গোপনীয়তা নীতি

PRIVACY POLICY

BandStream (Private Alpha Phase)

Updated on November 2, 2026 (audience measurement: clicks to release stores and to links published by the User, counted by domain name: Article 10.1). Updated on October 24, 2026 (Label subscription and contract archiving: Articles 3, 4, 5 and 8). Effective as of April 14, 2026, updated on October 20, 2026 (Pre-Release: the artist connects their own Brevo or Mailchimp account and becomes the controller of the release alert and of their list, BandStream acting as processor: Articles 1, 4.2, 5, 6.4, 8 and 12); updated on October 14, 2026 (retention period of contractual evidence, cancellation confirmations included: Article 8; contact requests from labels: Articles 5 and 8; profile pictures hosted by Google: Article 6.1); updated on October 11, 2026 (Pre-Release release alert: Article 12, the artist's sending account in Article 6.4, list of subscribers provided to the artist); updated on October 7, 2026 (cookie linking a promotional offer); updated on September 24, 2026 (data protection contact; end-of-trial purchase declared by our servers to Meta and Google Analytics; Umami audience measurement exempt from consent; hash of the email address sent to Google Ads and TikTok upon a purchase or a sign-up; list of cookies and local storage, rate limiting, optional telephone number and Meta event of the measurement container; on September 21, 2026: YouTube videos on release pages; on September 19, 2026: recipients, consent cookie, Meta pixel and anonymous click counting)

Article 1: Data Controller

The data controller for personal data is BandStream SAS, 60 rue François 1er, 75008 Paris, France. RCS Paris 939 221 438; SIRET 939 221 438 00012; VAT FR 81939221438. Contact: contact@band.stream.

By way of exception, for the Pre-Release feature (release alert), the controller is the User who owns the Artist Page, and BandStream acts as processor, except for the security of the form, under the conditions of Article 12.

Article 2: Data Protection Contact

Any question regarding the processing of personal data and any request to exercise data subjects' rights should be sent to: dpo@band.stream. This address is read by the BandStream founding team, who respond within one (1) month of receipt of the request (Article 12(3) GDPR).

BandStream has not appointed a data protection officer: such an appointment is not mandatory for its activity (Article 37 GDPR).

Article 3: Alpha Context, Specific Information

The Platform is currently in a private Alpha phase. Alpha access remains reserved for invited persons. The public Label subscription process also allows an Account to be created using a verified email address, without granting Alpha status. The Alpha-specific processing described below does not apply solely because of this registration. This phase involves the following specificities regarding personal data:

(a) BandStream may collect data specific to the Alpha phase, such as experience Feedback, bug reports, detailed usage data, and satisfaction survey responses, for the purpose of improving the Platform.

(b) Technical security measures may be in the process of deployment and may not reach the level of a final commercial version. BandStream nevertheless implements reasonable measures to protect the data of Alpha Users.

(c) In the event of the end of the Alpha phase, Alpha User data will be processed in accordance with article 8 (retention periods), unless the Alpha User continues their use in the commercial version.

Article 4: Personal Data Collected

For the public Label subscription process, only an email address is requested before link verification and Account creation. Stripe subsequently collects billing and payment information when the Order is placed. Pro to Label amendment data and evidence are limited to what is necessary for performance, billing and withdrawal; archiving is described in Article 8.

4.1 Alpha User Data

Identification data: artist name or pseudonym, email address.

Optional contact details: telephone number, if the User enters it in their settings, for the commercial management of their Account.

Connection data: IP address, browser type, operating system, date and time of connection, access logs.

Subscription data: plan type, subscription and renewal dates, billing history.

Content data: profile images, biography, links, event-related information.

Payment data: collected and processed directly by Stripe, Inc. Not stored by BandStream.

Alpha-specific data: experience Feedback, bug reports, detailed usage data (navigation paths, actions performed, features used), responses to internal surveys.

4.2 Visitor Data

Aggregated and anonymized browsing data: country, traffic source, pages visited, duration. "Privacy-first" approach. For the security of the Service, the Visitor's IP address and, when they enter one in a form, their email address are also used as the key of technical rate limiting counters, which prevent automated use of forms and links; each counter covers a window of one hour at most and is normally deleted less than two hours after the last request, at the latest during the following night's purge (Article 8).

