Privacy Policy

1. Introduction

Welcome to Band in Tour. Whether you are a band, a venue, a promoter or a music fan, the respect of your privacy is important to us.

This Privacy Policy describes how Band in Tour ("we", "us", "our") collects, uses and protects your personal data when you use our platform and services. It has been written in compliance with Regulation (EU) 2016/679 ("GDPR"), Directive 2002/58/EC ("ePrivacy"), Regulation (EU) 2022/2065 ("Digital Services Act" or "DSA") and applicable Italian data-protection law (D.lgs. 196/2003 as amended by D.lgs. 101/2018).

This policy applies to personal data collected through bandintour.com and any related pages or services operated by us. It does not apply to third-party websites you may reach through links on our platform.

2. Definitions

• Personal data: any information relating to an identified or identifiable natural person (name, email address, location, online identifier, etc.).
• Services: all features and functionalities made available through bandintour.com, including event discovery, profile management, the Live Music Club, the Live Music Club Agenda, the support and reporting system, and (when activated) the boost and membership system.
• User: any visitor or registered individual on the platform, including bands, venues, promoters and fans.
• Profile: the registered account and public page associated with a User on Band in Tour.
• Processing: any operation performed on personal data, whether automated or not, including collection, storage, use, disclosure and deletion.
• GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
• DSA: Regulation (EU) 2022/2065 of 19 October 2022 on a Single Market for Digital Services.

3. Data Controller

The data controller is IOCOS di G.C. (P.IVA 02758080804), with registered office at Via F. Baracca traversa De Salvo 15, 89123 Reggio Calabria, Italy. Band in Tour is developed under the Sunakoma project; legal responsibility for processing rests with IOCOS di G.C.

We are not required to appoint a Data Protection Officer (DPO): under Article 37 of the GDPR that obligation arises only where our core activities consist of large-scale, regular and systematic monitoring of individuals, or large-scale processing of special categories of data, or where we are a public authority, none of which applies to our processing. (Separately, for Digital Services Act purposes, Band in Tour qualifies as a micro/small enterprise online platform within the meaning of Article 19 of the DSA; that status concerns DSA transparency and moderation obligations, not the GDPR DPO requirement.) Our designated point of contact for privacy matters and for Member State authorities is:

• Privacy matters: privacy@bandintour.com
• Legal and authority requests: legal@bandintour.com
• Working language: English and Italian

4. Personal Data We Collect

The data we collect depends on how you use the platform.

4.1 All visitors

• Web server access logs: our web server keeps a standard record of each request (IP address, date and time, page requested, browser type), used only for security and troubleshooting. We do not compute traffic statistics from these logs. How long they are kept is set out below and in Section 7.
• Analytics (Google Analytics 4): only with your consent. If, and only if, you consent to analytics in the cookie banner ("Accept all", or the "Analytics" switch in Cookie preferences, which is separate from every other choice), we load Google Analytics 4, which collects aggregate usage data (pages visited, session duration, traffic sources, approximate location) through cookies. It is never loaded if you decline or before you choose, and you can withdraw consent at any time. Full details, including the provider and international transfers, are in our Cookie Policy.
• Technical data: browser type, device type, approximate country (derived from IP address). IP addresses are used for security, rate limiting and anti-abuse, and to estimate an approximate starting location, computed on our own server (Section 4.1.1). They are kept for up to 30 days in our application data and in our web server logs; the few exceptions (server backups, the logs of our intrusion-prevention system and the admin audit log) are described in Section 7.
• Data collected through cookies and local storage, as described in our Cookie Policy.

4.1.1 Third-party technical services

The technical third-party services listed below are already in use to make specific features work. They are not analytics or advertising services. Some are contacted as soon as a page opens (the hCaptcha script with the pages of our interactive map and with the password-reset ("Forgot password") page, and the map tiles with the pages of our interactive map), others only when you use a feature (a place or address search, "Near me", a video you choose to play, external media you choose to load). Some of them we call from our own server; others are fetched directly by your browser, which means the provider necessarily sees your IP address and the address of the page you are on, even when nothing is stored on your device.

• hCaptcha (bot protection): used on the registration, password-reset and report forms to distinguish humans from automated bots. Provided by Intuition Machines, Inc. (USA). Its script loads with the pages of our interactive map and with the password-reset ("Forgot password") page, before you open any form, so the provider receives your IP address and technical information about your browser and device from that moment; on the protected forms the challenge processes your interaction to assess whether you are human. When you submit a protected form, our server also sends hCaptcha the verification token and your IP address to confirm the check was passed. It may set its own storage (for example a bot-management cookie lasting about 30 minutes). We treat it as strictly necessary for security, on the basis of our legitimate interest (Section 5), so it does not depend on your cookie choices, as described in the hCaptcha Privacy Policy. Because the provider is established in the United States, this involves a transfer of data outside the EEA (see Section 6).
• Nominatim / OpenStreetMap (place and address search, made by our server): when you search for a city or a country, type an address or a city in a form (for example registering a venue, creating an event or setting the city of your profile) or use "Near me", the lookup is made by our server, not by your browser. Your browser sends our server the text you typed or, for "Near me", your position rounded to about 100 metres; our server forwards only that text or rounded position to Nominatim, the geocoding service operated by the OpenStreetMap Foundation (United Kingdom, covered by a European Commission adequacy decision), and sends you back the map coordinates, or the name of the city and country you are in. Nominatim therefore sees our server's address and never your IP address, and receives no cookie or identifier of yours; your exact GPS position does not leave your device for this lookup. We keep the answers to text searches on our server for up to 7 days, so that the same search is not sent again: they are stored under the search itself, are not linked to you, your IP address or your account; we do not record the time of the search, only the day, and each stored file expires within 7 days. Answers to "Near me" lookups are not kept. We do not log the text you type or your position. To limit abuse, for the lookups that actually go to Nominatim (not those answered from our stored results) we count the requests coming from each connection using a pseudonymised form of your IP address: a keyed hash made with a secret key used only for this purpose, not the address itself (for an IPv6 address, only its network part is used). These counts are deleted after 48 hours. See the OpenStreetMap Foundation Privacy Policy.
• YouTube, Vimeo, Spotify, SoundCloud and Bandcamp (video and audio players): video and audio trailers on profiles, in the "Watch" section of articles and on our landing page are click-to-play: nothing is requested from the provider until you press play. Players that our editors place inside the text of an article, and the cover images of "Watch" videos, load automatically only if you switch on "External media" in Cookie preferences; otherwise you see a placeholder served by us and can load a single item with a click. When a player loads, the provider receives your IP address and the address of the page and may store data on your device. The provider for YouTube in the EEA is Google Ireland Limited (see Section 6). Exactly what is requested, when, and by whom is set out in our Cookie Policy.
• Map tiles (loaded by your browser): the map background comes from server.arcgisonline.com (Esri, USA). These are static picture tiles that contain none of your personal data; we have verified that they set no cookies or other storage on your device, and we keep no record of these requests. The only data involved is the IP address your browser reveals in making them, and roughly which area of the map you are looking at, which we never receive. The map library, the social icons, the 3D-globe libraries and the photographs of our pages are served from our own servers, not by third parties.
• Place lookups made by our server (GISCO and Nominatim): when a place is saved with an event, a venue or a profile, our server may send the coordinates or the place name to GISCO (European Commission, gisco-services.ec.europa.eu) and to Nominatim (OpenStreetMap Foundation, United Kingdom) to assign it to the right city. The requests come from our server, so these services see our server's address and never your IP address.

