Privacy statement
4am.nl operates GigPlano, a band management platform. This statement explains what personal data we process, why, and what rights you have. The Dutch version is binding.
1. Two roles
This matters, so we say it up front. For the data of band accounts (your name, email, subscription) we are the controller. For the data a band enters about its own clients (the couple booking a wedding, a venue contact) the band is the controller and we are only the processor: we store it and make it available, and we do nothing else with it. Bands can request a data processing agreement from us at privacy@4am.nl.
2. What we process
| Data | Why | Basis |
|---|---|---|
| Name, email, password (hashed) | Your account and login | Performance of contract |
| Band details, logo, business and invoicing data | Filling your quotes, contracts and invoices | Performance of contract |
| Bookings, quotes, contracts, line-ups, riders, finances | The service itself | Performance of contract |
| Client data you enter | Storing it for you (we are processor) | Your instruction as controller |
| Subscription and payment data | Billing; Mollie handles the payment itself | Performance of contract, legal obligation |
| Signature, name and timestamp on signing | Proving that a contract was agreed | Legitimate interest (evidence) |
| Technical logs and error reports | Security and troubleshooting | Legitimate interest |
| Email address for tips and news | Only if you opted in | Consent (withdraw any time) |
3. Cookies
GigPlano uses two functional cookies: one to keep you logged in, and one to remember your language. There is no analytics, no advertising and no tracking by third parties, so there is no cookie banner. Nothing to accept, nothing to refuse.
4. Who else sees the data
- Hosting — our servers run inside the European Union.
- Mollie (Netherlands) — payment processing for subscriptions.
- SMTP2GO — delivery of emails such as contracts, invitations and availability requests.
- Dropbox — storage of uploaded documents, where the deployment is configured to use it.
We do not sell data and do not share it for advertising. Where a processor operates outside the European Economic Area, the transfer is covered by the safeguards required by the GDPR.
5. How long we keep it
- Account and band data: while your account exists, and up to 30 days after deletion.
- Invoices and payment records: seven years, as Dutch tax law requires.
- Signed contracts: while your account exists, because they are your evidence.
- Technical logs: up to 90 days.
6. Your rights
You can ask us to give you access to your data, correct it, delete it, restrict processing, or hand it to you in a portable format. You can object to processing based on legitimate interest, and withdraw consent for marketing at any time. Email privacy@4am.nl and we will respond within one month. You may also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
7. Security
Passwords are stored hashed with bcrypt, traffic runs over HTTPS, access is role-based and scoped per band, and we make daily backups. If a data breach occurs that is likely to affect you, we will inform you and the supervisory authority as the law requires.