An email address voluntarily provided by the Visitor in order to be notified of the publication of a release (Pre-Release feature), with the data attached to it (platforms chosen, optional consent to the artist's news, incoming campaign, transfer to the artist's list, sending status, clicks in the message), under the conditions of Article 12: the artist is the controller, BandStream their processor.

4.3 Mandatory or Optional Nature of Data

Data marked with an asterisk (*) in the forms is mandatory for Account creation and the provision of Services. If this mandatory data is not provided, BandStream will not be able to create the User's Account or provide the Services. Other data is optional, and its non-provision does not prevent use of the Platform but may limit certain features (for example, the absence of a biography or profile image on the Artist Page).

Article 5: Purposes and Legal Bases

Note: The "Ad Campaign management" purpose (Google Ads, Meta Pixel, TikTok) is based on User consent and not on the performance of the contract, in accordance with the recommendations of the CNIL regarding advertising tracking. The placement of advertising cookies and pixels is subject to prior consent obtained through the integrated consent manager.

Label subscriptions, amendments, billing and confirmations are processed to perform the contract (GDPR article 6(1)(b)). Statutory contract archiving relies on article 6(1)(c); evidence necessary for defending BandStream's rights relies on article 6(1)(f), within applicable time limits.

Article 6: Recipients and Processors

6.1 BandStream's Processors

Each processor is contractually bound to comply with the GDPR. BandStream may communicate data to competent authorities upon legal request.

6.2 Advertising Platforms Activated by Users (Pro Plan)

When a Pro Plan User configures a pixel on their Artist Page, the corresponding platform receives browsing events from that page's Visitors, only after their "marketing" consent has been obtained through the integrated consent manager. For Meta, TikTok and Snapchat, when the User has provided a conversions API key, clicks to streaming platforms and to ticketing points of sale are also sent from BandStream's servers, under the same consent condition. Two exceptions, which concern Meta only, are described in Articles 10.4 (loading of the pixel script before the Visitor has answered, with no cookie and no event) and 11.5 (anonymous click counting after a refusal). These platforms act as independent data controllers (see Article 11.4).

When a release page features a music video, Google LLC (YouTube) receives the Visitor's IP address and technical browser information when the player loads, which only happens after the Visitor clicks the video and agrees to the "YouTube videos" category (see Article 10.1). Before that agreement, no data is sent to Google. YouTube acts as an independent data controller.

6.3 Tags of the Site's Measurement Container

The Site's Google Tag Manager container (GTM-N9SS822J) is loaded only when the Visitor has granted both the "analytics" category and the "marketing" category. In addition to audience measurement (Google Analytics), it contains advertising tags used to measure BandStream's campaigns: Google Ads and TikTok, as well as an event of the Site's Meta pixel ("Lead") upon sign-up to the newsletter. When the Visitor grants the "analytics" category only, this container is not loaded: Google Analytics is then loaded on its own, with advertising signals denied, and no Google Ads or TikTok tag enters the page.

Measurement of purchases and sign-ups. When a User creates their Account or subscribes to the Pro Offer, a return page, located outside the logged-in area, sends this event to the container, only once, and only if the User has granted the "analytics" and "marketing" categories. For a purchase, the event carries the transaction identifier, the amount excluding taxes, the currency, any promotional code and the plan subscribed to. So that Google Ads and TikTok can attribute the purchase or the sign-up to a BandStream advertisement, it also carries the hash of the Account's email address: the output of the SHA-256 hash function applied to the address converted to lowercase and stripped of spaces (for Google Ads, also stripped of the dots preceding @gmail.com, as Google requires). The address itself is never transmitted. This hash remains pseudonymised personal data: Google and TikTok match it against the accounts of their own users, which is precisely its purpose. Without the "marketing" consent, no hash is sent; with the "analytics" consent only, Google Analytics receives the purchase or the sign-up without any data relating to the User. The Site's Meta pixel receives the purchase and the sign-up without any address or hash. BandStream keeps neither the hash nor the transmitted event; it only keeps a record that a purchase or a sign-up has already been counted, so as not to count it twice, until the Account is deleted.

