TERMS OF USE
BandStream: Alpha access and Label subscription
Version 5.1, updated on October 24, 2026 for the opening of the Label process. Existing contracts retain their rights and applicable version. The data processing agreement in Annex 1, version DPA 2026-10-20, applicable upon its express acceptance, remains unchanged.
Article 1: Purpose
The purpose of these Terms of Use (hereinafter the "Terms") is to define the conditions of access to and use of the BandStream platform (hereinafter the "Platform"), accessible at https://band.stream (hereinafter the "Site").
The Terms govern the relationship between BandStream, a SAS (simplified joint-stock company) with a share capital of 1,020.00 euros, registered with the RCS of Paris under number 939 221 438, with its registered office at 60 rue François 1er, 75008 Paris (hereinafter "BandStream"), and any person accessing the Site or using the Platform (hereinafter the "User").
The Platform is currently in a private Alpha phase. Alpha access remains reserved for invited users. As an exception, the public Label subscription process allows an Account to be created without an Invitation after the email address has been verified. Creating an Account is not a paid subscription: purchasing and activating Label are governed by the Terms of Sale. An Account created through this process does not thereby acquire Alpha or founder status or benefits. By creating an Account or using the Platform, the User acknowledges having read, understood, and accepted these Terms.
The sale of paid "Pro" and "Label" Subscriptions is governed by the Terms of Sale (hereinafter the "Terms of Sale"), available at https://band.stream/en/sales. For everything relating to that sale (plans, price, ordering, payment, term, renewal, right of withdrawal, termination, legal warranties), the Terms of Sale prevail over these Terms in the event of conflict.
Article 2: Definitions
"User": any natural or legal person who has created an Account and uses the Services, either by Invitation during the Alpha phase or through the public Label subscription process.
"Alpha User": any User admitted during the private Alpha phase by virtue of an Invitation. Unless otherwise specified, any reference to the "User" in these Terms also refers to the Alpha User, who is subject to additional obligations detailed herein.
"Invitation": a personal, non-transferable, and revocable authorization issued by BandStream allowing the creation of an Account during the Alpha phase. The Invitation may not be transferred, shared, or resold to any third party.
"Alpha Phase": a period of development and testing preceding the commercial release to the general public. Access is limited to invited Alpha Users only.
"Visitor": any person viewing the Site or an Artist Page without having an Account.
"Account": the personal space created by the User under article 4.1, either by Invitation or through the public Label subscription process using a verified email address.
"Artist Page": a personalized web page created by the User, accessible via a dedicated subdomain (artist.band.stream).
"User Content": all information, text, images, photographs, logos, artist names, and any elements uploaded or entered by the User.
"Services": all functionalities made available. During the Alpha phase, certain Services may be incomplete, unstable, or subject to modification or removal without notice.
"Subscription": a paid plan taken out by a User for their Account. The Subscription is attached to the Account and its benefit extends to all Artist Pages of which the User is a member. Its content, price and conditions of sale are set out in the Terms of Sale.
"Confidential Information": any non-public information relating to the Platform (features, interfaces, performance, bugs, roadmap, technical or strategic developments) to which the Alpha User gains access through participation in the Alpha phase.
"Feedback": any experience report, suggestion, bug report, or comment provided by the Alpha User.
Article 3: Access Conditions
3.1 Access Reserved for Invited Users
During the private Alpha phase, access to the Platform is strictly reserved for persons who have received a valid Invitation from BandStream by email. No Alpha registration can be completed without having first received this Invitation.
These Invitation requirements do not apply to the public Label subscription process described in articles 1 and 4.1. Access through that process does not constitute admission to the Alpha phase; obligations specific to Alpha Users, including confidentiality under article 10, do not apply solely because of this registration. The other rules governing use of the Platform continue to apply.
BandStream alone decides, at its sole discretion and without obligation to justify its decision, to whom an Invitation is sent. Having requested access does not create any right to receive an Invitation.
The Invitation is strictly personal. The Alpha User shall not transmit, share, publish, or resell it to any third party. Any breach of this obligation will result in the immediate revocation of the Invitation and deletion of the Account.
3.2 Age Requirement
Use of the Platform is reserved for persons aged at least sixteen (16) years. For minors aged 16 to 18, registration is subject to prior authorization from a legal guardian. BandStream may request proof of such authorization at any time.
