Privacy Statement

1. Who is responsible?

bosDAT operates gigBuddy and is the controller for personal data used to operate user accounts, subscriptions, the gigBuddy platform and its websites.

2. Personal data we process

Depending on how you use gigBuddy, we process:

• Account data: name, email address, profile picture, language, sign-in provider identifier, login and terms-acceptance details.
• Workspace content: member and contact details, availability, planning, files, photos, messages, invoices, expenses and other information entered by users.
• Subscription data: plan, billing status, payment references and transaction history. Mollie processes the payment details needed to complete payments.
• Technical data: session identifiers, IP address, request and security logs, browser information, local preferences and push-notification subscription details.
• Support data: messages and information you provide when asking for help or exercising a legal right.

We receive data from you, other members of your workspaces, Google or Microsoft when you sign in, Mollie when you pay, and services you choose to connect.

3. Why we use data

• Performing our contract: creating accounts, providing workspaces and features, processing subscriptions, sending service messages and providing support.
• Legitimate interests: securing and maintaining the Service, preventing abuse, troubleshooting, keeping operational records and improving reliability.
• Legal obligations: keeping required financial records and responding to lawful requests.
• Consent: optional push notifications and any processing for which the law requires consent. You may withdraw consent at any time.

We do not sell personal data. We do not use workspace content for advertising or to train AI models, and we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

4. Data entered in workspaces

For personal data that a band or business enters about members, contacts, customers or other people, that workspace owner normally determines why and how the data is used and is the controller. bosDAT processes that data to provide gigBuddy on the workspace owner’s behalf.

Workspace owners must have a lawful basis for this data, inform the people concerned where required and manage member access. Privacy requests about workspace content should normally be addressed to the relevant workspace owner. A data processing agreement should be concluded where required.

Information deliberately published through a public profile, share link or calendar feed can be viewed and copied by anyone with access to it.

5. Who receives personal data?

We share data only where needed to provide the Service, follow your instructions or comply with law.

• Bluehost: VPS hosting for the application, database and operational logs.
• Backblaze B2: S3-compatible storage for uploaded files and images.
• Resend: delivery of transactional and user-initiated email.
• Google or Microsoft: account authentication when you choose that provider; Google also serves web fonts on the public website.
• Mollie: subscription and optional invoice-payment processing.

If you activate an optional integration, the necessary data is also shared with the selected provider—for example Shopify, Bandsintown, TomTom/OpenStreetMap or a connected link-page service—under that provider’s terms and privacy notice.

We may disclose data to authorities or professional advisers when required by law or necessary to establish, exercise or defend legal claims.

6. International transfers

Some providers are established in the United States or may process data outside the European Economic Area. Where required, we use data-processing agreements and a valid transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses.

7. How long we keep data

• Account and workspace data is kept while the account or workspace is active. Permanently deleting a workspace deletes its content from the live Service.
• Sessions expire after no more than seven days.
• In-app notifications are normally removed after 90 days; completed platform-email queue records are normally removed after 30 days.
• Billing, tax, security and dispute records are kept for the applicable statutory period or as long as reasonably necessary for the relevant purpose.

When you request account deletion, we delete or anonymise personal data unless we must retain it by law or need it for a legal claim. Workspace owners remain responsible for exporting records they are legally required to keep before deleting a workspace.

8. Cookies and browser storage

The app uses a strictly necessary, HTTP-only session cookie to keep you signed in and protect your session. It expires after no more than seven days. Local or session storage is used for functional preferences such as language, theme, recent searches and interface settings.

gigBuddy does not currently use advertising or third-party analytics cookies. If this changes, we will update this statement and ask for consent where required.

9. Security

We use appropriate technical and organisational measures designed to protect personal data, including encrypted connections, access controls, workspace separation, secure session cookies, encrypted integration credentials, backups and security logging. No online service can eliminate every risk.

10. Your privacy rights

Depending on the circumstances, you may request access, correction, deletion, restriction, data portability or object to processing. Where processing is based on consent, you may withdraw it at any time. These rights are not absolute and legal exceptions may apply.

Send a request to support@gig-buddy.nl. We may ask for information needed to verify your identity. We will respond within the period required by the GDPR, normally one month. The best-effort support provisions in our Terms do not limit this statutory deadline.

You may also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

11. Changes and contact

We may update this statement when the Service or legal requirements change. We will announce material changes through the Service or by email where appropriate. The date above shows the latest version.

Questions or privacy requests can be sent to support@gig-buddy.nl.