End-of-trial purchase, declared by our servers. When a User starts a free trial of the Pro Offer, the return page only sends the start of the trial, under the conditions of the previous paragraph. The purchase itself only happens at the first payment, at the end of the trial, while the User is not on the Site: it is then declared directly by BandStream's servers, only once, according to the consents the User had given at the start of the trial, which are kept with it:

• with the "marketing" consent, to Meta's Conversions API, for the Site's pixel: a purchase event carrying the invoice identifier, the amount excluding taxes, the currency and the plan, the SHA-256 hashes of the email address and of the Account identifier, and the identifiers of the Site's Meta cookies (_fbp, _fbc) read at the start of the trial. As an exception to the above, Meta therefore receives, for this purchase only, the hash of the address; the address itself is never transmitted;
• with the "analytics" consent, to the Google Analytics Measurement Protocol: a purchase event carrying the invoice identifier, the amount, the currency, any promotional code and the plan, linked to the pseudonymous identifier of the _ga cookie read at the start of the trial, without any address or hash; advertising signals are only enabled with the "marketing" consent. Google Ads receives the purchase through the import of Google Analytics events.

Without the corresponding consent, nothing is sent. BandStream erases the cookie identifiers kept for this sending as soon as the purchase is declared, or when the trial ends without payment, and in any event with the Account. Meta Platforms and Google act as independent controllers for the data they receive in this way.

A tag transmits data only when it is actually triggered; Article 6.1 describes the contents of the container and the transmissions observed on the Site, not a systematic transmission on every visit. When the Visitor withdraws a consent while these tools are already active in the page, the page is reloaded once, so that they actually stop emitting. Google LLC and TikTok act as independent data controllers for the data they collect through these tags.

6.4 The User's provider for Pre-Release (Brevo or Mailchimp)

The Pre-Release feature (Article 12) relies on the email marketing account that the User who owns the Artist Page connects to the Platform, with one of the providers below. That provider is chosen and paid by the User, under the User's own contract: it is the service provider of the User, who is the controller of their list, and not a processor of BandStream. On the User's instructions, BandStream passes Visitors' sign-ups to it, which are added to the list or audience chosen by the User, and asks it to send the Pre-Release emails.

The User's Brevo account is separate from the one BandStream uses for its own newsletter (Article 6.1), which receives no Pre-Release data. Resend and Mailjet, previously offered for routing the release-day email only, are no longer offered: they do not allow a list to be kept. Any new provider is added to this list before it is offered to Users.

Article 7: Transfers Outside the EU

Data is primarily hosted in France and within the EU. Transfers outside the EEA are governed by standard contractual clauses or the EU-U.S. Data Privacy Framework.

In accordance with the recommendations of the European Data Protection Board (EDPB) and the Schrems II ruling (CJEU, case C-311/18), BandStream has conducted a Transfer Impact Assessment (TIA) for each processor located outside the EEA. These assessments are available upon request from the data protection contact at dpo@band.stream.

Supplementary measures (end-to-end encryption, pseudonymization, access segregation) are implemented when the TIA identifies a residual risk to the rights of data subjects.

Further information: dpo@band.stream.

Article 8: Retention Periods

The contract archive does not retain the entire Account: only information necessary for evidence and access to the contract is kept separately. Account deletion does not restart its retention period. Evidence needed for an ongoing dispute may be retained until its final resolution where necessary.

Upon expiration, data is deleted or irreversibly anonymized.

Article 9: Data Subject Rights

Right of access (art. 15 GDPR): obtain confirmation of processing and a copy of the data.

Right to rectification (art. 16): correction of inaccurate or incomplete data.

Right to erasure (art. 17): deletion of data, subject to legal obligations.

Right to restriction (art. 18): temporary suspension of processing.

Right to data portability (art. 20): retrieval of data in a structured and readable format.

Right to object (art. 21): objection to processing based on legitimate interest, and objection to marketing at any time.

Right relating to automated decision-making and profiling (art. 22 GDPR): the User has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects them. As of the date of this policy, BandStream does not engage in any solely automated decision-making or profiling producing legal effects with respect to Users. In the event of any change, this policy will be updated to inform Users accordingly.

Withdrawal of consent: possible at any time, without retroactive effect.

Post-mortem directives (art. 85 of the French Data Protection Act): directives regarding the fate of data after death.

Requests should be sent to dpo@band.stream with proof of identity. Response within one (1) month, extendable by two (2) months. Complaints may be filed with the CNIL (3 Place de Fontenoy, 75334 Paris Cedex 07; www.cnil.fr).

Article 10: Cookies

10.1 Types of Cookies

Strictly necessary cookies: technical operation (session, authentication, security). No consent required.

Analytical cookies (Google Analytics): audience measurement. Consent required.

