informational and leaves mandatory consumer rights untouched. Updates appear here with the effective date 15 October 2026; major edits trigger an email to ongoing clients.
Postal contact: Nobodyluno GmbH, Lerchenfelder Straße 14, 1080 Wien — electronic: [email protected].