Privacy Policy of BANDCOM
Last updated: 18 October 2026
1. Data Controller
The controller responsible for processing personal data on the BANDCOM platform is:
ESO Media
Owner: Thomas Tuchlinski
Blohmstr. 5
12307 Berlin
Germany
Email: info@bandcom.eu
Websites:
https://www.bandcom.eu
https://www.bandcom.de
BANDCOM – The Music Network is a service operated by ESO Media. It is a Europe-wide music networking platform for bands, artists, musicians, event organisers, booking agents, clubs and other music venues.
For questions concerning data protection or the exercise of data protection rights, data subjects may contact us using the email address provided above.
2. General Information on Data Processing
We process personal data only to the extent necessary to operate the platform, provide its functions, fulfil contractual and legal obligations, or pursue other lawful purposes.
In particular, processing is based on:
Article 6(1)(a) GDPR – Consent
Article 6(1)(b) GDPR – Performance of a contract and pre-contractual measures
Article 6(1)(c) GDPR – Compliance with legal obligations
Article 6(1)(f) GDPR – Legitimate interests
Where we rely on legitimate interests, we take into account the interests and fundamental rights of the individuals concerned.
3. Hosting and Technical Access Data
When BANDCOM is accessed, technically necessary data is processed. This may include IP addresses, access dates and times, browser types, operating systems, pages accessed, referrer information and technical error messages.
This processing serves to provide, maintain and secure the platform and to identify and prevent misuse.
The legal basis is Article 6(1)(f) GDPR.
Hosting: BANDCOM uses hosting services provided by lima-city.
The hosting provider's complete company details, the actual server location and the retention period for technical server logs must be confirmed and supplemented in accordance with the hosting agreement and actual technical settings.
4. Registration and Member Accounts
Registration is required to use certain platform functions.
The following data may be processed:
Username and display name
Email address
Password in a technically protected form
User role
Language preferences
Account status and necessary administrative information
This data is used to create, manage and secure member accounts.
The legal basis is Article 6(1)(b) GDPR.
5. Public Member Profiles
BANDCOM allows members to publish profiles for bands, artists, musicians, event organisers, booking agents and clubs.
Depending on the profile type, the following information may be publicly visible:
Profile name, band name or artist name
Profile pictures and logos
Descriptions and biographies
Music genres
Location information
Public performance dates
Website and social media links
Music and video content
Electronic press information and other submitted media
Publication serves to present members and facilitate networking within the music industry.
The legal basis is Article 6(1)(b) GDPR, insofar as the information is processed to provide the profile functions requested by the member.
Public content may be indexed by search engines. Members may publish only content and personal data for which they possess the necessary rights or authorisation.
6. Gig Marketplace, Applications and Gig Exchanges
BANDCOM provides functions for publishing and searching for performance opportunities, support slots, gig exchanges and last-minute offers.
The following information may be processed:
Details of the person or organisation publishing the offer
Gig descriptions
Venue and event date
Music genres
Payment arrangements
Available performance slots
Applications and their status
Related messages
Processing serves to facilitate and organise performance opportunities.
The legal basis is Article 6(1)(b) GDPR.
Public gig offers may be visible without registration. Application information and internal messages are accessible only to the respective authorised participants.
BANDCOM provides the technical platform and does not automatically become a contractual party to performance agreements concluded between members.
7. Venue Directory
BANDCOM maintains a Europe-wide directory of clubs, concert venues and other event locations.
Venue entries may be created by operators, registered members or on the basis of publicly available information.
The information used may include:
Name of the venue
Public business address
City, region and country
Geographical coordinates
Website
Type of venue
Music genres and event-related information
Data sources may include information supplied by BANDCOM members and publicly accessible structured directories such as Wikidata.
The inclusion of a venue does not mean that its operator is a BANDCOM member or has agreed to a business relationship with BANDCOM.
Where personal data is involved, Article 6(1)(f) GDPR may serve as the legal basis, provided that the necessary balancing of interests supports the specific processing activity.
