Privacy policy
This English text is for convenience. The German version is legally authoritative. Datenschutzerklärung
At a glance
- We process only what you send us and what we need to deliver studio services.
- No ad tracking, no analytics cookies, no sale of data.
- Session audio stays on your brief — we do not use it for machine learning.
- Questions and rights requests: [email protected] or 01 966 12 34.
1. Who is responsible
The controller under the General Data Protection Regulation (GDPR) and Austrian Data Protection Act (DSG) is Mumbocetra GmbH, a limited liability company (GmbH), Neubaugasse 40, 1070 Wien, Austria. Managing director: Lukas Brandstetter. VAT ID: ATU62832297. Company register: FN 571536 g, court: Handelsgericht Wien.
We operate the Mumbocetra recording studio in Vienna Neubau. This policy covers mumbocetra.click, contact requests, quotes, bookings, sessions, billing and day-to-day operations. We have not appointed a data protection officer where not required by law; privacy contact: [email protected].
2. Scope and roles
This policy is for website visitors, enquirers and clients of our services.
If you book as a consumer, we are usually the controller. If you are a business client and send us data about guests, musicians or podcast participants, you decide how those recordings are used; we then act as processor under our data processing agreement. See guest release guidance for podcasts.
Contract terms: terms and conditions. Browser storage: cookie policy.
3. Data we collect
Contact form and email: name, email address, optional phone, requested service, optional preferred date and project description. Required fields are needed for a meaningful reply.
Booking and delivery: billing and payment details, artist or band name, scheduling, correspondence, bank transfer references. Card payments at the studio use our bank terminal — we do not store full card numbers.
Recordings and project files: voice and performance are personal data when you can be identified. We use them only to perform the service (e.g. Vocals & singing, Stem mixing, Podcast & talk). Video you bring to the session remains your responsibility.
Technical data: our host World4You Internet Services GmbH processes server logs (IP address, time, page requested, user agent) to secure the site. Your consent choice is stored locally under mmbc_consent_v1 without identifying you in that entry.
We do not collect special-category data. If you need to reschedule for personal reasons, a short message is enough — no medical certificate.
4. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying and preparing quotes | Form, correspondence | Art. 6(1)(b) GDPR (pre-contractual steps) | 3 years after last contact |
| Booking, performance and follow-up | Identity, contact, project, schedule | Art. 6(1)(b) GDPR (contract) | 5 years after the relationship ends (general limitation) |
| In-studio project archive | Recordings, session files | Art. 6(1)(b) GDPR | 24 months after last service, then deletion unless agreed otherwise |
| Invoicing and tax | Identity, billing, payments | Art. 6(1)(c) GDPR (legal obligation) | 7 years under Austrian tax law |
| Defending claims | Correspondence, contract files | Art. 6(1)(f) GDPR (legitimate interest) | Until relevant limitation periods expire |
| Website security | Server logs at the host | Art. 6(1)(f) GDPR | Usually up to 12 months, or shorter if the host retains less |
| Storing your tracker choice | Key mmbc_consent_v1 in the browser | Art. 6(1)(c) GDPR (ePrivacy implementation) | 182 days |
Your information is not traded or shared for third-party marketing. We do not operate mailing lists. We aim to reply within 2 working days (FAQ).
Where we rely on legitimate interest, you may object under Art. 21 GDPR.
5. Voice, image, minors and AI
Your voice and image are protected under Austrian law. We do not publish audio excerpts, session photos or your name on the website or social channels without prior written consent.
Client audio is never fed into machine-learning pipelines for model building or evaluation, and synthetic voice doubles are produced only with explicit written consent from the individual.
Participants aged 16 and over are welcome. Minors are booked by a legal guardian who provides information and consent. The contact form is not aimed at children under 16.
6. Recipients and processors
Only team members who need access for their role (about us) can view your data. External recipients include:
- World4You Internet Services GmbH, Hafenstraße 47–51, 4020 Linz, Austria — website hosting in Austria;
- FormSubmit (formsubmit.co) — forwarding the contact form to our mailbox;
- accountant — billing data under professional secrecy;
- bank — payment processing;
- authorities — when legally required.
All processors are bound by Art. 28 GDPR contracts. We provide an up-to-date list on request.
7. Transfers outside the EU
Hosting and mail operations are mainly in Austria or the EU. FormSubmit is operated from the United States: form contents may be processed there briefly. We rely on Art. 49(1)(b) GDPR because the transfer is necessary for pre-contractual steps you request.
To avoid this transfer, email [email protected] or call 01 966 12 34 — we handle your request the same way.
8. Security
We use appropriate measures: HTTPS, restricted staff access, strong passwords, encryption on workstations and backup media where available, locked premises outside sessions, and deletion after the archive period.
If a breach is likely to affect your rights, we notify the Austrian Data Protection Authority and you when the risk is high (Arts. 33 and 34 GDPR). No internet transmission is completely risk-free; once data reaches us, our safeguards apply.
9. Your rights
You have the right to access, rectification, erasure, restriction, portability and objection (Arts. 15–21 GDPR), and to withdraw consent for the future (Art. 7(3) GDPR).
Contact [email protected] or our postal address. We usually respond within one month; complex cases may take two more months with notice (Art. 12(3) GDPR). Requests are generally free; manifestly unfounded or excessive requests may incur a fee.
You may lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at. Please contact us first — most issues are resolved quickly.
10. Cookies and similar technologies
The site does not use analytics, advertising or social trackers. We only store your consent decision in localStorage (key mmbc_consent_v1, 182 days). The banner offers equally prominent Accept all, Reject all and Customise; optional categories are empty today.
Details: cookie policy. Change settings anytime via .
11. External services and links
The contact page links to OpenStreetMap (OpenStreetMap) for directions. Their privacy policy applies separately. See also legal notice.
12. Status and changes
This policy describes our practices; it does not limit statutory rights. We update it when services, technology or law change. Effective 15 October 2026; last updated 15 October 2026.
Contact: Mumbocetra GmbH, Neubaugasse 40, 1070 Wien — [email protected], 01 966 12 34.