Privacy policy
Privacy policy for Gigga
Last updated: [date]
This policy describes how we collect, use and protect your personal data when you use Gigga – the website and service where musicians and organisers find each other and book gigs. We comply with the EU General Data Protection Regulation (GDPR) and supplementary Swedish legislation.
1. Data controller
The data controller is [Company name], company registration number [Organisationsnummer], [Postal address].
If you have any questions about how we process your personal data, please contact us at [Email address].
2. Personal data we process
- Account data: name, email address and password (stored only as an encrypted hash that cannot be read in plain text). Optional: phone number, home town and profile picture. In addition, the language you have chosen.
- Artist profile (musicians): artist name, category, genres, description, price indication, technical needs, places where you can play, links to music and video, and your calendar with blocked and booked dates.
- Organiser profile: name of the organisation or company and a description.
- Gigs and bookings: details of gigs (title, date, time, location, budget and description), requests, applications, offers, prices and the booking status.
- Messages: the content of chats between musicians and organisers and when a message has been read.
- Reviews: ratings and comments that you give or receive after a completed gig.
- Technical data: IP address, browser type and time of your visit in the web server's log files, and the cookies described in section 7.
The data comes from you, from other users (for example messages and reviews concerning you) and from your browser (technical data).
Payment within the service is not available yet. When it is introduced, we will update this policy with information about payment data and the payment provider.
3. Purposes and legal basis
| Why we process the data | Legal basis |
|---|---|
| Creating and managing your account and profile | Contract (Art. 6(1)(b) GDPR) |
| Showing artist profiles and gigs so that musicians and organisers can find each other | Contract (Art. 6(1)(b) GDPR) |
| Handling requests, applications, offers, bookings and messages | Contract (Art. 6(1)(b) GDPR) |
| Showing reviews and ratings to create trust between users | Legitimate interest (Art. 6(1)(f) GDPR) |
| Protecting the service against misuse, errors and unauthorised access, for example with log files | Legitimate interest (Art. 6(1)(f) GDPR) |
| Keeping data required by law, for example accounting records once payment is introduced | Legal obligation (Art. 6(1)(c) GDPR) |
| Showing embedded video and music from third parties (see section 5) | Consent (Art. 6(1)(a) GDPR) – you consent by clicking on the content |
Where we rely on legitimate interest, we have weighed our interest against your interest in privacy. You have the right to object to such processing (see section 9).
4. Who can see your data
- All visitors: If you publish your artist profile, everyone can see your artist name, profile picture, category, genres, description, price indication, technical needs, places, links to music and video, which days you are available or busy (but not why) and reviews. You decide whether your profile appears in search. Published gigs are shown to everyone together with the organiser's name or organisation.
- The other party of a booking: Musician and organiser see each other's name (or artist and organisation name), the details of the gig, the offer and their chat.
- Not to other users: Your email address and phone number are never shown to other users.
- Gigga: Authorised people at Gigga access data when needed for support, security and operations.
5. Processors and other recipients
- Web hosting: The website and the database are run by [Name and country of the web host], which processes the data on our behalf under a data processing agreement.
- Embedded video and music: Artist profiles may contain video or music from YouTube (Google), Vimeo, Spotify or SoundCloud. The content is only loaded when you click on it. Your IP address, among other data, is then sent to the provider, which may also set its own cookies. The provider is responsible for that processing. The data may be transferred to countries outside the EU/EEA, for example the USA. Such transfers are based on the European Commission's adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
- Authorities: We only disclose data to authorities when required by law.
We never sell your personal data.
6. How long we keep the data
- Account, profile, bookings, messages and reviews are kept as long as you have an account. If you ask us to delete your account, we delete the data within 30 days, unless we are legally required to keep it longer.
- Web server log files are kept for a maximum of [number] days.
- Once payment is introduced, accounting records are kept for seven years in accordance with the Swedish Bookkeeping Act (1999:1078).
7. Cookies
We only use cookies that are necessary for the service to work. Under the Swedish Electronic Communications Act (2022:482), no consent is required for such cookies.
| Name | Purpose | Storage period |
|---|---|---|
gigga | Keeps you logged in and protects forms against misuse | Until you close the browser |
gigga_lang | Remembers the language you have chosen (only set when you switch language) | 1 year |
We do not use cookies for statistics or marketing. Embedded third-party content is only loaded when you click on it (see section 5).
8. Security
We protect your data with technical and organisational measures. Among other things, we use an encrypted connection (HTTPS), passwords are only stored as a hash, and access to the database is limited to authorised people.
9. Your rights
Under the GDPR you have the right to
- receive information about and a copy of the personal data we process about you,
- have incorrect data corrected,
- have your data deleted,
- request that processing is restricted,
- receive data you have provided in a machine-readable format (data portability),
- object to processing based on legitimate interest,
- withdraw your consent at any time.
You can change most of your data yourself under Profile. For other questions, or if you want your account to be deleted, contact us at [Email address]. We will reply within one month.
10. Complaints
If you believe that we process your personal data incorrectly, you can lodge a complaint with the Swedish Authority for Privacy Protection (IMY), www.imy.se.
11. Changes
We may update this policy. The latest version is always available on this page. In case of significant changes, we will inform you in the service or by email.