EN / DE
Privacy policy
This is a translation provided for convenience. The legally binding version is the German Datenschutzerklärung. In case of any discrepancy, the German text prevails.
Introduction
With this privacy policy we would like to inform you about the types of personal data (also referred to below simply as "data") we process, for what purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the context of providing our services and in particular on our websites, in mobile applications and within external online presences such as our social media profiles (collectively referred to as the "online offering").
The terms used are not gender-specific.
Last updated: 12 September 2026
Table of contents
Controller
Legacy Reborn
Elisabethstraße 72
80797 Munich
Germany
Authorised representative:
Carlos Chavez
Email address:
Further mandatory information can be found in our imprint.
Overview of processing activities
The following overview summarises the types of data processed and the purposes of processing, and refers to the categories of data subjects concerned.
Types of data processed
Categories of data subjects
Purposes of processing
Relevant legal bases
Below you will find an overview of the legal bases under the GDPR on which we process personal data. Please note that in addition to the provisions of the GDPR, national data protection rules may apply in your or our country of residence or establishment. Should more specific legal bases be relevant in an individual case, we will inform you of these in this privacy policy.
In addition to the data protection rules of the GDPR, national data protection rules apply in Germany. These include in particular the Federal Data Protection Act (Bundesdatenschutzgesetz – BDSG). The BDSG contains special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes, transfers, and automated decision-making in individual cases including profiling. It also governs data processing for employment purposes (§ 26 BDSG), in particular regarding the establishment, performance or termination of employment relationships and employee consent. State data protection acts of the individual federal states may also apply.
Note on the TDDDG: The storing of information on users’ terminal equipment and the accessing of information already stored there is additionally governed by § 25(1) TDDDG (German Telecommunications Digital Services Data Protection Act). Where such storage and access is not strictly necessary, we obtain your consent. On this website this concerns only the embedded content from YouTube, Spotify and Bandsintown.
Transfer of personal data
In the course of our processing of personal data, it may happen that the data is transferred to, or disclosed to, other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks or providers of services and content which are embedded into a website. In such cases we comply with the legal requirements and in particular conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data.
Data processing in third countries
Where we process data in a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or where processing takes place in the context of using third-party services or of disclosing or transferring data to other persons, bodies or companies, this only occurs in accordance with the legal requirements.
Subject to express consent or a transfer required by contract or by law, we only process or allow data to be processed in third countries with a recognised level of data protection, on the basis of contractual obligations through so-called standard contractual clauses of the EU Commission, where certifications exist, or where binding corporate rules apply (Art. 44 to 49 GDPR, information page of the EU Commission: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en).
Transfers to the USA in connection with the services named in this policy (Google/YouTube, Bandsintown) take place on the basis of your consent pursuant to Art. 49(1)(a) GDPR and, where the respective provider is certified, on the basis of the EU-US Data Privacy Framework adequacy decision. Please note that US authorities may, under certain conditions, access such data and that enforcing your rights may be more difficult there.
Erasure of data
The data processed by us will be erased in accordance with the legal requirements as soon as the consents permitting the processing are withdrawn or other permissions cease to apply (e.g. if the purpose of processing the data no longer applies or the data is not necessary for the purpose). If the data is not erased because it is required for other and legally permissible purposes, its processing will be restricted to those purposes. That is, the data will be blocked and not processed for other purposes. This applies, for example, to data that must be retained for commercial or tax law reasons, or whose storage is necessary for the establishment, exercise or defence of legal claims, or for the protection of the rights of another natural or legal person.
Our privacy notices may also contain further information on the retention and erasure of data that applies with priority to the respective processing activities.
Use of cookies
Cookies are small text files, or other forms of stored records, that store information on terminal equipment and read information from it. For example, to store the login status in a user account, the contents of a shopping basket in an online shop, the content accessed or the functions used within an online offering. Cookies can also be used for a variety of purposes, such as the functionality, security and convenience of online offerings and the creation of analyses of visitor flows.
