Privacy Policy

4.1 Server Log Files

Each time you access our website, the following data is automatically collected by the web server:

• IP address of the requesting device
• Date and time of access
• Name and URL of the requested page
• Amount of data transferred
• Browser type and version
• Operating system
• Referrer URL (previously visited page)

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring smooth operation and security). Data is deleted after 30 days.

4.2 Registration and User Account

When you create a user account, we collect:

• Name
• Email address
• Password (stored encrypted)
• Phone number (optional, for notifications)
• Profile picture (optional)
• Notification preferences

Legal basis: Art. 6(1)(b) GDPR. Data is stored for the duration of the contractual relationship and thereafter in accordance with statutory retention periods.

4.3 Identity Verification (KYC)

To enable payouts of earnings, identity verification is required. We collect:

• First and last name
• Date of birth
• Country and postal address
• Business details (company name, registration number, VAT number) for business accounts

Legal basis: Art. 6(1)(b) and (c) GDPR (contract performance and legal obligations, in particular tax reporting requirements). We keep your name and address as long as the billing records they appear on. Your date of birth is deleted with your account.

4.4 ID Document Check with Didit

In individual cases we ask you to confirm your identity with an ID document, for example to make sure payouts and releases go to the right person or to clear up suspected misuse. While a requested check is open, you can't submit releases or request payouts.

The check is run by Didit. Didit takes photos of your ID document and, depending on the check, a selfie it uses to confirm that a real person is in front of the camera and that they match the ID photo. We don't store these images. How and where Didit processes and stores them is described in Didit's Verification Privacy Notice.

From Didit we receive and store the result of the check and these details from your ID:

• First and last name
• Date of birth
• Nationality
• Document type and number
• Issuing country and expiry date
• Address, if shown on the document

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in fraud prevention and platform security). Where Didit biometrically matches your selfie against the ID photo, the legal basis is the explicit consent you give during the check (Art. 9(2)(a) GDPR). Data is stored for the duration of the contractual relationship. After you delete your account, we keep the check for three years from the end of that year, or until a pending legal dispute ends. During that time we use it only to establish or defend legal claims, such as fraud or disputes over rights and payouts (Art. 17(3)(e), Art. 9(2)(f) GDPR). Didit deletes the images and biometric data shortly after the check.

4.5 Music Distribution

In the context of music distribution, we process:

• Artist name and release metadata
• Audio files and cover artwork
• ISRC and UPC codes
• Revenue and streaming data
• Payout information (e.g. PayPal email)

As part of distribution, your release data is transmitted to the music platforms you select (e.g. Spotify, Apple Music, YouTube Music, Amazon Music, Deezer). These stores process the data as independent controllers. We recommend reading their respective privacy policies.

Legal basis: Art. 6(1)(b) GDPR.

4.6 Cancellations, Withdrawals and Reports

"Cancel contracts here", "Withdraw from contract" and "Report content" lead to our forms, which also work without logging in. We process:

• for cancellations and withdrawals: name, email address, the contracts concerned and your other details, such as artist name, reason for cancelling or the date the contract was concluded, and the email address for the confirmation
• for reports: where the content is, your explanation, the category and, if you provide them, your name, email address and on whose behalf you report
• date and time of receipt

We confirm receipt by email, match cancellations and withdrawals to your account and carry them out. If a cancellation or withdrawal names a bbn.music account, we also inform that account's email address and name the confirmation address given in the form, so the account holder can stop a cancellation that isn't from them. We decide on reports and tell you our decision if you gave an email address. The person whose content is concerned learns your name only where strictly necessary (Art. 17(3)(b) DSA); we don't pass on your email address to them.

Legal basis: Art. 6(1)(c) GDPR in conjunction with Sections 312k and 356a German Civil Code and Art. 16 and 17 DSA; for informing the account named, Art. 6(1)(f) GDPR (legitimate interest in protecting accounts from cancellations and withdrawals by unauthorised persons); otherwise Art. 6(1)(b) GDPR. Retention: see section 11.

5.1 Technically Necessary Storage

The following data is stored without consent as it is strictly necessary for operation (Section 25(2) TDDDG):

5.2 Analytics Cookies (Consent Required)

The following cookies are only set with your express consent via our cookie banner (Section 25(1) TDDDG, Art. 6(1)(a) GDPR):

You can withdraw your consent at any time via "Cookie Settings" in the footer. Withdrawal does not affect the lawfulness of prior processing.

6.1 Description and Scope

We use PostHog, a web analytics service of PostHog Inc. We load it through our own address (hedgehog.bbn.music); PostHog stores the data on servers in the EU.

With your consent, PostHog processes: pseudonymous user ID, page views and click behavior, browser type, OS, screen resolution, referrer URL, IP address (for geolocation), and performance metrics.

PostHog Inc. is based in the USA. PostHog and its sub-processors may also process the data in the USA and in other countries outside the EU. These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Art. 45 GDPR), under which PostHog is certified. We have also agreed the European Commission's Standard Contractual Clauses with PostHog (Art. 46(2)(c) GDPR).

We don't analyse pages we provide for our customers' contract partners, such as offers, contracts and invoices behind a personal link, or pages with a one-time access code in their address. We remove access codes from all addresses before any data goes to PostHog.

6.2 Session Recording

With your consent, we record mouse movements, scroll behavior, click events, and DOM snapshots.

6.3 Identification of Logged-in Users

If you are logged in and have consented, we link your analytics data with your user ID, username and administrator status. We don't pass on your email address for this. Without consent, no identification takes place.

6.4 Legal Basis and Withdrawal

Legal basis: Section 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR. The PostHog SDK is only loaded after your consent. Withdraw at any time via "Cookie Settings" in the footer. If you withdraw your consent, we stop collecting new data.

6.5 Data Processing Agreement

We have concluded a data processing agreement (DPA) with PostHog Inc. in accordance with Art. 28 GDPR. PostHog processes data exclusively on our behalf and according to our instructions.