Last updated: September 2026
1. Controller
The controller responsible for the processing of personal data on this website is:
Joshua van der Heiden
Artist name / business name: Josh Maccoy
Kirchenstraße 7A
67259 Heuchelheim bei Frankenthal
Germany
Phone: +49 174 680 84 02
Email: datenschutz@joshmaccoy.com
2. General Information
Personal data means any information relating to an identified or identifiable natural person.
I process personal data only insofar as this is necessary for the operation of this website, communication with visitors, the performance or initiation of projects or contracts, or the provision of external content expressly selected by the visitor.
The processing of personal data is carried out in particular on the basis of the General Data Protection Regulation (GDPR).
Depending on the respective processing activity, the following legal bases may apply in particular:
- Art. 6(1)(a) GDPR – consent
- Art. 6(1)(b) GDPR – performance of a contract or steps taken prior to entering into a contract
- Art. 6(1)(c) GDPR – compliance with a legal obligation
- Art. 6(1)(f) GDPR – legitimate interests
Where information is stored on a user’s device or information already stored on the device is accessed, the requirements of Section 25 TDDDG also apply. Access that is not strictly necessary generally takes place only after prior consent.
3. Hosting and Email
This website and the associated email services are operated by:
STRATO GmbH
Otto-Ostrowski-Straße 7
10249 Berlin
Germany
As part of the provision of hosting and email services, STRATO processes personal data as a processor.
This may include technical connection data, IP addresses, communication data and information transmitted through this website or by email.
The processing is carried out for the secure, stable and efficient provision of this website and the associated communication services.
The legal basis is Art. 6(1)(f) GDPR. Where processing is necessary for the performance or initiation of a contract, Art. 6(1)(b) GDPR also applies.
4. Server Log Files
When this website is accessed, the web server processes technical information required for the delivery of the website.
This may include in particular:
- date and time of access
- page or file accessed
- browser type and browser version
- operating system used
- referrer URL
- technical connection information
STRATO anonymizes the host name or IP address of the accessing client in the access log files made available to the website operator.
The processing serves in particular to ensure the technical provision, stability, security and troubleshooting of the website.
The legal basis is Art. 6(1)(f) GDPR. The legitimate interest lies in the secure and reliable operation of the website.
5. SSL/TLS Encryption
This website uses SSL/TLS encryption to protect transmitted data against unauthorized access by third parties.
An encrypted connection can be recognized, among other things, by the fact that the website address begins with https://.
6. Contact by Email
If you contact me by email, the information you provide will be processed for the purpose of handling your inquiry.
This may include in particular:
- name
- email address
- content of your message
- any other information you voluntarily provide
If your inquiry relates to an existing or potential contract or project, the processing is based on Art. 6(1)(b) GDPR.
For other inquiries, the processing is based on Art. 6(1)(f) GDPR. The legitimate interest lies in handling and responding to the respective inquiry.
The data will be deleted once the inquiry has been fully dealt with, unless statutory retention obligations or other legitimate grounds require further storage.
7. Contact Form
This website uses a contact form based on WPForms Lite.
When you use the contact form, the following information is currently processed in particular:
- name
- email address
- message
The information is used solely for the purpose of handling the respective inquiry.
The form data is processed through the website and subsequently transmitted to me by email. The email service is operated by STRATO.
WPForms Lite is configured so that form submissions are not permanently stored in the WordPress database. The optional Lite Connect / Entry Backups feature is disabled, meaning that form submissions are also not stored as Lite Connect backups on WPForms servers.
The integrated modern anti-spam protection provided by WPForms is used to prevent automated spam submissions. This includes invisible anti-spam mechanisms and time-based checks. No external CAPTCHA service such as Google reCAPTCHA, hCaptcha or Cloudflare Turnstile is currently used.
The legal bases and storage periods described above under “Contact by Email” apply accordingly.
8. Cookies and Consent Management
This website uses cookies and comparable technologies.
