Last updated: 24.08.2026

NOCTURN MUSIC takes the protection of personal data seriously. This policy explains what we collect, why we collect it, and what rights you have.

1. Who is responsible

The controller responsible for data processing on this website is:

NOCTURN MUSIC S.à r.l.
8, Rue de Hobscheid
L-8422 Steinfort
Luxembourg

Represented by: Adrian Dony
RCS Luxembourg: B172650
Email: nocturn.music.management@gmail.com

We have not appointed a Data Protection Officer, as we are not legally required to do so.

2. Hosting

This website is built and hosted by Framer B.V., Rigakade 20, 1013 BC Amsterdam, Netherlands. When you visit the site, Framer's servers automatically process technical information sent by your browser, including your IP address, browser type and version, operating system, referring page, and the date and time of access.

This processing is necessary to deliver the website securely and reliably. The legal basis is our legitimate interest in operating a functional and secure website (Art. 6(1)(f) GDPR). Framer acts as our processor under a data processing agreement.

3. Contact form

The contact form on our Contact page collects your name, your email address, and the content of your message.

We use this information solely to read and respond to your enquiry. The legal basis is our legitimate interest in responding to enquiries directed at us (Art. 6(1)(f) GDPR), or where your message concerns a possible agreement, the steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

We keep contact enquiries for 12 months after our last exchange, unless the conversation leads to a business relationship, in which case retention is governed by section 7.

4. Booking form

The booking form on our artist pages collects the following required information: your name, your email address, the event date, and the event location.

You may also provide the venue, event type, capacity, budget, and any additional notes. These fields are optional and the form can be submitted without them.

We use this information to assess and respond to booking enquiries and to coordinate with the artist concerned. Where relevant, we share the details of your enquiry with the artist you are enquiring about, so that they can consider the request. The legal basis is the steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in conducting booking activity on behalf of the artists we represent (Art. 6(1)(f) GDPR).

We keep booking enquiries for 24 months, so that we can maintain continuity with promoters and venues across seasons. Where an enquiry leads to a confirmed booking, retention is governed by section 7.

5. Artist applications

Our Apply page links to an external application form hosted by Tally (Tally BV, Belgium). When you follow that link, you leave this website and your submission is processed on Tally's infrastructure. Tally's own privacy policy applies to your use of their platform: https://tally.so/help/privacy-policy

We receive the content of your application, which may include your name, contact details, links to your music and profiles, and the background information you choose to share. We use it solely to review your application and to contact you about it. The legal basis is the steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

We keep applications for 12 months after our decision, so that we can revisit projects as they develop. You can ask us to delete your application at any time.

6. Spotify player

Artist pages on this website include a music player provided by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden.

The player only loads once you actively choose to start it. Until then, no connection to Spotify is established and no data is sent to them. When you start the player, your IP address, browser information, and details of the content you play are transmitted to Spotify. Spotify may set cookies or similar technologies on your device and, if you are logged in to a Spotify account, may associate this activity with that account.

The legal basis is your consent (Art. 6(1)(a) GDPR), which you give by starting the player. You can withdraw it at any time by not using the player and by clearing the cookies set by Spotify in your browser settings. Withdrawal does not affect processing that took place before withdrawal.

We have no influence over how Spotify processes this data and no access to it. For details, see Spotify's privacy policy: https://www.spotify.com/legal/privacy-policy/

7. Email and business records

Enquiries and applications reach us by email. Our email service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Correspondence sent to us is stored on Google's infrastructure, which may involve transfers to servers outside the European Union. Google LLC is certified under the EU-US Data Privacy Framework, and transfers are additionally covered by Standard Contractual Clauses adopted by the European Commission.

The legal basis is our legitimate interest in reliable business communication (Art. 6(1)(f) GDPR) and, where relevant, the performance of a contract (Art. 6(1)(b) GDPR).

Where an enquiry becomes a business relationship, we retain the relevant records for as long as necessary to perform the agreement and thereafter for the retention periods required by Luxembourg commercial and tax law, which is generally ten years.

8. Analytics

We use Framer Analytics to understand how the website is used, for example which pages are visited and where visitors arrive from. Framer Analytics does not use cookies, does not store data on your device, and does not create profiles or track individuals across websites. The data we see is aggregated and does not allow us to identify you.

The legal basis is our legitimate interest in understanding and improving the performance of our website (Art. 6(1)(f) GDPR).

9. Cookies

This website does not set tracking or advertising cookies of its own. The only cookies that may be placed on your device come from the Spotify player described in section 6, and only after you choose to start it. You can delete or block cookies at any time in your browser settings.

10. Transfers outside the EU

Our providers process data within the European Union or European Economic Area wherever possible. Where a transfer to a third country takes place, it is covered by an adequacy decision of the European Commission, by certification under the EU-US Data Privacy Framework, or by Standard Contractual Clauses adopted by the Commission, together with any additional safeguards required.

11. Your rights

Under the GDPR you have the right to:

• Request access to the personal data we hold about you (Art. 15)

• Have inaccurate data corrected (Art. 16)

• Have your data deleted (Art. 17)

• Have processing restricted (Art. 18)

• Receive your data in a portable format (Art. 20)

• Object to processing based on legitimate interest, including on grounds relating to your particular situation (Art. 21)

• Withdraw consent at any time, where processing is based on consent (Art. 7(3))

To exercise any of these rights, contact us at nocturn.music.management@gmail.com. We respond within one month.

You also have the right to lodge a complaint with the Luxembourg supervisory authority:

Commission nationale pour la protection des données (CNPD)
15, Boulevard du Jazz
L-4370 Belvaux
Luxembourg
www.cnpd.lu

12. Automated decision-making

We do not use automated decision-making or profiling. Applications and enquiries are reviewed by a person.

13. Children

This website is not directed at children under 16. We do not knowingly collect data from children under 16.

14. Changes to this policy

We may update this policy to reflect changes to the website or to legal requirements. The current version always applies and is dated at the top of this page.