Climax Music Privacy Policy

Climax Music is an independent website operated by an individual based in the Republic of Cyprus under the Climax Music name. For the purposes of the EU General Data Protection Regulation (GDPR) and Cyprus data protection law, the operator is the data controller for the personal data described in this policy.

Privacy contact: hello.climaxmusic@gmail.com. As an individual operator we have not appointed a Data Protection Officer; privacy requests are handled by the operator directly.

This is the single privacy policy for the whole website. It covers discovering events and destinations, search and filters, the budget planner, news pages, the contact form, saved events, personalised recommendations and Friends Finder, including messaging, voice recordings and optional location sharing.

Our Terms & Conditions govern how you may use the website and are not a substitute for this policy.

We try to collect as little as possible. Depending on how you use the website, we process:

• Account data: your email address, your name if you give one, your account role and registration date, and the date and version of the Terms you accepted. Sign-in, password handling and email verification are managed by our platform provider; we do not store your password ourselves.
• Preferences and activity: events you save to your account, favourites saved in your browser before you sign in, the searches and filters you use, and budget-planner entries.
• Content you submit: messages sent through the contact form, and anything you write or record in Friends Finder.
• Friends Finder data: see section 12.
• Technical and security data: data such as timestamps and service logs generated by our hosting provider while you use the website, used to run and secure the service.
• Referral data: if you follow an affiliate link, the partner may report to us that a click or qualifying purchase came from our link, together with commission information.
• What we do not collect: we do not sell tickets or take payments, so we do not collect card or bank details.

Most data comes from you when you register, sign in, save events, use the budget planner, contact us or use Friends Finder. Technical data is generated as you use the service. Event, destination and news content comes from third-party sources and public information. Referral confirmations come from partner programmes.

Under the GDPR we need a legal basis for each purpose:

• Running your account, saved events, recommendations, and Friends Finder groups, membership, nicknames and chat: performance of a contract with you, or steps you ask us to take before a contract (Article 6(1)(b)).
• Optional Friends Finder location sharing: your consent (Article 6(1)(a)), asked for separately for each group and withdrawable at any time with Stop Sharing.
• Keeping the website secure, preventing misuse and fixing faults: our legitimate interests (Article 6(1)(f)), balanced against your rights. You may object (see section 10).
• Answering contact messages and handling complaints: our legitimate interests, or steps you ask us to take before a contract.
• Complying with legal obligations: Article 6(1)(c).
• Establishing, exercising or defending legal claims: our legitimate interests.
• Accepting the Terms & Conditions is not consent to location sharing. Withdrawing consent does not affect processing carried out before you withdrew it. Please do not include sensitive data (for example health, religious or political information) in messages, nicknames or recordings.

The website uses storage that is needed for it to work. We do not use our own advertising cookies.

• Strictly necessary storage: sign-in and session handling, security, favourites saved before you sign in, and short-lived caches that make pages load faster.
• Third-party websites: when you click through to a ticket provider, affiliate partner or other external site, that site may set its own cookies and trackers, including tools that attribute a booking to our link. Those are controlled by the partner, and its own cookie and privacy information applies.
• If we add analytics, advertising or measurement tools, we will update this policy and, where the law requires, ask for your consent before they load.
• You can block or delete cookies and site data in your browser settings. Some parts of the website may stop working if you do.

We do not sell, rent or trade your personal data. We share it only as follows:

• Base44, our platform provider, which hosts the website and provides the database, authentication, private file storage and backend services. Base44 processes this data on our behalf under its data processing terms.
• Ticket and event providers, such as Ticketmaster, when a search or feature uses their services.
• Affiliate and referral partners, which may receive click and conversion information when you follow their links.
• Other members of your Friends Finder groups, who can see what is shared in those groups (see section 12).
• Professional advisers, authorities and courts, where necessary to obtain advice, comply with the law, or establish, exercise or defend legal claims.

Base44 states that it stores data in the United States by default. Using the website can therefore involve transferring and storing personal data outside the European Economic Area.

Where personal data is transferred outside the EEA, it is protected by a transfer mechanism permitted by the GDPR. Base44 states that it relies on mechanisms such as adequacy decisions, including the EU-U.S. Data Privacy Framework, or the European Commission's Standard Contractual Clauses. You can contact us for more information about the safeguards that apply.

We keep personal data only as long as we need it for the purposes described above.