Audience measurement exempt from consent (Umami, self-hosted): visit statistics for Artist Pages (page views, clicks to streaming platforms, ticketing outlets, release stores and links published by the User, the last two counted by destination domain name without the rest of the address, country, traffic source, device and browser type), presented to Users in aggregated form. This measurement meets the conditions set by the CNIL for an audience measurement tool to be exempt from consent (article 82 of the French Data Protection Act):

(a) it is used solely to measure the audience of the Platform's pages and to produce anonymous statistics;

(b) Umami sets no cookies and does not track the Visitor from one site to another: each Artist Page is measured separately;

(c) the IP address is never stored: at the time of the visit, it is only used to derive the country (never a location more precise than the city) and to compute a hashed session identifier, renewed every month;

(d) before sending, the page address is stripped of its parameters, except campaign parameters (utm_*), and the referring address of its query: no advertising identifier and no token is recorded;

(e) the data is hosted on BandStream's servers within the European Union, is not combined with any other processing and is not shared with any third party;

(f) it is automatically deleted after 25 months.

This measurement therefore operates whether the Visitor accepts or refuses cookies, and does not appear in the consent manager. The Visitor can object to it at any time, in two ways: by choosing to not be counted, which places in their browser a strictly necessary cookie (bs_audience_optout, 12 months) recording their objection for all Artist Pages; or by enabling the "Do Not Track" option of their browser. Their visit is then no longer counted.

Advertising cookies of the Site: Google Ads and TikTok, loaded by BandStream's Tag Manager container, and the Meta pixel of the Site (see Article 6.1). Consent required via the integrated consent manager.

Advertising cookies (Pro Plan): Meta, Google Ads, TikTok, Snapchat and X pixels configured by the User on their Artist Page (see Article 6.2). Consent required via the integrated consent manager.

YouTube videos: on a release page that features a music video, the YouTube player (Google LLC, youtube-nocookie.com domain) is only loaded after the Visitor clicks the video and agrees to the "YouTube videos" category, asked within the video frame or through the integrated consent manager. Before that agreement, no request is sent to Google: the image shown is a copy hosted by BandStream. Once the player is loaded, YouTube may set cookies and receive the IP address and technical browser information, as an independent data controller. The choice is stored in the privacy:consent cookie and can be withdrawn at any time.

10.2 Detailed List of Cookies

Cookies marked "third-party script" are set on the visited domain by the advertising platform's script, which sets their name and duration and may change them. A Google Tag Manager container declared by the User on their Artist Page may set other cookies, depending on what the User has placed in it; it is only loaded after the "analytics" and "marketing" agreements.

Browser local storage. The Platform also stores in the browser a few items strictly necessary for the requested service, which do not leave it or only through an action of the Visitor: umami.disabled, the objection to audience measurement; the time of the last reload after a consent withdrawal; drafts of a campaign brief, of an artist page started from the home page or of a support reply; the page to reopen after login; and, in the logged-in area, bs-passkey-here (a passkey exists on this browser), the passkey and Pro offer reminders already seen and the closed getting-started help.

This list is kept up to date whenever the tools integrated into the Platform change.

10.3 Consent Management

Consent banner displayed upon the first visit. Preferences may be modified at any time. Choice remembered for 12 months; proof of consent kept for 13 months, the period recommended by the CNIL. The exempt audience measurement described in Article 10.1 does not appear in it: it does not depend on consent.

10.4 Loading of the Meta Advertising Script Before Consent

The Meta pixel script (fbevents.js, provided by Meta Platforms, Inc.) is loaded as soon as the page opens, on the Site as well as on the Artist Pages that use it, in the "consent revoked" mode provided by Meta. In this mode the script is present but inert: it places no cookie on the Visitor's device and sends no browsing event to Meta. This early loading has a single purpose: to allow Meta's verification tools to confirm that the pixel is correctly installed, which is impossible when the script only appears after consent.

Downloading this script from Meta's servers nevertheless involves, as does any call to a third-party server, the transmission to Meta Platforms, Inc. of the Visitor's IP address and of the technical headers of their browser, including the domain name of the page being viewed. The pixel-specific configuration file, which carries the pixel identifier, is only requested from Meta after consent. No other data is communicated at this stage: no advertising identifier is created, and no page view or click is measured until the Visitor has granted consent to the advertising category through the integrated consent manager. Consent, and only consent, then triggers the placement of Meta cookies and the sending of events. A refusal, like a later withdrawal, leaves the script in place and silent.

