Cookie Policy

Cookie preferences

1. What Are Cookies?

A cookie is a small data file placed on your device when you visit a website. Cookies allow a site to recognise your device and remember information about your visit, such as whether you are logged in or which preferences you have set.

This policy also covers similar technologies that serve the same purpose, including browser localStorage and sessionStorage, which we use alongside a small number of first-party cookies: the login itself is a cookie (bit_jwt), while settings and short-lived copies of data live in local storage. Under Article 5(3) of the ePrivacy Directive 2002/58/EC and the related guidelines of the European Data Protection Board, the consent rules described below apply to any storage of or access to information on your device, regardless of the technical mechanism used.

2. Strictly Necessary Storage (no consent required)

These are required for the platform to function and are set regardless of your cookie preferences. They are all first-party and contain no advertising or cross-site tracking data. Some of them simply remember a setting you chose or speed up a page you asked for; none of them is used for analytics or advertising.

3. Cookies and Storage Requiring Consent (active)

The following services are active on the Platform today but are loaded only after you give explicit consent, each through its own switch in the cookie banner or in Cookie preferences. If you decline, or until you accept, they are never loaded and nothing is sent to their providers. Accepting one does not accept the other.

3.1 Google Analytics 4 (active, consent required)

We use Google Analytics 4 to understand how visitors use the platform in aggregate: pages visited, session duration, traffic sources, approximate location. When you click "Accept all", or switch on "Analytics" in Cookie preferences and save, we load the Google Analytics script and it may set cookies on our domain (_ga and _ga_<ID>, which last up to 2 years) and send usage data to Google. In our configuration Google signals and ad personalisation are switched off. The provider for users in the European Economic Area is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); Google LLC (USA) may act as a sub-processor. See Google's Privacy Policy and how Google uses cookies.

Consent is required and remembered. Analytics is loaded only after you give that consent. Your choice is stored on your device (bit_consent); if you have accepted on a previous visit, Analytics will load automatically on your next visit without asking again. You can withdraw consent at any time through Cookie preferences (the button above or the link in the site footer): from that moment Analytics stops sending data, the Analytics cookies set on our domain are deleted, and the script is no longer loaded on the following pages. Google Analytics 4 by design does not log full IP addresses; we do not configure any additional advertising or data-sharing features within Analytics.

Transfers outside the EEA. Because Google operates globally, accepting Analytics may involve transferring data to servers outside the European Economic Area. Google states that such transfers are covered by appropriate safeguards under Chapter V of the GDPR (including standard contractual clauses and the EU–US Data Privacy Framework). For the exact mechanism Google applies, see Google's Privacy Policy linked above.

3.2 External media (active, consent required)

Some of our articles contain a video or audio player from another platform (YouTube and, where our editors use them, Vimeo, Spotify, SoundCloud or Bandcamp), and articles about an act or an event can show a "Watch" section with the cover image of a YouTube video. Loading any of these tells the provider your IP address and the address of the page, and a loaded player may store data on your device: a YouTube player, for example, uses local storage and similar browser storage as soon as it loads, even before a video is played, and may set cookies once it plays.

Until you consent, none of this is loaded. In place of each player you see a placeholder served by us that names the provider, with a "Load this content" button that loads that single item only (a request you make for that item, not a consent we record) and a link to open it on the provider's site. The "Watch" section shows our own play button without the cover image. If you switch on "External media" in Cookie preferences, or click "Accept all", players and cover images load as soon as a page opens. Video and audio trailers always start only when you press play, whatever this setting says (Section 4.3).

Withdrawing. Switching "External media" off removes these players from the page you are on, including any you started yourself, and they are no longer loaded on the following pages. Data that a provider has already stored on its own domain (for example youtube-nocookie.com) is outside our reach: you can clear it from your browser settings.

Providers. Google Ireland Limited for YouTube (with Google LLC, USA, as possible sub-processor, so loading a YouTube player or cover image may involve a transfer outside the EEA under the Chapter V GDPR safeguards Google declares), Vimeo, Inc. (USA), Spotify AB (Sweden), SoundCloud Global Limited & Co. KG (Germany) and Bandcamp (USA). Each sets its own storage under its own policy, for periods it decides: see Google's Privacy Policy, Vimeo, Spotify, SoundCloud and Bandcamp. We store nothing on our side about what you loaded or played.

