1. Who we are

This privacy statement applies to the website flotionrecords.com and all services provided by Flotion Records ("we", "us", "our").

Trading name	Flotion Records
Address	Zuid-Holland, Netherlands
KvK (Chamber of Commerce)	92478875
VAT (BTW) number	NL866065994B01
Email	contact@flotionrecords.com

We are the data controller for any personal data processed via this website, within the meaning of the General Data Protection Regulation (GDPR / AVG, EU 2016/679).

2. What data we collect

We only collect data you actively give us, plus minimal technical data needed to operate the site.

When	What we collect	Why
Track submission	Artist / producer name, email, track URL or audio file, genre, optional notes, submission ID	To review and respond to your submission
Curator application	Full name, email, country, Spotify profile URL, playlist URLs, follower counts, bio	To assess your application as a curator
Demo to label (free)	Artist name, email, track title, genre, demo file	A&R review for potential label release
Payment	Name, email, billing details (handled directly by Stripe; we never see card data)	To process your payment and issue invoices
Site visit	Anonymised IP, browser, device, referring URL, page views (Google Analytics)	To understand site usage and improve the site

3. Legal basis for processing

• Contract performance (Art. 6.1.b GDPR): for paid Track Review submissions, curator agreements, custom music orders, and sync licensing.
• Legitimate interest (Art. 6.1.f GDPR): for free demo submissions, curator applications, and basic security logs. We balance our interest in running a label against your privacy.
• Consent (Art. 6.1.a GDPR): for Google Analytics and any optional cookies. You can withdraw consent at any time via the cookie banner or by clearing your browser data.
• Legal obligation (Art. 6.1.c GDPR): for tax and accounting records (we must retain invoices for 7 years under Dutch law).

4. Third parties we share data with

We use specialised services (processors) that handle parts of the workflow on our behalf. We have data processing agreements (DPAs) with each.

Service	Purpose	Region
Stripe	Payment processing, invoicing	EU (Stripe Payments Europe Ltd, Ireland)
Formspree	Form submissions delivered to our email	USA (with EU-US Data Privacy Framework certification)
Google Analytics 4	Anonymised website analytics	USA (with IP anonymisation enabled)
GitHub Pages	Static site hosting	USA / EU edge nodes
Spotify	Stream attribution data for curator payouts (read-only via Spotify for Artists)	EU (Spotify AB, Sweden)

We do not sell your data. We do not share it with advertisers. We do not use it for purposes other than operating Flotion Records services.

5. International data transfers

Some of our processors (Formspree, Google) store data on servers in the United States. These transfers are protected by:

• The EU-US Data Privacy Framework (where applicable), or
• Standard Contractual Clauses (SCCs) approved by the European Commission.

6. How long we keep your data

Data type	Retention
Track submission data + audio files	12 months after submission, then deleted
Curator application data	24 months after last activity, then deleted
Free demo submissions	12 months after review
Invoices and payment records	7 years (Dutch tax law obligation)
Email correspondence	3 years after last message
Google Analytics data	14 months (default GA4 setting)

7. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Access: request a copy of all personal data we hold about you.
• Rectification: correct any inaccurate or incomplete data.
• Erasure ("right to be forgotten"): request deletion, subject to legal retention obligations.
• Restriction: limit how we use your data.
• Data portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• Withdraw consent: for any consent-based processing, at any time.

To exercise any of these rights, email contact@flotionrecords.com. We respond within 30 days. There is no charge for reasonable requests.

8. Cookies

We use the minimum cookies needed:

Cookie	Purpose	Lifetime	Type
flotion_cookie_consent	Remember your cookie choice	12 months	Functional (no consent needed)
_ga, _ga_*	Google Analytics: anonymous site usage	14 months	Statistics (consent required)

You can change your choice at any time via the cookie banner at the bottom of the site (clear your browser's site data to make it reappear).

9. Security

We use HTTPS across the entire site. Payments are handled directly by Stripe; we never store or see card details. Form submissions and email are protected by industry-standard encryption in transit. Our processors (Stripe, Formspree, Google) maintain SOC 2 / ISO 27001 certifications.

10. Children

Our services are not directed at people under the age of 16. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete the data.

11. Changes to this statement

We may update this statement to reflect changes in our practices or legal requirements. We will post the updated date at the top. For material changes (such as new processors), we will notify active users by email where possible.

12. Complaints

If you believe we are not handling your data lawfully, please first contact us at contact@flotionrecords.com so we can resolve the issue. You also have the right to lodge a complaint with the Dutch Data Protection Authority:

Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag
Telephone: 088 - 1805 250
Website: autoriteitpersoonsgegevens.nl