How data is handled

What this website does not do

This website sets no cookies for its visitors, embeds no third-party fonts, and loads nothing from third-party servers. There is no visitor counting and no analytics. Reading these pages leaves nothing behind beyond the requests any web server logs for technical reasons. The one cookie that exists belongs to the protected jury area and is only ever set for jury members who sign in there (see below).

One exception, and only if you ask for it: if you close the “Follow us on Instagram” line at the top of the page, your browser stores a single note in its local storage so that the line stays closed. It contains nothing but that fact, is never sent to us or anyone else, and you can delete it at any time by clearing this website’s data in your browser. The link itself only opens Instagram when you click it.

Preloading of pages

So that moving between pages happens without a wait, the browser sometimes fetches a linked page of this website in advance, while the pointer rests on the link. This stays within this website and this server; the log records such a request with the note Sec-Purpose: prefetch. Anyone who would rather it did not can switch page preloading off in their browser settings.

Hosting and server logs

This website and everything sent through it are hosted by Hostinger (Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus). The web server stands in a data center in Germany (Frankfurt am Main). Hostinger processes the data on our behalf under a data processing agreement pursuant to Article 28 GDPR.

The web server records each request for technical reasons: the address requested, the time, the browser’s identifier, and the IP address. These logs serve only to operate the server securely and troubleshoot technical issues (Article 6(1)(f) GDPR); they are not merged with other data and are deleted by the provider on its own schedule.

The application form

Submitting an application involves the processing of personal data: it goes through the form on this website.

What we collect. Name, date of birth, nationality, country of residence, gender identity, email address, optionally telephone number and website; your artist bio; the details of the album program (title, duration, works, performers, artistic concept); links to the album and the materials you provide (scores, program notes, biographies); the resolution of the recordings; your six declarations, one of them the acceptance of the Terms and Conditions; and whether you ticked the optional box for news from NEOS. The date of birth is asked because the call is open to composers up to a certain age — it is used for that check and for nothing else. For gender identity you can always choose “Prefer not to say”; the answer is not shown to the jury.

Why, and on what basis. We process this data to receive, check, and judge your application and to contact you about it. The legal basis is Article 6(1)(b) GDPR: steps taken at your request prior to entering into a contract (the release agreement with the winner), and — for the jury’s evaluation — our legitimate interest in running the award (Article 6(1)(f) GDPR).

Where it is stored. Each application is stored three times, all on our own systems: as an entry in the award’s database and as a text file on the web server — both outside the publicly accessible part of the server — and as an email to the program office of NEOS Music GmbH.

Who sees it. The program office of NEOS Music GmbH sees the complete application. Members of the jury read the applications in a protected jury area (see below); they see your name, nationality, country of residence, age at the deadline, your artist bio, and everything about the album program, but not your email address, telephone number, website, date of birth, or gender identity. Each jury member sees only their own ratings, notes, and tags; the chair of the jury sees all of them. NEOS Music GmbH and GERYON, the partner of the award, process the data for administering the award and for the eventual album or compilation production, as set out in section 8 of the Terms and Conditions. Other than the parties described above, we do not disclose your application data to anyone else or use it for advertising.

Outside the European Union. GERYON, the partner of the award, works in the United States, and members of the jury may work outside the European Union too. When they read applications in the jury area, your data is transferred there. The European Commission’s adequacy decision for the United States covers only organizations certified under the EU–U.S. Data Privacy Framework, so we do not rely on it: data protection there may not reach the level of the European Union, and authorities there may have wider powers of access. The transfer is necessary for evaluating the application you have asked us to consider (Article 49(1)(b) GDPR) and is limited to what the jury needs, as described above.

Materials you link to. The scores and recordings stay with the storage service you choose (for example a shared folder); we open the links to review the materials and may download them for the jury. That service’s own privacy terms apply to it. We do not upload your files anywhere.

News from NEOS (optional). At the end of the form you can tick a box to receive news and updates from NEOS Music GmbH. It is not ticked in advance and has no effect on your application or its evaluation. If you tick it, we use your name and email address to send you such news, on the basis of your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time, without giving reasons, by writing to the address below; this does not affect the lawfulness of anything sent before. We keep this information until you withdraw your consent or we stop sending news — independently of the deletion of your application. The jury does not see it.

Confirmation email. Once your application has arrived, we send one automatic confirmation to the email address you entered. It is a fixed text and repeats none of your entries, so nobody can use the form to send their own text to other people’s addresses.

Abuse protection. To keep the form from being flooded, the server counts submissions per connection for one hour. For this it keeps a salted checksum of the connection’s address that cannot be traced back — never the address itself — and discards it after the hour. A hidden field that only automated programs fill in is used to discard such submissions silently, and a simple question in the form, answered from this page, keeps them out; the answer is checked and not stored.

How long. Applications that are not selected are deleted no later than three months after the winner of the edition has been announced — in the database, in the file store on the server, and in the program office’s mailbox. The applications of the winner and of the other composers invited to the digital compilation are kept for as long as the releases need them; whatever becomes part of a contract is kept for the periods that commercial and tax law require, and then deleted.

The jury area

The jury evaluates the applications in a protected area of this website that is not linked from the public pages and not open to the public. Each jury member and each person in the program office has a personal account.

What it stores about account holders. Name, username, role, the password (only as a one-way hash that cannot be turned back into the password), the time of the last sign-in, and the star ratings, notes and tags the person gives. A log records sign-ins, sign-outs, and changes to accounts, with the account but without any IP address. Failed sign-in attempts are counted per connection for fifteen minutes as a salted checksum, never as the address itself.

The cookie. Signing in sets one cookie that holds the session; it is strictly necessary for the protected area to work, is sent only over an encrypted connection, and ends when the browser closes, after thirty minutes without activity or after eight hours at most.

Why, and on what basis. Running the jury procedure securely is our legitimate interest (Article 6(1)(f) GDPR); for jury members it is also part of their engagement for the award (Article 6(1)(b) GDPR). Accounts are deleted when a person leaves the jury or the program office.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability, and objection, as well as the right to lodge a complaint with a supervisory authority. To exercise them, write to the address below. The supervisory authority responsible for NEOS Music GmbH is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany); you may also turn to the authority where you live or work.