Privacy Policy

Last updated: 30.10.2026

1. Who we are and how to contact us

The controller of your data is AUDIOWAVE SOLUTIONS S.R.L., trading under the Privilege Agency brand (“we”). We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and applicable Romanian law.

  • Company: AUDIOWAVE SOLUTIONS S.R.L. (Privilege Agency)
  • VAT ID (CUI): 45596281 · Trade Register No.: J23/785/2022
  • Registered office: Str. Iernii nr. 25, Bragadiru, Ilfov County, Romania
  • Email: contact@privilegeagency.eu · Phone: +40 750 236 456

We are not required to appoint a Data Protection Officer (DPO). For any question or request about your data, email contact@privilegeagency.eu. We reply within 30 days at the latest.

2. In short

  • We use your data only to provide the services you ask for (courses, DJ School, booking, tickets, community), to comply with the law (accounting) and to protect our platform.
  • We do not sell your data to anyone.
  • We never see or store your card details: payments are made on the secure EuPlătesc page.
  • Google Analytics statistics and external players (YouTube, SoundCloud, Mixcloud, Spotify, Apple Music, Deezer) only run if you accept them in the cookie banner.
  • You only receive marketing emails if you opted in separately. Every email has an unsubscribe link.
  • You can delete your account yourself in your account settings and ask us for a copy of your data at any time.

3. What data we process, why, on what basis and for how long

Each of our activities is listed separately below. The legal bases are those in art. 6(1) GDPR: contract (b), legal obligation (c), legitimate interest (f) and consent (a). Where we rely on legitimate interest, we explain it and you can object at any time (see section 9).

3.1. Your account and online courses (Privilege Academy)

What data
Name, email, password (stored only as an irreversible hash that even we cannot read), the data Google sends us if you sign in with Google (name, email, profile picture), the courses you can access, lesson progress, quiz results, comments, the mixes you submit and the feedback you receive from a Privilege Academy mentor, studio bookings, referral codes, orders and the file download log (which file, date, time, IP address, device).
Legal basis
Contract, to create your account and give you access to courses. Legitimate interest, for account security and protecting the courses against piracy: downloaded materials carry a personal watermark with your name and email, and the download log shows us where any unauthorised distribution started. Legal obligation, for paid orders.
How long we keep it
For as long as you have an account. Accounts inactive for 3 years may be deleted after we notify you by email. Download log (including IP address): 6 months. Paid orders and accounting records: 10 years, as required by tax and accounting law.

3.2. The in-person DJ School programme (Privilege DJ School app)

What data
Enrolment data, session schedule, attendance and QR check-in at the studio, session journal, homework, playlists, the video and audio recordings you upload, chat messages with your mentor and course materials.
Legal basis
Contract.
How long we keep it
2 years after the programme ends. You can export or delete your data at any time. Accounting records (invoices, payments): 10 years.

3.3. Booking requests and services

What data
For booking DJs and artists, studio, equipment rental, videography, production, marketing, consultations and meetings: name, phone, email, event details and form answers; the offers we send; contracts you sign (which may contain your personal identification number (CNP), ID card details, address and IBAN), proforma invoices and invoices; for studio sessions, the image-rights assignment.
Legal basis
Steps taken at your request before entering a contract, and performance of the contract. Legal obligation, for accounting and archiving.
How long we keep it
Requests that do not become a contract: 12 months. Contracts, invoices and other accounting records: 10 years.

3.4. Event tickets

What data
Buyer's name, email, phone, member code (if you have one), payment status and entry time at the event (staff scan the ticket's QR code at the entrance).
Legal basis
Contract. Legal obligation, for payment records.
How long we keep it
Unpaid or expired orders are deleted after 3 months. Paid tickets are kept as long as accounting law requires for payment records (10 years). The entry time is deleted together with the ticket.
  • For stamping tickets with the local tax office we only send aggregated documents (ticket numbers and series), with no personal data.

3.5. Limited-spot offers (for example Black Friday DJ Pro Career)

What data
Name, email, phone and payment status.
Legal basis
Contract.
How long we keep it
Unpaid or expired orders are deleted after 3 months. Paid orders are kept for 10 years, for accounting.
  • After payment we contact you to schedule the programme together.

3.6. Privilege Community

What data
Name, email, phone, age (minimum 16), social media handle, preferred cities and music genres; member card and code; invitations and offers you receive; whether and when you opened our emails (number of opens and time, no IP address); participation in prize draws.
Legal basis
Consent, given when you sign up. You can withdraw it at any time through the unsubscribe link in every email or by writing to us. Withdrawal does not affect what happened before.
How long we keep it
Until you unsubscribe or withdraw consent, or after 24 months of inactivity.
  • You receive event invitations and member offers by email. To know what works, our emails contain a tiny image that tells us whether and when they were opened.
  • We hold prize draws among members. Winners are picked at random and notified by email.
  • Under the same consent, we may use your phone number to send community announcements on WhatsApp or by SMS. Numbers are used only for community members and only for such announcements. If you no longer want them, tell us on WhatsApp or at contact@privilegeagency.eu.