Every service in this list that involves your browser (what it does, when it is triggered, who operates it and where) is described one by one in our Cookie Policy. Place and address searches are described there too (Section 4.2), because they start from what you type in your browser, even though your browser no longer contacts Nominatim itself.

Approximate starting position (no third party involved). On your first visit, before you grant GPS access or search a city, the approximate starting position of the map is computed on our own server from your IP address using a locally stored geolocation database (DB-IP Lite, "IP Geolocation by DB-IP", licensed under CC BY 4.0). The IP address is not sent to any third party for this purpose, and nothing is stored: the result is used to answer that single request and is not kept or linked to your account. It is at best city-level, can be off by tens or even hundreds of kilometres, and is never shown or treated as GPS: you can always enable precise location instead. Legal basis: legitimate interest (Art. 6.1.f), see Section 5.

4.2 Registered users (all roles)

• Required at registration: username (public alias), email address, password (stored as a bcrypt hash, never in plain text), role (band / venue / promoter), city.
• Age confirmation: when you register, or when you claim a Ghost Profile, you confirm, with a separate box, that you are at least 16 years old (Section 11). We record your confirmation that you are at least 16 and when you gave it (date and time). The record is kept with your account and deleted together with it. Accounts created before this box was introduced have no such record.
• Optional profile data: display name, biography, profile photo, video trailer link and, for bands, an audio trailer link (one SoundCloud or Spotify track), genre tags, repertoire type, social media links.
• Location data (venues): full address, GPS coordinates and, if you paste one, the Google Maps link of your venue, used to display your venue on the map and as the starting position of new events that tag your venue (whoever creates the event can change it for that event). This data is public.
• Session data: when you sign in (and also when you register, confirm your email address or claim a profile), our server places a login cookie called bit_jwt in your browser. It contains a signed token (JWT) with your account number, your username, your role and your membership status, and your browser sends it back with each request so that we know the request comes from you. The cookie is marked HttpOnly, so the scripts running on our pages cannot read it; it is sent only to bandintour.com, only over an encrypted connection, and never with requests started from another website. It lasts 7 days from the moment you sign in and is not extended while you use the Platform: after 7 days you are asked to sign in again. When you sign out, the cookie is deleted from your browser and the token is also blocked on our server until its original expiry date, so it can no longer be used even if a copy of it existed somewhere; changing your password or deleting your account does the same for the session you are using. Separately, your browser keeps in its local storage a copy of your own profile details (bit_user), so that our pages can show you as signed in; it contains no password, no email address and no token, and it is removed when you sign out. Every item is listed in our Cookie Policy.
• Email log: each email our system sends you leaves a line in an internal log, described in Section 7.

4.3 Event data (bands, venues, promoters)

• Event details you publish: band name, event type, date, venue, city, GPS coordinates, ticket link, and an event flyer image (available to Members, and to any Registered User for an event with four or more acts on the bill).
• Participation in events as a linked profile (band, venue or promoter role on an event).
• Availability dates you set on your calendar (visible to registered users in the Live Music Club; the Live Music Club Agenda is available to Members only when that feature is activated).

Data about you provided by another user (Art. 14 GDPR). Not all event data about you reaches us from you. When a promoter, a venue or another act builds a lineup, they type in the names of the other acts on the bill, and our alias resolver matches those names against existing profiles: if the match succeeds, your profile is linked to an event you did not create. Source of the data: the Registered User who published the event, not you. Categories of data concerned: your public stage or business name, your profile link, and your role on that event (headliner, support act, special guest, accompanist). Purpose and legal basis: accurately describing who is on the bill of a live event, on the basis of our legitimate interest and that of the other entities named on the event in a complete and correct lineup (Art. 6.1.f GDPR). Because these data are not obtained from you, Art. 14 GDPR applies rather than Art. 13, and this Section is the general public disclosure required by it: under Art. 14(5)(b) individually notifying every act named in every lineup would involve disproportionate effort. You may object to the link at any time under Art. 21(1) GDPR (see Section 8) or write to privacy@bandintour.com to have your profile unlinked from a specific event; unlinking leaves your name on the event as plain text, and the removal of the event itself is assessed as described in Section 7.

4.4 Activity data (all registered users)

• Support actions ("heart") on events.
• Abuse reports submitted through the platform, including the reason text you provide.
• Membership status (free plan or Member) and the date it was activated.
• Inputs and outputs of the transparent ranking algorithm (profile links, support votes, activity, boost tier where applicable, crowdfunding badge).

If you are the subject of a report, not its author (Art. 14 GDPR). An abuse report is personal data of two different people: the user who submits it, and the user, profile or event it is about. If a report concerns you, we hold data about you that we did not obtain from you. Source of the data: the user or third party who submitted the notice, whose identity we do not disclose to you unless we are legally required to. Categories of data concerned: the profile, event or Content identified in the notice, the reason category selected, the free-text explanation written by the reporting party, and the moderation decision we took as a result. Purpose and legal basis: operating the notice-and-action mechanism required by Arts. 16 and 17 DSA, which is a legal obligation (Art. 6.1.c GDPR), alongside our legitimate interest in keeping the Platform free of unlawful and abusive content (Art. 6.1.f GDPR). Because these data are not obtained from you, Art. 14 GDPR applies rather than Art. 13, and this Section is our public disclosure of that processing. If we act on a report about you, you receive a statement of reasons and may appeal, as described in Article 10bis of the Terms of Use. Your rights of access and rectification over this material are limited to the extent that exercising them would reveal the identity of the reporting party or prejudice the investigation of the notice.

