PRIVACY POLICY

(pursuant to Articles 13 and 14 of EU Regulation 2016/679 – GDPR)

Last updated: 9 October 2026

This policy describes how the personal data of users who visit the monoloco.live website, submit a demo through the /demo page, or subscribe to the newsletter of the MONOLOCO / MONOLOCO SOUND project are processed, as well as social data used for the aggregate counter. This policy does not concern the third-party sites or platforms reachable through the links present on the site (Instagram, TikTok, WhatsApp, SoundCloud, Facebook, Nightify, Google Maps), which have their own independent privacy policies.

1. DATA CONTROLLER

The Data Controller is:

European Broadcasting Company S.r.l.
Registered office: Via Berta 10, 86170 Isernia (IS) – Italy
VAT no. 01647060704

Contacts for privacy matters and for the exercise of rights:

• General e-mail: events@monoloco.live
• E-mail for demos (MONOLOCO SOUND): demos@monoloco.live
• Booking e-mail: bookings@monoloco.live
• Events office (telephone): +39 351 702 2439

The Controller has not appointed a Data Protection Officer (DPO), there being no legal obligation to do so; any request concerning data protection may be sent to the contact details indicated above.

2. TYPES OF DATA PROCESSED, PURPOSES AND LEGAL BASES

2.1 Submission of a demo (/demo page – "MONOLOCO SOUND")

When you submit a demo by filling in the relevant form, we collect the data you voluntarily provide:

• stage name (mandatory);
• e-mail address (mandatory);
• private/streaming link to the track (mandatory – no audio files are uploaded or stored: we process only the link you provide);
• genre/style of the track and, optionally, the title of the track and its publication status (unreleased/already released);
• Instagram profile or other social media (mandatory);
• city/country of origin (optional);
• a short message (mandatory);
• the consent checkbox for the privacy policy and the optional checkbox for newsletter subscription.

Submissions are saved in a protected technical register, hosted on the hosting provider's servers (Aruba), in a structured format with restricted access.

Purpose: to evaluate the demo you have sent us and, in case of interest, to contact you to follow up on the artistic proposal.
Legal basis: performance of pre-contractual measures taken at your request and/or the Controller's legitimate interest in evaluating the artistic proposals received (Art. 6(1)(b) and (f) GDPR). The consent you give concerns the review and acceptance of this policy for the specific purpose of evaluating the demo.

2.2 Newsletter and e-mail marketing (double opt-in)

If you subscribe to the newsletter (from the site or by checking the relevant box in the demo form), we process your e-mail address – and possibly your name – to send you updates on events, dates, line-ups and new releases from the label.
Subscription takes place through a double opt-in procedure: after the request, you will receive a confirmation e-mail and the subscription is completed only after you have clicked the verification link. We retain proof of consent (date, time and method of subscription) for accountability purposes.
Purpose: sending promotional and informational communications by e-mail.
Legal basis: free, specific and revocable consent of the data subject (Art. 6(1)(a) GDPR). You may withdraw your consent at any time, without affecting the lawfulness of the processing based on the consent given before its withdrawal, by using the unsubscribe link present in every e-mail or by writing to events@monoloco.live.

2.3 Browsing data and server logs

The computer systems and software procedures used to operate the site acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (e.g. IP address, browser type/user agent, operating system, date and time of the request, pages visited). Such data are processed by the hosting provider (Aruba) in log files for exclusively technical purposes, for statistics in aggregate form and for security.
Purpose: to ensure the correct functioning, security and diagnostics of the site, as well as to ascertain any liability in the event of computer crimes against the site.
Legal basis: the Controller's legitimate interest in the security and continuity of the service (Art. 6(1)(f) GDPR) and any legal obligation (Art. 6(1)(c) GDPR).

2.4 Anti-abuse measures for the demo form

To prevent automated submissions and abuse of the demo form, we apply a limit on submissions per IP address. For this purpose the IP address is not stored in clear text: it is transformed into a non-reversible encrypted code (SHA-256 hash) and used only for the temporary counting of submissions. In addition, the integration of the Cloudflare Turnstile anti-bot system is in place – but currently DEACTIVATED – which may be activated solely for the security of the form.
Purpose: prevention of spam, fraud and abuse; security of the site.
Legal basis: the Controller's legitimate interest (Art. 6(1)(f) GDPR); for the possible activation of Cloudflare Turnstile, where required, consent through the banner.