4. Functional Third-Party Services (active)

The following third-party services are already in use and are technically necessary: protecting our forms against bots, turning an address into map coordinates and drawing the map. They are not advertising or analytics services and do not depend on your cookie choices. Some of them are contacted as soon as a page opens, before you choose anything: the hCaptcha script and the map tiles load with the pages of our interactive map (the hCaptcha script also loads with the password-reset page). Others run only when you use a feature: a place or address search when you type a place or use "Near me" (made by our server, Section 4.2), a video or audio trailer when you press play. Each provider may process data or set its own storage as described in its own policy.

Whenever your browser fetches something from one of these providers, that provider necessarily sees your IP address and the address of the page you are on: that is how the web works, and it happens even when nothing is stored on your device. Where we can avoid the request altogether until you ask for it, we do: that is why video and audio trailers are click-to-play (Section 4.3) and why players and cover images inside articles wait for your External media choice (Section 3.2). We keep no record on our side of your use of any of these providers: no log of which video you played or which map tiles you loaded, no counter and no profile, and none of these providers sends us anything back about you. The only exception is the short, anonymous cache of place searches described in Section 4.2. (Separately from this, our own anti-abuse rate limiting records requests made to our endpoints, as described in the Privacy Policy, Section 4.1; those records are ours and are purged after 30 days.)

4.1 hCaptcha (bot protection)

We use hCaptcha on the registration, password-reset and report forms to tell humans apart from automated bots and protect the Platform from spam and abuse. hCaptcha is provided by Intuition Machines, Inc. (USA). Its script is loaded with the pages of our interactive map (our home page), before you open any form, so that the check is ready when you need it (on the password-reset page it loads with that page). From that moment the provider receives your IP address and technical information about your browser and device. The challenge itself appears only on the protected forms, where it processes your interaction to assess whether you are human. When you submit one of those forms (registration, password-reset request or report), our server also sends hCaptcha the verification token and your IP address, to confirm that the check was passed. hCaptcha may set its own cookies on its own domains (for example __cf_bm, a bot-management cookie that lasts about 30 minutes) and local-storage items, as described in the hCaptcha Privacy Policy. We treat hCaptcha as strictly necessary for the security of the Platform, so it does not depend on your cookie choices; our legal basis is our legitimate interest (Section 6). We do not receive or store the data hCaptcha collects to make its assessment.

Transfers outside the EEA. Because Intuition Machines is established in the United States, using the anti-bot widget involves a transfer of data outside the European Economic Area. The provider declares that such transfers are subject to appropriate safeguards under Chapter V of the GDPR (such as standard contractual clauses or an equivalent framework); the details are set out in the hCaptcha Privacy Policy linked above.

4.2 Nominatim / OpenStreetMap (place and address search, through our server)

When you search for a city or a country, type an address or a city in a form (for example when registering a venue, creating an event or setting the city of your profile) or use "Near me", we look the place up with Nominatim, the geocoding service of OpenStreetMap, operated by the OpenStreetMap Foundation (United Kingdom). Your browser never contacts Nominatim: it sends our server the text you typed or, for "Near me", your position rounded to about 100 metres, and our server makes the request and returns the answer (the map coordinates, or the name of the city and country you are in). Nominatim therefore receives only that text or rounded position, from our server's address: never your IP address, and no cookie or identifier of yours. Nothing is stored on your device for this. On our side, we keep the answers to text searches for up to 7 days so that the same search is not sent again, stored under the search itself, not linked to you, your IP address or your account; we do not record the time of the search, only the day, and each stored file expires within 7 days; answers to "Near me" lookups are not kept, and we do not log the text you type or your position. To limit abuse, for the lookups that actually go to Nominatim (not those answered from our stored results) we count the requests coming from each connection with a pseudonymised form of your IP address (a keyed hash made with a secret key used only for this purpose, not the address itself; for an IPv6 address only its network part is used), deleted after 48 hours. The United Kingdom benefits from a European Commission adequacy decision, so this transfer takes place within an environment recognised as providing an adequate level of protection. See the OpenStreetMap Foundation Privacy Policy.

