Legal

Privacy

What happens to your data on this site and in the BPM Player app.

Draft — check before this goes live. One thing is still open: the data processing agreement with Brevo (section 3), marked “TO CONFIRM”. This is a working draft, not legal advice.

1. Controller

Kirill Lorenz, Frise – Abbildungszentrum, Hinterhof, Arnoldstr. 26–30, 22765 Hamburg, Germany · hi@bpmplayer.com. Full details in the imprint.

2. Visiting this site

This site loads no external resources: no fonts, scripts, images or trackers from third-party servers, and it sets no cookies. There is no analytics script running in your browser and no advertising.

Your browser does transmit the usual technical data to the server that delivers the page — IP address, time, requested file, referrer, browser and operating system. This is necessary to deliver the site at all and is processed on the basis of a legitimate interest in operating it securely (Art. 6 (1) (f) GDPR).

The download counter. Clicking the download button is counted, in aggregate, so it is possible to see which channels actually bring people to the app. Recorded per download: the date, the channel — a short word for the site's own button, or the domain of the page you followed a plain link from, otherwise "direct" — the country your request came from, as Cloudflare's network already derives it for routing, and the app version. This runs server-side in Cloudflare Workers Analytics Engine, not as a script in your browser: no IP address, no cookie, no identifier is stored with it, and no single entry can be tied back to a visit or a person. Basis is a legitimate interest in knowing which channels reach people (Art. 6 (1) (f) GDPR).

The visit counter. Opening the home page or the page for dance teachers is counted the same way, so the downloads from a channel can be set against the visits it brought. Recorded per page request: the time, the page, the channel by the same rule as above, including the medium and campaign a tagged link names (or "internal" when you came from another page of this site), and the country. It runs server-side in the same Analytics Engine, not as a script in your browser: no IP address, no cookie, no identifier, and no entry can be tied back to a person. Search engine crawlers and link previews are not counted. Same basis as the download counter.

The site is hosted on Cloudflare Pages, operated by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA. Cloudflare delivers the pages and writes the server log described above on our behalf, as a processor under Art. 28 GDPR, on the terms of its data processing addendum. Delivery runs over a global network, so the request may be handled by a server outside the EU; Cloudflare covers those transfers with the EU standard contractual clauses.

3. The optional update notes

You do not need to leave an email address to get BPM Player — the download button works without one. Next to it is an optional form: leave an address there and you get one email when a new version of the app does something new. Nothing else, and it changes nothing about downloading the app itself. Your address is not sold, rented or passed to anyone for their own purposes.

Double opt-in. After you enter your address you receive one email with a confirmation link. Only when you click it is your address stored on the list. If you do not click, the entry is discarded. To prove that the confirmation was given, the time of registration, the time of confirmation and your IP address are stored alongside your address.

Where you came from. One more thing is stored next to your address: if you reached the form through a link carrying campaign parameters, the name in that link — otherwise the domain of the site you followed the link from, if there was one. It tells us which channel actually reaches people, and it is a single word or a domain name. No full address of the page, no record of what else you looked at, nothing that outlives the entry: it is deleted with the rest when you unsubscribe.

Legal basis. Your consent, Art. 6 (1) (a) GDPR, given by clicking the confirmation link. You can withdraw it at any time with effect for the future — every email carries an unsubscribe link, or write to the address above. Withdrawing does not affect the lawfulness of what happened before.

Storage. Your address stays on the list until you unsubscribe. After that it is deleted, except where a legal retention obligation applies.

Processor. The list is run with Brevo, operated by Sendinblue GmbH, Köpenicker Str. 126, 10179 Berlin, Germany. Brevo processes your address on our behalf and under our instructions. TO CONFIRM — conclude and record the data processing agreement under Art. 28 GDPR in the Brevo account.

4. The app itself

BPM Player runs entirely on your Mac. It reads the audio files you drop into it and plays them from where they are; nothing is uploaded, copied or sent anywhere. The app does not contain analytics and does not report usage.

The one connection it makes is the update check: on start it asks the release server whether a newer version exists. That request transmits the technical data any HTTP request transmits, including your IP address. Basis is our legitimate interest in shipping security and bug fixes (Art. 6 (1) (f) GDPR).

From version 1.0.2 the check goes to bpmplayer.com, which forwards it to the release server on GitHub. On the way, each check is counted: the date, the app version the request names and the country Cloudflare derives from the connection. The IP address is not recorded. The update component also sends a random number it keeps on your Mac for staged rollouts; that is not recorded either. The count tells us how often the app is started, not who starts it. Same legal basis: our legitimate interest in knowing whether the app is in use and which versions are still out there.

5. Your rights

Access to the data stored about you (Art. 15 GDPR)
Correction of inaccurate data (Art. 16)
Erasure (Art. 17) and restriction of processing (Art. 18)
Data portability (Art. 20)
Objection to processing based on legitimate interest (Art. 21)
Withdrawal of consent at any time (Art. 7 (3))

A message to hi@bpmplayer.com is enough.

6. Complaints

You may complain to a supervisory authority. The competent one here is Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg.