Beatnickel Privacy Policy

Version 2.2 • Effective from 1 November 2026

This privacy policy explains how Beatnickel processes personal data, who can see it and how you can exercise your rights.

1 Who is responsible

Beatnickel is operated by Beatnickel ApS, Hirsevej 11, 4040 Jyllinge, Denmark, company registration number CVR 35414169. The company is the controller for the processing described here. Contact us about personal data and your rights at support@beatnickel.com. General support: support@beatnickel.com. Data protection officer: Oli Olsen, contact support@beatnickel.com.

This policy applies to Beatnickel’s website and the apps and features we provide. It also applies when we process information about a person in a profile or event created from an external source, even if that person does not have a Beatnickel account.

2 What information we process

Account information: email address, account ID, selected roles, account settings, login and session information and information about acceptance of the terms. We use one time codes for login where this feature is available.

Profile information: name, artist name, biography, city or area, instruments, genres, experience, contact details, images, media, links and relationships with bands, artists and Places, to the extent entered or lawfully obtained.

Activity: selected search filters, Follow and Interested actions, Events and Opportunities created, applications, messages, notifications and relevant administrative actions. We also process personal data that you or others lawfully include in content.

Claim and administration: requests for access to profiles, information about authority to represent others, correspondence and documentation for identity checks. We only request documentation necessary for the specific check. Do not include a CPR number or other unnecessary information; remove it from documentation before sending it.

Technical information: IP address, timestamps, device and browser information, app version and error and security logs, to the extent necessary for operation and security. Cookies and similar technologies are described in our cookie policy.

Location: we use the city or area you select yourself for local searches. We do not collect your phone’s precise location.

Beatnickel is not intended to collect sensitive information such as health, religion or political matters. Do not upload such information about yourself or others. If we receive it unintentionally, we assess whether it should be removed and whether there is a separate lawful basis for any necessary processing.

3 Where the information comes from

We receive information from you, from your use of the platform, from people authorised to administer relevant profiles and from other users who contact you or refer to you in legitimate content.

We obtain factual information about venues and events by crawling venues’ public websites. This is our only category of external sources at launch. The information may include the venue, artist or band, event name, date, time and location. We record the source and only use information for which we have a lawful basis and the necessary rights of use. Links to official YouTube videos and Spotify content may be used for embedding. We do not copy music files or videos from these services.

A curated profile is not an account created in the name of the person described. It does not establish that the person has accepted the terms or approved the information. If we obtain personal data about you from others, we provide the legally required information within the applicable time limits, normally no later than one month after obtaining it and earlier at the first contact or disclosure. Any exemption is applied only following a specific, documented assessment.

4 Purposes and lawful bases

Account, login and features you request: Article 6(1)(b) GDPR, where processing is necessary to provide our agreed service to you. Mandatory information is indicated when collected. Without it, the relevant feature cannot be provided. Optional profile fields may be left blank.

Messages, applications and actions you initiate: Article 6(1)(b), to the extent processing is necessary for the requested service. Processing information about people who are not parties to the contract requires an independent basis and is assessed separately.

Curation of public music information and profiles not created by users: Article 6(1)(f), following a specific balancing of interests. Our interest is to make relevant, accurate and current information about musical life available. We weigh this against your reasonable expectations, the nature of the information and the consequences for you. This is not a general basis for publishing private information.

Claim verification, dispute handling, security, prevention of abuse and necessary troubleshooting: Article 6(1)(f). Our interest is to protect users, rights holders and the service against unauthorised access and abuse. Processing required by law is based on Article 6(1)(c), where a specific legal obligation applies.

Support and handling legal claims: Article 6(1)(b) or (f), depending on the enquiry. Our legitimate interest is to answer questions, resolve disputes and establish, exercise or defend legal claims.

Newsletters and electronic marketing: Article 6(1)(a), where we rely on your separate consent. We also obtain the consent required by marketing rules. Unsubscribing is free and easy. Accepting the terms of use does not constitute consent to marketing.

At launch, we do not use personalised recommendations. Optional statistics using Google Analytics 4 are processed only after consent as described in section 9. Necessary operational and security logging is processed as described in this policy. If new analytics features are introduced, we update the information and obtain consent where required.

