Skip to content
Harry Pepl * 1945  † 2005
Contact Sign in

Information under the General Data Protection Regulation (GDPR)

Privacy policy

This platform manages without tracking, without analytics tools and without cookies for visitors who are not signed in. Here you can read which data are nevertheless generated, for what purpose and for how long.

Controller

The controller for the processing of personal data on this website is the media owner named in the legal notice: Daniel Pepl / Fullmax Recordings, Staudgasse 47/9-10, 1180 Vienna, Austria, email daniel.pepl@fullmax.at.

Principles

We do not use tools for audience measurement, analytics or advertising, and we do not embed content from third-party servers unless you trigger this yourself. Fonts, scripts and images are loaded from our own server. If you only read the pages, you receive no cookies.

Hosting and server logs

The website is hosted by hosttech GmbH in Switzerland; for Switzerland there is an adequacy decision by the European Commission. When a page is requested, the server automatically processes technical access data in log files: IP address, date and time, page requested and browser type. This is necessary for delivering the pages, for security and for troubleshooting. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR, the General Data Protection Regulation; DSGVO in German). The server rotates the logs automatically and deletes older log files once the set number of stored files is reached, as a rule after a few months. We do not evaluate them for statistics, and only in individual cases for troubleshooting or to repel attacks. To protect the server, the security software Imunify360 analyses requests in order to repel attacks.

Cookies

We use only technically necessary cookies, for which no consent is required (§ 165 para. 3 TKG 2021, the Austrian Telecommunications Act 2021):

  • __Host-hp_csrf (formerly hp_csrf): is set only when you open a page with a form (contact, access, contribute) and protects the form against misuse by third-party websites. It contains a random number and is deleted when you close the browser.
  • __Host-hp_sitzung (formerly hp_sitzung): only for signed-in accounts; keeps you signed in for up to 30 days, for the editorial team and administration for up to 12 hours, and ends when you sign out.
  • hp_vorschau: only during the set-up phase, for people who have received a preview link; valid for up to 60 days.

If you only read the website, you receive no cookies.

If you choose light or dark under “Display” at the bottom of the page, your browser remembers this choice in its own storage (localStorage, entry hp_thema). The setting never leaves your device and only serves the display you asked for; “automatic” deletes the entry again.

Contact form

When you write to us via the contact form, we store your enquiry, your name, your email address, the message, your organisation (or “private”) and, if provided, the reference, as well as the language of the page. The enquiry is stored in our database and forwarded to us by email so that we can reply. We send an automatic confirmation of receipt to the address you provide; it does not repeat your message. As protection against misuse, instead of your IP address we store only a check value (hash) calculated from it with a secret key. The legal bases are your consent, which you give by submitting the form (Art. 6(1)(a) GDPR), and the handling of your enquiry (Art. 6(1)(b) and (f) GDPR). We keep enquiries for up to three years and then delete them. You may withdraw your consent at any time and request deletion.

For a personal access account we store the details from your application: name, email address, institution, media outlet or ensemble (or “private”), the type of access, the stated purpose and the language of the page. If you wrote to us via the contact form about research, press or teaching and would like an account of your own, we may create such an application from your enquiry; you will learn of it from the approval email. Every application is reviewed personally; you receive an automatic confirmation of receipt by email. Sign-in is passwordless: on request we send a link to your email address that is valid for 15 minutes and can be used only once. Passwords are not stored. You stay signed in for up to 30 days, the editorial team and administration for up to 12 hours. For signed-in accounts we also store your saved list and log security-relevant events such as sign-ins, likewise only with a check value instead of the IP address. So that “My account” can show what is new since your last visit, we store the time of your previous sign-in as well as that of your last one; both are overwritten at every sign-in and deleted with the account. The legal bases are your consent and the provision of the access (Art. 6(1)(a) and (b) GDPR). Your account remains until you request its deletion; we then also delete the data associated with it. Rejected applications are deleted after twelve months.

The security log and the technical error logs are deleted after twelve months.

Checking the email address

So that confirmations and sign-in links reach you, our server checks for contact, sign-in and account requests whether the domain of your email address (for name@example.at, that is “example.at”) can receive email. To do so it queries the public Domain Name System (DNS), just as any mail delivery does. If there is an obvious typing error (such as “gmial.com”), we suggest the usual spelling. Only the domain is queried, not the full address. We keep the result (such as “mail server present”) for at most one day as a cache, without any link to you as a person, so that not every entry triggers a new query. The legal basis is our legitimate interest in making sure that our replies reach you and are not sent to wrong addresses (Art. 6(1)(f) GDPR).

Spam protection of the forms

We protect the forms for contact, sign-in, access and contributions with ALTCHA, an open-source solution that runs entirely on our own server; we do not use services from Google, Cloudflare or other providers for this. While you fill in a form, your browser fetches a small computing task from our server and solves it in about one second. The result is sent along with the form and checked by our server. No cookies are set, no data are transferred to third parties and no characteristics of your device or your behaviour are recorded. So that each solution can be used only once, we store a random identifier of the solved task that does not allow any conclusions about you as a person. To limit misuse, we count the requests for computing tasks, the form submissions and the automatic confirmation emails for a short time, and only by means of a check value (hash) of your IP address or of the email address provided, calculated with a secret key. We delete identifiers and counts after two days at the latest. The legal basis is our legitimate interest in protecting the forms against automated spam submissions (Art. 6(1)(f) GDPR).