Notes on consent: We use cookies in accordance with the legal requirements. We therefore obtain prior consent from users, except where this is not required by law. Consent is in particular not necessary where the storing and reading of the information, including cookies, is strictly necessary in order to provide users with a telemedia service (i.e. our online offering) that they have expressly requested. The revocable consent is clearly communicated to users and contains the information on the respective use of cookies.
Notes on the legal bases under data protection law: Which legal basis we rely on when processing users’ personal data with the help of cookies depends on whether we ask users for consent. If users consent, the legal basis for processing their data is the declared consent. Otherwise, the data processed by means of cookies is processed on the basis of our legitimate interests (e.g. in the commercial operation of our online offering and the improvement of its usability) or, where this takes place in the context of fulfilling our contractual obligations, where the use of cookies is necessary in order to fulfil those obligations. We explain the purposes for which we process cookies in the course of this privacy policy or as part of our consent and processing procedures.
Retention period: With regard to the retention period, the following types of cookies are distinguished:
General information on withdrawal and objection (opt-out): Users may withdraw the consent they have given at any time and may also object to processing in accordance with the legal requirements of Art. 21 GDPR. Users may also declare their objection via their browser settings, for example by disabling the use of cookies (which may also limit the functionality of our online services). An objection to the use of cookies for online marketing purposes can also be declared via the websites https://optout.aboutads.info and https://www.youronlinechoices.com/.
Cookies and consent on this website:
This website does not itself set any cookies for analytics, tracking or marketing purposes, and does not use an external cookie banner service. Cookies and comparable storage operations arise here exclusively from the third-party content we embed (YouTube, Spotify and Bandsintown). This content is only loaded after you have given your consent. As long as you have not consented, no connection is established to these providers and in particular your IP address is not transmitted; you will only see a local placeholder in the relevant position.
All or nothing: Consent applies uniformly to all three services named above. It is not technically possible to enable only individual services. If you choose "Allow", YouTube, Spotify and Bandsintown are activated together; if you choose "Decline", none of the three services is active. The buttons on the individual placeholders also grant consent for all three services.
Storage of your decision: Your decision is not transmitted to us or to any third party, but is stored exclusively locally in your browser, namely in local storage under the key lr-embed-consent with the value granted or denied. No user identifier is created, and no timestamp, device identifier or browser identifier is stored. The entry remains until you change it or delete the website data in your browser.
Withdrawal: You can withdraw your consent at any time with effect for the future. To do so, use the "Cookie settings" button in the footer of any page and select "Decline". Content that has already been loaded will still be displayed until the next page load. Cookies already set by the providers can be deleted via your browser settings. The lawfulness of the processing carried out up to the point of withdrawal remains unaffected.
Commercial services
We process the data of our contractual and business partners, e.g. customers and prospective customers (collectively referred to as "contractual partners"), in the context of contractual and comparable legal relationships as well as related measures and in the context of communication with the contractual partners (or pre-contractually), for example in order to answer enquiries.
We process this data in order to fulfil our contractual obligations. This includes in particular the obligations to provide the agreed services, any update obligations and remedies in the event of warranty claims and other service disruptions. In addition, we process the data to safeguard our rights and for the purposes of the administrative tasks associated with these obligations as well as for the organisation of our business. We also process the data on the basis of our legitimate interests in proper and commercially sound business management and in security measures to protect our contractual partners and our business operations from misuse and from risks to their data, secrets, information and rights (e.g. involving telecommunications, transport and other auxiliary services as well as subcontractors, banks, tax and legal advisors, payment service providers or tax authorities). Within the framework of applicable law, we only pass on the data of contractual partners to third parties to the extent necessary for the aforementioned purposes or to fulfil legal obligations. Contractual partners will be informed about further forms of processing, e.g. for marketing purposes, within the scope of this privacy policy.
We inform contractual partners which data is required for the aforementioned purposes before or in the course of data collection, e.g. in online forms, by means of special markings (e.g. colours) or symbols (e.g. asterisks or similar), or in person.
