This privacy policy informs you about the type, scope, and purpose of the processing of personal data (hereinafter referred to as “data”) within our online services and associated websites, features, and content, as well as external online presences (e.g., our social media profiles), collectively referred to as the “online offering.”

The terms used, such as “processing” or “controller,” are based on the definitions in Article 4 of the General Data Protection Regulation (GDPR).

Controller

JKLN

Magmatic Records / Label 828

c/o IP-Management #7643

Ludwig-Erhard-Str. 18

20459 Hamburg, Germany

Contact email: info@magmaticrecords.com / jkln.promo@gmail.com

https://jklnmusic.com

https://label828.com

https://magmaticrecords.com

https://komi.io/jkln

Categories of Data Subjects

Visitors and users of the online offering (hereinafter collectively referred to as "users").

Purpose of Processing

• Provision of the online offering, its functions, and content

• Responding to contact requests and communicating with users

• Security measures

• Reach measurement and marketing

Definitions of Terms• Personal data refers to any information relating to an identified or identifiable natural person ("data subject"). An identifiable person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier (e.g., cookie), or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity.

• Processing means any operation or set of operations performed on personal data, whether or not by automated means. The term is broad and includes virtually any handling of data.

• Pseudonymization means the processing of personal data in such a way that the data can no longer be

attributed to a specific individual without additional information, provided that such information is kept separately and subject to technical and organizational safeguards.

• Profiling means any form of automated processing of personal data to evaluate certain personal aspects, in particular to analyze or predict aspects concerning performance at work, economic situation, health, preferences, interests, reliability, behavior, location, or movements of a person.

• Controller refers to the natural or legal person who determines the purposes and means of processing personal data.

• Processor refers to a natural or legal person who processes personal data on behalf of the controller.

Relevant Legal Bases

In accordance with Art. 13 GDPR, we inform you of the legal bases for our data processing activities. If the legal

basis is not specified individually in this privacy policy, the following applies:

• The legal basis for obtaining consent is Art. 6(1)(a) and Art. 7 GDPR

• The legal basis for processing to fulfill our services and carry out contractual measures is Art. 6(1)(b)

GDPR

• The legal basis for processing to fulfill our legal obligations is Art. 6(1)(c) GDPR

• The legal basis for processing based on our legitimate interests is Art. 6(1)(f) GDPR

• In cases where processing is necessary to protect vital interests of the data subject or another natural

person, Art. 6(1)(d) GDPR applies.

Security Measures

In accordance with Art. 32 GDPR, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, considering the state of the art, implementation costs, nature, scope, and context of the processing.

These measures include safeguarding the confidentiality, integrity, and availability of data through physical access controls, access control to systems and data, input controls, data separation, and regular evaluation. We also have procedures in place to ensure data subject rights, data deletion, and incident response.We further consider data protection by design and by default in accordance with Art. 25 GDPR, meaning privacy is

integrated into our technology and service choices from the outset.

Collaboration with Processors and Third Parties

If, in the course of our processing activities, we disclose data to other individuals or companies (processors or third

parties), transmit such data to them, or otherwise grant them access to the data, this is done only on the basis of:

• a legal permission (e.g., if data transfer to third parties, such as payment service providers, is necessary for

the performance of a contract pursuant to Art. 6(1)(b) GDPR),

• your consent,

• a legal obligation, or

• our legitimate interests (e.g., when using agents, web hosts, etc.).

If we commission third parties with the processing of data on the basis of a so-called “data processing agreement,”

this is done in accordance with Art. 28 GDPR.

Transfers to Third Countries

If we process data in a third country (i.e., outside the European Union (EU) or the European Economic Area (EEA))

or if this occurs in the context of using third-party services or disclosing/transmitting data to third parties, this is

done only if it is:

• necessary for the fulfillment of our (pre-)contractual obligations,

• based on your consent,

• due to a legal obligation, or

• based on our legitimate interests.

Subject to legal or contractual permissions, we only process or allow the processing of data in third countries if the

special requirements of Art. 44 et seq. GDPR are met. That means processing occurs, for example, based on:

• specific safeguards such as the EU Commission’s adequacy decisions, or

• the use of Standard Contractual Clauses (SCCs) approved by the European Commission.

