Privacy Policy

At GRE2JAZZ S.L. we take your privacy seriously. This policy explains what personal data we collect, for what purpose, on what legal basis, for how long, with whom we share it and what rights you have over it.

Two sets of rules apply to us at once. We are a Spanish company publishing a US listings site. Because the controller is established in the European Union, the GDPR applies to this processing wherever you read from — that is also why the data is held in the EU. And if you are a resident of California, the CCPA as amended by the CPRA gives you its own rights, which are set out in section 5. Where the two differ, we apply whichever gives you more.

1. Data controller

• Identity: GRE2JAZZ S.L.
• Company no.: B10785392
• Registered address: Calle Portalón, 7, 05690 Los Llanos de Tormes (Ávila), España
• Email: info@clubgre2jazz.com

We have not appointed a Data Protection Officer (DPO) for now, as it is not required given the volume and type of data we process. For any privacy query, please write to the email address above.

2. What data do we collect and why?

2.1 If you subscribe to the newsletter

• Data: email address; signup source; consent version and timestamps; IP address; browser/device user-agent string; and the technical status, stage and time of the confirmation-email hand-off.
• Purpose: to send you the weekly jazz newsletter for this edition (every Thursday) with the listings and selected editorial articles. The source and limited technical metadata document the request, help prevent abuse and support security or delivery investigations; they are not used to personalise advertising.
• Legal basis: your explicit consent (art. 6(1)(a) GDPR). Double opt-in: you request the subscription and then confirm by clicking the verification email. Consent is the basis for newsletters; our legitimate interests in service security, fraud/abuse prevention and consent evidence cover the limited source, IP and user-agent metadata.
• Retention: pending, unconfirmed requests are removed after 30 days. Active details remain until you unsubscribe; subscriber details — including source, consent evidence, IP, user-agent and confirmation-delivery state — and pseudonymous campaign/delivery mappings are then removed within 180 days once no unresolved delivery references them. Opaque unsubscribe credentials expire after two years and used credentials are removed within 180 days. Confirmation and unsubscribe links contain no email address: their opaque fragments are removed from browser history before analytics can load. Every email includes an unsubscribe link.

2.2 If you send us a musician profile or a correction

• Data: whatever you choose to put in your email — typically the artist or band name, town or city, official website, links to your music and upcoming dates — plus the address you write from.
• Purpose: to add the artist to the public directory, or to correct or remove an existing profile.
• Legal basis: your consent (art. 6(1)(a)), given by sending us the message, together with our legitimate interest in keeping the listings accurate.
• Retention: the correspondence is kept for 24 months from the last exchange, or until you ask us to delete it. A published profile stays until you ask us to take it down; we do that within 7 days.

We do not run a booking service here: we do not ask for your fee, we do not broker engagements and we do not charge you any commission.

2.3 If you make an enquiry as a client / promoter

• Data: name, email, phone number, city, type of event, approximate date, indicative budget, any information you provide voluntarily.
• Purpose: to reply with a proposal of available musicians and, if we proceed, to manage the booking.
• Legal basis: pre-contractual steps taken at the request of the data subject (art. 6(1)(b)). If we go on to sign a contract, the basis becomes performance of a contract.
• Retention: 12 months from the last interaction if we do not reach a contract (so that we can pick the conversation back up if you return). If we reach a contract, the event data is kept for the mandatory tax periods (6 years for invoicing).

2.4 If you email us (the "Enquiry" CTA)

We process the data you send us in order to reply to your enquiry. Legal basis: the implied consent of anyone who sends an email asking for a reply. Retention: 24 months after the last interaction or until you request deletion.

2.5 Automatic technical data (analytics)

If you accepted analytics cookies, Google Analytics 4 collects: anonymised IP, page views, duration, device, browser, city-level location. It is not cross-referenced with any personal identity. More detail in the Cookie Policy.

2.6 If you create a Jazz Live US account

• Data: email address, encrypted password, optional display name, saved shows, followed musicians and venues, and any reminder preferences you choose.
• Purpose: to authenticate you and provide the account features you request, including your personal saved and followed lists.
• Legal basis: performance of the account service you requested (art. 6(1)(b) GDPR). Newsletter consent is separate and is never implied by creating an account.
• Retention: while the account remains active and until you request deletion. Security logs and backups are retained only for the limited period needed to protect and restore the service.