• Account data, saved events and preferences: kept while your account exists. You can ask us to delete your account by contacting hello.climaxmusic@gmail.com.
• Friends Finder locations: a shared location stops being shown 24 hours after it was last shared or refreshed. An automatic hourly process deletes expired location records. Stop Sharing removes your stored location.
• Friends Finder invitations: invitation links expire after 7 days. The hourly process deletes expired invitation records.
• Friends Finder messages: kept until the group is deleted. Leaving a group does not delete the messages you sent; they remain visible to the remaining members, labelled 'Former member'. Your membership, nickname and shared location for that group are removed when you leave.
• Group deletion: when a group is deleted (when its creator leaves), it is immediately marked for deletion and all access to it through the website is blocked. Our backend then deletes its messages, notifications, memberships, locations and invitations, and checks that none remain. If any step does not complete, the hourly process retries it. Your account and data unrelated to the group are not affected.
• Voice recordings: voice messages are stored as private files, not at public links. When a group is deleted, each voice message record is removed and the file is separately recorded as awaiting erasure. Our platform does not currently provide a supported way for us to permanently delete these private files, so a voice file may remain in Base44 storage after the group's records have been removed, although it can no longer be accessed through the website. We will update this policy when permanent deletion becomes possible.
• Playback links: voice messages are played through temporary links that expire after one hour. Once a group is marked for deletion no new links are issued, but a link already issued may keep working until it expires.
• Provider backups: deleting data in the website removes it from the active records we manage. Our platform provider may keep deleted records and backups for a limited period under its own retention practices before they are permanently removed. We cannot remove data from those provider-controlled copies sooner.
• Contact messages, technical logs and referral records: kept only as long as needed to handle your request, keep the service secure, support commission claims and meet legal requirements.

Where the GDPR applies, you have the following rights:

• Access: to receive a copy of your data.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have your data deleted where there is no good reason to keep it, subject to the voice-file limitation described in section 9.
• Restriction: to ask us to limit what we do with your data while a question is resolved.
• Portability: to receive data you gave us in a structured, machine-readable format.
• Objection: to object to processing based on our legitimate interests.
• Withdraw consent: to withdraw consent, including location consent, at any time.
• Automated decisions: we do not make decisions based solely on automated processing that produce legal or similarly significant effects. Recommendations and budget estimates are suggestions only.
• To exercise your rights, contact hello.climaxmusic@gmail.com. We will respond within one month, which may be extended by up to two further months for complex requests. We may ask you to confirm your identity.
• You may complain to the Office of the Commissioner for Personal Data Protection in Cyprus (www.dataprotection.gov.cy) or to the supervisory authority where you live or work.

Account data is accessible only to the signed-in user and the operator. Friends Finder groups, locations and messages are accessible only to members of the relevant group, and voice messages are stored as private files. Base44 applies security measures to the infrastructure the website runs on.

No system is perfectly secure. Location from a phone or browser can be inaccurate, and other group members can take screenshots or pass on what they see. Please share only with people you trust.

If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the supervisory authority and, where the law requires, you.

Friends Finder lets signed-in users create or join private, invitation-only groups, optionally share their location with group members, and exchange text and voice messages.

What we process: your account ID and a display name taken from the part of your email address before the @; an optional nickname and marker colour; group names and membership, and whether you created the group; your shared location (latitude, longitude and time shared), only if you choose to share it; your text messages, voice recordings, sender, time sent and any member you tag; in-app message notifications; a one-way hash of each invitation token and its expiry date (not the link itself); and your acceptance of the Terms with the date, time and version.

Who can see it: your name, nickname, messages and voice messages are visible to members of your groups. Your shared location is visible only to current members of the specific group you chose. 'Show My Location' displays your position only on your own screen and does not send it to anyone.

Your choices: location sharing is optional, asked for separately for each group, and can be stopped at any time with Stop Sharing. You can edit your nickname, leave a group, and, if you created a group, remove members or delete the group by leaving it.

Retention and deletion of Friends Finder data, including voice recordings, are described in section 9.

Climax Music is a discovery and referral platform, not the organiser or direct seller of tickets, accommodation, travel or other third-party services.

Some links are affiliate or referral links. If you make a qualifying purchase or booking after following one, the partner may pay Climax Music a commission, at no additional cost to you. Once you follow such a link you are dealing with the partner, under its own terms and privacy practices. The partner may report to us limited information, such as that a click or purchase came from our link and the commission due. We do not receive your payment details.

The website is not directed at children. We do not knowingly collect personal data from children below the minimum age at which they can consent to online services in their country (16 under the GDPR unless a country has set a lower age). If you believe a child has given us personal data, contact hello.climaxmusic@gmail.com and we will delete it.

We may update this policy when the website, our providers or the law change. The date above shows the current version. Where a change materially affects you, we will bring it to your attention on the website.