Contributions to the archive and invitations

Signed-in people can submit photographs, documents, recordings, memories and information via Contribute. For this we store the details entered in the form (title, description, date, place, people involved, creator, intended use) and the uploaded files together with a checksum. The files are held on our server outside the publicly accessible area and are accessible only to the editorial team. Only what you have approved for the chosen use is published, and only with the stated photo credit. The legal bases are your consent and the agreement on the use of the material (Art. 6(1)(a) and (b) GDPR). Submitted material remains part of the archive until you request its deletion; rejected contributions we delete after twelve months at the latest. As long as a contribution has not been added to the archive, you can withdraw it yourself under “My contributions”; it is then deleted immediately together with its files.

We also invite people by email to set up an account. For this we store name, email address and the text of the invitation. An invitation that has not been accepted expires after 30 days.

Spotify player

On individual pages you can listen to recordings through a player from Spotify. The player is loaded only when you click “Load player” (two-click solution). Before that, no data are transmitted to Spotify. After the click, your browser connects to Spotify; Spotify AB, Stockholm, Sweden, then receives, among other things, your IP address and details of your device, and Spotify may set cookies. A transfer to countries outside the EU is also possible. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR). Further details are in Spotify's privacy policy. Instead of the player you can also use the link “Open on Spotify”.

YouTube videos

On individual pages you can watch videos from YouTube. A video is loaded only when you click “Load video” (two-click solution); before that, no data are transmitted to YouTube, not even preview images. After the click, the video is embedded via the address youtube-nocookie.com (extended privacy mode). Your browser then connects to YouTube; Google Ireland Limited, Dublin, Ireland, then receives, among other things, your IP address and details of your device, and cookies or similar techniques may be used. A transfer to countries outside the EU, in particular to the USA, is also possible. The legal basis is your consent by clicking (Art. 6(1)(a) GDPR). Further details are in Google's privacy policy. Instead of the embedded video you can also use the link “Watch on YouTube”.

Saved list in the browser

The saved list stores the releases, works, people and press entries you have saved in your browser's storage (localStorage). These data do not leave your device as long as you are not signed in. Only when you sign in with an access account is the saved list stored with your account on our server. In your browser, you delete the saved list by removing the site data for harrypepl.com.

Exports and citation data

Exports from the finding aid, from the saved list or for individual entries (RIS, BibTeX, CSL-JSON, CSV and Excel) are generated by our server when you request them; we do not store the files themselves, but the fact that an export took place is recorded in the usage log (see below). When you export the saved list held in your browser, your browser sends the identifiers of the saved entries to our server in the address. To limit misuse, we count exports and requests to the finding aid for a short time by means of a check value of your IP address, or of your account if you are signed in, as described under spam protection, and delete the count after two days at the latest.

Change log of the archive

We record every change to the records of the archive in a change log: the time, the record and the field with its old and new value, together with the editorial account that made the change or, when data are imported, the working version. This serves the traceability and security of the archive data; the legal basis is our legitimate interest in a reliable archive (Art. 6(1)(f) GDPR). We delete the link to the person after twelve months and the entries themselves after five years. Exports of collections containing personal data (accounts, enquiries, contributions, log, usage) can only be created by the administration; every such export is logged.

Log of access to non-public materials

Material that can only be opened with an account (original scans, listening copies, scores and other documents) comes from the estate of Harry Pepl and is partly protected by copyright and personality rights. We therefore record in a usage log when a signed-in account opens or downloads such material, when entries are exported (the hit list of the finding aid, the saved list or individual entries, each with format and number of entries) and when a contribution is submitted or withdrawn. We store the time, the account and its role, the action and the item concerned (collection, identifier, title). We do not store IP addresses or search terms; exports without signing in appear in the log without any link to a person. Repeated requests for the same file within ten minutes count once. The purpose is to protect the estate and to keep the use of non-public materials traceable; the legal basis is our legitimate interest (Art. 6(1)(f) GDPR). Only the editorial team can view the log, and only the administration can export it. We delete the entries after twelve months, and immediately when an account is deleted. You can request information and object at any time (see “Your rights”).

The platform links to other websites, such as streaming services, labels or reference works. Data are transmitted to the respective provider only when you follow such a link; the provider is responsible for the processing there.

Your rights

You have the right of access, rectification, erasure and restriction of processing, the right to data portability, and the right to object to processing based on our legitimate interest. You may withdraw consent at any time with effect for the future. To do so, contact the address given above or use the contact form. You can also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde): Barichgasse 40-42, 1030 Vienna, www.dsb.gv.at.

Last updated: October 2026

This translation is provided for convenience; the German version is legally binding.

Last updated: 18 Oct 2026