4.3 Video and audio trailers (click-to-play)

A profile can show a video trailer, articles about an act or an event can show it in a "Watch" section, and our landing page has a presentation video. A band profile can also show an audio trailer, a single track chosen by the band, just below the video, and the band's Local Scene article shows it in the same section. All of these are click-to-play: what you see first is a placeholder with a play button served by us, and no player is requested from the provider until you press play. On profiles and on the landing page the placeholder never contains anything from the provider; in the "Watch" section the video's cover image, which comes from a Google domain (i.ytimg.com), is shown only if you have switched on External media (Section 3.2).

When you press play, the video is loaded from the provider: for YouTube trailers on profiles and in articles from www.youtube-nocookie.com, YouTube's privacy-enhanced embed domain, and for the landing-page video from www.youtube.com. A video trailer can also come from Vimeo, and an audio trailer is loaded from SoundCloud (w.soundcloud.com) or Spotify (open.spotify.com); these providers and their policies are listed in Section 3.2. From that moment the provider receives your IP address and the address of the page, and may store data on your device (local storage and similar browser storage when the player loads, cookies once the video or track plays). Pressing play is a request you make for that one video or track, which is why it works whatever your External media choice. The provider for YouTube in the European Economic Area is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), with Google LLC (USA) as a possible sub-processor, so playing a video may involve a transfer outside the EEA under the Chapter V GDPR safeguards Google declares. See Google's Privacy Policy and how Google uses cookies.

What we store on our side: nothing. We do not record that you watched a video or listened to a track, we keep no playback log or view counter, and we receive nothing back from the provider. The only thing we hold is the video or track address that the profile owner entered into their own profile, which is part of their account data (Privacy Policy Section 7, "Account and profile data"). Whatever is stored after you press play is set by the provider on your device and is governed by its policies, not by ours.

Players that our editors place inside the text of an article are not trailers: they follow your External media choice (Section 3.2).

4.4 Leaflet map library (served by us)

The interactive map is drawn by Leaflet, an open-source JavaScript library (version 1.9.4). We serve our own copy of it from our servers, so loading the map library involves no third party. What the map then downloads for its background picture is described in Section 4.5.

4.5 Map tiles (Esri)

The map background (the actual picture of streets and coastlines) is made of small images ("tiles") downloaded from server.arcgisonline.com, operated by Esri (Environmental Systems Research Institute, Inc., USA). Your browser requests them while you pan and zoom the map, which tells Esri your IP address and which tiles you asked for, that is, roughly which area you are looking at. As the provider is established in the United States, this is a transfer outside the EEA under the safeguards Esri declares. The tile responses set no cookies (verified: no Set-Cookie header), and we store no data about which tiles you loaded. See the Esri Privacy Statement.

4.6 Icons, libraries and images (served by us)

The coloured brand icons next to social links (from the open-source Simple Icons project, released under the CC0 licence), the Font Awesome icons and our fonts, the JavaScript libraries behind the 3D globe on our landing page (three.js, globe.gl, topojson and a public map of national borders), the decorative photographs on our landing page and the picture behind its small map are all stored on our own servers and delivered by us, like the rest of each page. No third party receives your IP address because of them.

4.7 Place lookups made by our server (GISCO and Nominatim)

When a place is saved with an event, a venue or a profile, our server may look it up to assign it to the right city: it asks GISCO, the geographic service of the European Commission (gisco-services.ec.europa.eu, European Union), which administrative area a pair of coordinates belongs to, and Nominatim (OpenStreetMap Foundation, United Kingdom) which coordinates a city name has or which city they fall in. Only those coordinates or place names are sent, and the requests come from our server: these services see our server's address, never your IP address, and nothing else about you.

4.8 Approximate starting position (our own server)

On your first visit, before you allow GPS or search a city, the approximate starting position of the map is computed on our own server from your IP address, using a geolocation database stored locally (DB-IP Lite, "IP Geolocation by DB-IP", licensed under CC BY 4.0). Your IP address is not sent to any third party for this purpose, nothing is stored on your device and the result is not kept. Legal basis: legitimate interest (Art. 6.1.f). More in our Privacy Policy, Section 4.1.1.

