Last updated: November 11, 2026
This privacy policy explains what personal data is collected when you visit www.serzomusic.com, why, and what you can do about it.
Who is responsible
Leininger Musikk (Espen Leininger, org. no. 923 345 280), Drammen, Norway, is the data controller for the personal data described here.
Questions about privacy: [email protected].
What data is collected
When you visit the site, technical data is collected: your IP address, browser, device and the pages you open. Some of it is collected with cookies; see Cookies below.
The site has no forms, user accounts, comments or newsletter, and Leininger Musikk doesn’t buy or collect data about you from other sources.
Bookings go through Serzo’s agency, The Wishlist. When you email them or use their contact page, The Wishlist handles your data under its own privacy policy.
Why, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Visitor statistics (Google Analytics) | Your consent in the cookie banner (Art. 6(1)(a)) |
| Showing the Spotify players and the Bandsintown tour dates | Your consent in the cookie banner (Art. 6(1)(a)) |
| Keeping the site secure and available | Legitimate interest (Art. 6(1)(f)) |
Legitimate interest: protecting the site against attacks is necessary to run it, uses only technical data, and is something you can expect when you visit a website. No profiles are built and no automated decisions are made about you. You can object at any time (see Your rights).
Who receives the data
Personal data is never sold. These providers process data on Leininger Musikk’s behalf (processors):
| Provider | What they do |
|---|---|
| The web hosting company | Runs the website and its server firewall; sees the IP addresses of visits |
| Cloudflare | Delivers the site quickly and securely (network, firewall) |
| Google (Analytics, via Site Kit) | Visitor statistics, only with your consent |
| CookieYes | Shows the cookie banner and keeps a record of your choice |
Embedded content: release pages show a Spotify player, and the tour dates come from Bandsintown. When they load, your browser connects to Spotify or Bandsintown, which receive your IP address and may set their own cookies. They decide themselves what they do with that data; see Spotify’s privacy policy and Bandsintown’s privacy policy. They only load after you accept them in the cookie banner.
Links to Spotify, Apple Music, SoundCloud, Instagram, Facebook, YouTube and the merch shop are plain links: nothing is shared with them until you click.
Data may also be handed over when the law requires it, for example to the police on a court order.
Transfers outside the EU/EEA
Google, Cloudflare and Bandsintown are US companies and may process data in the USA. These transfers are based on the EU–US Data Privacy Framework for providers certified under it, and otherwise on the European Commission’s standard contractual clauses. CookieYes is based in the UK, which the EU recognises as having adequate protection.
How long data is kept
- Google Analytics: at most 14 months (the retention set in Google Analytics), then deleted automatically.
- Your cookie choice: 12 months, after which the banner asks again.
- Security logs (firewall, server): a limited period, normally a few weeks.
Your rights
You have the right to:
- see the data held about you and get a copy;
- have wrong or incomplete data corrected;
- have data deleted;
- restrict how it’s used in some cases;
- object to processing based on legitimate interest;
- withdraw your consent at any time, without affecting what was done before. Cookie choices can be changed with Consent Preferences in the cookie policy.
To use your rights, email [email protected]. You’ll get an answer within 30 days.
If you think your data is handled unlawfully, you can complain to the Norwegian Data Protection Authority, Datatilsynet.
Cookies
Which cookies the site uses, and how you choose which ones you accept, is explained in the cookie policy. Statistics cookies (Google Analytics) and the embedded players are only used if you accept them in the cookie banner.
Children
The site isn’t aimed at children under 16, and data about them isn’t collected knowingly.
Security
The site uses an encrypted connection (HTTPS), a firewall, restricted access to its administration and regular updates. No system is completely secure, but every reasonable step is taken.
Changes
This policy is updated when what the site does, or the law, changes. The date at the top shows the latest change.
Contact
Leininger Musikk (org. no. 923 345 280), Drammen, Norway
Email: [email protected]