Privacy Policy

This statement describes what data is processed when you visit this site. It is deliberately short, because the site does very little: it sets no cookies of its own, includes no analytics or advertising services and keeps no user accounts.

Controller

Art of Cibulka — Eigenverlag, Eva Cibulka, Popelkaring 24, 8045 Graz, Austria. Email: cibulka@gmx.at, Phone: +43 650 8765 111.

Visiting the site

The site is served through Cloudflare Pages (Cloudflare, Inc., USA). On each request Cloudflare processes technically necessary connection data, including your IP address, date and time, the address requested and details of your browser and operating system. This is required to operate the site and to fend off attacks; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website).

Recordings, score previews and images are stored in Cloudflare R2 object storage and are likewise delivered through Cloudflare. For transfers to the USA, Cloudflare relies on the European Commission’s standard contractual clauses.

No cookies, no tracking

This site sets no cookies for analytics or advertising. There are no tracking pixels, no social media buttons and no ad networks. A cookie banner is therefore unnecessary.

Your browser’s local storage holds only whether you have agreed to load YouTube videos. That entry never leaves your device and exists solely so that you are not asked again for every video. You can remove it at any time using the “Withdraw YouTube consent” link in the footer.

YouTube videos

Some works have videos hosted on YouTube (Google Ireland Limited, Ireland). These videos are NOT loaded automatically. You first see a preview image served from our own storage — as long as you do not click, no connection to Google is made.

Only when you click play is the video loaded from YouTube. Google then learns, among other things, your IP address and the page you are on, and may store or read information on your device. If you are signed in to Google at the same time, the request may be linked to your account. The legal basis is your consent under Art. 6(1)(a) GDPR together with § 165(3) of the Austrian Telecommunications Act 2021; you give it by clicking and may withdraw it at any time with future effect.

We use the youtube-nocookie.com variant, which transmits less data than the standard embed. It does not, however, replace consent. What Google does with the data is beyond our control; see Google’s privacy policy at policies.google.com/privacy.

Contacting us by email

On the work pages you will find a way to email us about an order. There is no form on this site — the message is composed in your own email program. If you write to us, we process your details solely in order to answer your enquiry (Art. 6(1)(b) or (f) GDPR) and keep them only as long as that requires.

Buying sheet music

When you buy an edition we store: your email address, the work purchased, the amount paid, the date and time, the order number, the language of the order and an identifier for the payment at the payment service. We also record that you ticked both boxes before buying, and which version of the legal texts applied at the time — without that record we could not show that delivery lawfully began at once.

The legal basis is Art. 6(1)(b) GDPR (performance of the contract of sale). Without an email address we cannot deliver, because delivery consists of the email carrying the download links.

We store no payment data. Card numbers, account details and the like are entered exclusively at the payment service and never reach us.

The download entitlement itself is needed for 30 days; the links belonging to it are stored only as a cryptographic checksum, so no working link can be recovered from our database. Order data is kept for seven years — as a business we are required to under § 132 of the Austrian Federal Fiscal Code and § 212 of the Austrian Commercial Code (Art. 6(1)(c) GDPR).

Payment processing

Payment is handled by Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland; for processing in the USA, Stripe, Inc.). When you click “Order with obligation to pay” you are taken to a page operated by Stripe. There Stripe processes your payment data, your email address, the amount and technical data such as IP address and device characteristics — including for fraud detection. Stripe acts as its own controller in doing so; see stripe.com/privacy.

What we receive back from Stripe is: the email address, the amount paid, the time, and an identifier that allows a refund to be matched to an order. For transfers to the USA, Stripe relies on the European Commission’s standard contractual clauses.

Sending the confirmation email

The confirmation carrying your download links is sent through an email service provider, which processes your email address and the content of the message on our behalf (processing under Art. 28 GDPR). Its servers are located in the European Union.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection. Please contact the address above. If you believe that the processing of your data infringes data protection law, you may lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

Status

This statement reflects the state of August 2026. It will be updated if the technology behind the site changes.