This statement explains which data we process about you and your child, why we do it, and what rights you have. We have written it to be readable without a law degree.

Last updated: 25 September 2026

Who is responsible for your data

Musical Munchkins Productions GmbH
Esslinggasse 6, 1010 Vienna, Austria
Office: Neutorgasse 12/3, 1010 Vienna
Company register FN 363979p, Commercial Court Vienna · VAT ID ATU66547613

Phone +43 1 239 24 08
E-mail office@musicalmunchkins.eu

Please use this address for any question about data protection. We are not legally required to appoint a data protection officer, and we have not appointed one.

Registration and customer account

When you register your child for a course, we create an account. It holds:

About you: first and last name, e-mail address, phone number, address, date of birth, gender and an encrypted password. Your password is unreadable, including to us.

About your child: first and last name, date of birth and gender. We need the date of birth because it determines which class your child belongs in.

About the registration itself: the course and class time booked, the type of registration (semester course, trial lesson, four- or eight-week course), payment status and the date of registration.

The legal basis is Art. 6(1)(b) GDPR — we need this data to perform the course contract with you. Without it we cannot place your child in a class.

Registration at the studio

If you prefer not to book online, you can register with us on site using a tablet. The same data is collected as described above.

Payment

Course fees are handled by two providers:

Stripe (Stripe Payments Europe Ltd., Dublin, Ireland) for card payments, EPS and Sofort.
PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg) for payments from your PayPal account.

Your card number, security code and bank credentials never reach us. You enter them directly with the payment provider. What stays with us is only what we need to match the payment to your registration: transaction number, payment method, amount, currency and whether the payment succeeded.

Both providers may transfer data to group companies in the United States. This takes place on the basis of the European Commission's Standard Contractual Clauses.

Newsletter

Our newsletter is sent through Mailchimp (Intuit Inc., United States). It covers our own courses, dates and offers — nothing else, and no advertising for other companies.

We transfer your e-mail address, your name, your child's name, the course booked and a few attributes we use to target our mailings (such as semester, weekday and whether you currently attend a course).

The legal basis is your consent (Art. 6(1)(a) GDPR). If you have booked a course with us, we additionally rely on § 174(4) of the Austrian Telecommunications Act 2021, which permits informing existing customers about the sender's own similar services.

You can unsubscribe at any time — through the link at the foot of every mailing, or with an informal message to us. Unsubscribing costs nothing beyond basic transmission rates.

The transfer to the United States takes place on the basis of the European Commission's Standard Contractual Clauses. Please note that the United States does not offer a level of data protection equivalent to the European one, and that US authorities may gain access to this data under certain conditions.

Photos and videos

Photographs and video recordings are made during classes and at performances. We use them to show our programme on our website and on social media.

This happens only with your consent. The legal bases are Art. 6(1)(a) GDPR and § 78 of the Austrian Copyright Act.

You may withdraw that consent at any time, without giving reasons and without any disadvantage to your child's participation. A message to office@musicalmunchkins.eu is enough. We then remove the recordings concerned from our own publications. What third parties have already shared or saved is beyond our control — which is why we are careful with recordings in the first place.

Anything published on Instagram or Facebook reaches Meta Platforms Ireland Limited. Meta is responsible for its own processing of that material.

Our website

Server logs. Each time our pages are called up, our hosting provider — unixSECURITY Internetdienstleistungs GmbH in Vienna, trading as WebMachine — briefly stores the IP address, the time, the page requested and the browser identification. This is technically necessary and serves the security of the service. The legal basis is Art. 6(1)(f) GDPR.

Cookies and external services. On your first visit we ask whether you wish to allow cookies and external content. Until you agree, none of it loads — the scripts concerned sit inactive in the page source and make no contact with external servers.

If you do agree, the following become active:

Google Tag Manager (Google Ireland Limited, Dublin, with transfer to Google LLC, United States). It decides which of the following two services are loaded.

Google Analytics 4, ID G-MZMLR1NE3E. Measures how our pages are used — which pages are opened, how long someone stays, how they found us. It sets the cookies _ga and _ga_MZMLR1NE3E.

Google Ads, ID AW-1058003626. Measures how our advertisements perform and makes it possible to recognise people who have visited us before. It also contacts ad.doubleclick.net and sets the cookie _gcl_au.

Facebook (Meta Platforms Ireland Limited) for the message window in the page footer.

YouTube (Google Ireland Limited) for embedded videos.

The legal basis is your consent (Art. 6(1)(a) GDPR). You may withdraw it at any time by opening the cookie settings on our website again or by deleting the cookies in your browser.

E-mail

The messages our system sends — confirmations, payment notices, internal reports — are routed through domainfactory GmbH, Germany. Our mailboxes are held there as well. Your correspondence with us is therefore stored on servers in Germany for as long as we keep it.

Who else receives your data

We do not pass your data on, except to the following providers, who work for us and on our instructions:

· unixSECURITY Internetdienstleistungs GmbH (WebMachine), Vienna — operation of the website
· domainfactory GmbH, Germany — e-mail
· Stripe Payments Europe Ltd., Ireland and PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg — payments
· Intuit Inc. (Mailchimp), United States — newsletter
· Google Ireland Limited and Meta Platforms Ireland Limited — only after your consent, see above

Contracts under Art. 28 GDPR are in place with all of the providers named.

Beyond that, we pass data to our tax advisors and to public authorities where we are legally obliged to do so.

How long we keep data

Customer account and registrations: seven years after the last course attended. We then delete the account and the data belonging to it.

Invoices and payment data: seven years from the end of the financial year. We are obliged to keep these under § 132 of the Federal Fiscal Code and § 212 of the Commercial Code, and may not delete them during that period even on request.

Newsletter: until you unsubscribe.

Photographs and video: until you withdraw your consent.

Backup copies of our server are kept for one week. Deleted data may therefore persist in those copies for up to seven days.

Children's data

We work with small children, and we are aware that their data deserves particular care. From the child we collect only what the class assignment requires: name, date of birth and gender. Consent is always given by you as the parent or guardian, never by the child. We do not direct advertising at children.

Your rights

At any time you have the right to

· access — to know what data we hold about you and your child
· rectification if something is wrong
· erasure, unless a statutory retention obligation stands in the way
· restriction of processing
· data portability — we will provide your data in a common format
· objection to processing we base on a legitimate interest
· withdrawal of any consent given, with effect for the future

A message to office@musicalmunchkins.eu is enough. We reply within one month.

If you believe we are not handling your data properly, you may lodge a complaint with the supervisory authority:

Austrian Data Protection Authority
Barichgasse 40–42, 1030 Vienna
dsb@dsb.gv.at · www.dsb.gv.at

Changes

When the way we work changes, this statement changes with it. The date at the top tells you when it was last revised.