2.7 If you enable personalised event alerts

• Data: your account email, the musicians, venues or cities you follow, saved shows and your chosen frequency.
• Purpose: to send only the gig alerts and reminders that you expressly enable in your account.
• Legal basis: your consent (art. 6(1)(a) GDPR), separate from the newsletter and off by default. We keep an append-only audit record of the version, source, date and state of every change.
• Retention and withdrawal: the current preference is retained while the account exists. Inactive mappings are removed after 30 days, completed pseudonymous delivery metadata after 180 days, and superseded consent-history entries after three years. Orphaned account preferences/history are purged after 30 days. An uncertain delivery is retained until manual review to prevent duplicates. You may turn alerts off or use an email unsubscribe link at any time; withdrawal does not affect the lawfulness of earlier messages.

3. Who do we share your data with?

Your data is NEVER sold to third parties. We work with data processors bound by GDPR contracts:

• Hostinger International Ltd. (EU, Lithuania) — site and email hosting.
• Google Ireland Ltd. (EU) — Analytics, Search Console and technical services. If you accepted analytics.
• Stay22 Inc. (Canada) — accommodation affiliate. Only if you open the Stay22 accommodation map on a gig or venue page (by accepting marketing or clicking to load it), Stay22 processes your interaction with its embedded map under its own privacy policy.
• Anthropic PBC (USA) — solely for internal editorial content generation (reviews, profiles, guides). It does NOT process personal data of site users.
• Hostinger's managed MySQL service (EU) — authentication and storage of account preferences. Passwords are stored as one-way hashes, never in plain text.

Not processors, but they still see you. Some pages pull photographs, album artwork, a player or a map straight from Deezer, Apple Music, Wikimedia Commons, TheAudioDB, YouTube, Spotify and CARTO / OpenStreetMap. They do not act on our instructions, so they are not our processors: your browser simply contacts them, and they see your IP address and the page you are on. This happens whatever you choose in the cookie banner, because it is how the page is put together. The Cookie Policy lists each one and links its policy.

If in the future we sign a booking contract for an event, we will share the essential data (name, artistic and financial terms) between the musician and the contracting client in order to perform the contract. Never with third parties outside the transaction.

4. International transfers

Your data is held in the European Union. Some processors (Google, Anthropic and Stay22) may process it outside the EU, including in the United States: under the GDPR that is an international transfer, and those transfers are covered by the EU-U.S. Data Privacy Framework or by the standard contractual clauses approved by the European Commission. Stay22 is Canadian, covered by the European Commission's adequacy decision for Canada.

The direction is worth stating plainly, because it is the opposite of what you might assume from a US site: your data does not sit in the United States and get sent to Europe. It sits in Europe.

5. Your rights (access, rectification, erasure, portability & restriction)

The GDPR grants you the following rights:

• Access: to know what data we hold about you.
• Rectification: to correct inaccurate data.
• Erasure / right to be forgotten: to ask us to delete your data.
• Objection: to ask us to stop processing your data for a specific purpose.
• Restriction of processing: to ask us to keep but not process your data temporarily.
• Portability: to receive your data in a structured format (JSON/CSV) to take it to another service.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.

To exercise any of these rights:

1. Send an email to info@clubgre2jazz.com stating which right you are exercising and attaching a copy of your ID or equivalent document (identity verification).
2. We will respond within a maximum of 30 calendar days (extendable to 60 if the request is complex, in which case we would let you know).

If you believe we have not handled your request properly, write to us first — it is usually the fastest way to fix it. If that does not settle it, you have two routes, depending on where you are:

• Under the GDPR, our supervisory authority is the Spanish data protection agency, because that is where the controller is established: Agencia Española de Protección de Datos (AEPD), aepd.es— C/ Jorge Juan 6, 28001 Madrid, Spain.
• If you are a California resident, you may also contact the California Privacy Protection Agency(cppa.ca.gov) or the California Attorney General (oag.ca.gov/privacy).

What California adds. You may ask what categories of personal information we collect and why, ask us to delete it, and ask us to correct it. We do not sell personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of on that front — and we will never treat you worse for exercising any of this.

6. How do we protect your data?

We apply proportionate technical and organisational measures: TLS encryption across the whole site, strong passwords on internal systems, encrypted backups, role-based access control, minimal staff with visibility. Continuous auditing of our data processors.

If a security breach were to occur that could affect your data, we would notify the AEPD within 72 hours and notify you if the breach involves a high risk, in accordance with articles 33-34 of the GDPR. Where a breach reaches California residents we would also follow California's own notification rules.

7. Children

This site is not directed at children under 14. If we discover that we have collected a child's data by mistake, we will delete it.

8. Changes to this policy

If we substantially change this policy we will notify you by email (if you gave us one) or via a banner. The "Last updated" date always reflects the current version.

9. Contact

For any query: info@clubgre2jazz.com.