We erase the data after expiry of statutory warranty and comparable obligations, i.e. generally after four years, unless the data is stored in a customer account, e.g. for as long as it must be retained for legal archiving reasons. The statutory retention period is ten years for documents relevant under tax law, as well as for commercial books, inventories, opening balance sheets, annual financial statements, the working instructions and other organisational documents necessary to understand these documents, and accounting vouchers; and six years for commercial and business letters received and for reproductions of commercial and business letters sent. The period begins at the end of the calendar year in which the last entry was made in the book, the inventory, opening balance sheet, annual financial statement or management report was drawn up, the commercial or business letter was received or sent, or the accounting voucher was created, the record was made, or the other documents came into being.
Where we use third-party providers or platforms to provide our services, the terms and conditions and privacy notices of the respective third-party providers or platforms apply to the relationship between users and those providers.
Further information on processing operations, procedures and services:
Provision of the online offering and web hosting
In order to provide our online offering securely and efficiently, we use the services of one or more web hosting providers, from whose servers (or servers managed by them) the online offering can be accessed. For these purposes we may use infrastructure and platform services, computing capacity, storage space and database services as well as security services and technical maintenance services.
The data processed in the context of providing the hosting offering may include all information relating to the users of our online offering that arises in the course of use and communication. This regularly includes the IP address, which is necessary in order to deliver the content of online offerings to browsers, and all entries made within our online offering or on web pages.
Further information on processing operations, procedures and services:
Audio content
We use hosting and analytics offerings from service providers in order to make our audio content available for listening or download and to obtain statistical information on the retrieval of the audio content.
Further information on processing operations, procedures and services:
Presence on social networks (social media)
We maintain online presences within social networks and, in this context, process data of users in order to communicate with the users active there or to offer information about us.
We would like to point out that user data may be processed outside the European Union in this context. This may result in risks for users, because it could, for example, make it more difficult to enforce users’ rights.
Furthermore, user data within social networks is generally processed for market research and advertising purposes. For example, usage profiles may be created based on usage behaviour and the resulting interests of users. These usage profiles may in turn be used, for example, to place advertisements within and outside the networks that presumably correspond to users’ interests. For these purposes, cookies are generally stored on users’ computers, in which the usage behaviour and interests of users are stored. Furthermore, data may also be stored in the usage profiles independently of the devices used by the users (in particular if the users are members of the respective platforms and are logged in to them).
For a detailed description of the respective forms of processing and the opt-out options, we refer to the privacy policies and information of the operators of the respective networks.
In the case of requests for information and the assertion of data subject rights, we would also point out that these can be asserted most effectively with the providers. Only the providers have access to users’ data and can take appropriate measures and provide information directly. If you nevertheless need help, you can contact us.
Further information on processing operations, procedures and services:
Plugins and embedded functions and content
We embed functional and content elements into our online offering that are obtained from the servers of their respective providers (referred to below as "third-party providers"). These may, for example, be graphics, videos or maps (referred to uniformly below as "content").
Embedding always requires that the third-party providers of this content process the IP address of users, since without the IP address they could not send the content to their browser. The IP address is therefore necessary in order to display this content or these functions. We endeavour to use only content whose respective providers use the IP address solely to deliver the content. Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. Pixel tags can be used to evaluate information such as visitor traffic on the pages of this website. The pseudonymous information may also be stored in cookies on the user’s device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and further details about the use of our online offering, and may also be combined with such information from other sources.
All of the third-party content named below is only loaded after you have given your consent. Until then, no connection is established to the providers’ servers.
Further information on processing operations, procedures and services:
Amendment and updating of the privacy policy
We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes to the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.
Where we provide addresses and contact details of companies and organisations in this privacy policy, please note that addresses may change over time and we ask you to verify the details before making contact.
Rights of data subjects
As a data subject, you are entitled to various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:
Definitions of terms
This section provides an overview of the terms used in this privacy policy. Many of the terms are taken from the law and are defined above all in Art. 4 GDPR. The legal definitions are binding. The following explanations are intended primarily to aid understanding. The terms are sorted alphabetically.