Privacy Policy
Last updated: July 2026
1. Introduction
This Privacy Policy explains how RadioGift collects, uses, stores, and protects your personal data when you use our Platform. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR), the ePrivacy Directive, and all applicable EU data protection legislation. This policy applies to all users: organizers, contributors, and visitors.
2. Data Controller
The data controller responsible for your personal data is RadioGift, a company registered in the European Union. For all data protection inquiries, you may reach our Data Protection Officer at: privacy@radiogift.eu.
3. Data We Collect
For organizers: name, email address, password (hashed), event details, payment information (processed by Stripe, not stored by us). For contributors: name, email address, audio recordings, song dedications. For all users: IP address, browser type, device information, locale preference, and usage data (pages visited, timestamps). We do not collect sensitive personal data (racial/ethnic origin, political opinions, health data, etc.).
4. Purposes of Processing
We process personal data for the following purposes: (a) Service delivery — to create events, collect contributions, produce radio shows, and deliver them to organizers. (b) Account management — to authenticate users and manage accounts. (c) Payment processing — to process transactions via Stripe. (d) Communication — to send transactional emails (confirmations, notifications, delivery). (e) Legal compliance — to fulfil our legal obligations. (f) Platform improvement — to analyse anonymised usage patterns and improve our services.
5. Lawful Basis
We process your data under the following legal bases per GDPR Article 6: (a) Contract performance (Art. 6(1)(b)) — processing necessary for service delivery to organizers and contributors. (b) Legitimate interest (Art. 6(1)(f)) — platform security, fraud prevention, and service improvement. (c) Legal obligation (Art. 6(1)(c)) — tax records, financial reporting. (d) Consent (Art. 6(1)(a)) — where applicable, such as for optional marketing communications (none currently sent). Contributors' lawful basis is contract performance (the contribution submission constitutes acceptance of processing for radio show production).
6. Data Retention
We retain data only as long as necessary: (a) Account data — retained while your account is active, plus 30 days after account deletion for dispute resolution. (b) Contribution data — retained until 30 days after event cancellation or 12 months after show delivery, whichever comes first. (c) Audio files — permanently deleted 12 months after show delivery or 30 days after event cancellation. (d) Payment records — retained for 7 years as required by EU tax and financial regulations. (e) Usage logs — anonymised or deleted after 90 days.
7. Third-Party Processors
We use the following sub-processors to deliver our services: (a) Supabase (database, authentication, file storage) — EU region (Ireland), data remains within the EU. (b) Stripe (payment processing) — EU entity, certified PCI DSS Level 1, data processed in the EU. (c) Resend (transactional email delivery) — US-based, data transfers governed by EU Standard Contractual Clauses (SCCs). (d) Vercel (web hosting and CDN) — US-based, data transfers governed by EU Standard Contractual Clauses (SCCs). All processors are bound by Data Processing Agreements ensuring GDPR-compliant handling of personal data.
8. International Transfers
Your data is primarily stored and processed within the European Union (Supabase Ireland, Stripe EU). Where data is transferred to processors outside the EU/EEA (Resend, Vercel — both US), we rely on EU Standard Contractual Clauses (SCCs) adopted by the European Commission as the legal mechanism ensuring adequate protection. We regularly assess transfer risks and processor compliance with data protection obligations.
9. Your Rights
Under GDPR, you have the following rights: (a) Right of access — obtain a copy of your personal data. (b) Right to rectification — correct inaccurate data. (c) Right to erasure — request deletion of your data (subject to legal retention requirements). (d) Right to data portability — receive your data in a structured, machine-readable format. (e) Right to restriction — limit how we process your data. (f) Right to object — object to processing based on legitimate interest. (g) Right to withdraw consent — where processing is based on consent. To exercise any right, contact privacy@radiogift.eu. We respond within 30 days. You also have the right to lodge a complaint with your national Data Protection Authority.
10. Cookies
RadioGift uses only strictly necessary cookies as defined by the ePrivacy Directive. These include: (a) Session cookie — to maintain your authenticated session. (b) Locale preference cookie — to remember your language selection. We do not use analytics cookies, advertising cookies, or any third-party tracking cookies. Since we only use strictly necessary cookies, no cookie consent banner is required under the ePrivacy Directive. No personal data is shared with advertisers or analytics providers.
11. Children's Privacy
RadioGift is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided personal data to us, please contact privacy@radiogift.eu and we will promptly delete such data. Organizers must ensure that contributors are at least 16 years of age or have parental consent.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email to registered users at least 30 days before taking effect. The "Last updated" date at the top indicates when the policy was last revised. Continued use after changes take effect constitutes acceptance.
13. Contact and Complaints
For privacy inquiries, data subject requests, or complaints: Data Protection Officer, Email: privacy@radiogift.eu. We aim to resolve all complaints internally. If you are unsatisfied with our response, you have the right to lodge a complaint with your national Data Protection Authority. A list of EU DPAs is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.