Legal · Privacy

Privacy notice

Last updated 2026-10-15

1. Who is responsible

BASSWAV is a trade name of Kai van Megen, eenmanszaak (sole proprietorship), Koningslust, The Netherlands. KvK 98170716, BTW NL005313360B57. He is the controller for the personal data described here. For anything about your data, write to contact@basswav.com. We do not have a data protection officer; the owner handles every request himself.

2. What we collect, why, and on what legal basis

Demo submissions (/submit)

Data: Artist name, email, optional phone and country, track title and private link, genre, optional portfolio, your pitch and how you found us.

Purpose and basis: Reviewing your demo and replying: steps you ask for before a possible contract (Art. 6(1)(b) GDPR). After our answer we may send up to 4 weekly follow-up emails (legitimate interest, Art. 6(1)(f)). Every follow-up has a link to stop them.

Contact and booking enquiries

Data: Name, email, optional company and phone, your message; for bookings also event, date, venue, audience size and budget.

Purpose and basis: Answering you and handling the booking (Art. 6(1)(b)); keeping a record of the conversation (legitimate interest, Art. 6(1)(f)).

Link requests on Instagram and Facebook

Data: When you comment a release keyword (for example REMEDY) under a BASSWAV post, Meta sends us the comment, its id, the post id and your Instagram or Facebook account id and username.

Purpose and basis: Sending you the one link you asked for, as a single private reply through Meta, plus a short public reply under your comment (legitimate interest, Art. 6(1)(f): answering your request). We read the comment only to check for the keyword. We do not store your comment, account id or username, do not add you to any list, and do not message you again. The link carries campaign tags (platform, release and post), never anything that identifies you.

Community email list

Data: Email, name, the email types you chose, optional role, phone, country, artist name and link, how you signed up (campaign, referrer), your browser user agent and the version and time of your consent.

Purpose and basis: Sending only the email types you chose (consent, Art. 6(1)(a) GDPR and Art. 11.7 Telecommunicatiewet). You can withdraw with the unsubscribe link in every email.

Event alerts and location preferences

Data: Email, optional name, the events or countries you select, optional home country and city, and the version and time of your event-email consent. Our internal demand reports use a coded identifier and your selected events or countries; they do not contain your email or home location.

Purpose and basis: Sending event updates you request and understanding where there is interest in future BASSWAV nights, based on your consent (Art. 6(1)(a) GDPR). Choosing event alerts does not subscribe you to release emails. You can withdraw event alerts through your emailed preference link. Registering interest is not a ticket or reservation.

Signed artists (artist onboarding)

Data: Legal name, date of birth, address, email, phone, songwriter and producer credits (PRO/IPI), AI-use disclosure, bio and photo, payout details (bank account, IBAN/SWIFT, PayPal or Wise) and, for artists under 18, the guardian’s name, relationship, email, address and consent.

Purpose and basis: Preparing and performing your release contract, registering rights and metadata with distributors and stores, and paying royalties (Art. 6(1)(b)); keeping financial records for 7 years (legal obligation, Art. 6(1)(c)). Without these details we cannot sign or pay you.

Cookie-free site statistics (every visitor)

Data: Pages viewed, clicks on links and buttons, form steps, media plays, referrer and campaign tags, which test version of a page you saw, country (from the request), browser family and device type (for example "chrome/mobile"), a session id that lives only in your open tab, and a visitor code that changes every day. When you send a form, the submission is linked to that tab session so we can see which pages lead to it. No IP address is stored, no cookie is set, and ad click ids (such as gclid) are left out.

Purpose and basis: Understanding which pages and tracks work, in aggregate only (legitimate interest, Art. 6(1)(f); covered by the analytics exemption of Art. 11.7a Telecommunicatiewet). Our interest: running and improving a small label site. Your impact is minimal: nothing identifies you across days or sites, nothing is shared, and you can object at any time.

Detailed analytics (only if you click Accept)

Data: Pages, events, device and browser data and Google Analytics cookies, sent to Google. On our side we also record which form is visible, which step you reach and which fields fail validation, using fixed technical codes. We do not collect the field contents or error messages in these diagnostics, and do not send these diagnostics to Google. They are retained for 13 months. Also, on our side: a random visitor id kept in your browser for 13 months (linked to forms you send, so we can see a returning visitor), and the ad click id an ad link carried.

Purpose and basis: Measuring site use in more detail and which ads work (consent, Art. 6(1)(a)). Google signals and ad personalisation are off. Withdraw any time under Cookie settings in the footer; rejecting deletes these from your browser.

Security and abuse prevention

Data: Your IP address, held briefly in memory to rate-limit form submissions, and server logs at our hosting provider.

