Privacy Policy

At GRE2JAZZ S.L. we take your privacy seriously. This policy explains what personal data we collect, for what purpose, on what legal basis, for how long, with whom we share it and what rights you have over it. It complies with the UK GDPR and the Data Protection Act 2018.

1. Data controller

• Identity: GRE2JAZZ S.L.
• Company no.: B10785392
• Registered address: Calle Portalón, 7, 05690 Los Llanos de Tormes (Ávila), España
• Email:info@clubgre2jazz.com

We have not appointed a Data Protection Officer (DPO) for now, as it is not required given the volume and type of data we process. For any privacy query, please write to the email address above.

2. What data do we collect and why?

2.1 If you subscribe to the newsletter

• Data: email address; signup source; consent version and timestamps; IP address; browser/device user-agent string; and the technical status, stage and time of the confirmation-email hand-off.
• Purpose: to send you the weekly jazz newsletter for the UK (every Thursday) with the listings and selected editorial articles. The source and limited technical metadata document the request, help prevent abuse and support security or delivery investigations; they are not used to personalise advertising.
• Legal basis: your explicit consent (art. 6(1)(a) UK GDPR). Double opt-in: you request the subscription and then confirm by clicking the verification email. Consent is the basis for newsletters; our legitimate interests in service security, fraud/abuse prevention and consent evidence cover the limited source, IP and user-agent metadata.
• Retention: pending, unconfirmed requests are removed after 30 days. Active details remain until you unsubscribe; subscriber details — including source, consent evidence, IP, user-agent and confirmation-delivery state — and pseudonymous campaign/delivery mappings are then removed within 180 days once no unresolved delivery references them. Opaque unsubscribe credentials expire after two years and used credentials are removed within 180 days. Confirmation and unsubscribe links contain no email address: their opaque fragments are removed from browser history before analytics can load. Every email includes an unsubscribe link.

2.2 If you add yourself as a musician to the directory

• Data: stage name, instruments, styles, city, contact email, optional phone number, indicative fee, links to your work (video/audio sample), photo. The fee, email and phone number are NOT published — we only use them for internal management.
• Purpose:
  1. to publish your professional profile in the public directory at /musicians/[slug]/ so that clients can discover you;
  2. to put you in touch with clients who enquire about your availability for an event;
  3. to manage the booking if you decide to accept (contract, fee, settlement, Jazz Live UK 15% commission).
• Legal basis: consent (art. 6(1)(a)) for 1 and 2; performance of a contract (art. 6(1)(b)) for 3 when you accept a booking.
• Retention: for as long as you wish to be in the directory. You can request removal at any time and we delete your listing within 7 days.

2.3 If you make an enquiry as a client / promoter

• Data: name, email, phone number, city, type of event, approximate date, indicative budget, any information you provide voluntarily.
• Purpose: to reply with a proposal of available musicians and, if we proceed, to manage the booking.
• Legal basis: pre-contractual steps taken at the request of the data subject (art. 6(1)(b)). If we go on to sign a contract, the basis becomes performance of a contract.
• Retention: 12 months from the last interaction if we do not reach a contract (so that we can pick the conversation back up if you return). If we reach a contract, the event data is kept for the mandatory tax periods (6 years for invoicing).

2.4 If you email us (the "Enquiry" CTA)

We process the data you send us in order to reply to your enquiry. Legal basis: the implied consent of anyone who sends an email asking for a reply. Retention: 24 months after the last interaction or until you request deletion.

2.5 Automatic technical data (analytics)

If you accepted analytics cookies, Google Analytics 4 collects: anonymised IP, page views, duration, device, browser, city-level location. It is not cross-referenced with any personal identity. More detail in theCookie Policy.

2.6 If you create a Jazz Live UK account

• Data: email address, encrypted password, optional display name, saved gigs, followed musicians and venues, and any reminder preferences you choose.
• Purpose: to authenticate you and provide the account features you request, including your personal saved and followed lists.
• Legal basis: performance of the account service you requested (art. 6(1)(b) UK GDPR). Newsletter consent is separate and is never implied by creating an account.
• Retention: while the account remains active and until you request deletion. Security logs and backups are retained only for the limited period needed to protect and restore the service.