4.5 Interest and recommendation data

• City preferences: up to three cities you choose to follow (stored with display name and GPS coordinates).
• Genre preferences: musical genres you select from our standard list.
• Band type filter: whether you want to see local acts, touring bands, or international artists in your recommended feed.
• Recommendation history: the timestamp of your last visit to the "Recommended for you" section, used solely to compute the notification badge.
• Newsletter subscription: whether you have asked to receive our newsletter by email, which covers the recommendations email (sent at most once every two weeks and built from the interests above) and the occasional newsletters composed by our team. You are subscribed only if you tick the newsletter box yourself in your interests form, which is offered after sign-up and in Profile > Settings under "Interests & Recommendations". The box is never ticked in advance, and a new account is not subscribed. When you tick it we record the date, as proof of your consent. You can unsubscribe at any time and free of charge, with the one-click link in every newsletter or by unticking the box in Profile > Settings (the interests form can be saved once a day; the link in the email always works). Our emails contain no tracking image or any other means of telling us whether or when you open them. The data used are your email address, the name on your account and, for the recommendations email, the interests listed above. The legal basis is your consent (Art. 6.1.a GDPR and Art. 130 of the Italian Privacy Code, Legislative Decree 196/2003). For each newsletter sent to you we keep a delivery record (Section 7, "Newsletter").

All interest data is voluntary and can be deleted at any time from your Profile settings or by contacting us.

4.6 Membership and payment data (future)

Stripe is our designated payment provider for Membership and Boost purchases. Payment processing is not yet active on the platform: no card or transaction data is currently collected. When payments go live, all card data will be handled directly by Stripe and will never transit through or be stored on our servers. We will retain only the record of the tier purchased, the associated event or subscription, the expiry date and the fiscal invoice data required by Italian tax law. This section will be updated, and where required additional consent collected, before the payment feature is activated.

4.7 Push notifications (future)

Browser push notifications are not yet active: no push data is collected today. When this feature is activated, enabling it will first require your browser's own native notification permission, which you must accept. If you do, we will store a push subscription endpoint provided by your browser, associated with your account, used solely to deliver the notifications you have asked for (such as nearby availability or events). You will be able to disable notifications at any time from your browser or your account settings. This section will be updated before the feature goes live.

4.8 Sponsorship and advertising (future)

We do not currently run advertising. Two future possibilities are anticipated here for transparency:

• Programmatic advertising (Google AdSense): if activated, contextual ads shown only to non-paying users (Members would see no ads), loaded only after a renewed consent request. The cookie aspects are described in our Cookie Policy.
• Direct sponsored content: separately from programmatic advertising, we may host content or placements agreed directly with a sponsor (for example a musical-instrument brand or a festival). This is a direct commercial relationship, not third-party ad targeting. If and when we introduce it, we commit to clearly and prominently labelling such content as sponsored, so that its commercial nature is immediately recognisable, in line with Directive 2005/29/EC (as amended by the "Omnibus" Directive (EU) 2019/2161) and Article 26 of the DSA. The exact form is not yet decided and this Policy will be updated before any such content goes live.

4.9 Ghost Profiles (profiles sourced from publicly available information)

To help the live music scene gain visibility before every act, venue or promoter has registered directly, Band in Tour creates a limited number of unclaimed "Ghost Profiles" for acts, venues and promoters that are, at the time of creation, already publicly active in the sector. These profiles are compiled entirely from information the entity itself has already made public for the same essential purpose (being found and booked), such as its own public social media page or publicly listed events and lineups.

• What is included: the name of the act, venue or promoter, its city, a short descriptive bio compiled from publicly available promotional information, and links to its own public social media pages. Where available, we also include a logo or another non-representative image (such as an official symbol, artwork or graphic associated with the entity) sourced from its own public profile, intended only to help visually identify the listing. We do not use a photograph of an identifiable individual for this purpose unless the entity has confirmed its use, and never for advertising purposes.
• What is not included: no private, sensitive or non-public information is ever used to create a Ghost Profile. No contact details (email, phone) are published, and none are collected from third parties for this purpose.
• The automatically generated Local Scene article: a Ghost Profile is not published only as a profile. Once it has a bio and an image, our system also generates a separate public article about the entity in the Local Scene section of the site, at its own web address. The article is written automatically from the same profile data and adds no data that is not already in the profile: a title made of the name, the role and the city and country; a short description for search engines, built from the same bio; a cover image, which is the same logo or non-representative image described above; a body text with the bio and the role, city, genres and repertoire shown on the profile; and tags for the city, the country, the genres and the role. The Local Scene section is published in English: where the public bio is written in another language, the article may carry an English version of it prepared by us, while the profile keeps the original. The article is generated as a draft and goes online only when a member of our team publishes it. Once published it is meant to be found: it appears in the Local Scene listings, it is included in our sitemap and it is described to search engines through structured data (schema.org), so it can be indexed and shown in search results and link previews. It is therefore a second public surface of the same data, and everything this Section says about the profile (the legal basis, the data used, your right to object, to have it corrected and to have it removed) applies to the article in exactly the same way. When a Ghost Profile is removed at your request, its article is deleted with it, together with its cover image and tags, and links to the profile inside other articles are turned into plain text; if you only ask us to stop showing the profile (opt-out), the article is taken offline at the same moment as the profile. The one exception is an article whose processing is itself under an active restriction under Art. 18 GDPR (Section 8): restriction means the article may not be deleted or modified, so it stays stored, unchanged and offline (off every public page and listing we control and out of our sitemap) until the restriction ends. It is never put back online at that point: if the profile has been removed in the meantime, the article is deleted; if the profile has only been taken offline (opt-out), the article stays offline with it.
• Minors: we do not create Ghost Profiles of people who appear to be under 18, and we do not create one for an act any of whose members appears to be under 18. If it turns out that a Ghost Profile concerns a minor, we remove it immediately on notice, from anyone: write to privacy@bandintour.com, and you will not be asked to prove the person's age or your relationship to them. Even where a Ghost Profile is otherwise allowed, its image is always and only a logo or the name: never a photograph that could make a minor identifiable. These are not courtesies: Art. 6(1)(f) GDPR names the case "in particular where the data subject is a child" as one where the interests of the person concerned weigh more heavily against a legitimate interest, and a Ghost Profile is created without the person's involvement, so we do not carry out that balancing for minors at all.
• Legal basis: legitimate interest (Art. 6.1.f GDPR) in supporting the discoverability of live-music entities that are already, by their own choice, publicly promoting the same activity the profile describes. We have carried out a Legitimate Interest Assessment for Ghost Profiles, available on request at privacy@bandintour.com.
• How we inform you (Art. 14 GDPR): because a Ghost Profile is compiled from public sources and not obtained from you, Art. 14 GDPR applies. Whenever there is a reasonable channel through which to reach the entity (in practice, the public social account or the email address from which the profile was compiled), we notify it individually: the invitation we send to claim the profile is itself the notice, and it states who the controller is, why the profile exists and on what legal basis, where the data comes from, what it contains, which rights you have, how to claim the profile and how to have it removed, with a link to this Section. We rely on the exemption in Art. 14(5)(b) GDPR, under which individual notice is not owed where it would be impossible or involve disproportionate effort, only where no such channel exists at all; in that case, and only in that case, this Privacy Policy is our public disclosure of the processing.
• Your control: if a Ghost Profile represents you, your act, your venue or your promotion business, you can claim it at any time using a one-time invite code (when you claim it you accept our Terms of Service and Privacy Policy and confirm that you are at least 16 years old, as at registration, and we record both), which gives you full ownership and immediate control to edit, correct or remove any content. The code is never published or shown on the profile itself: we deliver it individually through a direct, verified contact channel (typically a private message to a social account already linked to that profile, or by email), precisely so that only the entity the profile represents can use it. Alternatively, you can request the profile's removal without claiming it, at any time and without needing to justify the request, by contacting privacy@bandintour.com; we process such requests promptly as an exercise of your rights to object and to erasure (see Section 8).