5 Public and restricted visibility

Public Artist, Place and Event pages and published parts of personal industry profiles can be viewed without login and may be indexed by search engines. Profile visibility and contact fields are indicated when published. Deletion from Beatnickel does not result in immediate deletion of search engine caches or copies others have lawfully saved.

Your login email address does not become public merely because you create an account. All logged in users with an account can see who follows a profile, has marked Interested for an event and is a member of a band. Consider this visibility when using these features.

Access to Opportunities and application and messaging features requires login and an account, as well as the relevant permissions. An application to a band can only be read by the band’s administrator. Being logged in or a member of the band does not in itself grant access to read the application.

Messages can only be read by participants in the conversation and relevant Beatnickel staff with administrator permissions. Staff access may only be used for legitimate, necessary tasks such as support, handling reports, security and compliance with legal obligations. Recipients may save or forward messages they have access to.

6 Who receives information

We use Hetzner Online GmbH for hosting, databases and the operation of login, emails and push notifications on our infrastructure. Servers and backups are hosted by Hetzner in Germany. Backups are stored on separate servers. We have entered into a data processing agreement with Hetzner. Cookiebot CMP from Usercentrics A/S is used for cookie information and consent management. Google Analytics 4 is used for optional statistics after consent, and Google Tag Manager is used as technical infrastructure to manage approved analytics tags. These services may receive information when activated. At launch, we do not use other separate providers for login, emails or push notifications. Embedded YouTube and Spotify content is described separately below.

Other users and profile administrators only receive information within the access rules described above. We may disclose necessary information to advisers or authorities where there is a lawful basis. A sale or restructuring of the company may involve necessary transfers with appropriate safeguards and information to affected people.

We embed official YouTube videos and Spotify content on Beatnickel. When content is activated, the provider may receive your IP address and information about your browser, device and playback, among other things, and use cookies or similar technologies. Content requiring consent is activated only after your choice through Cookiebot. The provider’s own privacy policy applies to its processing. Ordinary external links are visited on the external service’s terms.

7 Transfers outside the EU and EEA

Our own hosting and backups take place in Germany. Use of Cookiebot, Google Analytics, Google Tag Manager and embedded YouTube and Spotify content may involve processing by providers or their subcontractors outside the EU and EEA. Where Beatnickel is responsible for such a transfer, we use a lawful transfer mechanism, for example an adequacy decision or EU standard contractual clauses with necessary supplementary measures. Contact support@beatnickel.com for information about specific recipients, countries and relevant safeguards.

8 How long we retain information

We only retain information for as long as necessary for the specific purpose. The following are the usual maximum periods from launch. We delete it earlier when it is no longer necessary or when a valid request requires this. The exceptions below only apply following a specific assessment:

• Account data and profile content created by users: while the account is active; ordinary deletion is completed within 30 days of a valid request, subject to the lawful exceptions below.

• Messages: deleted no later than 12 months after the most recent message in the conversation. Applications: deleted no later than 6 months after a decision, withdrawal or closure of the relevant Opportunity. Pending applications are reviewed at least every 6 months and closed and deleted when their purpose ends. When an account is deleted, your information is deleted or genuinely anonymised within 30 days, unless a specific legal obligation or documented legal claim requires limited continued retention. Removing your name alone is not anonymisation.

• Claim documentation: raw documents are deleted within 90 days of a final decision. The current access relationship and the minimum necessary information about its approval are retained while the relationship remains in effect and deleted no later than 24 months after it ends. The minimal decision history of rejected or withdrawn requests is deleted no later than 24 months after completion.

• Security logs: 90 days, with separate, limited retention for specific incidents.

• Support, reports and complaints: 24 months after completion, with the possibility of necessary longer retention for a specific legal claim.

• Curated personal data is reviewed at least every 6 months and updated or deleted when no longer relevant and necessary. Historical copies of personal data and source histories that can be linked to individuals are deleted no later than 12 months after recording or replacement by a new version. Necessary current source references may be retained with the current information. Basic information that cannot be linked to individuals may be retained for as long as it remains relevant.