Article 11: Redirection to Third-Party Platforms and Processing of Browsing Data

11.1 Leaving the BandStream Perimeter

The Platform allows Users to create Artist Pages containing hyperlinks redirecting Visitors to third-party music streaming platforms (including Spotify, Apple Music, Deezer, YouTube Music, Tidal, Qobuz) as well as to ticketing platforms or social networks.

When a Visitor clicks on one of these links, they leave the BandStream environment and access a site or application operated by an independent third party. From the point of redirection onward, the Visitor's personal data is collected and processed by the destination platform, acting as an independent data controller, in accordance with its own privacy policy. BandStream exercises no control over the data processing carried out by these third-party platforms and disclaims all liability in this regard.

BandStream encourages Visitors to review the privacy policies of third-party platforms before accessing them.

11.2 Data Collected by BandStream Upon Click

Prior to the redirection, BandStream may collect browsing data related to the click made by the Visitor on the Artist Page. This data includes: the Visitor's country of origin (approximate geolocation derived from the IP address), the traffic source (referrer), the streaming platform selected by the Visitor, the type of device and browser used, and the date and time of the click.

This data is processed in an aggregated and anonymized manner, as part of the traffic statistics provided to Users with a Pro Plan, in accordance with BandStream's "privacy-first" approach. It is collected by the audience measurement exempt from consent described in Article 10.1, including when the Visitor has refused cookies. The legal basis for this processing is the legitimate interest of BandStream and its Users (article 6.1.f GDPR), consisting in measuring the audience and performance of Artist Pages.

11.3 No Transmission of Personal Data to Streaming Platforms

BandStream does not transmit any personal data of Visitors to streaming platforms or to any other third party accessible via the links on the Artist Pages. The redirection is carried out by simple hyperlink: the Visitor's browser is redirected to the URL of the destination platform without any personal data being communicated by BandStream to said platform.

Streaming platforms are not processors of BandStream within the meaning of article 28 of the GDPR. They act as independent data controllers for the data they collect directly from Visitors after the redirection.

11.4 Third-Party Cookies and Pixels on Artist Pages

When a User activates the Google Tag Manager or Meta Pixel features on their Artist Page (features that may be offered free of charge during the Alpha phase or included in a future paid plan), third-party cookies and pixels may be placed on the devices of Visitors who view said Artist Page. These cookies and pixels are operated by Google LLC and Meta Platforms, Inc., acting as independent data controllers for the data they collect through these technologies.

The placement of these third-party cookies and pixels is subject to the prior consent of the Visitor, obtained through the consent manager integrated into the Platform, in accordance with CNIL recommendations and the ePrivacy Directive. In the absence of consent, no third-party cookies or pixels are placed. The Meta pixel script may however be loaded inertly before the Visitor answers, under the conditions and with the consequences described in article 10.4.

11.5 Anonymous Click Counting After a Refusal

Where a Visitor refuses advertising cookies on an Artist Page whose holder has configured a server-side conversion interface (Meta Conversions API), the click towards a destination platform or a ticketing point of sale is nevertheless sent to that interface from BandStream's servers, in a strictly anonymous form: without IP address, without browser identifier (user-agent), without cookie and without any advertising identifier, including those the Visitor's device might still carry from an earlier visit. Only the destination of the click and its nature (platform or ticketing), the identifier of the release concerned, the address of the Artist Page stripped of all parameters (advertising click identifiers such as fbclid are removed from it), a single-use technical event identifier and the timestamp are transmitted.

This processing allows neither the identification of the Visitor nor their attachment to a profile or an advertising campaign: it produces an aggregate statistic, a click count, and nothing more. Its legal basis is the legitimate interest of BandStream and of its Users (article 6.1.f of the GDPR) in measuring the performance of Artist Pages. In that case no data is sent to the other advertising tools (TikTok, Snapchat), whose interfaces require a Visitor identifier, nor to the User's tag container, which only runs in the Visitor's browser.

Article 12: Pre-Release (release alert)

12.1 What the feature does

Pre-Release is the state a release page takes before its publication date. The page shows a countdown and invites the Visitor to leave their email address to be notified on release day and, if they wish, to receive the artist's news.