5. Planned Future Services (not yet active)

We intend to introduce the following services in the future. They are not currently loaded or active on the Platform and no data is collected or sent to any provider through them at this time.

5.1 Google AdSense (planned)

When activated, Google AdSense will display contextual advertising on the platform. Advertising will be shown only to non-paying users: Members will see no ads. Google AdSense may use cookies to serve ads based on your interests and prior visits to other websites. See Google's advertising policies.

Before activation, we will update this Cookie Policy, add a separate Advertising switch (off unless you switch it on), present a renewed consent banner, and load Google AdSense only after explicit consent. In accordance with Articles 26 and 28 DSA, we will not use sensitive categories of personal data for ad targeting and will not display targeted advertising to users we know to be minors. Declining advertising cookies will not affect your access to any platform feature.

5.2 Direct sponsorships and sponsored content (planned)

Separately from programmatic advertising such as AdSense, we may in the future host direct sponsored content, for example a section or placement agreed directly with a sponsor (such as a musical-instrument brand or a festival). This is a direct commercial relationship, not third-party ad targeting, and would not by itself require advertising cookies.

If and when we introduce such content, we commit to clearly and prominently labelling it as sponsored or advertising, so that its commercial nature is immediately recognisable to you, in line with Directive 2005/29/EC on unfair commercial practices (as amended by the "Omnibus" Directive (EU) 2019/2161) and Article 26 of the DSA. The exact form and implementation are not yet decided; this Policy will be updated before any such content goes live.

5.3 Stripe (planned)

Stripe will be used for processing Membership and Event Boost payments when paid services are activated. Stripe may set its own cookies for fraud prevention and session integrity on the checkout pages. These are considered strictly necessary to complete a payment you have initiated and will be set only on the relevant checkout pages.

5.4 Web Push notifications (planned)

We are preparing browser push notifications (for example, to alert you about nearby availability or events). This feature is not yet active: no push data is collected today. When activated, enabling notifications will require the browser's own native permission prompt, which you must accept before any subscription is created. This happens independently of, and in addition to, any cookie consent. If you enable it, we will store a push subscription endpoint provided by your browser, associated with your account, used solely to deliver the notifications you asked for. You will be able to disable notifications at any time from your browser or your account settings. This Policy will be updated before the feature goes live.

6. Legal Basis for Processing

• Essential storage (the bit_jwt login cookie, the admin session, bit_user, bit_consent and the other items listed in Section 2): contract performance (GDPR Art. 6.1.b) and, where applicable, legitimate interest (Art. 6.1.f). Exempt from consent under Article 5(3) of the ePrivacy Directive ("strictly necessary" exception).
• Analytics cookies (Google Analytics 4, active): your explicit prior consent (Art. 6.1.a GDPR and Art. 5(3) ePrivacy), given through the cookie banner or Cookie preferences and withdrawable at any time in the same place. Analytics is never loaded without this consent.
• Functional third-party services: for hCaptcha, our legitimate interest in keeping the Platform secure against bots, spam and abuse (Art. 6.1.f), including loading its script with the pages of our interactive map so that the check is ready on the protected forms; any storage it sets is strictly necessary for that security function, which is why it does not depend on the cookie banner. For place and address searches through Nominatim/OpenStreetMap (Section 4.2), contract performance (Art. 6.1.b) when you use a feature of your account, such as registering a venue or creating an event you have asked to publish, and otherwise our legitimate interest in providing the search you asked for (Art. 6.1.f); routing it through our server, the short search cache and the abuse limits rest on our legitimate interest in not exposing your IP address to the provider and in respecting its usage policy (Art. 6.1.f). Nothing is stored on or read from your device for this.
• External media (Section 3.2): your explicit prior consent (Art. 6.1.a GDPR and Art. 5(3) ePrivacy) through the "External media" switch, withdrawable at any time in the same place. Without it, a single item is loaded only when you ask for it with "Load this content".
• Video and audio trailers (Section 4.3): your own action starts the loading: the player is fetched only after you press play, so nothing is requested from the provider or stored on your device before you ask for that video or track; the request rests on our legitimate interest in showing the content the profile owner chose to publish (Art. 6.1.f). Any cookie the provider then sets is set by that provider under its own policy, and we neither instruct it nor receive its data.
• Map tiles (Section 4.5): our legitimate interest (Art. 6.1.f) in showing the map background. The tile responses set no storage on your device (verified), so the consent rule of Article 5(3) ePrivacy is not triggered; the only data involved is the IP address your browser necessarily reveals when it fetches a tile, which we never receive back. The map library, icons, fonts and images (Sections 4.4 and 4.6) are served by us and involve no third party.
• Place lookups by our server (Section 4.7): contract performance (Art. 6.1.b) and our legitimate interest (Art. 6.1.f) in keeping events and profiles under the correct city; only place names or coordinates leave our server.
• Future advertising cookies (AdSense): will require your explicit prior consent (Art. 6.1.a GDPR and Art. 5(3) ePrivacy) before activation.
• Future payment cookies (Stripe): strictly necessary to complete a payment you have initiated, exempt from consent on the checkout pages only.
• Future push notifications (Web Push): your consent (Art. 6.1.a), given through your browser's native notification permission prompt before any subscription is created.

