Privacy

This is a translation for convenience; the German version is legally binding.

Last updated: November 2026

In brief

This website uses no cookies, no analytics or statistics services and no advertising. Fonts and images are delivered from our own server. Third-party services – the map view (OpenStreetMap), YouTube videos and Instagram reels – are only loaded when you explicitly request them with a click.

Controller

Muddy What? GbR
Fabian Spang, Ina Spang
Donnersbergerstr. 53
80634 München
Germany

Email: info@muddywhat.de
Phone: +49 171 5413 649

We are not required to appoint a data protection officer.

Hosting and server log files

This website is hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Whenever a page is requested, the server automatically processes information sent by your browser: IP address, date and time of the request, requested address, amount of data transferred, status code, the previously visited page (referrer), and browser type and operating system.

This data is technically necessary to deliver the website and to keep it secure and stable. The legal basis is our legitimate interest under Art. 6 (1) (f) GDPR. Log files about visitors to the website are stored for a maximum of 7 days unless they are needed to investigate a specific security incident. We have a data processing agreement with STRATO under Art. 28 GDPR.

Cookies and local storage

We do not use cookies. If you switch on the map view, your browser remembers this choice in its local storage (entry “mw-map-ok”) so that you are not asked again on every page. The entry stays on your device, is never sent to us and can be removed at any time in your browser settings (“clear site data”). The legal basis is § 25 (2) no. 2 TDDDG, as the storage is expressly requested by you.

When content from YouTube or Instagram is loaded (see below), these providers may use their own cookies or similar technologies.

Map view (OpenStreetMap)

On the tour dates and archive pages you can display a map of concert venues. Only after you click “Show map” does your browser load map tiles from the servers of the OpenStreetMap Foundation, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Your IP address and technical browser information are transmitted to the OpenStreetMap Foundation in the process.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG. The European Commission has recognised the United Kingdom as providing an adequate level of data protection (adequacy decision). More information: OpenStreetMap Foundation privacy policy.

YouTube videos

We embed videos using YouTube’s privacy-enhanced mode. Until you click, we only show a preview image from our own server and there is no connection to YouTube. Only when you start a video is it loaded from YouTube, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In particular, your IP address, the page visited and technical information are transmitted; YouTube may use cookies or similar technologies and, if you are signed in to Google, link the request to your account.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, given by your click. Data may be transferred to Google LLC in the USA. Google is certified under the EU-US Data Privacy Framework, for which an adequacy decision of the European Commission exists. More information: Google privacy policy.

Instagram reels

On the home page we show preview images of our Instagram reels from our own server. Only when you play a reel is the Instagram player loaded, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. In particular, your IP address, the page visited and technical information are transmitted; Instagram sets cookies and, if you are signed in to Instagram or Facebook, may link the request to your account.

The legal basis is your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG, given by your click. Data may be transferred to Meta Platforms, Inc. in the USA. Meta is certified under the EU-US Data Privacy Framework. More information: Instagram privacy policy.

Links to other websites

Our site links to other services, such as Google Maps (venues), ticket shops and promoters, our merch shop, streaming services and our social media profiles. These links open in a new window. No data is sent to these providers when you visit our site; only once you follow a link does the respective provider’s privacy policy apply.

You sign up for our newsletter on a page of our mailing service Mailchimp (The Rocket Science Group LLC d/b/a Mailchimp, 405 N Angier Ave NE, Atlanta, GA 30308, USA, an Intuit Inc. company). Your email address is all that is needed; a name is optional. You will receive an email asking you to confirm your subscription (double opt-in). Mailchimp logs the time of sign-up and confirmation and your IP address so that we can prove your consent.

The legal basis for sending the newsletter is your consent under Art. 6 (1) (a) GDPR. Mailchimp records whether a newsletter was opened and which links were clicked; this helps us improve its content. You can unsubscribe at any time via the link in every issue or here. After you unsubscribe we remove your address from the mailing list; to prove earlier consent it may be kept, blocked from any other use, for up to three years (Art. 6 (1) (f) GDPR).

Mailchimp processes the data on our behalf (Art. 28 GDPR) in the USA. Mailchimp/Intuit is certified under the EU-US Data Privacy Framework. More information: Mailchimp privacy statement.

Contact by email or phone

If you contact us by email or phone, for example with a booking request, we process your details to handle your enquiry. The legal basis is Art. 6 (1) (b) GDPR where a contract or its preparation is concerned, otherwise our legitimate interest in replying under Art. 6 (1) (f) GDPR. We delete the data once it is no longer needed, unless statutory retention obligations (e.g. for contracts and invoices) apply.

We are present on Instagram, Facebook, YouTube and TikTok, among others. When you visit these profiles, the respective operators process your data under their own terms. For our Facebook page and Instagram profile we are jointly responsible with Meta for the statistics (“Insights”) (Art. 26 GDPR); Meta has published a joint controller addendum and is primarily responsible for fulfilling your rights. We process messages you send us there in order to reply.

Your rights

You have the right at any time to

access the data we hold about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
withdraw consent with effect for the future (Art. 7 (3) GDPR).

Right to object: where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

An informal email to info@muddywhat.de is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de.

Security

This website is delivered encrypted via HTTPS, indicated by the padlock icon in your browser’s address bar.