Rights of the Data Subject

You have the following rights under GDPR:• Right of access (Art. 15 GDPR): You may request confirmation of whether your personal data is being

processed and receive information about this data.

• Right to rectification (Art. 16 GDPR): You can request that inaccurate data be corrected or incomplete data

be completed.

• Right to erasure (Art. 17 GDPR): You may request that your personal data be deleted without undue delay.

• Right to restriction of processing (Art. 18 GDPR): You can request restricted processing instead of deletion.

• Right to data portability (Art. 20 GDPR): You have the right to receive your data in a structured, commonly

used, and machine-readable format and request its transfer to another controller.

• Right to lodge a complaint (Art. 77 GDPR): You have the right to file a complaint with a data protection

authority.

Right of Withdrawal

You have the right to withdraw consent granted under Art. 7(3) GDPR at any time with effect for the future.

Right to Object

You can object to the future processing of your personal data at any time in accordance with Art. 21 GDPR. In

particular, you may object to processing for direct marketing purposes.

Cookies and Right to Object to Direct Marketing

"Cookies" are small files that are stored on users' devices. Different types of information can be stored in cookies.

Their main purpose is to store data about a user (or the device on which the cookie is stored) during and after their visit to a website.

• Temporary cookies or “session cookies” are deleted after the user leaves the website and closes their

browser. For example, these may store the contents of a shopping cart or login status.

• Permanent cookies remain stored even after closing the browser and can, for example, remember login

status across visits or store user preferences for analytics or marketing.

• Third-party cookies are cookies set by providers other than the website owner. If only the website’s own

cookies are used, they are called first-party cookies.

We may use both temporary and permanent cookies and inform you about this within this privacy policy.

If you do not want cookies to be stored on your device, please disable the appropriate option in your browser

settings. Stored cookies can also be deleted via the browser settings. Disabling cookies may lead to limited

functionality of this website.

A general objection to the use of cookies for online marketing purposes—particularly for tracking—can be declared

via:• U.S. site: http://www.aboutads.info/choices/

• EU site: http://www.youronlinechoices.com/

You can also disable the storage of cookies directly in your browser settings. However, please note that doing so

may prevent full use of all website functions.

Deletion of Data

Data processed by us will be deleted or their processing restricted in accordance with Art. 17 and 18 GDPR. Unless

explicitly stated in this privacy policy, stored data will be deleted as soon as they are no longer needed for their

intended purpose and provided no legal retention obligations prevent deletion.

If data is not deleted because it is needed for other legally permissible purposes, processing will be restricted. This

means the data will be blocked and not used for other purposes—for example, for tax or commercial law

obligations.

"User data is stored only as long as necessary for contractual and legal obligations. Upon request, personal data will

be deleted from our systems and third-party platforms within 30 days, provided there are no overriding legal

retention requirements. We ensure all services used (e.g., Fourthwall, Stripe, Komi.io) support GDPR-compliant

data deletion.”

Legal retention periods in Germany:

• 10 years: § 147(1) AO, § 257(1) Nos. 1 and 4, § 257(4) HGB

(books, records, accounting documents, commercial books, tax-relevant records)

• 6 years: § 257(1) Nos. 2 and 3, § 257(4) HGB

(commercial correspondence)

Legal retention periods in Austria:

• 7 years: § 132(1) BAO (accounting documents, receipts, business papers, etc.)

• 22 years: for documents related to real estate

• 10 years: for electronically supplied services under MOSS to non-business EU customers

Business-Related Processing

Additionally, we process:

• Contract data (e.g., subject matter, term, customer category)

• Payment data (e.g., bank account, transaction history)from our customers, prospects, and business partners to fulfill contractual services, provide customer service,

conduct marketing and advertising, and perform market research.

Order Processing in the Online Shop and Customer Account

We process the data of our customers in the context of order transactions in our online shop to enable them to select

and order the chosen products and services, as well as to enable their payment, delivery, or execution.

The data processed includes inventory data, communication data, contract data, and payment data. The affected

persons include our customers, prospects, and business partners. Processing is carried out for the purpose of

providing contractual services within the operation of the online shop, billing, delivery, and customer service. We

use session cookies to store cart contents and persistent cookies to save login status.

Processing is based on Art. 6 (1) lit. b (contract performance) and c (legal archiving obligations) GDPR. The

information marked as mandatory is necessary for the conclusion and fulfillment of the contract. Data is only

disclosed to third parties as part of delivery, payment, or within the framework of legal permissions and obligations

(e.g., to legal advisors, tax authorities). Data is only processed in third countries if necessary for contractual

performance (e.g., upon customer request during shipping or payment).

Users can optionally create a customer account, allowing them to view their orders. During registration, users are

informed about the mandatory information required. Customer accounts are not public and cannot be indexed by

search engines. If users cancel their account, the relevant data will be deleted, unless retention is required for

commercial or tax law reasons (Art. 6 (1) lit. c GDPR). Information in the customer account remains until its

deletion with subsequent archiving if legally required. It is the responsibility of users to back up their data before the

end of the contract.

As part of the registration and repeated logins, as well as the use of our online services, we store the IP address and

the time of the respective user action. This storage is based on our legitimate interests and the user’s interest in

protection against misuse and other unauthorized use. These data are not passed on to third parties unless required

for the pursuit of claims or there is a legal obligation (Art. 6 (1) lit. c GDPR).

Deletion takes place after expiry of statutory warranty and similar obligations. The necessity of retention is reviewed

every three years; in the case of statutory archiving obligations, deletion occurs after their expiration (commercial

law: 6 years; tax law: 10 years).

Payment Processing via Third Parties (e.g., Stripe, PayPal)

Payment processing in our merch shop is carried out via external payment providers such as Stripe and PayPal, who

process personal data (e.g., name, address, payment information) in the context of the order transaction. This

processing is based on Art. 6 (1) lit. b GDPR (contract performance).

For more information:

• Stripe: https://stripe.com/en/privacy

• PayPal: https://www.paypal.com/webapps/mpp/ua/privacy-full

Agency ServicesWe process our customers’ data in the context of our contractual services, which include strategic and conceptual

consulting, campaign planning, software and design development/consulting, maintenance, campaign execution and

handling, server administration, data analysis/consulting, and training.

We process the following data: inventory data (e.g., customer master data such as name or address), contact data

(e.g., email, telephone number), content data (e.g., text inputs, photos, videos), contract data (e.g., contract subject,

duration), payment data (e.g., bank details, payment history), and usage/meta data (e.g., for marketing performance

analysis). We generally do not process special categories of personal data unless they are part of a commissioned

project. The data subjects include our clients, prospects, their clients/users, website visitors, employees, and third

parties.

The purpose of the processing is to fulfill contractual services, billing, and customer support. The legal basis is Art. 6

(1) lit. b GDPR (contractual services) and Art. 6 (1) lit. f GDPR (analytics, statistics, optimization, security). Data is

disclosed to third parties only if necessary for fulfilling an assignment. We act strictly according to the client's

instructions and the legal framework for data processing on behalf (Art. 28 GDPR).

Data is deleted after the expiration of statutory retention periods. The necessity for retention is reviewed every three

years. If statutory retention applies, deletion occurs after their expiration (6 years under §257 (1) HGB, 10 years

under §147 (1) AO). For data disclosed to us in the context of a contract, deletion is carried out per the contract,

generally after the end of the assignment.

External Payment Providers

We use external payment providers via whose platforms users and we can process transactions (e.g., links to privacy

policies):

• PayPal: https://www.paypal.com/webapps/mpp/ua/privacy-full

• Klarna: https://www.klarna.com/privacy/

• Skrill: https://www.skrill.com/en/footer/privacy-policy/

• Giropay: https://www.giropay.de/rechtliches/datenschutz-agb/

• Visa: https://www.visa.de/datenschutz

• Mastercard: https://www.mastercard.de/de-de/datenschutz.html

• American Express: https://www.americanexpress.com/en/legal/privacy-center.html

We use these providers based on Art. 6 (1) lit. b GDPR for contract performance and, additionally, on our legitimate

interest in offering secure and efficient payment options (Art. 6 (1) lit. f GDPR).

The data processed by these services includes:

• inventory data (e.g., name, address)

• financial data (e.g., bank account or credit card number, passwords, TANs, checksums)• contract, amount, and recipient-related information