5. Purposes and Legal Bases

6. Recipients of Your Data

We do not sell, rent or share your personal data with third parties for commercial or marketing purposes. Our core hosting, database and email infrastructure is located within the European Economic Area. However, some third-party services we use are operated by providers outside the EEA: when you consent to Google Analytics 4, when the pages of our interactive map or the password-reset page load the hCaptcha anti-bot script, when you play a video or load external media, and whenever your browser fetches the map tiles of our interactive map, data (at a minimum your IP address) may be transferred outside the EEA. These providers declare that such transfers take place under the safeguards required by Chapter V of the GDPR (such as standard contractual clauses or equivalent frameworks adopted by the provider); the specific mechanism for each provider is described in that provider's own privacy policy, linked below. We have carried out a Transfer Impact Assessment of these transfers, available on request at privacy@bandintour.com; for the video and audio players and the map tiles it relies on the safeguards stated by each provider, which are being reviewed. The approximate starting location estimated from your IP address involves no transfer at all: it is computed on our own server (Section 4.1.1).

Your data may be disclosed to, or processed by, the following recipients:

• Internal team: authorised team members of IOCOS di G.C. and the Sunakoma development team who need access to operate and maintain the platform (development, support, moderation), under confidentiality obligations.
• Hosting and infrastructure: the EU-based servers and database services that store platform data operate as data processors under written agreements compliant with GDPR Art. 28.
• Email delivery: service notifications and newsletters are sent by the mail server of our own hosting infrastructure, located in the European Economic Area; your email address and the content of the message are processed there only to deliver the message to your mailbox provider. We also keep our own log of the emails we send (Section 7, "Email log").
• Analytics (only if you consent): Google Ireland Limited (with Google LLC, USA, as possible sub-processor) processes Google Analytics 4 data, but only after you consent to analytics in the cookie banner or in Cookie preferences. This may involve a transfer outside the EEA under Chapter V GDPR safeguards. See Google's Privacy Policy.
• Bot protection: Intuition Machines, Inc. (hCaptcha, USA) receives your IP address and technical information about your browser and device as soon as the pages of our interactive map and the password-reset ("Forgot password") page load its script, before you open any form, and processes your interaction on the protected forms, for security purposes (Art. 6.1.f GDPR). When you submit a protected form, our server also sends it the verification token and your IP address. This involves a transfer outside the EEA under Chapter V GDPR safeguards. See the hCaptcha Privacy Policy.
• Geocoding: the OpenStreetMap Foundation (Nominatim, United Kingdom) receives, from our server, the place or address text you type or, for "Near me", your position rounded to about 100 metres, in order to return map coordinates or the name of the place. It does not receive your IP address or any identifier of yours. The UK is covered by a European Commission adequacy decision. See the OpenStreetMap Foundation Privacy Policy.
• Video and audio players: Google Ireland Limited (YouTube, with Google LLC, USA, as possible sub-processor) and, where a profile or an article uses them, Vimeo, Inc., SoundCloud Global Limited & Co. KG, Spotify AB and Bandcamp receive your IP address and the address of the page when a player or a video cover image is loaded, and may set their own storage at that point. This happens only when you press play on a trailer, when you ask for a single item with "Load this content", or automatically in articles if you have switched on "External media". It is separate from Google Analytics and does not depend on your analytics consent. For YouTube this may involve a transfer outside the EEA under Chapter V GDPR safeguards. See Google's Privacy Policy and our Cookie Policy.
• Map tiles: Esri (server.arcgisonline.com, USA) receives your IP address, and which tiles you ask for, when your browser fetches the map background. It receives nothing else about you, sets no storage on your device, and sends us nothing back. The transfer takes place under Chapter V GDPR safeguards. The map library, icons, globe libraries and photographs of our pages are served from our own servers and involve no third party.
• Payment provider (when activated): Stripe will act as an independent controller for card data and as a processor for invoice metadata. Until the payment feature is live, no data is transferred to Stripe.
• Other users: information you publish on your profile (name, alias, city, bio, genre, events, social links) is public and visible to all visitors. Availability dates are visible to registered users. Support actions are publicly counted.
• Legal authorities: we may disclose personal data if required by law, court order or a request from a competent authority (including DSA points of contact, judicial police, supervisory authorities), or to protect the rights and safety of the platform and its users.