7. Managing Your Preferences

On your first visit a banner at the bottom of the page offers three options with the same size and prominence: "Accept all", "Reject all" and "Customize". Refusing takes exactly one click, like accepting, and the site remains fully usable whatever you choose, or while you have not chosen yet. Until you choose, nothing optional is loaded.

"Customize" opens Cookie preferences, where each purpose has its own switch and a short description, and a "Services" row that lists every service in that category with its provider, purpose, storage duration and a link to the provider's policy:

• Strictly necessary: always on and cannot be switched off, because the site cannot work without it: sign-in, security (hCaptcha), your settings and this choice, the map and the files our pages are built from (Sections 2 and 4). No consent is needed.
• Analytics: off unless you switch it on. Google Analytics 4 (Section 3.1).
• External media: off unless you switch it on. Video and audio players and video cover images from YouTube and other platforms inside our articles (Section 3.2).
• Advertising: not shown today, because no advertising is active. It will appear, off unless you switch it on, only when Google AdSense is activated (Section 5.1).

Earlier versions of the banner had a single "Analytics and advertising" switch, which only ever loaded Google Analytics 4, and a "Marketing communications" preference. If you made a choice there, your Analytics choice is kept as it was; External media and Advertising stay off until you switch them on. Marketing communications are no longer part of the cookie choices: the recommendations email has its own opt-in in your account settings.

From there you can save exactly the combination you chose ("Save my choices"), or accept or reject everything. Closing the panel without saving does not record any choice.

You can change your mind at any time, and withdrawing is as easy as giving consent:

• On our pages: use the "Cookie preferences" link in the site footer. A few service pages have no footer (for example password reset, email confirmation and unsubscribe); they load no optional technology, and you can manage your choices from any other page or from this one.
• On this page: click the "Cookie preferences" button at the top.
• Via browser settings: clear site data for bandintour.com. This resets all preferences including your login session, and the banner will appear again.

Withdrawing consent stops any future data collection but does not affect data already collected prior to withdrawal. Each confirmed choice, including a withdrawal, is recorded as described in Section 2.

8. Third-Party Content

Profiles may contain links to external platforms (social media, streaming services, ticket vendors). If you follow those links, those platforms may set their own cookies independently of your choices here.

If a profile contains a video or audio trailer, opening the profile loads nothing from the video or audio provider: you see a placeholder served by us, and the player is fetched only if you click play. From that click on, the provider may set its own cookies, outside our control. YouTube trailers use the privacy-enhanced youtube-nocookie.com domain. Section 4.3 explains this in full; players inside the text of articles follow your External media choice (Section 3.2).

9. Changes to This Policy

We will update this Cookie Policy when we introduce new cookies or storage technologies, and in particular before activating Google AdSense, direct sponsored content, Stripe payments or Web Push notifications. The version date at the top reflects the last update. Material changes will be notified to registered users by email and will be subject to a renewed consent request where required by law.

10. Contact

Questions about our use of cookies? Contact us at privacy@bandintour.com. Data controller: IOCOS di G.C., Via F. Baracca traversa De Salvo 15, 89123 Reggio Calabria, Italy (P.IVA 02758080804).