2.5 Cookies and similar technologies

The site uses the technical monoloco_consent cookie to remember choices for 180 days. After Marketing consent, it loads Meta Pixel (ID 1788149108617507) for campaign measurement and retargeting; the legal basis is consent (Art. 6(1)(a) GDPR). No statistical cookies are active. Withdrawal via Cookie preferences is communicated to the SDK on the current page and prevents loading on subsequent visits. Cloudflare Turnstile is configured but disabled on the demo form.
The typographic fonts used by the site are hosted directly on our servers (self-hosting): NO call is therefore made to Google Fonts and no IP address is communicated to Google for loading the fonts.
The site contains exclusively outbound links (and not embedded content/"embeds") to third-party platforms (Instagram, TikTok, WhatsApp, SoundCloud, Facebook, Nightify) and a link to Google Maps for locating the venues: such links do not install cookies on our site; any processing takes place only after you have clicked and been redirected to the respective platforms, according to their independent policies.
Legal basis of the technical cookie: legitimate interest and/or technical necessity connected to the use of the service requested by the user (Art. 6(1)(f) GDPR); for the technical cookie storing the choice, no prior consent is required under the applicable legislation.

2.6 Partner / venue requests

The partner form collects organisation, contact person, email and request details, with optional phone, location, dates and capacity. Data are used to reply and evaluate the proposed collaboration, based on the user’s request and relevant pre-contractual steps. Requests are stored on Aruba and notified to MONOLOCO contacts through the email channels described below. Requests without a follow-up are kept for a maximum of 24 months. Newsletter consent remains separate and optional.

2.7 Aggregate counter for MONOLOCO social content

To display the available total views of MONOLOCO content on the website, we process metrics from our Instagram and TikTok accounts. Collection may use official exports and, once the account authorises access, the platforms' official APIs. We process post identifiers, the account name needed to verify their origin and view counts. API access credentials are held in the administrative system and are not sent to visitors. The website publishes only aggregate data, the number of measured posts and the verification date. We do not use these metrics to profile visitors, and the counter does not load social-platform scripts on their devices. Purpose: to provide verifiable information about the project's activities. Legal basis: the Controller's legitimate interest in documenting and presenting its activities (GDPR art. 6(1)(f)), subject to the platforms' terms.

3. NATURE OF THE PROVISION OF DATA

The provision of the data marked as mandatory in the demo form is necessary in order to evaluate your proposal: in its absence, it will not be possible to follow up on the submission. The provision of the e-mail for the newsletter is optional, but necessary to receive communications: failure to provide it only results in the impossibility of subscribing. Browsing data are collected automatically for technical reasons.

4. RECIPIENTS AND DATA PROCESSORS

The data are processed by the Controller's authorized personnel and may be communicated, within the limits of their respective purposes, to the following parties, appointed as Data Processors pursuant to Art. 28 GDPR where they act on behalf of the Controller:

• Aruba S.p.A. (Italy – EU) – Data Processor. Provides the hosting of the site, the storage of the demo register and the e-mail mailbox used, primarily, for sending confirmation/notification e-mails and for receiving communications.

• SMTP2GO (SMTP2GO Inc. / SMTP2GO Ltd – United States, with an EU data center available) – Data Processor. Used as a backup (fallback) delivery channel for transactional e-mails (demo confirmations and notifications) when the primary Aruba channel is unavailable, and as a delivery service for the newsletter.

• Hetzner Online GmbH (Germany – EU) – Data Processor/sub-processor. Provides the server (VPS) on which the newsletter management software "listmonk" is self-hosted.

• Brevo (Sendinblue SAS – France – EU) – former Data Processor. E-mail marketing platform used in the past for the management of the newsletter; mentioned for transparency with reference to past processing.

• Cloudflare, Inc. (United States) – possible Data Processor, limited to the Turnstile anti-bot service on the demo form, currently DEACTIVATED; it will be involved only in the event of its future activation.

