Skip to Content

PRIVACY POLICY

This privacy policy applies to the CAVE website, online shop and the internal CAVE Marketing & Growth Platform.

1. PRIVACY AT A GLANCE

GENERAL INFORMATION

This privacy policy explains how personal data is processed when you visit this website, contact us, place an order in the online shop or use an expressly authorized platform connection. Personal data is any information relating to an identified or identifiable person.

2. CONTROLLER

The controller responsible for the processing described in this privacy policy is:

Roberto Palacios, trading as CAVE
Kleeweg 3
71139 Ehningen
Germany
Telephone: +49 7031 3048150
Email: contact@cave.band

The controller is the person who determines the purposes and means of processing personal data alone or jointly with others.

3. YOUR DATA-PROTECTION RIGHTS

Subject to the applicable statutory requirements, you have the following rights:

  • Access under Article 15 GDPR
  • Rectification under Article 16 GDPR
  • Erasure under Article 17 GDPR
  • Restriction of processing under Article 18 GDPR
  • Data portability under Article 20 GDPR
  • Withdrawal of consent under Article 7(3) GDPR
  • Objection under Article 21 GDPR
  • Complaint to a supervisory authority under Article 77 GDPR

4. WEBSITE ACCESS, SERVER LOGS AND ENCRYPTION

When you access the website, the hosting provider automatically processes technical data required to deliver and protect the service, including:

  • Browser type and version
  • Operating system
  • Referrer URL
  • Host name of the accessing device
  • Time of the request
  • IP address

Processing is based on Article 6(1)(f) GDPR and our legitimate interest in secure, stable and technically correct operation. Data is erased or anonymized when it is no longer required for operation, troubleshooting or abuse prevention and no legal ground requires further retention. The website uses TLS encryption.

5. HOSTING

The website and planned server-side platform components are hosted by an external service provider. Processing is based on Article 6(1)(b) GDPR where necessary for contractual services and Article 6(1)(f) GDPR for secure and efficient provision. A data-processing agreement is used where required.

Hosting provider:

Hetzner Online GmbH
Industriestr. 25
91710 Gunzenhausen
Germany

6. COOKIES

The website uses cookies that are technically necessary for operation, including session management. They are used on the basis of Article 6(1)(f) GDPR and the applicable telecommunications data-protection rules. Optional analytics or marketing cookies are used only after consent under Article 6(1)(a) GDPR and section 25(1) TDDDG. Consent may be withdrawn through the available cookie settings.

7. CONTACT FORM AND EMAIL

If you contact us, we process the information you provide to handle the enquiry and reasonable follow-up. Processing is based on Article 6(1)(b) GDPR for contractual or pre-contractual matters, otherwise on Article 6(1)(f) GDPR for effective communication, or on consent where expressly requested. The data is erased when the enquiry is complete and no contractual, statutory or legal-claims purpose requires further retention.

8. ONLINE SHOP AND ORDERS

When you place an order, we process contact, delivery, order, payment-status and communication data to conclude and perform the contract under Article 6(1)(b) GDPR and to comply with legal obligations under Article 6(1)(c) GDPR. Required data may be provided to payment-service providers selected during checkout, shipping companies, tax advisers and public authorities where legally required. Commercial and business correspondence is generally retained for six years, invoices and accounting vouchers for eight years, and certain primary accounting records for ten years. Other shop and account data is erased or anonymized when its purpose ends and no other legal basis remains.

9. SOCIAL MEDIA LINKS AND CONNECTED PLATFORM ACCOUNTS

The website contains ordinary links to Instagram, Facebook, YouTube, TikTok, Spotify and Apple Music. Data is transmitted to those providers only when you follow a link. The internal CAVE Marketing & Growth Platform may connect CAVE-owned social-media accounts after authorization by an authorized user. It may process account identifiers, display names, permissions, OAuth tokens, approved content, publication settings, post identifiers, status information and redacted audit data to securely plan, approve and publish CAVE content. Processing is based on Article 6(1)(f) GDPR and our legitimate interest in secure management of CAVE-owned accounts. Data is transmitted to the selected platform provider, for example TikTok. Tokens and permissions are disabled and erased without undue delay after disconnection, revocation or loss of authorization. Other data is erased or anonymized when the documented purpose ends unless statutory retention or legal claims require continued restricted storage.

10. RETENTION

Personal data is retained only for as long as necessary for the stated purpose or required by law. Where statutory retention applies, data is restricted from normal operational use. Commercial and business correspondence is generally retained for six years, invoices and accounting vouchers for eight years, and certain books, annual accounts and related organizational records for ten years. Data is erased or anonymized after the applicable purpose and legal grounds cease to apply. Legal holds, tax audits or legal proceedings may require longer restricted retention.

11. RIGHT TO OBJECT

Where processing is based on legitimate interests under Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation. Direct-marketing processing may be objected to at any time without giving reasons.

Last updated: 28 August 2026