Purpose and basis: Keeping the site and forms safe (legitimate interest, Art. 6(1)(f)). IP addresses are not written to our intake sheets or our statistics.

We never sell your data, and we do not use it for automated decisions or profiling.

3. Artists, guardians of minors and payout data

Your release contract refers to this section. We use your onboarding details only to run your contract: to draft and sign it, to deliver your release with correct credits, and to account for and pay your royalties.

What becomes public: your artist name, bio, photo, credits and release details, as you approve them. Your legal name, date of birth, address, contact and payout details never appear on the site.
Payout data (bank, IBAN/SWIFT, PayPal or Wise) is used only to pay you. It is kept out of the contract text itself, where only a masked reference appears, and access is limited to the owner. A change to your payout account takes effect only after you confirm it from an email we send to the address on file (for an artist under 18, to the guardian). We keep a log of these changes.
Distributors and stores receive the release metadata they need (artist and contributor names, credits, rights holders, ISRC and similar codes). Our distributor TooLost is based in the USA (see section 5).
Artists under 18: we sign only with a parent or guardian’s consent. We collect the guardian’s name, relationship, email, address and consent, and the guardian is our contact for rights and money matters. We never publish a minor’s age, school or location, and a minor’s photo is published only with the guardian’s approval.
Retention: contract and payout records are kept for the contract term plus 7 years, because Dutch tax law requires it. Other onboarding details are deleted when they are no longer needed for the contract.

4. Children and the community list

The community list and giveaways are for people aged 16 and over. If you are under 16, please do not sign up; a parent or guardian can ask us to delete a younger person’s data at any time.

5. Who receives your data

We use these service providers, each under a data processing agreement or their own terms as independent controller where stated:

Vercel Inc. (USA): hosts the website; cookie-free Web Analytics and Speed Insights.
Supabase: database for our cookie-free site statistics and form records, hosted in the EU.
Google (Google Workspace: Gmail, Drive, Sheets and Apps Script): receives and stores form submissions and sends our emails. Google Analytics only if you accept.
TooLost (USA): our music distributor, for signed artists’ release metadata and royalty accounting.
Meta Platforms Ireland (Instagram, Facebook): when you comment a keyword under our post, Meta passes the comment to us and delivers our private reply. Meta acts as an independent controller under its own privacy policy.
Streaming stores such as Spotify and Apple Music: release metadata for signed releases. A Spotify player on our pages loads only when you press play, and Spotify may then set its own cookies.

We share data with authorities only when the law requires it.

6. Transfers outside the EU

Vercel, Google, TooLost and Meta are US companies or groups, so data can be processed in the USA. We rely on the EU-US Data Privacy Framework where the company is certified under it, and otherwise on the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguard that applies.

7. How long we keep it

Demo submissions that we decline: 6 months after our answer.
Other demo, contact and booking messages: 12 months after the last contact.
Artists who asked us to stop contacting them: only a coded (hashed) form of your email on a do-not-contact list, kept until you send us a new demo or ask us to remove it; your demo itself is deleted 6 months after you withdraw.
Community email list: until you unsubscribe; then only your coded (hashed) email on a suppression list for 30 days, so we do not mail you again by mistake.
Event alerts: Active preferences until you withdraw. We remove optional home location when you withdraw all event alerts. If you have no other subscriptions, we remove your contact details after 30 days, once the withdrawal has reached our reporting system. Minimum synchronisation records are removed after 30 days once synchronisation succeeds; failed synchronisations remain pending until resolved so old updates cannot restore your choices..
Artist contract and payout records: the contract term plus 7 years (Dutch tax retention duty).
Payout-account changes: confirmed changes: the contract term plus 7 years; changes never confirmed: 12 months, reduced to a masked form.
Instagram and Facebook link requests: nothing is stored on our side. Our hosting provider’s server logs keep only a coded (hashed) form of the comment id and the result, for at most 30 days. The comment, our reply and the private message stay on Instagram or Facebook under Meta’s own policy.
Cookie-free site statistics: 13 months, then deleted.
Statistics about crawlers and bots: daily totals per bot and page, with no IP address or visitor id; 13 months, then deleted automatically.
Google Analytics data: 14 months (Google Analytics setting); cookies expire after 13 months.

8. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its use, to receive it in a portable format, and to object to any use based on our legitimate interest, including our site statistics. Where we rely on your consent you can withdraw it at any time, without affecting earlier use: unsubscribe links for email, and Cookie settings in the footer for Google Analytics.

Mail contact@basswav.com. We answer within one month. We may ask you to confirm your identity first.

9. Complaints

If you are not happy with how we handle your data, tell us first. You also have the right to complain to the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl.

10. Cookies

Which cookies and storage we use, and for how long, is listed on the cookie page.