Pre-Release can only be turned on if the User who owns the Artist Page has connected their own Brevo or Mailchimp account to the Platform, verified, with a mailing list of their choice, and has accepted the data processing agreement annexed to the Terms of Use. Visitors' sign-ups join that list, and all emails sent to Visitors under Pre-Release go out from that account. No email to a Visitor under Pre-Release is sent from BandStream's account. If the User's account is missing, unverified, without a list or not covered by the agreement, the form is closed.

12.2 Data controller and BandStream's role

The User who owns the Artist Page (in this article, "the artist") is the controller (Article 4(7) GDPR) of the release alert, of sending their news and of their mailing list: the artist decides to open Pre-Release on their release, chooses their provider and their list, and decides how that list is used. Their name appears on the release page, next to the form.

BandStream SAS acts as the artist's processor (Article 28 GDPR), on the artist's documented instructions set out in the data processing agreement annexed to the Terms of Use, in order to: host the form and the confirmation page; collect the Visitor's consent and keep proof of it; pass the sign-up, with that proof, to the artist's Brevo list or Mailchimp audience; trigger, on release day, the sending of the email through the artist's account; produce the release statistics; erase the data within the periods of Article 12.6. Apart from the overall statistics mentioned below, BandStream does not process this data for any purpose of its own: it does not use it for its own marketing or advertising measurement, and does not disclose it to any other User.

BandStream remains the controller for the security of the form only: rate limiting, bot trap and checks on the origin of requests, which it operates to protect the Service and people whose address might be entered without their knowledge (see 12.3 and 12.5), and for producing its own overall statistics on the use of the feature across all Artist Pages (for example the number of sign-ups, confirmations and transfers), which contain no data that could identify a Visitor.

Why this is not joint controllership. Joint controllership (Article 26 GDPR) arises where two organisations jointly determine the purposes and means of the same processing. That is not the case here: the decision to collect addresses, the release concerned, the provider, the list and the use made of it belong to the artist alone; BandStream pursues no purpose of its own with this data and does not reuse it, and the technical means it offers to all artists (form, double opt-in, retention periods) are operated on the instructions of the artist, who accepts them knowingly by enabling the feature. The only two processing operations BandStream decides on itself, the security of the form and its overall statistics, are separate and fall under its sole responsibility.

12.3 Data collected

At sign-up: the email address entered, the language of the page, the date of the request and, where applicable, the dates of confirmation and unsubscription; the listening platforms the Visitor says they will use, among those the artist offers for this release; their answer to the optional box about the artist's news, with the date it took effect; the version of the information and consent text shown to the Visitor; and the campaign parameters present in the page address ("UTM" parameters) and the origin of the referring page, reduced to the protocol and domain name, without the path or parameters.

When the sign-up is passed to the artist's list: the provider concerned, the date it was passed on and, if it failed, the number of attempts and the technical reason for the failure.

When sending: for emails sent through the artist's Brevo account, the technical status of the message (scheduled, sent, failed), the identifier given to it by Brevo and the outcome Brevo reports (delivered, soft bounce, hard bounce, complaint, blocked); for Mailchimp, the identifier of the release campaign created in the artist's account and its status. BandStream measures no message opening. Any measurement the artist's provider carries out in the artist's account is a matter for the artist and their contract with that provider.

If the Visitor clicks a link in the release email that goes through the Platform: the targeted platform and the time of the click, through a technical redirect, before sending them on to the chosen platform.

What is never attached to the sign-up: no IP address, no cookie, no browser identifier, no plain-text user agent, no music service account. To limit abuse, the email address and the IP address are only used, for a one-hour window, as the key of a technical rate-limiting counter, which is linked to no sign-up and is normally erased less than two hours after the last request, at the latest during the following night's purge (Article 8). That counter is part of the security of the form, for which BandStream is the controller. The tokens contained in the confirmation, unsubscribe and redirect links are never stored in plain text: only their hash is. The unsubscribe link is not tracked.

12.4 Recipients

The artist's list. The sign-up is passed to the Brevo list or Mailchimp audience chosen by the artist, together with proof of the Visitor's consent: the release concerned, the date, the use of double opt-in, the version of the text accepted and the answer to the box about the artist's news. That provider is chosen and paid by the artist, under the artist's own contract: it is the artist's service provider, not a processor of BandStream (Article 6.4). Once passed on, the contact is in the artist's list: how long it is kept, how it is secured and how it is used are matters for the artist, within the limits of what the Visitor consented to. Only sign-ups collected under this text, which names the artist as controller and the artist's provider as recipient, are passed on: a sign-up collected under an earlier version of this article is never passed to a list, and stays with BandStream until it is erased within the periods of Article 12.6.

