Privacy Policy

Data controller

Julien Marsan, sole trader (entrepreneur individuel, EI), publisher of DJBackstage, 14 impasse Paul Monié, 11410 Salles-sur-l’Hers, France.

Contact for any question about your data: contact@djbackstage.com

Two different situations

• For the data of professional users (DJs and service providers), DJBackstage is the data controller.
• For the data of clients that each professional records in their workspace, the professional is the data controller. DJBackstage acts as a processor within the meaning of Article 28 of the GDPR: this data is processed solely to provide the service, on the professional’s instructions.

Data processed

• Account: last name, first name, email address and password, stored only as a secure hash.
• Business information: company, country, currency, business identifier (SIRET, EIN), address, phone number, bank details and legal notices entered for documents.
• Activity data: clients, events, quotes, contracts (including PDF contracts attached by the professional and the fingerprint of the signed PDF), invoices, payments, questionnaires, run sheets and travel bookings.
• Client portal: name, email address, questionnaire answers and, when a contract is signed, the typed name, date and IP address. When a professional emails a quote or an invoice, the client receives a personal access link to their portal, valid for 30 days, of which only a hash is stored.
• A professional's public page and request form (if enabled): name, email address, phone number, event details and message entered by the person making the request. They are sent only to the professional concerned, who is responsible for processing them, with that person's consent.
• Technical data: session and theme cookies, IP address and technical logs needed to secure the service.
• Contact form: name, email address, subject and message.

Purposes and legal bases

No data is sold, rented or used for advertising.

• Providing the service, managing accounts and answering requests: performance of the contract.
• Securing the service and preventing abuse and fraudulent sign-in attempts: legitimate interest.
• Keeping information required by law, where applicable: legal obligation.

Recipients and processors

Data is accessible only to the publisher and to these technical providers, within the limits of their tasks.

• Hostinger International Ltd. (Cyprus, European Union): hosting of the application and website.
• Brevo (Sendinblue SAS, Paris, France): sending of service emails (password reset, request notifications, quotes, invoices and reminders sent to clients).
• Google Ireland Limited (Ireland, European Union): optional sign-in with a Google account. If you choose “Continue with Google”, Google sends us your first name, last name and confirmed email address; DJBackstage receives neither your Google password nor access to your other Google data.
• Supabase Pte. Ltd.: database hosting on servers located in London (United Kingdom). The United Kingdom benefits from an adequacy decision of the European Commission.
• GitHub, Inc. (United States, Microsoft group): storage of encrypted copies of the database, which can only be read with an encryption key held by the publisher.
• HeiGIT gGmbH (OpenRouteService, Heidelberg, Germany): driving time calculation, only when a professional requests it. Only the professional's starting address and the event venue address are sent, without the client's name or contact details.
• Anthropic, PBC (United States): generation of the replies of the support assistant built into the application. Only the messages you write to the assistant, your first name and the page being displayed are sent to it; no document, client record or other account data is sent. DJBackstage does not store the conversations unless you choose to send them to the team.
• Cloudflare, Inc. (United States): bot check (Turnstile service) on the sign-in, sign-up and forgotten password forms. Cloudflare receives technical information about your browser and your IP address, solely to tell a person from a bot; none of your account data is sent to it.

Retention periods

• Account and activity data: for as long as the account is used, then deleted within one month of a closure request, unless the law requires it to be kept.
• Contact form messages: 12 months at most after they are received.
• Session cookie: 30 days at most, or until you sign out.
• Theme cookie: 12 months.
• Database backups at the host: 7 days, on automatic rotation.
• Additional encrypted copies of the database: 30 days, on automatic rotation. Deleted data disappears from backups once these periods have elapsed.

Security

Traffic is encrypted (HTTPS), passwords are stored as hashes, access to data is restricted to each account and the database is backed up every day, with an encrypted copy stored separately. Repeated sign-in attempts are temporarily blocked, and a bot check protects the sign-in forms.

Cookies

DJBackstage only sets strictly necessary cookies: the session cookie, which keeps you signed in, and a cookie that remembers your light or dark theme choice. They are exempt from consent. No audience measurement tool or advertising cookie is used.

If an audience measurement tool is added, this policy will be updated and your consent will be requested where the law requires it.

Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data. If you are a client of a professional using DJBackstage, contact them first: DJBackstage will help them respond to your request.

You may also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr).

To exercise your rights: contact@djbackstage.com

Changes

This policy may change as the service evolves. The date of the last update appears at the top of this page.