Privacy Policy

Controller

Controller

MOON SHOT MUSIC OY
Opastinsilta 8 D
00520 Helsinki
Finland

Email

info@moonshot.music

Please use that address for any question or request concerning data protection. Full company details are listed in the Imprint.

Server log files

Every time a page is requested, our hosting provider's web server automatically records technical data that your browser transmits:

• your IP address,
• date and time of the request,
• the file or page requested and the amount of data transferred,
• the HTTP status code and referring URL,
• browser type, version and operating system.

Purpose: delivering the site, ensuring stability and security, and investigating attacks or abuse. Legal basis: Article 6(1)(f) GDPR — our legitimate interest in operating a working and secure website. Retention: log data is kept only for as long as it is needed for these purposes — in the case of a security incident until it has been investigated and resolved — and is deleted or anonymised afterwards. This data is never used to identify you personally, and it is not combined with other data sources.

Hosting

The site is hosted for us by more than ads GmbH & Co. KG, Bitburg, Germany, on servers located in the European Union. The provider acts as a processor on our behalf and is bound by a data processing agreement pursuant to Article 28 GDPR; it processes the log data described above solely for the purpose of operating the site.

Fonts and icons

The typefaces Archivo and Anton and the small platform icons in the channel list and in the footer are stored on our own server and delivered together with the page. They are not fetched from Google Fonts, from a content delivery network or from any other third party, so no connection to an external provider is established and your IP address is not transmitted to anyone but our hosting provider when the page loads.

Links to other services

Links to Spotify, Apple Music, YouTube, Instagram, Facebook, the ticket shops and our merch shop are plain hyperlinks. Nothing is embedded, so none of those providers receives data until you actively click a link — from that point on, the privacy policy of the respective provider applies. Ticket purchases and merch orders are handled entirely by those platforms; we do not receive your payment data.

Newsletter

You can subscribe to our newsletter through the sign-up window on the start page. We process the email address you enter, the date and time of your sign-up and of your confirmation, and the IP address used for both. The dates and IP addresses are stored solely so that we can prove your consent if we ever have to; they are not used for anything else.

How the sign-up works

We use a double opt-in procedure. After you enter your address we send you a single email asking you to confirm it. Your address is only added to our list once you click the link in that email. If you do not confirm, the entry is deleted automatically. This step makes sure nobody can sign up an address that is not theirs.

Purpose: sending you news about releases, tour dates and the band. Legal basis: Article 6(1)(a) GDPR — your consent, which you give by ticking the box and confirming the email. Retention: we keep your data for as long as you are subscribed. After you unsubscribe we delete the address; we only keep the record of your consent and your unsubscription for as long as we may need it to defend against claims.

Withdrawing your consent

You can unsubscribe at any time and with effect for the future, either through the unsubscribe link at the end of every newsletter or by emailing info@moonshot.music. Withdrawing your consent does not affect the lawfulness of the mailings sent before you withdrew it.

Our newsletter provider

The newsletter is sent for us by Brevo (Sendinblue GmbH, Koepenicker Strasse 126, 10179 Berlin, Germany, part of Brevo SAS, Paris, France), on servers located in the European Union. Brevo acts as a processor on our behalf and is bound by a data processing agreement pursuant to Article 28 GDPR. Brevo stores your address and sends the mailings; it may not use your data for its own purposes. Your address is passed to Brevo by our own server, not by your browser — the sign-up window itself loads nothing from Brevo.

We do not measure whether you open our newsletters or which links you click, and we do not build a profile of your reading behaviour.

Contacting us by email

If you write to us, we process your email address, your name and the content of your message in order to answer you. Legal basis: Article 6(1)(b) GDPR where your message concerns a contract or its preparation, otherwise Article 6(1)(f) GDPR — our legitimate interest in responding to enquiries. We keep the correspondence for as long as it is needed to deal with your matter, and delete it once the exchange has been concluded and no statutory retention obligation requires us to keep it any longer. You can ask us to erase your enquiry at any time.

Fan video uploads

You can send us a clip you filmed at one of our shows. This is entirely voluntary — the site works without it.

