Privacy policy
1. Data controller
The data controller under the General Data Protection Regulation (GDPR) is:
Haensel
Cornelius-Fredericks-Straße 19
13351 Berlin
Email: fanbuero@haenselel.de
2. General information on data processing
We process personal data about visitors only as needed to provide a functioning website, our content and our services (especially the merch shop). The legal bases are Article 6 (1) (b) GDPR (performance of a contract), Article 6 (1) (c) GDPR (legal obligations, such as tax retention requirements) and Article 6 (1) (f) GDPR (our legitimate interest in secure, stable operation).
3. Server log files
When you visit this website, the hosting provider automatically stores information in server log files (IP address, date and time, page requested, browser type and referring URL). This data is used to keep the website running and analyse errors, and is not combined with other data sources.
4. Cookies and session data
This website uses only technically necessary cookies: a session cookie to manage your session (such as your cart and login) and a CSRF token to protect forms. No tracking or marketing cookies are set, so no consent is required for these cookies (section 25 (2) TDDDG).
5. Shop orders
To process orders, we use the information you provide (name, address, email address, phone number if provided, and order and payment details). This processing is necessary to perform the contract (Article 6 (1) (b) GDPR). We retain invoice data for the statutory periods (section 147 AO and section 257 HGB). A customer account is created only at your express request and can be deleted at any time.
6. Payment service providers
Credit card and PayPal payments are processed by Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland). The data needed for payment is sent directly to Stripe; we do not receive or store full card details. The legal basis is Article 6 (1) (b) GDPR. Further information is available in Stripe’s privacy policy: stripe.com/de/privacy. For advance bank transfers, we receive the usual transaction details from your bank.
7. Contact form and email
When you contact us using the contact form or by email, we process the information provided (name, email address and message) solely to respond to your enquiry (Article 6 (1) (b) or (f) GDPR). The data is deleted once it is no longer needed to handle the enquiry, unless statutory retention obligations apply.
8. Newsletter
When you subscribe to our newsletter, we process your email address and, optionally, your name with your consent (Article 6 (1) (a) GDPR). Your subscription becomes active only after you open the confirmation link sent by email (double opt-in). To document consent, we store the sign-up and confirmation times, the version of the consent wording and a non-reversible hash of the IP address used to subscribe. Unconfirmed subscriptions are deleted after seven days.
Every newsletter contains an unsubscribe link. Unsubscribing withdraws your consent for future processing, and no further newsletters will be sent. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Delivery status and failed deliveries are logged to support reliable delivery and error analysis.
9. External links
Our website links to external services (such as ticket shops, Google Maps and social media profiles). Following these links takes you away from our website, and the respective provider’s privacy policy applies.
10. Your rights
You have the right to access (Article 15 GDPR), rectify (Article 16 GDPR), erase (Article 17 GDPR) and restrict the processing of your data (Article 18 GDPR), as well as the rights to data portability (Article 20 GDPR) and to object to processing (Article 21 GDPR). You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR).
11. Updates to this policy
This privacy policy was last updated in 10/2026. Changes to the website or legal requirements may require updates.