Privacy Policy

Last updated: August 30, 2026

1. Controller

The controller is hammX, owner: Senol Dursun, Wielandstr. 2a, 59077 Hamm, Germany, email: info@coldplayer.eu, Phone: +49-151-2008 9494.

2. Data Collected

The following data may be collected during use: Device ID (identifier generated at installation) for identification, playlist URLs for assignment, payment information via third-party providers, usage data when visiting the website (page visited, language, IP address, browser type, referrer), as well as information provided in contact inquiries (name, email address, message content).

In the event of a declaration of withdrawal, your name, device ID, email address, time of receipt and IP address are additionally collected.

You can withdraw your contract online via the withdrawal button at https://coldplayer.eu/widerruf.html. A withdrawal form opens in which you enter your name, device ID and email address. After submitting, you will immediately receive a confirmation of receipt by email (§ 356a (4) BGB).

3. Purposes and Legal Bases of Processing

Data is processed for app provision, device activation, license management, payment processing, customer support and improving app quality. Processing for the fulfilment of the contract (activation, license management, payment processing, customer support) takes place on the basis of Art. 6(1)(b) GDPR. The processing of IP addresses and server log files to ensure technical operation and security takes place on the basis of Art. 6(1)(f) GDPR (legitimate interest).

The processing of your contact request details (name, email address, message content) to respond to your request takes place on the basis of Art. 6(1)(b) GDPR (pre-contractual measure) or Art. 6(1)(f) GDPR (legitimate interest in handling your request).

The processing of declarations of withdrawal serves to confirm receipt, to unwind the contract and to protect against abuse. The legal basis is Art. 6(1)(b) GDPR (performance of contract) as well as Art. 6(1)(c) GDPR (compliance with legal obligations arising from the right of withdrawal, § 356a BGB); the processing of the IP address for protection against abuse is carried out on the basis of Art. 6(1)(f) GDPR.

Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place.

4. Data Sharing

Personal data is only shared with third parties as permitted by law or necessary for contract fulfillment. Data is not shared for advertising purposes.

Payment processing: When paying via the payment service provider PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, the data required for the transaction (e.g. name, email address, payment information) is transmitted to PayPal. The processing takes place for the fulfilment of the contract on the basis of Art. 6(1)(b) GDPR. Depending on the transaction, data may also be transmitted to companies of the PayPal Group in third countries (in particular the USA and Switzerland); for the USA, the transfer is carried out on the basis of the adequacy decision on the EU-US Data Privacy Framework; for Switzerland, on the basis of the adequacy decision pursuant to Art. 45 GDPR.

Email delivery: For sending emails (e. g. confirmations of receipt for withdrawals, replies to contact inquiries) we use the email service provider Strato AG (Otto-Ostrowski-Straße 7, 10249 Berlin, Germany), which sends the emails on our behalf. The data required for delivery (e. g. name, email address, email content) is processed in this process. Processing takes place on the basis of a data processing agreement pursuant to Art. 28 GDPR.

The provision of our services is carried out via the hosting provider Contabo GmbH (Welfenstraße 22, 81549 München, Germany), which operates the services on servers within the European Union on our behalf. In particular, IP addresses and server log files are processed. The processing is carried out on the basis of a data processing agreement pursuant to Art. 28 GDPR. Should processing in a third country exceptionally be necessary, this will only take place on the basis of an adequacy decision of the European Commission or appropriate safeguards pursuant to Art. 46 GDPR (in particular EU Standard Contractual Clauses).

5. Retention Period

Your data is stored as long as necessary for the respective purposes or as required by statutory retention obligations.

Withdrawal data is retained for a period of ten years in accordance with § 257 HGB (German Commercial Code) and § 147 AO (German Fiscal Code).

6. Your Rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to withdraw consent given at any time (Art. 7(3) GDPR). Furthermore, you have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

Competent Supervisory Authority

The competent data protection supervisory authority for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

7. Cookies and Tracking

The website uses exclusively technically necessary session cookies (e.g. for language selection and session management). No analytics, marketing or tracking cookies are used. The legal basis is § 25(1) TTDSG (technically necessary cookies).

8. Security

We implement technical and organizational security measures pursuant to Art. 32 GDPR to protect your data against loss, misuse and unauthorized access. These include in particular TLS encryption (HTTPS), access restrictions by permissions, regular security updates, and the conclusion of data processing agreements pursuant to Art. 28 GDPR with our service providers.

9. Changes

We reserve the right to amend this privacy policy as needed. The current version is always available on this page.