7. Data Retention

• Account and profile data (including the record of your age confirmation): retained while your account is active. When you delete your account from the settings, it is deleted at once; a deletion request sent to us by email is carried out within 30 days at the latest.
• Events: an event that is deleted (by the account that published it or by us) or rejected in review is removed from every public page straight away, but it stays in our database for 30 days, so that a mistake can still be undone. After that it is permanently deleted by our automatic maintenance job, which runs every night. Two kinds of event are never deleted this way: an event that has a published Event Agenda article (for a tour or festival, every date of it), and an event under an active restriction of processing, or published by an account under an active restriction (Section 8).
• Automatic archiving of past events: the same nightly job keeps, for each account, its 10 most recent past events (an event counts as past 12 hours after its start time) and archives the older ones. An archived event is treated exactly like a deleted one: it is removed from every public page, including its own page, and it is permanently deleted 30 days later, as described in "Events" above. Three kinds of event are left out of this, are never archived and do not count towards the 10: events that have a published Event Agenda article (for a tour or festival, every date of it); events under an active restriction of processing, or published by an account under an active restriction (Section 8); and events whose publishing account has been deleted (see the next entry).
• Events after an account is deleted: events you created, or that you were linked to as an act, venue or promoter, are not deleted together with your account. They stay published and unchanged, and this applies in particular to events that involve other entities or that have already taken place. What is removed is the link to your profile: your name remains on the event as plain text and is no longer clickable, and no other profile or account data stays attached to it. Content you contributed as part of the event itself, such as its description or flyer, remains published as part of the event, the same way it would if you had left the Platform without deleting your account. The reason is that an event is shared content, not personal data belonging exclusively to whoever created it: the other entities named on it (the act, the venue, the promoter) and the users who gave it Community Support have their own legitimate interest in seeing it preserved, and a past event is also part of the public record of what happened in the live music scene. Automatic erasure is therefore not owed: Art. 17.3(a) and Art. 17.3(e) GDPR expressly disapply the right to erasure where processing is necessary for the exercise of the right to freedom of expression and information, or for the establishment, exercise or defence of legal claims. We keep the event published on the basis of legitimate interest (Art. 6.1.f GDPR), which covers the legitimate interests of the controller or of a third party. If you want a specific event removed, write to privacy@bandintour.com: we assess each request individually, balancing your right to erasure against the legitimate interests of the other entities involved, and we remove the event where your interest prevails (Section 8). This is distinct from a Ghost Profile, which represents a single entity and which we remove on request without asking you for a reason (Section 4.9).
• Event flyers: a flyer is part of the event it was uploaded for and does not expire with the event date. It stays on the event after the event has taken place and, when the event has an Event Agenda article, the same flyer is normally that article's cover image, so it stays in the article too. Our automatic media clean-up, which runs every night, removes a flyer only when all of the following apply: the event took place more than 7 days ago, no article on the Platform uses the flyer as its cover image, and it is not one of the three most recent flyers uploaded from the same account (those are kept so that they can be reused when creating a new event). In that case the file is deleted from our servers and the event stays published without it. The clean-up never touches the flyer of an event that is under an active restriction of processing, or that was published by an account under an active restriction (Section 8). When an event is permanently removed from our database (see "Events" above), its flyer file is deleted with it, unless an article, another event or a profile on the Platform still uses the same file.
• Profile pictures: when you replace your profile picture, or it is removed, the previous file is deleted from our servers straight away, unless an article on the Platform uses it, for example as its cover image (the cover of the Local Scene article generated from a profile is normally the profile picture itself). An image linked to an article is treated as part of that published content: it stays on our servers and in the article until you ask us to remove or change it by writing to privacy@bandintour.com. This rule covers the case where a picture is replaced or removed while the account still exists. Deleting your account works differently: your current profile picture is deleted, together with the Local Scene article generated from your profile and its cover image (see "Local Scene article generated from a profile" below), and the file is removed even if an article by someone else also uses it, for example as the cover of an Event Agenda article about a tour you were part of. In that case the erasure of your personal data takes priority: the other article stays published, without that image. The only exception is a picture that is also the cover of the Local Scene article generated from your own profile while that article is under an active restriction of processing (Section 8): such an article may not be modified, so it keeps its cover.
• IP addresses and server logs: IP addresses are kept for up to 30 days in our application data (such as rate-limit and anti-abuse records, abuse reports and Ghost Profile claims) and in our web server and application logs; after that they are deleted or overwritten with a blank value. There are three exceptions: backups of our server, which include these logs, can contain them for up to about two months before being overwritten (see "Backups" below); the logs of our intrusion-prevention system, which blocks addresses that attack the server, are kept for up to about eight weeks; and the internal admin audit log keeps the IP address of each administrator access and action for 6 months (see "Internal admin audit logs" below). The approximate geolocation cache follows its own rule, described in the next entry. The legal basis is our legitimate interest in the security of the Platform (Art. 6.1.f GDPR).
• Approximate IP geolocation (Section 4.1.1): the lookup is done in a database stored on our server and its result is not saved. Until 26 September 2026 a cache of earlier lookups was kept, keyed by network prefix (the first part of the address, /24 for IPv4 and /48 for IPv6) and never by your full IP address; that cache is no longer written and its remaining rows are permanently deleted at the latest 90 days after they were last refreshed, by an automatic daily job. Nothing in it was linked to your account.
• Abuse reports and moderation records: retained for 12 months after the report is closed, to allow appeal and accountability under the DSA, then deleted. For this period the right to erasure does not apply to these records: keeping them is necessary to comply with the notice-and-action and internal-appeal obligations of Arts. 16, 17 and 20 DSA (Art. 17(3)(b) GDPR, legal obligation) and to defend the moderation decision if it is challenged before an out-of-court dispute settlement body or a court (Art. 17(3)(e) GDPR, establishment, exercise or defence of legal claims).
• Internal admin audit logs: actions performed by platform administrators (such as content moderation decisions and access events, together with the IP address they came from) are logged for security and accountability purposes and automatically deleted after 6 months by our nightly maintenance job. For this period the right to erasure does not apply to them: an audit log that could be erased on request would not be an audit log, and retaining it is necessary both to demonstrate our compliance under Art. 5.2 GDPR (Art. 17(3)(b) GDPR) and to establish, exercise or defend legal claims arising from a security incident or a contested administrative action (Art. 17(3)(e) GDPR).
• Payment and fiscal records (when activated): retained for the period required by Italian fiscal and accounting law (generally 10 years, under Art. 2220 of the Italian Civil Code and Art. 22 of Presidential Decree 600/1973), in a restricted archive accessible only for tax, audit or legal-defence purposes. For this period the right to erasure does not apply to them: the retention is imposed on us by law, which Art. 17(3)(b) GDPR expressly carves out of the right to be forgotten. Deleting your account therefore does not delete an invoice already issued to you; it stays in the fiscal archive, separate from the Platform, and is not used for any other purpose.
• Availability dates: deleted when you remove them from your calendar, when your account is deleted, or automatically by our nightly maintenance job once the date is more than one day in the past.
• Ghost Profiles: the bio text and the logo or non-representative image remain in place only while the profile is unclaimed; both are replaced by content the rights-holder controls directly as soon as the profile is claimed, and can be removed entirely at any time on request, even before claiming (Section 4.9).
• Local Scene article generated from a profile: retained for as long as the profile it describes exists. When the profile is deleted (a Ghost Profile removed at the request of the entity, or any account deleted by its owner), the article is deleted in the same operation, together with its cover image and tags, and it disappears from its web address and from our sitemap. An opt-out request that stops a Ghost Profile from being shown takes the article offline at the same moment. The only exception is an article that is itself under an active restriction of processing (Art. 18 GDPR, Section 8): it is kept, unchanged and offline, until the restriction ends, and is then deleted rather than republished; where the profile was only taken offline by an opt-out, it is instead kept offline with it (Section 4.9).
• Newsletter: your subscription is a single on/off setting on your account, which stays off unless you tick the newsletter box yourself. It is stored together with the date you ticked the box (our proof of your consent) and a random code whose only use is to build the one-click unsubscribe link in each email. Unsubscribing, from that link or from Profile > Settings, switches the setting off at once and clears the subscription date. For the recommendations email we store only the date of the last one sent to you, so that the next one is not sent too early. For each newsletter composed by our team we keep a delivery list with your email address, the delivery status and the date it was sent. We do not record whether or when you open our emails. The delivery list currently has no automatic expiry: it is deleted together with your account. The setting, the subscription date and the unsubscribe code are deleted with your account too.
• Email log: every email our system sends leaves a line in an internal log: the recipient address, the subject, the kind of email (service email or newsletter), the date and time, and whether the handover to our mail server succeeded or failed, with the technical error message if it failed. For service emails (such as account confirmation, password reset or event approval) that were sent successfully, and for the recommendations email, we also store the text of the message as sent, after replacing the secret codes in its links (such as password-reset and email-confirmation links) with a placeholder, so the log can never be used to act on your account. The text of newsletters composed by our team is not stored. We use this log only to diagnose delivery problems and to be able to show what we sent and when, if a message is disputed. Each line is deleted automatically 6 months after the email was sent, by our nightly maintenance job; when you delete your account, the lines addressed to your email address are deleted at the same time.
• Record of the requests you send us under Sections 8 and 14: when you write to us to exercise one of your rights (access, rectification, erasure, restriction, objection, portability), we record the request itself: which right you invoked, what it concerned, the date we received it, whether we extended the deadline and told you so, the date and content of our answer, and, where the request led to a restriction of processing, the date on which we told you before lifting it. These records are kept for 24 months from the date the request is closed, then deleted. Two reasons, and both of them are about protecting you rather than us: Art. 5(2) GDPR makes us accountable for demonstrating that we handled your request lawfully and within the deadline, and a request we cannot prove we answered is a request we cannot prove we did not ignore; and Art. 17(3)(e) GDPR keeps the right to erasure from applying to material needed to establish, exercise or defend a legal claim, which is exactly what this record becomes if you later challenge our decision before the Garante or a court. Twenty-four months is the shortest period that still covers a complaint filed near the end of the ordinary limitation window. During that period the record is not used for anything else: it is never used to profile you, to rank you, or to inform any decision about your account. If you asked us to restrict processing, the record also contains the notification we sent to the recipients of your data under Art. 19 GDPR.
• Cookie banner consent records: each choice you confirm in the cookie banner or in Cookie preferences (Cookie Policy Section 7) is kept as proof of consent (GDPR Art. 7.1). Records linked to your account are retained while the account is active and deleted with it. Records from visitors who are not signed in are identified only by a random browser identifier, never by IP address, and are retained for 12 months as proof of the choice made, then deleted.
• Backups: our database and our server are backed up automatically, so that the Platform can be restored after a fault or a security incident (legitimate interest, Art. 6.1.f GDPR, and security of processing, Art. 32 GDPR). A backup contains the same data as the original, including the logs described above, and is used only for restoring it. Backups are kept for a limited time (up to about two months) and are then overwritten, so data deleted under the rules in this section also disappears from the backups, with the delay of their rotation cycle.