What we process

The video file itself, its length and size, and the city you select. Optionally your name and your email address, if you choose to give them. Together with every submission we store the date and time, your IP address, and the exact wording of the usage agreement you accepted, so that both sides can later establish what was agreed.

Purpose: reviewing submissions and, where we use them, producing and publishing band content. Legal basis: Article 6(1)(a) GDPR — your consent, given by ticking the box. The video itself is additionally used on the basis of the separate rights agreement you accept when submitting. Retention: submissions we do not use are deleted after the tour. Submissions we use are kept for as long as the resulting content is published, together with the record of your agreement.

Where the files are stored

On the same server that hosts this site, operated for us by more than ads GmbH & Co. KG in Germany. The files are stored outside the publicly accessible area: there is no gallery, no listing and no address under which a submitted video could be retrieved. Only our team can access them. No third party is involved and no data leaves the EU.

Other people in your clip

A concert is a public gathering, and footage of such an event may generally be published without asking everyone in the picture. That exception covers the event itself — it does not cover clips that single out an individual, for example a close-up of one person in the crowd. Please do not send those. We review every submission before using it, and we leave out anything where this is unclear. If you appear in a clip we published and want it taken down, email info@moonshot.music.

Withdrawing

You can ask us to delete your submission at any time by emailing info@moonshot.music. If you gave us an email address, the confirmation we send you contains a copy of what you agreed to. Withdrawal does not affect content already published before you withdrew.

Storage on your device

The newsletter window appears once per visit. Simply closing it changes nothing — it will appear again next time. Only if you choose Don't show this again, or if you sign up, do we store a single entry in your browser's local storage under the name ms-crew. It contains the word off and nothing else, and its only job is to stop the window from appearing. It holds no identifier, it is never sent to our server, and we cannot read it from anywhere else. The Newsletter link in the footer opens the window again at any time.

No consent banner is required for it: it is used exclusively to provide a function you have explicitly asked for by choosing to hide the window, and it is not used to recognise or track you. You can delete the entry at any time by clearing your browser's site data.

Apart from this one entry, nothing is written to your device — no cookies, no session storage.

What this site does not do

• No cookies and no tracking storage: apart from the single newsletter entry described above, nothing is written to your device.
• No analytics, no tracking pixels, no advertising networks, no social media plug-ins.
• No external resources: every font, image and icon comes from our own server, and your browser never contacts a third party — not when you sign up for the newsletter, and not when you upload a video.
• No user accounts and no comment function. Newsletter and video upload are optional and need your explicit consent.
• No profiling and no automated decision-making within the meaning of Article 22 GDPR.
• The animated starfield runs entirely in your browser and stores nothing.

Recipients and third countries

Apart from our hosting provider and — if you have subscribed to the newsletter — our newsletter provider Brevo, both named above, we do not pass your data on to anyone. Both act as processors on our behalf under a data processing agreement pursuant to Article 28 GDPR and process your data only on our instructions. Data is disclosed to public authorities only where we are legally obliged to do so. Both providers process your data on servers within the EU.

Encryption

This site is delivered over TLS (https). You can tell from the padlock in your browser's address bar that the connection is encrypted and cannot be read by third parties in transit.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you (Article 15),
• have inaccurate data corrected (Article 16),
• have your data erased (Article 17),
• have processing restricted (Article 18),
• receive your data in a portable format (Article 20),
• object to processing based on legitimate interests (Article 21),
• withdraw a consent you have given us at any time with effect for the future (Article 7(3)) — for the newsletter, the unsubscribe link in every mailing is enough.

To exercise any of these rights, an email to info@moonshot.music is enough. We answer within one month; where a request is complex, we may extend that period and will tell you why.

Right to lodge a complaint

You can complain to a data protection supervisory authority at any time. The authority responsible for us is the Office of the Data Protection Ombudsman, Lintulahdenkuja 4, 00530 Helsinki, Finland (tietosuoja.fi). You may also contact the supervisory authority in the EU member state where you live or work.

Changes to this policy

We update this policy when the site changes technically or when the legal situation requires it. The version currently published here applies; the date at the top tells you when it was last revised.