On the Platform, the artist only sees counters and aggregated statistics: sign-ups, sign-ups passed to their list or awaiting transfer, messages sent, delivered or failed, platforms chosen and incoming campaigns.

List of sign-ups. The artist who holds the Pro Offer may also download from the Platform the list of sign-ups for their release: email address, platforms chosen, sign-up date, confirmation, consent to the artist's news, source and incoming campaign, date passed to their list. Only confirmed sign-ups are included: neither people who have unsubscribed nor requests never confirmed, which carry no proven consent. This download makes available to the artist data they already process as controller; the copy they hold is theirs, like their list.

BandStream's sub-processors involved in this processing are those in Article 6.1 that host the Platform and its database, route its traffic and send its service emails to the artist (for example the erasure notice in Article 12.7).

There is no other recipient. In particular, streaming platforms and ticketing outlets receive nothing: the Visitor reaches them through a redirect that does not pass on the originating page, and no token follows them. No advertising tool receives these addresses.

12.5 Purposes and legal bases

For the purposes for which the artist is the controller, BandStream acts as processor and collects consents on the artist's behalf.

Consent to the release alert is collected by double opt-in: entering the address is not enough.

• With Brevo, the confirmation email is sent from the artist's Brevo account. The sign-up is only kept, and passed to the artist's list, after an explicit action by the Visitor on the Platform's confirmation page. Opening the link does not confirm anything by itself: confirmation requires submitting a form, so that an automated link scanner cannot consent on the Visitor's behalf.
• With Mailchimp, the address is passed to the artist's audience with the status "pending", and Mailchimp sends the Visitor its own confirmation email. Until the Visitor has confirmed with Mailchimp, they are not one of the audience's subscribers.

An unconfirmed request is erased by BandStream when the link expires, within seven (7) days.

This consent covers the release-day email for the release concerned. It does not extend to other releases by the same artist, to their news or to any commercial prospecting. A Visitor who does not tick the box about the artist's news joins the artist's list marked for the release alert only, and the Terms of Use prohibit the artist from sending them anything else. No address collected through Pre-Release is sold or rented by BandStream.

Consent to the artist's news is collected through an optional, separate box that is never pre-ticked. Refusing it does not prevent signing up for the alert. Once ticked, it allows the artist to send their news to the Visitor from their own account, every message including a way to unsubscribe. For their Artist Page, the artist may subject this box alone to double opt-in: this setting is off by default. When it is off, consent to the news takes effect when the form is submitted; when it is on, it only takes effect upon confirmation, and the confirmation email says so. The setting never affects the release alert, which is always subject to the double opt-in described above. The exact text shown to the Visitor and the date on which they accepted it are kept, as proof of what they consented to.

Measurement of clicks and incoming campaigns only concerns the release page and the links in the message the Visitor asked for. It is attached to their sign-up, kept for as long as it is, and only produces totals for the artist. The Visitor may object to it by unsubscribing, or by writing to dpo@band.stream.

The security of the form relies on BandStream's legitimate interest: without it, the form could be used to flood an address with confirmation requests or to sign up a third party without their knowledge. It serves no other purpose.

12.6 Retention period

At BandStream, the sign-up and everything attached to it (platforms chosen, consent to the artist's news, campaign parameters, transfer and sending status, clicks) are erased thirty (30) days after the release date. The following are erased earlier: requests never confirmed, when their link expires, within seven (7) days; and all the sign-ups for a release whose date is removed or whose Pre-Release state is turned off, erased without delay, as they no longer serve any purpose. Deleting a release, an Artist Page or the User's Account deletes the corresponding sign-ups.

These periods apply to the data kept by BandStream. Contacts passed to the artist's list remain there under the artist's responsibility: how long they are kept is a matter for the artist and their contract with their provider, and they are not removed by BandStream's purges or when the artist disconnects their account. The artist must not keep a contact for longer than the purpose the Visitor consented to requires (Article 5(1)(e) GDPR). The same applies to the copy of a downloaded list.