• Marketing consents: while used, followed by minimal documentation for no more than 24 months after withdrawal or the most recent use, where necessary to demonstrate lawfulness. Cookiebot consent records are normally retained for 12 months after recording, in accordance with the provider’s stated default. A minimal opt out list may be retained for as long as necessary to respect the opt out; the need is reviewed at least annually.

• Backups: expire after no more than 90 days. They are only used for recovery; relevant deletion requests are reapplied on recovery.

Information may be retained longer if a specific legal obligation or documented legal claim makes this necessary. In that case, processing is restricted and the information is deleted when the basis ceases to apply. Deleting an account does not necessarily remove an independent public Place or Artist profile; any personal data in that profile is assessed separately under your rights.

9 Cookies and similar technologies

We use Cookiebot CMP to provide information about cookies and manage consent. Necessary technologies are used for login, session management, security and recording your cookie choices. Other technologies are activated only after the required consent. You can refuse, change or withdraw consent through Cookie settings at https://beatnickel.com/cookies.

If you give consent to the Statistics category through Cookiebot, Beatnickel uses Google Analytics 4 for optional statistics about use of the service. The purpose is to understand how Beatnickel is used, measure use of pages and features and improve the user experience. Depending on the approved configuration, processing may include page views, navigation and interactions, timestamps and browser and device information. Google Tag Manager is used as technical infrastructure to manage approved analytics tags; it is not a separate marketing purpose. Beatnickel does not currently use Google Ads or personalised advertising. Advertising consent remains denied in the current analytics setup.

The legal basis for optional statistics is consent under Article 6(1)(a) GDPR, together with the applicable rules on storing or accessing information on your device. If you do not consent to Statistics, Beatnickel does not activate Google Analytics through the approved consent setup. Google Analytics is not required to use Beatnickel’s ordinary features. You can reject optional technologies and later change or withdraw consent through Cookie settings at https://beatnickel.com/cookies. Withdrawal does not affect the lawfulness of processing already carried out on valid consent. Accepting the terms of use does not constitute cookie consent.

The cookie policy and Cookiebot’s ongoing cookie declaration at https://beatnickel.com/cookies describe specific names, providers, purposes and lifetimes. The declaration covers the cookies and technologies detected on the website. Any technologies used in apps are described separately when used.

10 Recommendations and automated decisions

Search and filtering use the criteria you select yourself, for example date, city and genre. Personalised recommendations are not enabled at launch.

We use both automated tools and manual assessment for moderation and handling content. Complaints are handled by a staff member. See the terms of use for information about moderation and complaint options.

11 Your rights

Subject to the conditions in the GDPR, you have rights of access, rectification, erasure, restriction, objection and data portability. You may object at any time to processing for direct marketing. For processing based on legitimate interests, you may object on grounds relating to your particular situation.

You may withdraw consent without affecting the lawfulness of previous processing. These rights also apply to personal data in imported profiles, even if you do not have an account. You do not need to take over a profile or create an account to request rectification or erasure.

Contact Beatnickel support at support@beatnickel.com about your rights or account deletion. We normally respond no later than one month after receipt. If the law permits an extension because of complexity or the number of requests, we inform you within the first month and explain why. We may request proportionate proof of identity where necessary.

You may complain to the Danish Data Protection Agency, www.datatilsynet.dk, or the relevant supervisory authority in the country where you live, work or believe an infringement has occurred. You do not need to contact us first.

12 Young users and security

Accounts are intended for people aged 15 or over. During account creation, we compare the date of birth entered with the age limit to determine whether the account can be created. The date of birth is processed only for this check and is not stored. The basis is our legitimate interest in enforcing the age limit and protecting young users, under Article 6(1)(f). People under 15 cannot create an account. Contact us if you believe an account has been created contrary to the age requirement. Information about minors in public music content is assessed with particular regard to their protection.

We use appropriate technical and organisational security measures, including access restrictions and handling security incidents. No digital service is entirely free of risk. In the event of a breach, we make the reports and notifications required by law.

13 Changes

The current privacy policy is available at https://beatnickel.com/privacy. We update it when our processing changes. Material changes are communicated clearly. If new processing requires consent, we obtain it separately; continued use does not in itself constitute such consent.