Our legitimate interest is to provide a factual venue directory for the European music and events industry.
When personal data is obtained from third-party sources, we take into account the information obligations under Article 14 GDPR.
Venue operators and affected individuals may request correction or removal of an entry and exercise their statutory data protection rights by contacting info@bandcom.eu.
Where necessary and legally permissible, minimal suppression records may be retained to prevent the automatic re-import of entries that have been lawfully removed.
8. Tour Planning and Map Functions
BANDCOM allows users to search for venues and plan tour routes.
For this purpose, user-entered search locations, destinations, distances and necessary location information are processed.
The legal basis is Article 6(1)(b) GDPR.
Where external mapping or geocoding services are used, technically necessary data may be transmitted to their providers.
The mapping services actually used, their providers and any required consent mechanisms will be identified in accordance with their technical integration.
9. Internal Messaging System
Registered members can communicate with one another through BANDCOM.
In particular, we process senders, recipients, message content, timestamps, conversation references and necessary status information.
The legal basis is Article 6(1)(b) GDPR.
Messages are generally intended only for the participating members. Administrative access takes place exclusively where necessary for lawful operational, security-related or legal purposes.
Automatic deletion of private conversations 90 days after the last message is planned. Booking-related conversations may be retained for longer where necessary.
The actual retention periods depend on the deletion procedures implemented in the system.
10. Email Notifications
BANDCOM sends function-related emails, for example concerning registration, account security, messages, gig applications and contractual matters.
The legal basis is generally Article 6(1)(b) GDPR or Article 6(1)(f) GDPR for security-related communications.
Marketing emails are sent only where a lawful basis exists.
11. Cookies and Technically Necessary Storage
BANDCOM uses technically necessary cookies and comparable technologies where required for login, session management, security and platform functions expressly requested by users.
The exemption under Section 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG) may apply to strictly necessary technologies.
The processing of personal data is based on the applicable provisions of the GDPR.
For non-essential cookies, tracking technologies and third-party content requiring consent, we obtain the necessary consent before their use.
Consent may be withdrawn at any time with effect for the future.
The cookies actually used, their purposes and their retention periods depend on the platform's technical configuration.
12. External Links and Social Networks
BANDCOM allows members to add links to external websites and platforms.
These may include:
YouTube
Spotify
Apple Music
Artist websites and other external services
In the case of ordinary external links, BANDCOM itself does not establish a direct connection to the linked provider as long as the visitor does not follow the link and no additional external resources are embedded.
When an external link is clicked, the visitor may leave BANDCOM. The respective third-party provider may then process personal data in accordance with its own privacy policy.
Such data may include IP addresses, browser information and other information collected by the third-party provider.
The respective provider is generally responsible for its independent processing of personal data on the external website.
13. Embedded Content from YouTube and Spotify
BANDCOM allows music and video content from external providers to be displayed.
13.1 YouTube
YouTube is a video service operated by Google.
The provider includes Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.
When a YouTube video is directly embedded, technical data may be transmitted to Google or YouTube as soon as the player loads.
This may include IP addresses, browser and device information, and information about the page accessed.
Depending on the technical integration, the visitor's settings and Google's processing activities, cookies or comparable technologies may be used.
Even when a more privacy-friendly embedding method is used, data transmission when the video actually loads cannot be ruled out entirely.
Where consent is required, the video will be loaded only after the visitor has given the necessary consent.
Further information:
https://policies.google.com/privacy
13.2 Spotify
Spotify is a music and streaming service.
The provider is Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden.
BANDCOM may integrate Spotify players into band and artist profiles.
When a Spotify player is directly embedded, data may be transmitted to Spotify as soon as the player loads.
This may include IP addresses, browser and device information, and information concerning the use of the player.
Spotify may use cookies and comparable technologies. Further processing is governed by the provider's privacy policy.
Where consent is required, the Spotify player will be loaded only after the visitor has given the necessary consent.