3.3 Revocation of the Invitation
BandStream reserves the right to revoke an Invitation for legitimate cause, including but not limited to: the end of the Alpha phase, a breach by the Alpha User of these Terms, a strategic reorientation of the Platform, or a reduction in the number of testers. Except in cases of serious breach of these Terms, BandStream will notify the revocation with a reasonable notice period of fifteen (15) days.
Revocation of the Invitation results in the immediate suspension of access to the Account and Services. The Alpha User will have a period of thirty (30) days from the notification of revocation to download a copy of their data. After this period, the Account and all associated data may be permanently deleted.
3.4 Technical Access
Access to the Platform requires an internet connection and a compatible browser. The costs of access and equipment are borne by the User.
Article 4: Registration and Account
4.1 Account Creation
An Account may be created either through a BandStream Invitation or through the public Label subscription process. In the latter case, the User enters their email address and uses the verification link sent to that address; the Account is created only after verification. Merely requesting or verifying this link neither incurs payment nor grants Label rights. Stripe requests billing information subsequently when the Order is placed. The User undertakes to provide accurate information and keep it up to date.
4.2 Account Security
The User is solely responsible for the confidentiality of their login credentials and for all activity carried out from their Account. In the event of a security breach, they must notify BandStream without delay at contact@band.stream.
4.3 Uniqueness and Personal Nature of the Account
Each User may only have one Account. The Account is strictly personal and may not be shared with any third party, even if said third party has their own Invitation. The creation of multiple accounts or any sharing of an Account is prohibited and will result in the deletion of all accounts concerned.
Article 5: Description of Services and Alpha Disclaimer
5.1 Features
The Platform allows Users to create an Artist Page grouping links to streaming platforms (Spotify, Apple Music, YouTube Music, Deezer, Tidal, Qobuz, etc.), integrate links to events and ticketing, benefit from a dedicated subdomain, and multilingual support (26 languages). Advanced features (detailed traffic analytics, advertising pixels and Google Tag Manager, unlimited releases, team members, Pro badge, priority support) are reserved for Pro and Label Subscriptions, according to the features of each, whose content and price are described in article 5 of the Terms of Sale and on the Site's pricing page. BandStream may, at its discretion, offer all or part of them free of charge to certain Alpha Users during the testing phase; such free provision does not constitute a sale and does not imply their inclusion in the final commercial offerings.
Label includes the limits described in article 5.6 of the Terms of Sale.
5.2 Alpha Phase Disclaimer
The Alpha User expressly acknowledges and accepts that:
(a) the Platform is a product under development, provided "as is" and "as available";
(b) the features offered may be incomplete, unstable, modified, degraded, or removed at any time and without notice;
(c) errors, bugs, security vulnerabilities, data losses, and service interruptions may occur;
(d) BandStream does not guarantee the permanent availability of the Platform, nor the complete preservation of data during or after the Alpha phase;
(e) the features available during the Alpha phase do not imply those that will be offered in the final commercial version;
(f) BandStream may modify the technical architecture, interfaces, and user experience without prior notice.
(g) The disclaimers in this article do not in any way deprive the User acting as a consumer of their mandatory legal rights, particularly with respect to the legal guarantees of conformity (articles L217-3 et seq. of the French Consumer Code) and hidden defects (articles 1641 et seq. of the French Civil Code).
BandStream strongly recommends that the Alpha User keep a backup copy of all their content and information.
5.3 Pro Subscription Trial Period
The Pro Subscription may start with a free trial period. The conditions of the trial period are those of the Terms of Sale accepted upon subscription (article 5.4 of the Terms of Sale), which set out in particular its term, the information given before the payment method is entered, the first charge, the reminder sent before the trial ends, cancellation and the right of withdrawal. A trial period opened before September 25, 2026, when version 3 came into force, keeps the term stated upon its subscription.
Article 6: User Content
6.1 Ownership
The User retains all intellectual property rights over the User Content. By publishing content, the User grants BandStream a non-exclusive, free-of-charge, worldwide license limited to the duration of use of the Services, solely for the technical purposes of operating the Platform (display, caching, adaptation). This license terminates upon deletion of the content or the Account.
6.2 Content Liability
The User is solely responsible for their User Content and warrants that they hold all necessary rights. The User agrees to indemnify BandStream against any third-party claims.
6.3 Prohibited Content
It is strictly prohibited to publish any content that: (a) is unlawful or contrary to public order; (b) infringes on the intellectual property rights of third parties; (c) is defamatory, insulting, discriminatory, hateful, racist, xenophobic, homophobic, or incites violence; (d) is pornographic or involves child exploitation; (e) glorifies terrorism or crimes; (f) violates the privacy of a third party; (g) contains viruses or malicious code; (h) constitutes spam or advertising unrelated to musical activity.
Article 7: Personalized Subdomain
The subdomain is assigned on a "first come, first served" basis. The User has no ownership rights over the subdomain. In the event of termination, revocation of the Invitation, or deletion of the Account, the subdomain is immediately released and may be reassigned. BandStream may refuse, suspend, or revoke a subdomain in cases of infringement of third-party rights or abusive registration.
Article 8: Prohibited Conduct
The User shall not: (a) use the Platform for illegal purposes; (b) attempt to access BandStream's systems without authorization; (c) engage in scraping or crawling; (d) use bots or automated scripts; (e) impersonate a third party; (f) engage in cybersquatting; (g) deliberately overload the servers; (h) circumvent security measures; (i) resell or sublicense access; (j) transfer or share their Invitation; (k) communicate to uninvited third parties any information enabling them to circumvent the closed nature of the Alpha phase.
Article 9: Fair Use of the Subscription
9.1 Purpose of the Subscription
The Subscription is taken out by a User and its benefit extends to all Artist Pages of which that User is a member. It is designed for one artist, or for the various projects of a single person or a single band. It is not intended to allow a User to provide the Services to third parties, whether free of charge or for consideration.
As an exception, the Label Subscription allows the Customer to create and manage Artist Pages for artists they represent, within the limits of their plan and with those artists' necessary permissions. It does not permit reselling, renting or sublicensing credentials or sharing a personal Account; collaboration uses the team access provided by the plan.
9.2 Indicative Order of Magnitude
As an indication, use consistent with clause 9.1 leads to no more than twenty (20) Artist Pages being attached to a single Account. Exceeding this order of magnitude does not, in itself, constitute a breach of these Terms: it leads BandStream to review the actual use of the Account against clause 9.1.
By contrast, manifestly abusive use includes, in particular: (a) creating or administering Artist Pages on behalf of third parties unconnected with the User; (b) reselling, renting out, or sublicensing access to the Services or the benefit of the Subscription; (c) multiplying Accounts or Artist Pages in order to circumvent the limits of the plan taken out.
Managing Artist Pages for represented artists under a Label Subscription within its limits does not, in itself, constitute the abuse referred to in (a).
9.3 Procedure in the Event of Manifestly Abusive Use
In the event of manifestly abusive use within the meaning of clause 9.2, BandStream proceeds in the following order:
(a) a warning sent by email to the address associated with the Account, stating the facts observed and the measures expected;
(b) a compliance period of fifteen (15) calendar days from the sending of that warning, during which the User may bring their use into compliance or submit observations;
(c) upon expiry of that period and in the absence of compliance, suspension of the Subscription and then, where applicable, its termination together with that of the Account.
Any decision taken on this basis is notified with its reasons and gives rise to the internal appeal right provided for in article 12 of these Terms. In the event of a characterized emergency, in particular where the observed use compromises the security or stability of the Platform, BandStream may immediately suspend access as a precautionary measure, the warning and period provided for above then being sent without delay.
9.4 Refund
Where BandStream terminates the Subscription on the basis of clause 9.3, the User is refunded on a pro rata temporis basis for the subscription period paid for and not used, within thirty (30) days of termination. No pro rata refund is due where the User terminates their own Subscription. Other cases of termination and refund (withdrawal, discontinuation of the service, modification of the plan) are governed by articles 10 to 15 of the Terms of Sale.
9.5 Quantified Limits of the Plan
This article applies to all Accounts, whatever their opening date. The applicable usage limits are those of the plan taken out by the Account, as displayed on the pricing page of the Site. Where those limits are expressed in figures, they prevail over the indicative order of magnitude in clause 9.2; the procedure in clause 9.3 and the refund in clause 9.4 remain applicable. An Account whose number of Artist Pages already exceeds the limit of its plan keeps those Artist Pages, but may only create new ones by taking out a plan whose limit allows it.
Article 10: Confidentiality and Alpha User Obligations
The Alpha User acknowledges that their early access grants them access to Confidential Information. They undertake to:
(a) not disclose, publish, or share Confidential Information, whether on social media, forums, blogs, press articles, podcasts, or any other medium, without prior written authorization from BandStream;
(b) not take screenshots, video or audio recordings, or reproductions of the interfaces for the purpose of distributing them;
(c) not engage in reverse engineering, decompilation, or extraction of technical data from the Platform;
(d) not communicate to third parties any information about BandStream's roadmap, upcoming features, or product strategy;
(e) limit the use of Confidential Information solely to the purpose of testing and using the Platform.
Exceptions: information made public by BandStream, information the Alpha User can demonstrate prior knowledge of, and information that has become public through no fault of theirs, are not considered confidential.
This obligation survives the termination of the Account or the end of the Alpha phase for two (2) years. Any breach constitutes a serious fault resulting in the immediate deletion of the Account and revocation of the Invitation, without prejudice to damages.
Article 11: Feedback and Contributions
BandStream encourages Feedback. The Alpha User acknowledges that: (a) Feedback is voluntary and provided free of charge; (b) BandStream may use it freely; (c) it does not confer any intellectual property rights; (d) BandStream has no obligation to integrate it or report on it.
Article 12: Moderation and Account Deletion
BandStream may suspend or delete any Account in the event of a breach of the Terms, including: publication of prohibited content, prohibited conduct, sharing of an Invitation, violation of Alpha confidentiality, or provision of inaccurate information during registration. All moderation decisions (content removal, Account suspension, or Account deletion) are notified to the User concerned with an indication of the reasons for the decision, in accordance with articles 17 and 20 of Regulation (EU) 2022/2065 (Digital Services Act). In cases of manifest urgency (manifestly illegal content, serious security breach), BandStream may proceed with immediate precautionary suspension, with the reasoned notification being sent as soon as possible.
The User has a right to an internal appeal allowing them to contest any moderation decision within thirty (30) days of its notification, by sending their complaint to contact@band.stream. BandStream undertakes to examine this complaint within a reasonable timeframe and to notify the User of its reasoned decision. This internal appeal is free of charge.
Permanent deletion results in: the deletion of all data associated with the Account (Artist Page, User Content, statistics), the immediate release of the subdomain, and the loss of all advantages and access related to the Alpha phase.
Any third party who believes content is illegal may report it to contact@band.stream (LCEN). BandStream provides an accessible and clear reporting mechanism, in accordance with article 16 of the Digital Services Act.
Article 13: BandStream Intellectual Property
The Platform and all its elements are the exclusive property of BandStream. Access during the Alpha phase does not confer any intellectual property rights, including over developments inspired by Feedback.
Article 14: Hyperlinks
BandStream disclaims all responsibility for third-party websites accessible via the Platform.
Article 15: Platform Availability
BandStream endeavors to provide access 24/7, subject to maintenance and force majeure. No guarantee of uninterrupted availability is given, particularly during the Alpha phase where frequent and prolonged interruptions may occur for development, testing, maintenance, or update purposes. These interruptions do not give rise to any compensation.
Article 16: Liability
BandStream is subject to an obligation of means, assessed during the Alpha phase in light of the experimental nature of the Platform.
BandStream shall not be held liable for: content published by Users; information on third-party websites; damages resulting from the use or inability to use the Platform, except in the event of proven fault.
During the Alpha phase, BandStream specifically disclaims all liability in the event of: total or partial loss of Alpha User data; prolonged unavailability of the Platform; modification or removal of features; incompatibility with certain configurations; inaccurate or incomplete statistical results, to the extent permitted by law.
To the extent permitted by law, BandStream's total liability under these Terms shall not exceed the amount actually paid by the User during the twelve (12) months preceding the event giving rise to liability, or one hundred (100) euros if use is free of charge. This limitation does not apply in the event of personal injury, intentional misconduct, gross negligence, or under the legal guarantees of conformity and hidden defects. Nor does it apply to a User acting as a consumer or non-professional, whose right to compensation is governed by law and, for the Pro Subscription, by article 16 of the Terms of Sale.
Article 17: Personal Data
Processing in accordance with the GDPR and the French Data Protection Act (loi Informatique et Libertés). Details are provided in the Privacy Policy accessible on the Site. The Platform uses "privacy-first" analytics and includes a GDPR-compliant consent manager.
Pre-Release: the User's account and responsibility for their list. The Pre-Release feature (Article 12 of the Privacy Policy) can only be turned on for a release if the User who owns the Artist Page has connected to the Platform a Brevo or Mailchimp account opened in their name, or in the name of the organisation that runs the Artist Page, verified and with a mailing list of their choice, and has accepted the data processing agreement set out in Annex 1 to these Terms. Visitors' sign-ups join that list and all emails sent to them under Pre-Release go out from that account: BandStream sends none of them by its own means. The costs, quotas and sending limits of that account are borne by the User. The User is the controller of the Visitors' data collected through Pre-Release and of their mailing list; BandStream acts as processor, under the conditions of Annex 1, except for the security of the form, for which it remains the controller. By connecting their account, the User undertakes to:
(a) only connect an account they hold or are authorised to use, comply with the terms of use of their provider, hold the necessary rights over the sender address, and keep confidential the credentials they provide on the Platform;
(b) fulfil towards Visitors the obligations of a controller (in particular Articles 5, 6, 7, 12 to 22 and 24 GDPR), including for the choice of their provider, with which they themselves enter into the contract required by Article 28 GDPR, and for safeguarding the transfers outside the European Union that this choice involves (Articles 44 et seq. GDPR), in particular when they choose Mailchimp, which is established in the United States;
(c) only send their news to Visitors who consented to it by ticking the box provided for that purpose, within the limits of that consent and, for direct marketing messages, in compliance with Article L. 34-5 of the French Postal and Electronic Communications Code, stating in each message their identity and a simple way to unsubscribe;
(d) send Visitors who only consented to the release alert, marked as such in their list, no message other than the release-day email for the release concerned; not import those contacts into another list or tool for another use; and not keep them for longer than that purpose requires;
(e) act without delay on any unsubscription, objection or withdrawal of consent, and on any request by a Visitor to exercise their rights, including the erasure notice that BandStream sends them (Articles 17 and 19 GDPR);
(f) not assign, rent or disclose any address to a third party, other than a service provider acting on their behalf and on their instructions;
(g) not alter in their account the consent information passed on with each contact (attributes or tags) in a way that would falsify the proof it provides;
(h) notify BandStream without delay, at dpo@band.stream, of any compromise of their account or of the credentials stored on the Platform, of any personal data breach affecting the sign-ups collected through Pre-Release of which they become aware, and of any complaint or request from a supervisory authority concerning those sign-ups, so that BandStream can assist them (Articles 28(3)(f), 33 and 34 GDPR) and, where appropriate, close the form.
The User may disconnect their account at any time: the form closes, sign-ups already passed on remain in their list, under their responsibility, and the others are never passed on and are erased by BandStream within the periods of the Privacy Policy. If the account refuses an operation, the form is closed and pending emails wait until the User has verified the account again; BandStream does not send them by its own means. In the event of a serious or repeated breach of the undertakings in this paragraph, BandStream may, after a warning that has gone unheeded and save in an emergency, turn off Pre-Release on the Artist Page concerned, under the conditions of article 12 of these Terms.
Export of the list of sign-ups. The User who holds the Pro Offer may also download from the Platform the list of confirmed sign-ups for a release of their Artist Page: email address, platforms chosen, sign-up date, consent to the artist's news, source and incoming campaign, date passed to their list. It includes neither people who have unsubscribed nor requests never confirmed. This download makes available to the User data of which they are already the controller: the copy they hold is theirs, on the same terms as their list. Undertakings (b) to (f) above apply to it, and the User ensures its security. BandStream plays no part in how the User uses their list or their copy.
Article 18: Amendment of the Terms
BandStream reserves the right to amend these Terms at any time. In the event of a substantial amendment, BandStream will notify Users by email at least thirty (30) days before the new Terms take effect, specifying the nature of the amendments and their effective date. Continued use of the Platform after the amended Terms take effect constitutes acceptance. A User who does not accept the amendments may delete their Account before they take effect.
Article 19: End of the Alpha Phase and Transition
BandStream reserves the right to end the Alpha phase at any time. Upon transition to the commercial version, new Terms will be published. Alpha Users will be notified at least thirty (30) days in advance.
The end of the Alpha phase may result in: changes to available features, changes to pricing under the conditions provided in the Terms of Sale, the requirement to accept new contractual terms, and deletion of inactive accounts. BandStream will endeavor to ensure as smooth a transition as possible for Alpha Users.
Article 20: Force Majeure
Within the meaning of article 1218 of the French Civil Code, neither party shall be held liable for the non-performance or delay in the performance of any of its obligations if such non-performance or delay results from an event beyond the reasonable control of the affected party, which could not have been reasonably foreseen at the time the contract was entered into, and the effects of which cannot be avoided by appropriate measures.
The following are notably considered cases of force majeure: natural disasters, wars, terrorist attacks, epidemics or pandemics, general strikes, electrical grid or telecommunications outages, massive cyberattacks, government or regulatory decisions preventing performance of the contract.
The affected party must notify the other party as soon as possible. If the force majeure event continues for more than ninety (90) days, either party may terminate these Terms by right, by written notice to the other party, without compensation.
Article 21: Consumer Mediation
In accordance with articles L611-1 et seq. of the French Consumer Code, any User acting as a consumer has the right to free access to a consumer mediator for the amicable resolution of any dispute with BandStream.
Prior to referring the matter to the mediator, the User must have attempted to resolve their dispute directly with BandStream by sending a written complaint to contact@band.stream.
The consumer mediator designated by BandStream is: CM2C (Centre de la Médiation de la Consommation de Conciliateurs de Justice), 49 rue de Ponthieu, 75008 Paris; telephone: +33 (0)1 89 47 00 14 (01 89 47 00 14 from France); online referral: https://www.cm2c.net/declarer-un-litige.php; email: litiges@cm2c.net. Failing a satisfactory response from BandStream to their written complaint, the User may refer the matter to the mediator free of charge. The referral procedure is detailed in article 21 of the Terms of Sale.
The European Online Dispute Resolution (ODR) platform, formerly available at ec.europa.eu/consumers/odr, was discontinued by Regulation (EU) 2024/3228 with effect from 20 July 2025 and is no longer available.
Article 22: Governing Law and Jurisdiction
These Terms are governed by French law. For Users acting in a professional capacity, any dispute shall be submitted to the Commercial Court of Paris (Tribunal de commerce de Paris). For Users acting as consumers, disputes fall under the jurisdiction of the courts of the consumer's domicile or the registered office of BandStream.
In accordance with article 21 of these Terms, any consumer dispute must, prior to any court proceedings, be subject to an attempt at amicable resolution under the conditions defined in said article.
Article 23: General Provisions
Partial invalidity: the invalidity of any provision does not affect the others. These Terms, the Privacy Policy and, for Users holding a Pro Subscription, the Terms of Sale constitute the entire agreement between BandStream and the User regarding the use of the Platform. Contact: contact@band.stream.
Article 24: Legal Notices
In accordance with article 6 of the French Law for Confidence in the Digital Economy (LCEN), the following information is brought to the attention of Users and Visitors:
Publisher: BandStream SAS, with a share capital of 1,020.00 euros, registered with the RCS of Paris under number 939 221 438, SIRET 939 221 438 00012, intra-community VAT number: FR 81939221438, registered office: 60 rue François 1er, 75008 Paris, France. Telephone: available upon request at contact@band.stream. Email: contact@band.stream.
Host: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany. Telephone: 09 70 808 911. Website: www.ionos.fr.
Article 25: Digital Accessibility
BandStream currently benefits from the exemption provided by article 4 of Directive 2019/882 (European Accessibility Act, EAA) for micro-enterprises (fewer than 10 employees and less than 2 million euros in annual turnover). BandStream nevertheless commits to progressively improving the accessibility of the Platform in accordance with the principles of the Référentiel Général d'Amélioration de l'Accessibilité (RGAA) and WCAG 2.1 Level AA standards.
Annex 1: Data Processing Agreement (Article 28 GDPR)
Version DPA 2026-10-20.
This agreement is entered into between the User who owns an Artist Page and turns on the Pre-Release feature, as controller (the "Controller"), and BandStream SAS, as processor (the "Processor"). The Controller expressly accepts it, by ticking the box provided for that purpose, when connecting their Brevo or Mailchimp account to the Platform; the Processor keeps the date of that acceptance, the version accepted and the Account that gave it. The agreement takes effect upon that acceptance, including before the effective date of the version of the Terms that contains it. For the personal data of Visitors collected through Pre-Release, it prevails over any other provision of the Terms. The terms "personal data", "processing", "controller", "processor" and "personal data breach" have the meaning given to them in Article 4 GDPR.
A.1 Subject matter
The Processor processes on behalf of the Controller the personal data of Visitors collected through the Pre-Release feature on the releases of the Controller's Artist Page, solely for the purposes described in A.3, in accordance with Article 28 GDPR. The security of the form (rate limiting, bot trap, checks on the origin of requests), for which the Processor is the controller on its own account, falls outside this agreement, as does the production by the Processor of overall statistics on the use of the feature across all Artist Pages, which contain no data that could identify a Visitor and for which the Processor is likewise the controller on its own account.
A.2 Duration
The agreement applies for as long as the Controller's Brevo or Mailchimp account is connected to the Platform, and then until the Processor has erased the data it keeps, under the conditions of A.12.
A.3 Nature and purpose of the processing
Nature: hosting the sign-up form and the confirmation page; collecting, recording and storing sign-ups and proof of consent; passing sign-ups, with that proof, to the Controller's Brevo list or Mailchimp audience, through their provider's programming interface; triggering, through the Controller's account, the confirmation email (Brevo) and the release-day email or campaign; measuring clicks that go through the Platform and incoming campaigns; producing aggregated statistics; making available the list of confirmed sign-ups where the Controller holds the Pro Offer; unsubscription and erasure.
Purposes: notifying Visitors when the release they signed up for comes out; collecting and proving, for the Controller, their consent to receive the Controller's news; providing the Controller with the statistics of their release.
A.4 Types of personal data
Email address; page language; dates of the request, confirmation, unsubscription, transfer and sending; listening platforms chosen; answer to the box about the artist's news and the date it took effect; version of the text shown; campaign parameters ("UTM") and origin of the referring page, reduced to the protocol and domain name; technical status of the transfer and sending and technical identifiers at the provider; clicks (targeted platform, time); hashes of link tokens. No special category of data within the meaning of Article 9 GDPR is processed, and no IP address is attached to a sign-up.
A.5 Categories of data subjects
Visitors to the Controller's Artist Pages who sign up for the release alert of one of the Controller's releases.
A.6 Documented instructions (Article 28(3)(a) GDPR)
The Processor only processes the data on documented instructions from the Controller. Those instructions consist of this agreement, Article 12 of the Privacy Policy and the settings the Controller chooses on the Platform (turning on Pre-Release for a release, provider, list or audience, double opt-in for the box about the artist's news, platforms offered). In particular, the Controller instructs the Processor:
(i) to pass sign-ups to the provider the Controller chose, including where that provider is established outside the European Union, such as Mailchimp in the United States, safeguarding that transfer being a matter for the Controller's contract with that provider;
(ii) to erase the data it keeps within the periods of Article 12.6 of the Privacy Policy;
(iii) where a Visitor unsubscribes through the Platform's link, to record that unsubscription and remove the contact from the Controller's Brevo list;
(iv) where a Visitor asks the Processor directly for their data to be erased, to erase all sign-ups it keeps for that address and to send the Controller the erasure notice provided for in Article 12.7 of the Privacy Policy, which tells the Controller, for each sign-up passed to their list, the address to remove from it and the date it was passed on (Article 28(3)(e) GDPR);
(v) never to pass on to the Controller's list a sign-up collected under an information text earlier than the one that names the Controller as controller and the Controller's provider as recipient; such a sign-up stays with the Processor until it is erased within the periods of Article 12.6 of the Privacy Policy.
Apart from the processing excluded from this agreement by A.1, the Processor does not process this data for its own purposes. If it is required to process it by Union or Member State law, it informs the Controller before processing, unless that law prohibits such information on important grounds of public interest. It immediately informs the Controller if, in its opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions.
A.7 Confidentiality (Article 28(3)(b) GDPR)
The Processor ensures that persons authorised to process the data, members of its team, have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, and only access the data to the extent necessary to perform this agreement or the support requested by the Controller.
A.8 Security (Article 28(3)(c) and Article 32 GDPR)
The Processor implements the appropriate technical and organisational measures described in Article 13 of the Privacy Policy, in particular: encryption of exchanges (HTTPS/TLS); encryption at rest of the credentials of the Controller's account, which are never returned by the Platform; storage of link tokens as hashes only; access restricted to authorised team members; backups; automatic purges; logging of erasures as hashes. It reviews them in the light of the state of the art and of the risks.
A.9 Sub-processors (Article 28(2), 28(3)(d) and 28(4) GDPR)
The Controller gives the Processor general written authorisation to engage sub-processors. Those involved in this processing are, among the processors listed in Article 6.1 of the Privacy Policy, those that host the Platform and its database, route its traffic and send its service emails to the Controller. The Processor informs the Controller by email of any intended addition or replacement at least thirty (30) days before it takes effect, giving the Controller the opportunity to object, with reasons, within that period. If the objection cannot be resolved, the Controller may disconnect their account, at no cost or penalty, before the change takes effect. The Processor imposes on each sub-processor, by contract, data protection obligations equivalent to those of this agreement, and remains fully liable to the Controller for the performance of their obligations by its sub-processors.
Brevo and Mailchimp are not sub-processors of the Processor: they are the Controller's service providers, chosen by the Controller and bound to the Controller by its own contract.
A.10 Assistance (Article 28(3)(e) and 28(3)(f) GDPR)
Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures in fulfilling its obligation to respond to requests from data subjects to exercise their rights (Articles 12 to 22 GDPR): it forwards to the Controller without delay any request it receives directly, carries out the instructions in A.6, and provides on request the data it keeps on the data subject. It also assists the Controller in ensuring compliance with the obligations of Articles 32 to 36 GDPR (security, notification and communication of breaches, impact assessment, prior consultation), taking into account the nature of the processing and the information available to it.
A.11 Personal data breaches (Article 33(2) GDPR)
The Processor notifies the Controller of any personal data breach concerning this processing as soon as possible, and in any event without undue delay, after becoming aware of it. The notification includes, to the extent available, the information provided for in Article 33(3) GDPR, in phases where necessary. It is for the Controller to notify the breach to the supervisory authority and, where applicable, to communicate it to data subjects (Articles 33 and 34 GDPR); the Processor assists the Controller in doing so.
A.12 Data at the end of the service (Article 28(3)(g) GDPR)
At the end of the service, by disconnection of the Controller's account, turning off Pre-Release for a release or deletion of the release, the Artist Page or the Account, the Processor erases the data it keeps, at the latest within the periods of Article 12.6 of the Privacy Policy. Sign-ups already passed on are in the Controller's list at their provider: they are thereby returned to the Controller and remain there under the Controller's sole responsibility. The Controller who holds the Pro Offer may also download the list of confirmed sign-ups before that erasure. The only exceptions are the hashes and proofs described in Article 12 of the Privacy Policy, which do not allow an address to be recovered and serve to demonstrate that unsubscriptions and erasures were carried out, and any data whose retention is required by Union or Member State law.
A.13 Audits and information (Article 28(3)(h) GDPR)
The Processor makes available to the Controller all information necessary to demonstrate compliance with the obligations of Article 28 GDPR: this agreement, the Privacy Policy and, on written request to dpo@band.stream, written answers to the Controller's questions within thirty (30) days. It allows for and contributes to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller, bound by professional secrecy or a confidentiality obligation. Save in the event of a personal data breach or a request from a supervisory authority, an audit is announced at least thirty (30) days in advance, takes place no more than once in any twelve (12) month period, is carried out during business hours without disrupting the Service, gives access neither to other Users' data nor to the Processor's trade secrets, and is at the Controller's expense.
A.14 Obligations of the Controller
The Controller ensures that the processing is lawful and complies with the undertakings of article 17 of the Terms, points (a) to (h). The Controller checks that the information and consent text the Platform presents to Visitors on their behalf suits them, and gives Visitors, in particular in their emails, a way to contact them. The Controller chooses their provider, enters into the contract required by Article 28 GDPR with it and is responsible for safeguarding the transfers this choice involves. The Controller's instructions must comply with the GDPR.
A.15 Liability and amendment of the agreement
Each party is liable towards data subjects under the conditions of Article 82 GDPR. Between the parties, article 16 of the Terms applies within the limits permitted by law. Any new version of this agreement is subject to the Controller's express acceptance; failing that, the version the Controller accepted continues to apply, unless the amendment is required by law or by a supervisory authority, in which case the Processor informs the Controller, who may disconnect their account.