8. Your Rights Under the GDPR

If you are located in the EU or EEA, you have the following rights regarding your personal data:

• Right to access: request a copy of the personal data we hold about you.
• Right to rectification: correct inaccurate or incomplete data. Most profile data can be updated directly from your account settings.
• Right to erasure ("right to be forgotten"): request the deletion of your personal data. You can delete your account directly from the platform settings. This right applies in full to data that concerns you alone: your account, your profile and the content attached to it. It does not extend automatically to content that also involves third parties, such as an event shared with an act, a venue or a promoter: deleting your account removes the link to your profile but leaves the event published, and the removal of a specific event is assessed case by case, balancing your interest against that of the other entities involved (Section 7).
• Right to restriction: require us to stop using your data while keeping it, in the four situations listed in Art. 18(1) GDPR. Because restriction is often confused with deletion or with account suspension, and because it is the one right whose effects you can actually see on the Platform, it is explained in full in its own block below.
• Right to data portability: receive the data you gave us, and the data generated by your own activity, in a structured, commonly used and machine-readable format. What is and is not covered is set out precisely in its own block below.
• Right to object: object to processing based on our legitimate interest, and object to direct marketing at any time. Article 21(4) of the GDPR requires this right to be brought to your attention explicitly and separately from any other information, so it is set out on its own immediately below this list.
• Right to withdraw consent: where processing is based on your consent (such as the recommendations newsletter or interest-based personalisation), you may withdraw it at any time and free of charge, without affecting the lawfulness of processing carried out prior to withdrawal.
• Right not to be subject to automated decision-making: we do not take decisions that produce legal or similarly significant effects based solely on automated processing. The ranking algorithm is transparent and does not exclude users from any feature.

Your right to object — Article 21 GDPR

Your right to restriction of processing — Article 18 GDPR

What restriction is. Restriction is the right to make us stop using your data without making us delete it. It exists precisely for the situations where deleting would be the wrong answer: where the data is disputed, or where you need it kept. It is not a penalty, it is not account suspension, and you do not have to justify it beyond showing that one of the four cases below applies.

The four cases (Art. 18(1)), in plain language. You can ask us to restrict processing when:

• (a) you say something we hold about you is wrong. Restriction lasts for as long as we need to check whether it is wrong. You do not have to wait for the outcome to get the data frozen: freezing it is the point.
• (b) the processing is unlawful but you do not want the data erased. Perhaps you need it kept as evidence. You can ask us to restrict its use instead of deleting it, and we must comply rather than insist on erasure.
• (c) we no longer need the data, but you do, to establish, exercise or defend a legal claim. Normally we would delete it; at your request we keep it, unused.
• (d) you have objected under Art. 21(1) and we are still weighing it up. While we check whether our legitimate grounds override yours, the data is frozen. You are not left exposed for the length of our own deliberation.