3.7. Song requests and DJ tips (QR code at events)

What data
Name, email, phone (optional), the requested song, your message and the payment.
Legal basis
Contract.
How long we keep it
3 months if the payment was not completed. Otherwise, as long as accounting law requires for payment records (10 years).
  • The DJ only sees the song, your first name and your message.

3.8. Partners and ambassadors (referral programme)

What data
Name, email, phone, referral code, the referrals you bring, commissions and payments.
Legal basis
Contract. Legal obligation, for payment records.
How long we keep it
For the duration of the partnership. Payment records: 10 years.

3.9. Roster artists (artist portal)

What data
Stage name, contact details, availability, fees, uploaded documents, statistics and link page, booking proposals sent from the portal.
Legal basis
Contract. Legal obligation, for financial records.
How long we keep it
For the duration of the collaboration. Accounting records: 10 years.

3.10. Marketing emails

What data
Name, email, the fact that you agreed to receive offers and, if you unsubscribe, your address on the suppression list.
Legal basis
Separate consent, given by ticking a box yourself (it is never pre-ticked). Every email has an unsubscribe link.
How long we keep it
Until you unsubscribe. After that we keep your address only on a global suppression list, so that no part of the platform sends you such emails again.

3.11. B2B prospecting (data we did not receive from you)

What data
Business contact details of venues, clubs, festivals and event organisers, as they publish them: business emails, phone, Instagram account, names of contact persons; the history of proposals sent and whether they were opened.
Legal basis
Legitimate interest: proposing our artists for events (business-to-business prospecting).
How long we keep it
24 months from the last contact. If you unsubscribe, we keep only your address on the suppression list.
  • Source of the data: the businesses' own websites and public listings (venue guides, event pages, public profiles). We also find them using automated research tools.
  • Proposals are sent by the agency or by roster artists through the agency's platform. Every proposal contains an unsubscribe link.
  • You can object to this processing at any time: use the unsubscribe link or write to us and we will stop contacting you.

3.12. The website

What data
Technical server logs (IP address, date and time, page visited, browser type); sign-in attempts, to limit attacks; visit statistics with Google Analytics 4, only if you accept them; messages sent through the contact form and the fact that you accepted this privacy policy.
Legal basis
Legitimate interest, for the operation and security of the website. Consent, for Google Analytics. Pre-contractual steps, for the contact form.
How long we keep it
Technical logs: a short period, as long as needed for security. Google Analytics data: up to 14 months. Contact form messages: 12 months, unless they lead to a contract.

3.13. Record of your consents

What data
What you accepted (cookies, communications, privacy policy) and when. We do not store your IP address.
Legal basis
Legal obligation: we must be able to prove that you gave consent (art. 7(1) GDPR).
How long we keep it
As long as we process data on the basis of that consent, and afterwards only as long as needed to prove it.

3.14. DJ Tools: Playlist generator

What data
If you have an account: the playlists you save and the tracks you save with the heart button (track title, artist, BPM and key). We don't link track searches and generator settings to you. The player preferences (volume, your streaming platform, mix length) stay only in your browser.
Legal basis
Contract, for the account features (saving playlists).
How long we keep it
Until you delete the playlist or your account.
  • To find similar tracks and play them, our server sends Deezer, Last.fm, YouTube, SoundCloud, Spotify and Apple only the track title and artist, with no data about you.
  • Cover images and 30-second audio previews load directly from Deezer's servers (France), which therefore receive your IP address, as with any image or file loaded from the internet.
  • The YouTube, SoundCloud, Spotify, Apple Music and Deezer players only start with your consent for external media. On Spotify, Apple Music and Deezer the full track plays only if you're logged in to that platform in your browser; that account is managed by the platform, not by us.

3.15. The 5-day email challenge

What data
Your email, first name (optional), chosen language, the day you've reached and whether you stopped the emails.
Legal basis
Your request: you sign up to receive the 5 challenge emails (art. 6(1)(b)). Other news and offers only if you tick that separately (consent).
How long we keep it
Up to 12 months after the challenge ends or you stop it. You can stop the emails any time, from the link in every email.

4. Payments

Card payments (courses, tickets, song requests) are processed by EuPlătesc (EuroPayment Services S.R.L.). You enter your card details directly on the secure EuPlătesc page and they never reach us. We only receive the transaction confirmation: amount, order number and payment result.

5. Where we get your data from

  • Directly from you: through forms, your account, our apps, emails, phone calls or contracts.
  • From Google, if you choose to sign in with your Google account (name, email, profile picture).
  • From EuPlătesc: the payment confirmation.
  • From public sources, only for the B2B prospecting described in section 3.11.

6. Which data is mandatory

The fields marked as mandatory in our forms are needed to conclude and perform the contract (for example your email for an account or your invoicing details). Without them we cannot provide the service. Invoicing and contract details are also required by law. Consent for marketing, the community, statistics and external media is optional: if you do not give it, you can still use our services.

