This Privacy Policy applies to sounds.zolahr.com and the developer application ZolahrSounds Brandpulse.
1. Controller
Dominik Lehner
Untere Donaulände 10
4020 Linz, Austria
2. Hosting and server logs
The website is hosted by Avernis Communications GmbH, Seeweg 157, 78467 Konstanz, Germany. When the site is opened, the server processes connection data required for delivery. This includes the IP address, date and time, requested page or file, referrer, browser, operating system and transfer status.
The logs are used to keep the website secure and stable and to diagnose errors. The legal basis is Article 6(1)(f) GDPR. Data is deleted once it is no longer needed for these purposes, unless a legal obligation requires longer storage. Further provider details are available in the Avernis legal notice.
3. Strictly necessary storage
Joomla may set a session cookie for the duration of a visit. It keeps the current session together and is needed for basic functions such as forms and language switching.
The privacy choice is stored in the cookie zs_consent_v2. It contains only the choice version and two yes/no values for Facebook content and Spreadshop. It does not contain an identifier. The cookie lasts for 180 days, uses SameSite=Lax and is marked secure on HTTPS. Without it, the choice would have to be requested on every page view.
The legal basis is section 165(3) of the Austrian Telecommunications Act 2021 together with Article 6(1)(f) GDPR. The Austrian Data Protection Authority explains the requirements for necessary cookies and consent.
4. Music and external links
Audio previews are stored on our own server and load only after a click. The Artist template does not embed Spotify, SoundCloud or YouTube players. Links to streaming platforms and social networks connect to the relevant provider only when they are clicked. The privacy terms of that provider then apply.
5. Locally cached Facebook feed
BrandPulse retrieves posts from the public Zolahr Projects Facebook page on the server. Text and selected images are cached on our server and delivered from there. The browser receives no Meta token, and displaying the feed does not connect the website to Meta.
The section still has its own privacy choice. The page loads the local feed file only after approval. Following a link to the original post then opens Facebook. Approval can be withdrawn at any time through “Privacy settings” in the footer.
6. Spreadshop
The Spreadshop is fully blocked at first. The site loads Spreadshirt scripts and content only after separate approval. This may send the IP address, time, requested files, referrer, browser and device information to sprd.net AG, Gießerstraße 27, 04229 Leipzig, Germany, and may place cookies or similar technologies. If an order is made, Spreadshirt also processes the information needed for ordering, payment, production and shipping.
The legal basis for loading the shop is consent under Article 6(1)(a) GDPR and section 165(3) of the Austrian Telecommunications Act 2021. Consent can be withdrawn through “Privacy settings”; the page then reloads without the shop. Details are provided in the Spreadshirt Privacy Policy.
7. Contact
If you use the contact form or email, we process your name, email address, message and any information you provide voluntarily in order to reply. The form sends the details by email and does not create a public message. The legal basis is Article 6(1)(b) GDPR for contractual or pre-contractual matters and Article 6(1)(f) GDPR for other enquiries. The data is deleted when the request has been resolved, unless a retention obligation applies.
8. Newsletter
AcyMailing runs on our own server for the newsletter. Registration uses double opt-in: the subscription becomes active only after the email address has been confirmed. We store the email address, subscription status and the technical evidence needed to document the registration. AcyMailing can also record opens and clicked links. These local statistics are currently deleted after no more than 360 days.
The legal basis for delivery and performance measurement is consent under Article 6(1)(a) GDPR. Every newsletter includes an unsubscribe link. After unsubscribing, the address is no longer used for delivery and is deleted once no legal evidence or retention requirement remains.
9. ZolahrSounds Brandpulse
When a person explicitly connects their own social media account to BrandPulse, they allow the application to process the approved account and page information, access tokens and content selected for synchronisation or publication. Credentials remain on the server and are never delivered to visitors of this website. Processing ends when the connection is revoked or the information is no longer needed for the agreed purpose. The relevant platform also processes the sign-in and use under its own privacy terms.
10. Recipients and international transfers
Personal data is shared only when required for hosting, communication, a requested service or a legal obligation. Spreadshirt and platforms opened by the visitor may process data outside the European Economic Area. The safeguards and legal grounds described by those providers apply to their processing.
11. Your rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction, data portability and objection. Consent can be withdrawn at any time for future processing. Contact
You may also lodge a complaint with a data protection authority, in particular the Austrian Data Protection Authority.
12. Changes
This policy will be updated if the website, providers or legal requirements change.
Last updated: 14 July 2026