EVIXTION BOOKINGS by Hardwave Studios
Legal · AVG / GDPR

Privacy policy

Last updated: 27 June 2026

Evixtion Recordings & Evixtion Bookings (handelsnamen van Hardwave Studios, KvK 82826757, Rotterdam, NL) takes your personal data seriously. This policy explains what we collect, why, how long we keep it, and what your rights are under the EU General Data Protection Regulation (GDPR / AVG).

Who we are

Hardwave Studios is the controller for personal data processed via hardwavestudios.com.
Contact: hello@evixtion.com · Pisuissestraat 12, 3034WK Rotterdam.

What we collect, when, and why

  • Booking enquiry form: name, email, phone, company, country/city, venue, event date, budget range, notes. Legal basis: execution of a contract (Article 6(1)(b)). Used to respond with availability and a quote.
  • Demo submission: artist name, email, SoundCloud link / audio file, optional bio. Legal basis: legitimate interest in evaluating signings.
  • Newsletter signup: email address. Legal basis: consent (Article 6(1)(a)). Withdraw any time via the unsubscribe link or by emailing us.
  • Artist account (logged-in roster): username, profile photo, bio, socials, fees, tour dates. Legal basis: execution of a contract.
  • Server logs: IP address, user agent, timestamps, requested URLs. Legal basis: legitimate interest in security + fraud prevention. Retained 90 days.
  • Cookies: see our cookies page.

Who we share it with

We do not sell or rent personal data. We share with:

  • Hosting: Hetzner (Falkenstein, DE) — server infrastructure.
  • Email delivery: our SMTP provider for transactional emails (booking confirmations, A&R notifications, newsletter).
  • Authorities: only when legally required (e.g. court order).

How long we keep it

  • Booking enquiries — 7 years after last contact (NL fiscal retention requirement).
  • Demo submissions — 12 months after final A&R decision, then deleted.
  • Newsletter — until you unsubscribe.
  • Artist accounts — for the duration of the roster relationship + 5 years.
  • Server logs — 90 days.

Your rights

Under the GDPR you can request: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, and objection to processing. Send any request to hello@evixtion.com — we respond within 30 days.

You also have the right to file a complaint with the Dutch supervisory authority — Autoriteit Persoonsgegevens.

Security

We use HTTPS, hashed passwords (bcrypt), CSRF protection, parameterized SQL, and Content-Security-Policy headers. Access to admin systems is role-gated and logged.

Changes to this policy

We update this page when our processing changes. The date at the top reflects the last revision.