Further information:
https://www.spotify.com/de/legal/privacy-policy/
https://www.spotify.com/de/legal/cookies-policy/
13.3 Activation of External Media
To protect visitors' privacy, external media content requiring consent should initially be replaced by a placeholder.
Visitors can then choose to activate the requested content themselves.
Before activation, visitors are informed which third-party provider will be connected and that loading the content may involve the transmission of personal data to that provider.
Activation is voluntary. Other BANDCOM functions remain available without consent.
Where activation constitutes consent under data protection law, processing is based on Article 6(1)(a) GDPR and, where applicable, Section 25(1) TDDDG.
Consent must be capable of being withdrawn with effect for the future.
The technical implementation of consent management must ensure that content requiring consent is not loaded before consent has been given.
13.4 International Data Transfers
When external media providers are used, personal data may also be processed outside the European Economic Area.
Such transfers are subject to the requirements of Articles 44 et seq. GDPR.
Where third-party providers process data independently, their privacy policies also apply.
14. Paid Services and Payment Processing
BANDCOM may offer paid services, such as enhanced profiles, ticketing functions, shops or advertising placements.
Commercial administration and billing are handled by ESO Media.
In this context, names, contact details, booked services, contractual information, payment status and invoice data may be processed.
The legal basis is Article 6(1)(b) GDPR and Article 6(1)(c) GDPR for statutory retention obligations.
Where PayPal is used as a payment service provider, the data necessary for payment processing is also processed by PayPal.
Further information:
https://www.paypal.com/de/legalhub/paypal/privacy-full
Where additional payment service providers or specific ticket buyer functions are introduced, the corresponding data protection information will be supplemented.
15. Usage Statistics
BANDCOM may analyse technical usage data to improve the platform and identify errors.
Where such analysis involves personal data, it is carried out only on an appropriate legal basis.
Consent is obtained before the use of analytics or tracking technologies that require it.
The analytics procedures actually used and their retention periods depend on the technical implementation.
16. Recipients of Personal Data
Personal data is disclosed only where necessary for the respective purpose and legally permissible.
Recipients may include:
Hosting and technical service providers
Email service providers
Payment service providers
External media and mapping providers
Public authorities and other recipients legally entitled to receive data
Where service providers process personal data on our behalf, the necessary agreements under Article 28 GDPR are concluded.
17. Data Retention and Deletion
Personal data is generally stored only for as long as necessary for the respective purpose or as required by statutory retention obligations.
Member accounts and profiles are removed in accordance with the applicable account deletion procedures, unless legal reasons require further retention.
Gig offers, applications, messages and venue data are processed in accordance with their respective purposes and the deletion procedures actually implemented.
Invoices and business records are retained in accordance with statutory retention periods.
Technical logs and backups are subject to the retention and deletion periods actually established.
18. Rights of Data Subjects
Subject to the conditions laid down in the GDPR, data subjects have the following rights in particular:
Right of access under Article 15 GDPR
Right to rectification under Article 16 GDPR
Right to erasure under Article 17 GDPR
Right to restriction of processing under Article 18 GDPR
Right to data portability under Article 20 GDPR
Right to object under Article 21 GDPR
Right to withdraw consent under Article 7(3) GDPR
Requests may be sent to info@bandcom.eu.
Data subjects also have the right to lodge a complaint with a competent data protection supervisory authority under Article 77 GDPR.
19. Data Security
BANDCOM implements appropriate technical and organisational measures to protect personal data.
These include, in particular, encrypted data transmission via HTTPS, appropriate access restrictions and measures to secure the platform and its database.
Security measures are adapted according to existing risks and technical possibilities.
20. Changes to This Privacy Policy
This Privacy Policy may be updated when legal requirements, technical functions or service providers change.
The current version will be published on BANDCOM.
Previous versions may be archived for documentation and evidentiary purposes.
Contact for data protection enquiries: info@bandcom.eu
Data Controller: ESO Media, Owner: Thomas Tuchlinski, Blohmstr. 5, 12307 Berlin, Germany.
End of Privacy Policy