Privacy Policy

Bandhamster is run by Simon Richardson, a sole trader based in the United Kingdom and the data controller for the personal data described here.

For anything to do with your data or this policy, email privacy@bandhamster.com.

• Account details. Your name, email address and a password. Passwords are handled and stored by our authentication provider, not in plain text by us.
• Band content. Everything you add to your site: band name, biography, line-up, gigs, setlist, press quotes, merch and news posts.
• Uploaded media. Images and audio recordings you upload. A recording can feature identifiable people (your bandmates, session players, an audience on a live recording), so it counts as personal data. See the section below.
• Booking enquiries. When someone contacts your band through your site, we process the name, email, phone number, event details and message they send.
• Technical data. Basic server information such as IP address, needed to run the service securely and to prevent abuse and spam.

An audio recording of identifiable performers is their personal data, not just yours. We rely on you, the uploader, to have the right to upload it.

If you are featured in a recording on the platform and object to it, even if you are not a Bandhamster user, you can ask us to remove it or to remove your details. Email privacy@bandhamster.com and we will deal with it.

• To provide the service (contract). Building and hosting your site, storing your content, and passing booking enquiries to you are all part of delivering what you signed up for.
• To run and protect the platform (legitimate interests). Keeping the service secure, preventing spam and abuse, fixing problems, and sending you the notifications that make the booking loop work. We balance this against your rights.
• To take payment (contract). Billing for the subscription plan you choose.

We only use strictly necessary cookies: the one that keeps you signed in, and the ones our security checks need (the human / bot check and request protection). These are required for the service to work, so they do not need a consent banner.

We do not use advertising or tracking cookies. If we ever add analytics, we will use a privacy-friendly, cookie-free option, or ask for your consent first.

Note that embedded media a band adds to their site (YouTube, Vimeo, Spotify) can set the provider's own cookies and receive a visitor's IP address when that media is played. That happens under the provider's own privacy policy.

We do not sell your data. We share it only with the service providers we need to run the platform (database, storage, hosting, email and payments). They process it on our instructions under a data processing agreement. The full list, with where each one processes data, is on our sub-processor list.

A booking enquiry is, of course, shared with the band it was sent to. That is the point of the form.

We store personal data in the UK or the EEA: our database and uploaded files are pinned to EU regions. The UK treats the EEA as offering adequate protection, so this is fine for UK data.

Some of our providers are US-owned. Where data reaches a US company, the transfer is covered by the safeguards in that provider's data processing agreement (Standard Contractual Clauses or the UK International Data Transfer Addendum). These are noted on the sub-processor list.

• Account and band content: for as long as your account is open. When you close your account or ask us to delete your data, we remove it from our database and delete your uploaded files from storage.
• Booking enquiries: kept while they are useful to you for managing the booking, then removed on request or when the account is closed.
• Backups: our database keeps short-term, point-in-time backups that roll over on a set cycle. Deleted data ages out of those backups on that cycle. We never restore a backup to bring back data you have asked us to delete.

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you (access);
• correct anything that is wrong (rectification);
• delete your data (erasure);
• restrict or object to how we use it;
• provide your data in a portable format.

To exercise any of these, email privacy@bandhamster.com. We will respond within one month. There is no charge for a reasonable request.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.

We may update this policy as the platform grows. When we make a meaningful change we will update the date at the top, and let you know where the change is significant.