What restriction actually does on this Platform. This is not an abstract promise: it is a specific technical state, and it is the same for a profile, an event or an article. While a restriction is active, the restricted item stays in our database, complete and unmodified, and it leaves every public page and listing we control: it disappears from the map, from search, from the ranking, from recommendations and from Scout, from the Local Scene and Event Agenda listings, from city and country pages, from notifications and from any newsletter, and from our sitemap, so search engines stop being pointed at it. For a profile, this includes the events that are its own (the events it published, a single-act event where it is the only act on the bill, and the dates of its own tour), together with their Event Agenda articles. Where a restricted profile is instead one of several participants in an event or festival published by someone else (one act on a shared bill, the venue hosting it, a co-promoter), that event stays published, because taking it down would restrict the data of people who asked for nothing, and the profile's name may remain in its text or line-up; ask us and we will assess that entry case by case. From the moment the restriction is applied, the profile's picture and video are no longer used for such an event. Its map card and its link preview show the event's own flyer if one was uploaded; otherwise the picture of another participant that is not restricted, the headlining act first and then the venue; otherwise a generic image. Any article cover we generate for it from then on is the event's own flyer if one was uploaded; otherwise the picture of the headlining act, if it has a profile and that profile is not restricted; otherwise a generic image for the type of event. An article cover never uses the venue's picture. An article about such an event that was already written before the restriction is not rewritten, because restriction does not allow us to modify content, so its cover may still show the picture it was built from; that too we assess case by case on request. In addition, while the restriction is active the item is not modified and is not deleted by anything: our automatic maintenance jobs skip it, its automatically generated article is not regenerated or re-dated, and it cannot be removed even from our own administration panel. If the restriction concerns your account, you will not be able to sign in while it lasts: not as a sanction, but because signing in would mean editing the very data whose use has been restricted. Art. 18(2) allows us to keep storing it, and to process it further only with your consent, for legal claims, to protect someone else's rights, or for reasons of important public interest.

What restriction does not reach. We would rather tell you exactly where the limits are than promise more than we do. (1) As explained above, a restricted profile that is one of several participants in an event or festival published by someone else can remain named in its text and line-up. (2) Files belonging to the restricted item that were already published (images, flyers, article covers and link previews we had already generated) stay stored on our servers while the restriction lasts, because restriction does not allow us to delete them. The pages that hid the item no longer link to them, but anyone who already has a file's direct web address can still open it, and search engines and social networks may keep their own cached copy, which we do not control. (3) Whether an Event Agenda article is taken offline is worked out when the restriction is applied. If the line-up or the owner of an event changes afterwards, that is not recalculated automatically: we check it by hand.

Before we lift it, you hear from us first. Art. 18(3) GDPR requires that you be informed before the restriction is lifted, and we treat that as a hard condition rather than a courtesy: our internal tool physically refuses to lift a restriction until the date and the channel of that notice have been recorded. You will therefore always be told in advance, and you will always have the chance to object again before your data goes back into normal use.

How to ask. Write to privacy@bandintour.com, saying what should be restricted and which of the four cases applies. You do not need to use legal wording. Deadlines and costs are the ones set out at the end of this Section.

Notification to third parties — Article 19 GDPR

If we rectify, erase or restrict your data, Art. 19 GDPR requires us to communicate that to each recipient to whom the data was disclosed, unless doing so proves impossible or involves disproportionate effort, and to tell you who those recipients are, if you ask. In practice, the recipients of data on this Platform are the categories listed in Section 6: our hosting and email processors, and the functional third-party services described in the Cookie Policy. We record the date on which that notification was sent as part of the record described in Section 7, so that you can ask us to prove it was done. Where a rectification or a restriction affects something that was publicly visible, removing it from our public surfaces and from our sitemap is part of the same obligation: it is how the change reaches the parties who saw the data through us. We cannot force a search engine to forget a page it has already cached, but we can and do stop pointing it there; if you need a cached copy removed, tell us and we will tell you exactly which URL to give the search engine.

Your right to data portability — Article 20 GDPR

Portability is narrower than access, and the difference matters: the right of access (Art. 15) covers everything we hold about you, while portability covers only data that you provided, processed by automated means, on the basis of your consent or of a contract (Art. 20(1)). Recital 68 GDPR is explicit that it does not extend to processing based on any other legal ground. We would rather tell you precisely where that line falls on this Platform than restate the article.

Included (data processed to perform our contract with you, Art. 6.1.b):

• your profile: role, public name, alias, city and country, address, biography, genres, repertoire, avatar, video and audio trailer links, and the dates the account was created and claimed;
• the social links you added to your profile;
• the events you own: date, time zone, act, venue, promoter, city, description, ticket and directions links, lineup entries you typed, and the flyer you uploaded;
• the availability dates in your Live Music Club calendar;
• your membership and boost records, where active, excluding the invoices themselves (see below).

Included (data processed on your consent, Art. 6.1.a):

• your interest preferences and the cities you follow, which drive "Recommended for you";
• your newsletter subscription status;
• the entries in our consent register that relate to you, with the date, the version of the policy in force and the choice you confirmed.

Included, on the wider reading we have chosen to follow: "observed" data. The Community Support you gave to events (the hearts you tapped) is data observed from your activity rather than typed in by you. The Article 29 Working Party guidance on portability, endorsed by the EDPB, treats observed data generated by the data subject's own activity as in scope. There is room for argument here; we have resolved it in your favour and we export it.

Not included, and why. We would rather name these than let you discover them missing:

• Ghost Profiles that have never been claimed. These are created on the basis of our legitimate interest (Art. 6.1.f, Section 4.9), not on consent or contract, and Recital 68 excludes that basis from portability. This is not a way of withholding anything: you can have a Ghost Profile removed on request, without giving a reason, and once you claim it the profile becomes yours and is fully portable from that moment.
• Data we derived or computed ourselves. Art. 20 covers data you provided, and the EDPB reads that as excluding data inferred or created by the controller. On this Platform that means: the output of the ranking algorithm, the city we resolved automatically from an address you typed, the time zone derived from coordinates, the alternative text generated for a cover image, and the body of an automatically generated Local Scene or Event Agenda article. The inputs you actually gave us (the address, the biography, the name) are all in the export; our arithmetic on top of them is not.
• Data processed on a legal obligation (Art. 6.1.c), principally invoices and fiscal records. You can obtain a copy of an invoice, but through Art. 15 access, not Art. 20.
• Data processed on our legitimate interest (Art. 6.1.f): security and rate-limit logs containing IP addresses, hCaptcha risk assessments, our internal administrator audit log, and the log of the emails we send.