2.7 If you enable personalised event alerts

• Data: your account email, the musicians, venues or cities you follow, saved gigs and your chosen frequency.
• Purpose: to send only the gig alerts and reminders that you expressly enable in your account.
• Legal basis: your consent (art. 6(1)(a) UK GDPR), separate from the newsletter and off by default. We keep an append-only audit record of the version, source, date and state of every change.
• Retention and withdrawal: the current preference is retained while the account exists. Inactive mappings are removed after 30 days, completed pseudonymous delivery metadata after 180 days, and superseded consent-history entries after three years. Orphaned account preferences/history are purged after 30 days. An uncertain delivery is retained until manual review to prevent duplicates. You may turn alerts off or use an email unsubscribe link at any time; withdrawal does not affect the lawfulness of earlier messages.

3. Who do we share your data with?

Your data is NEVER sold to third parties. We work with data processors bound by GDPR contracts:

• Hostinger International Ltd. (EU, Lithuania) — site and email hosting.
• Google Ireland Ltd. (EU) — Analytics, Search Console and technical services. If you accepted analytics.
• Meta Platforms Ireland Ltd. (EU) — only if you interact with Instagram/Facebook embeds in the magazine and accepted marketing cookies.
• Awin AG (Germany, EU) — only if you click an affiliate "Tickets" button and accepted marketing.
• Stay22 Inc. (Canada) — accommodation affiliate. Only if you open the Stay22 accommodation map on a gig or venue page (by accepting marketing or clicking to load it), Stay22 processes your interaction with its embedded map under its own privacy policy.
• Adsterra (advertising network) — only if you accept marketing cookies, we display a native advertising banner served by Adsterra, which may use cookies and identifiers to serve and measure ads under its ownprivacy policy. If you reject marketing or do not decide, no advertising script loads.
• Anthropic PBC (USA) — solely for internal editorial content generation (reviews, profiles, guides). It does NOT process personal data of site users.
• Hostinger's managed MySQL service (EU) — authentication and storage of account preferences. Passwords are stored as one-way hashes, never in plain text.

If in the future we sign a booking contract for an event, we will share the essential data (name, artistic and financial terms) between the musician and the contracting client in order to perform the contract. Never with third parties outside the transaction.

4. International transfers

Some processors (Google, Meta, Anthropic, Stay22 and the Adsterra advertising network) may process data outside the UK, including in the USA. These transfers are covered by theUK Extension to the EU-U.S. Data Privacy Framework or by the UK's International Data Transfer Agreement (IDTA) and standard contractual clauses.

5. Your rights (access, rectification, erasure, portability & restriction)

The UK GDPR grants you the following rights:

• Access: to know what data we hold about you.
• Rectification: to correct inaccurate data.
• Erasure / right to be forgotten: to ask us to delete your data.
• Objection: to ask us to stop processing your data for a specific purpose.
• Restriction of processing: to ask us to keep but not process your data temporarily.
• Portability: to receive your data in a structured format (JSON/CSV) to take it to another service.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights:

1. Send an email toinfo@clubgre2jazz.com stating which right you are exercising and attaching a copy of your ID or equivalent document (identity verification).
2. We will respond within a maximum of 30 calendar days (extendable to 60 if the request is complex, in which case we would let you know).

If you believe we have not handled your right properly, you can complain to the Information Commissioner's Office (ICO):ico.org.uk— Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — helpline 0303 123 1113.

6. How do we protect your data?

We apply proportionate technical and organisational measures: TLS encryption across the whole site, strong passwords on internal systems, encrypted backups, role-based access control, minimal staff with visibility. Continuous auditing of our data processors.

If a security breach were to occur that could affect your data, we would notify the ICO within 72 hours and notify you if the breach involves a high risk, in accordance with articles 33-34 of the UK GDPR.

7. Children

This site is not directed at children under 14. If we discover that we have collected a child's data by mistake, we will delete it.

8. Changes to this policy

If we substantially change this policy we will notify you by email (if you gave us one) or via a banner. The "Last updated" date always reflects the current version.

9. Contact

For any query:info@clubgre2jazz.com.