When the artist, a member of their Artist Page or a member of the BandStream team downloads the list of sign-ups, BandStream keeps a record of that download (account, date, release) and, for each Visitor on the list, a cryptographic hash of their address, from which the address cannot be recovered. This record is used only to notify the recipient of the list if the Visitor asks for their data to be erased (Article 19 GDPR). It is kept for as long as the account that downloaded the list exists; a Visitor's hash is deleted as soon as their erasure request has been handled.

12.7 The Visitor's rights

The Visitor exercises their rights (Articles 15 to 22 GDPR) with the artist, as controller, in particular by replying to one of the artist's emails. They may also write to dpo@band.stream, an address read by the BandStream founding team: BandStream, as processor, then handles the request for the data it keeps, forwards it to the artist without delay and informs the Visitor. The one (1) month period of Article 12(3) GDPR runs against the artist; BandStream helps them meet it.

Every email sent under Pre-Release contains an unsubscribe link that works without authentication and without conditions. For emails sent through Brevo, this link is the Platform's, which does not carry the address, only a token, together with the mail client's unsubscribe button: the unsubscription is recorded by BandStream and the contact is removed from the artist's list. For Mailchimp, it is Mailchimp's unsubscribe link, managed in the artist's account. Unsubscribing also withdraws consent to the artist's news; submitting the form again with the box unticked withdraws it too.

When the Visitor asks BandStream to erase their address, all their sign-ups kept by BandStream, across all releases, are erased in a single operation, together with everything attached to them, in accordance with the artist's instructions in the data processing agreement. The operation is logged as a hash, which makes it possible to attest to it without keeping the address. BandStream cannot itself erase a contact from the artist's list at their provider, other than the removal that follows an unsubscription: in accordance with Articles 17 and 19 GDPR, it sends an erasure notice by email to the artist of each release whose sign-up had been passed to their list, and to each person who had downloaded a list of sign-ups containing the address, telling them which address to remove from their list, their copy and their tools and, for a sign-up passed to their list, the date it was passed on; this notice is the assistance BandStream owes the artist, as processor, in responding to requests to exercise data subject rights (Article 28(3)(e) GDPR); the artist, as controller, carries out that erasure themselves. BandStream keeps proof of this notice (recipient, date, release concerned), without the Visitor's address, and tells the Visitor, on request, which recipients were notified. The other rights in Article 9 are exercised in the same way, and the Visitor may lodge a complaint with the CNIL.

A spam complaint or a hard bounce reported by Brevo unsubscribes the address automatically at BandStream. A soft bounce does not: a full mailbox on a given day is not a withdrawal of consent.

12.8 Transfers outside the European Union

Data kept by BandStream is kept under the conditions of Articles 6.1 and 7. Brevo processes data in France (EU). Mailchimp (The Rocket Science Group LLC, Intuit Inc. group) is established in the United States: a sign-up is passed to the artist's Mailchimp audience on the artist's documented instructions (Article 28(3)(a) GDPR), and safeguarding that transfer is the artist's responsibility, as the controller who chose that provider and contracts with it (Articles 44 et seq. GDPR: adequacy decision on the EU-U.S. Data Privacy Framework for companies that adhere to it, or standard contractual clauses in the provider's contract).

Article 13: Security

Technical and organizational measures in accordance with article 32 of the GDPR: HTTPS/TLS encryption, authentication, access restriction, backups, monitoring. During the Alpha phase, these measures are being progressively deployed; BandStream implements reasonable measures proportionate to the Platform's stage of development.

In the event of a personal data breach likely to result in a high risk to the rights and freedoms of data subjects, BandStream will notify the breach to the CNIL within seventy-two (72) hours of its discovery, in accordance with article 33 of the GDPR. If this deadline cannot be met, the notification will be accompanied by the reasons for the delay. BandStream will also inform the data subjects concerned as soon as possible, in accordance with article 34 of the GDPR, indicating the nature of the breach and the measures taken or recommended to mitigate its effects.

Article 14: Minors

The Platform is reserved for persons aged 16 and over (art. 8 GDPR, art. 7-1 of the French Data Protection Act). Data of minors under 16 collected without parental consent will be deleted.

Article 15: Policy Amendments

This policy may be amended at any time. Users will be notified by email at least thirty (30) days in advance of any substantial amendment. The updated version will be published on the Site.

Article 16: Contact

Data protection contact: dpo@band.stream (founding team)

Customer service: contact@band.stream

Mail: BandStream SAS, 60 rue François 1er, 75008 Paris, France