The rights of other people (Art. 20(4)). Portability must not adversely affect the rights and freedoms of others, and on a live-music platform that is a real constraint rather than a formality: an event is shared between an act, a venue and a promoter. Your export therefore contains the lineup of your events as it is already public (the public names and roles on the bill) and no personal data about those other parties beyond that: no email addresses, no telephone numbers, no account details. The same applies in reverse: nobody else's export contains anything about you that was not already public on the event.

Direct transmission to another controller (Art. 20(2)). You have the right to have your data transmitted directly from us to another controller where technically feasible. We must be straightforward with you: today it is not. There is no interoperable standard for live-music profile and event data, no other platform publishes an import endpoint we could authenticate to and push to, and building a one-off private integration for each destination would not be a transmission "by automated means" in any meaningful sense: it would be us retyping your data somewhere else. Art. 20(2) does not oblige controllers to adopt or maintain technically compatible systems (Recital 68 says so expressly). What we do instead is give you the file: a structured, machine-readable export you can hand to anyone you choose, which is the outcome Art. 20(1) guarantees you in any event. If a genuine interoperable standard appears, we will revisit this and say so here.

How to get your export. We do not currently offer a self-service export button. Write to privacy@bandintour.com and we will prepare the export by hand and deliver it within the deadline set out at the end of this Section, at no cost. The format is JSON, one object per category listed above, with field names matching the ones used in this Section, accompanied by a plain-text key explaining each field; if you prefer, we will also provide the same content as CSV files, one per category. Both are structured, commonly used and machine-readable within the meaning of Art. 20(1).

To exercise any of these rights, contact us at privacy@bandintour.com. We may need to verify your identity before processing the request (Art. 12(6) GDPR), and we will ask only for the additional information strictly necessary to do so.

How long we take, and what it costs you. We reply without undue delay and in any event within one month of receiving your request, as required by Art. 12(3) GDPR. Where a request is particularly complex, or where you have sent us several, that period may be extended by a further two months: if we need the extension, we will tell you within the first month, explaining why. Exercising your rights is free of charge (Art. 12(5) GDPR). Only where a request is manifestly unfounded or excessive, in particular because it is repetitive, may we either charge a reasonable fee reflecting our administrative costs or refuse to act on it, and in that case the burden of demonstrating that the request is manifestly unfounded or excessive falls on us, not on you.

If we say no. If we do not act on your request, we will tell you so within one month of receiving it, explaining our reasons, and we will inform you that you may lodge a complaint with a supervisory authority and seek a judicial remedy (Art. 12(4) GDPR). A refusal is never silent: you will always get an answer you can challenge.

You have the right to lodge a complaint with the Italian Garante per la protezione dei dati personali (garanteprivacy.it) or with the supervisory authority of your country of residence.

9. Cookies and Local Storage

We use first-party essential technical cookies and local-storage items required to operate the platform (the login cookie, the administrators' session, the consent preference and a few interface settings). These are always active and exempt from consent. We also use Google Analytics 4, but only after you give explicit consent through the cookie banner: it is never loaded without your consent, and you can withdraw it at any time from the "Cookie preferences" link in the site footer. With a separate choice ("External media") you can also let video and audio players from other platforms load automatically inside our articles. We do not currently use advertising cookies.

For full details, including how Google Analytics 4 is loaded only on consent, the functional third-party services (hCaptcha, Nominatim/OpenStreetMap, video players and map tiles), and the planned future activation of Google AdSense and Web Push notifications, see our Cookie Policy.

10. Security

We apply appropriate technical and organisational measures to protect your personal data:

• Passwords are hashed using bcrypt and never stored in plain text.
• All communication between your browser and our servers is encrypted via HTTPS (TLS).
• Session tokens (JWT) are signed, kept in an HttpOnly cookie that the scripts on our pages cannot read, expire 7 days after sign-in and are blocked on our server as soon as you sign out.
• Uploaded files are validated for type and size before storage.
• Admin access to the platform is segregated and protected by separate authentication and audit logging.
• Rate limiting and input validation protect against brute force, injection and abuse.

No system is completely immune from risk. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Italian Garante within 72 hours and, where the risk is high, communicate the breach to affected users without undue delay, as required by GDPR Art. 33 and 34.

11. Minors

Band in Tour is not directed at minors. Under Article 8 of the GDPR the default age for a child to consent to information-society services is 16, which Member States may lower to no less than 13; Italy, through D.lgs. 101/2018, has set this threshold at 14 years. As a matter of our own policy we go beyond the Italian minimum and require users to be at least 16 years old to register on the platform: at registration, or when you claim a Ghost Profile, you confirm this with a separate box, and we record your confirmation and when you gave it (Section 4.2). This is a voluntary editorial choice on our part, more restrictive than the Italian legal minimum, not a requirement imposed by Italian law. If we become aware that we have collected personal data from a person below this age without appropriate parental consent, we will delete it promptly. As required by Article 28 of the DSA, where minors do access the platform we apply appropriate and proportionate measures to ensure a high level of privacy, safety and security for them, including not directing advertising or profiling at users we know to be minors. If you believe a minor has registered on our platform, please contact us at privacy@bandintour.com. Ghost Profiles follow a stricter rule than accounts: we never create a Ghost Profile of anyone under 18, or of an act any of whose members is under 18, and we remove one immediately if it turns out to concern someone under 18, without asking you for proof (Section 4.9).

12. Third-Party Links

Profiles on Band in Tour may contain links to external websites (social media, artist websites, streaming platforms, ticket vendors). We are not responsible for the privacy practices of those third-party services. We encourage you to read their privacy policies before sharing any personal data with them.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in the law, our services or our data practices. If we make material changes (including before activating Stripe payments, Google AdSense, Web Push notifications or direct sponsored content), we will notify registered users by email and update the version number and date at the top of this page, so that you can always see which version is in force and from when.

This document is an information notice, not a contract: it tells you what we do with your personal data, and we are required to give it to you under Arts. 13 and 14 of the GDPR. It is therefore not something you accept, and continuing to use the Platform is not your agreement to it. Any updated version simply applies from its effective date, and your rights under Section 8 (including the right to object and the right to lodge a complaint with a supervisory authority) remain fully exercisable against the processing described in it, before and after any change. Where a new processing activity requires your consent, we will ask for it separately and explicitly before starting, and not by way of an update to this page. (Our Terms of Use, which are a contract, work differently: Article 21 of that document explains how changes to them take effect.)

14. Contact

For any questions, requests or concerns regarding this Privacy Policy or your personal data:

• Privacy: privacy@bandintour.com
• Legal and authority requests: legal@bandintour.com
• Postal address: IOCOS di G.C., Via F. Baracca traversa De Salvo 15, 89123 Reggio Calabria, Italy
• Supervisory authority: Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it