Some of these are technically necessary to provide the website and its basic functions. Technologies or external services that are not technically necessary are generally activated only after you have given the corresponding consent.
Complianz is used to manage these consents.
Your selection is stored in your browser so that the website can take your decision into account and you do not have to make the same selection each time you visit the website.
You can change or withdraw your consent at any time with effect for the future via the consent settings.
The legal basis for processing activities requiring consent is Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG. Technically necessary storage or access may fall under the exception provided by Section 25(2) TDDDG.
Further information about the cookies used, their purposes and storage periods can be found in the Cookie Policy (EU) on this website.
9. Embedded YouTube Content
Individual pages of this website may contain embedded videos provided by YouTube.
For users in the European Economic Area, most Google consumer services are provided by Google Ireland Limited.
YouTube content is initially blocked by the consent management system. A connection to YouTube or Google is established only after you consent to the corresponding service.
After activation, information including the following may be processed or transmitted to Google:
- IP address
- browser and device information
- information about the page accessed
- information about the content accessed or played
If you are logged into a Google or YouTube account at the same time, Google may be able to associate your visit with your user account.
Google also provides an enhanced privacy mode for embedded YouTube players. However, this does not completely exclude data processing when the player is accessed.
Embedded YouTube content is activated on the basis of your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
You can withdraw your consent at any time with effect for the future via the consent settings.
10. Embedded Spotify Content
Individual pages of this website may contain embedded content from the music streaming service Spotify.
The provider is:
Spotify AB
Regeringsgatan 19
111 53 Stockholm
Sweden
Spotify content is initially blocked by the consent management system and is loaded only after you have given the corresponding consent.
Once activated, technical information including your IP address, browser and device information and information about the content accessed may be transmitted to Spotify.
If you are logged into Spotify, Spotify may be able to associate your visit with your user account.
The activation of Spotify content is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.
You can change or withdraw your consent at any time with effect for the future via the consent settings.
11. Social Media Links
This website contains links to external social media profiles, currently including in particular:
- TikTok
On the newly built website, these are normal external links. Merely displaying such a link does not establish a connection with the respective social network.
Only when you click on a link do you leave this website and access the respective external service. From that point onward, the processing of personal data is generally the responsibility of the respective platform operator.
For TikTok in the European Economic Area, TikTok Technology Limited in Ireland is among the responsible entities.
12. Other External Links
This website may contain links to websites and services operated by other providers.
Merely displaying a normal link does not cause your browser to communicate directly with the linked website.
Only when you click on a link is the respective third-party service accessed. The respective provider is generally responsible for the processing of personal data on that service.
13. Storage Period
Personal data is stored only for as long as necessary for the respective purpose.
Where statutory retention obligations apply, the relevant data will be retained for the duration of those obligations.
Once the respective purpose no longer applies and statutory retention periods have expired, the data will be deleted unless another legal basis permits or requires further processing.
14. Rights of Data Subjects
Subject to the applicable legal requirements, you have in particular the following rights:
- the right to obtain information about the personal data processed concerning you
- the right to rectification of inaccurate data
- the right to erasure
- the right to restriction of processing
- the right to data portability
- the right to object to certain processing activities
- the right to withdraw consent with effect for the future
The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.
To exercise your rights, you may contact:
15. Right to Lodge a Complaint with a Supervisory Authority
You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data.
The supervisory authority responsible in particular for my place of establishment is:
The State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate
Hintere Bleiche 34
55116 Mainz
Germany
Phone: +49 6131 8920-0
Email: poststelle@datenschutz.rlp.de
You may also contact another supervisory authority competent under the GDPR.
16. Automated Decision-Making
No solely automated decision-making, including profiling within the meaning of Art. 22 GDPR, currently takes place on this website.
17. Changes to this Privacy Policy
This Privacy Policy will be updated if the website, the services used or the applicable legal framework changes.
The version currently published on this website applies.