The site integrates Meta Pixel, ID 1788149108617507, only after your consent to Marketing. It measures Facebook/Instagram campaigns and enables retargeting; it may transmit browsing data and device identifiers to Meta. It is not loaded without consent. You can withdraw via Cookie preferences: withdrawal is communicated to the Pixel on the current page and accessible marketing cookies are removed. Meta Platforms Ireland Ltd. participates in the collection and transmission under the applicable terms; subsequent processing is described at https://www.facebook.com/privacy/policy.

The data may also be communicated to competent authorities, consultants and professionals, where necessary to comply with legal obligations or for the ascertainment and defence of a right. The data are not disseminated nor sold to third parties for marketing purposes.

5. DATA TRANSFERS TO NON-EU COUNTRIES

Processing takes place primarily within the European Union (Aruba hosting in Italy; Hetzner listmonk server in Germany).

Some providers may involve a transfer of personal data to the United States:

• SMTP2GO (USA): the transfer, where it takes place through the provider's US infrastructure, is carried out on the basis of the Standard Contractual Clauses (SCC) approved by the European Commission pursuant to Art. 46 GDPR and/or, where the provider is certified, the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), with adequate supplementary measures. SMTP2GO also makes available a data center located in the EU (Amsterdam).
• Cloudflare (USA) – only in the event of future activation of Turnstile: transfers are covered by the Standard Contractual Clauses (SCC) and/or by certification under the EU-US Data Privacy Framework.
• Meta (USA): only after Marketing consent to the website Pixel, under the applicable safeguards described in Meta’s terms, including SCCs and/or applicable adequacy decisions.

In all cases, transfers take place in compliance with Articles 44 et seq. of the GDPR. You may request a copy of the safeguards adopted by writing to the contacts indicated in section 1.

6. DATA RETENTION PERIOD

• Non-selected demos and related contacts: retained for a maximum of 24 months from submission, after which they are deleted. In case of interest and the start of a relationship, the data are retained for the time necessary to manage the collaboration and the related obligations.
• Newsletter and e-mail marketing: the data are retained until consent is withdrawn or the subscription is cancelled; proof of consent is retained for the time necessary to demonstrate its lawfulness.
• Server logs: retained for the technically necessary time according to the hosting provider's policies, for security and diagnostic purposes, and in any case for a limited period.
• Hash of the IP address for form rate limiting: retained only for the time window necessary for the anti-abuse check (in the order of hours).
• "monoloco_consent" technical cookie: limited duration (180 days), unless deleted earlier by the user.

At the end of the indicated periods, the data are deleted or irreversibly anonymized.

7. RIGHTS OF THE DATA SUBJECT

In relation to the data processed, you have the right, within the limits and under the conditions provided for by Articles 15-22 of the GDPR, to:

• obtain confirmation of the existence of the processing and access to your personal data (Art. 15);
• obtain the rectification of inaccurate data or the integration of incomplete data (Art. 16);
• obtain the erasure of the data ("right to be forgotten"), in the cases provided for (Art. 17);
• obtain the restriction of processing (Art. 18);
• receive the data concerning you in a structured, commonly used and machine-readable format, and transmit it to another controller (portability, Art. 20);
• object at any time, for reasons connected to your particular situation, to processing based on legitimate interest, as well as object at any time to processing for direct marketing purposes (Art. 21);
• not be subject to automated decisions producing legal effects (Art. 22): the Controller does not make solely automated decisions with legal effects; consent-based Meta retargeting is described above;
• withdraw at any time the consent given, without affecting the lawfulness of the processing carried out before the withdrawal (Art. 7(3)).

To exercise your rights you may write to events@monoloco.live or, for demos only, to demos@monoloco.live. The request is free of charge and we will respond without undue delay and in any case within one month, extendable by a further two months in cases of particular complexity. To unsubscribe from the newsletter you may also use the link at the bottom of every e-mail.

8. COMPLAINT TO THE SUPERVISORY AUTHORITY

If you believe that the processing of your data takes place in violation of the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority:
Garante per la protezione dei dati personali – Piazza Venezia 11, 00187 Rome – website www.gpdp.it / www.garanteprivacy.it – switchboard +39 06 696771.
Without prejudice to any other administrative or judicial action.

9. CHANGES TO THIS POLICY

The Controller reserves the right to modify or update this policy, including as a result of changes in the applicable legislation or in the services and providers used. The updated version will be published on this page with an indication of the date of last update. We invite you to consult it periodically.

European Broadcasting Company S.r.l. – monoloco.live