7. Who else receives your data

We work with providers that process data on our behalf, only on our instructions and under a contract:

Hostinger International
Website and email hosting
Where / safeguards: Website: server in the USA (Boston), under Standard Contractual Clauses. Email: in the EU
Supabase
Database
Where / safeguards: EU (Ireland)
Bunny.net (BunnyWay)
Private file storage and course videos
Where / safeguards: EU (Germany)
Amazon Web Services
Public website images
Where / safeguards: EU (Sweden)
Google
Google Analytics 4 (only with your consent)
Where / safeguards: USA, under the EU-US Data Privacy Framework
Google
Sign-in with Google
Where / safeguards: Under Google's policy; USA, under the Data Privacy Framework
Google Firebase
Archive of the former bookings.privilegeagency.eu app (retired on 29.10.2026) and scheduling of automated tasks
Where / safeguards: EU
YouTube (Google)
Video player in lessons and in the Playlist generator (only with your consent)
Where / safeguards: USA, under the Data Privacy Framework
Deezer
Cover images and audio previews in DJ Tools; the Deezer player, only with your consent
Where / safeguards: EU (France)
SoundCloud
The SoundCloud player in DJ Tools and on artist pages (only with your consent)
Where / safeguards: EU (Germany)
Spotify
The Spotify player in DJ Tools (only with your consent)
Where / safeguards: EU (Sweden)
Apple
The Apple Music player in DJ Tools (only with your consent)
Where / safeguards: Under Apple's policy; USA, under the Data Privacy Framework
EuPlătesc
Card payment processing
Where / safeguards: Romania
Anthropic
AI tools used internally for research and administration
Where / safeguards: USA, under Standard Contractual Clauses / Data Privacy Framework
WhatsApp (Meta)
Community announcements sent on WhatsApp
Where / safeguards: Under WhatsApp's policy

From the former booking app we still keep only 3 old photobooth payments. Such data is no longer collected.

Others receive data only as far as they need it: roster artists and mentors (for example the DJ sees your song request, your mentor sees your homework), our accountants, and public authorities when the law requires it.

We do not sell or rent your data.

8. Transfers outside the EU/EEA

Some data reaches the USA: the website server (Hostinger, Boston), Google Analytics, YouTube and Apple Music (only with your consent), Google sign-in and Anthropic's AI tools. These transfers rely on Standard Contractual Clauses approved by the European Commission or on the adequacy decision for the EU-US Data Privacy Framework, where the provider is certified. You can ask us for details about these safeguards at contact@privilegeagency.eu.

9. Your rights

  • Access: you can find out what data we hold about you and get a copy.
  • Rectification: you can correct inaccurate or incomplete data.
  • Erasure: you can delete your account yourself in your account settings with the “Delete account” button, or write to us. We only keep what the law requires (for example invoices).
  • Restriction: you can ask us to pause the use of your data, for example while we check a complaint.
  • Portability: you can receive your data in a commonly used electronic format. In the DJ School app you can export it directly.
  • Objection: you can object to processing based on legitimate interest and, at any time and without giving a reason, to direct marketing.
  • Withdrawing consent: at any time, as easily as you gave it (the unsubscribe link, “Cookie settings” in the site footer, or an email to us).
  • We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

To exercise your rights, email contact@privilegeagency.eu. We reply within 30 days at the latest. If a request is complex, we will tell you within that period that we need more time, as the law allows. We may ask you to confirm your identity so that we do not give your data to someone else.

If you believe we are not respecting your rights, you can lodge a complaint with the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest, www.dataprotection.ro, or with the authority in the EU country where you live. Please write to us first: most issues can be solved quickly.

10. Automated tools and AI

We use automated tools internally, including AI, for research (for example finding venues and organisers for B2B prospecting) and for administration. They do not make decisions about you on their own: decisions about contracts, courses or the community are made by our team.

11. Minors

Our services are not intended for children under 16. You must be at least 16 to join Privilege Community. Contracts for people under 18 are concluded with the consent and signature of a parent or guardian. If you are a parent or guardian and believe a child has sent us data, write to us and we will delete it.

12. How we protect your data

  • Connections to the website and apps are encrypted (HTTPS).
  • Passwords are stored only as an irreversible hash.
  • Team members can access only the data they need for their role and enter the admin panel only with two-factor authentication (password or Google account, plus a code from an authenticator app on their phone). For this we store, on team accounts, the authenticator key (encrypted) and the backup codes (only as a hash).
  • Private files (course materials, documents, your uploads) are stored privately and open only through temporary links.
  • We limit sign-in attempts and keep data only as long as necessary.

13. Cookies

Details about the cookies and local storage used on the site, and how to change your choice, are in our Cookie Policy.

Read the Cookie Policy

14. Changes

We update this policy when the way we process data changes. The date of the last update is shown at the top. If a change is significant, we will also let you know by email or on the website.

15. Terms and conditions

The rules for using the website and our services (copyright, payments, cancellations) are in our Terms and Conditions.

Read the Terms and Conditions