Privacy policy

The controller responsible for data processing is DJ Robinho, proprietor Robin Kolb, Carrer de S’Illot 13, 07400 Alcúdia, Spain.

Email: info@dj-robinho.com

We use the information in your enquiry to check availability, understand your event, prepare a proposal and communicate with you. If you select other suppliers, we check their availability for you using the event type, date, location and guest count; we only pass on your name and contact details after checking with you. As a rule you receive an automatic confirmation email at the address you provided shortly after submitting; it repeats your name, the event type, date and location of your enquiry.

For your enquiry, we collect the event type, fixed event date, event location, planned start and end timings, guest count, first and last name, your address for the quote (street and house number, postal code, city, country), email address, phone number, the preferred contact method, music styles, technical areas and requirements (including the answer “Not sure yet”), a short description of your event, and your answer on how you heard about us. These details are mandatory because we need them for a binding quote. We also record which other suppliers we should contact for you (or that you need none) and, voluntarily, whether we may recommend a DJ from our agency if we are not available on your date. We also store a coarse source group for your enquiry (for example Google, Instagram or a direct visit); the address of the previous page is not transmitted.

The legal basis is Article 6(1)(b) GDPR for pre-contractual steps and contract performance. Where a statutory retention obligation applies, Article 6(1)(c) GDPR also applies. We store the coarse source group on the basis of our legitimate interest (Article 6(1)(f) GDPR) in understanding through which channels enquiries arrive; it is deleted together with the enquiry. Your answer on how you heard about us is mandatory in the form. We process it on the basis of our legitimate interest (Article 6(1)(f) GDPR) in understanding which channels enquiries come from; it is deleted together with the enquiry. Contacting other suppliers happens at your request (Article 6(1)(b) GDPR). We only recommend a DJ from our agency with your consent (Article 6(1)(a) GDPR); you can withdraw it at any time by email.

When the site is opened, the IP address, time, requested URL, referrer, browser and device information may be processed technically. This supports secure delivery, stability and abuse detection. The legal basis is Article 6(1)(f) GDPR; the legitimate interest is the secure and reliable operation of the website. The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA; server functions run in the Frankfurt am Main (Germany) region; page requests are received by a global network at the nearest location, which pre-processes them there (language selection, redirects) and delivers static content. Transfers to the USA rely on EU standard contractual clauses (Article 46 GDPR) and, where the certification is in place, on the EU-US Data Privacy Framework. According to its documentation, Vercel keeps access logs only briefly for troubleshooting and abuse prevention.

We count how often the pages of this website are opened, even if you give no consent. This happens without cookies and without storing anything on your device. Only the following are processed: the page path without its query string, the language version, the country derived at the network entry point, a traffic-source group (search engine, social network, direct visit, referring domain or the campaign tag utm_source from the link — never the full referring address), a coarse device category (phone, tablet, computer) and the time during which the page was visible, plus whether the enquiry button was pressed, a service was selected, the enquiry form was started or submitted, or an external video was approved — only the category, never form contents. Your IP address is not stored; it only feeds a visitor key built with a random value that is generated fresh each day (daily key). Only the coarse device category is derived from your browser identification; the identification itself is not stored. The daily key is deleted no later than the second day after your visit; from its deletion on, recognising you beyond a single day is technically impossible. The visitor key itself remains part of the individual events for up to 90 days (see Retention). No cookies are set and no individual visit histories are shown; the evaluation consists solely of daily totals. Countries are named individually, even when only a single view came from a country on a given day. Views inside the admin area are not counted, and the data is not passed on to third parties.

After your explicit consent, we enable Vercel Web Analytics and Speed Insights. Page views, referrers, approximate region, device and browser information, technical Web Vitals and only the following interaction categories may then be processed: an enquiry-action click, the selected event format, moving to the second form step, the submission result and approval of an external video. Names, email addresses, phone numbers, event locations, dates, messages and internal enquiry IDs are never sent as analytics events. According to Vercel, Web Analytics uses no cookies and stores anonymised data; your choice is stored locally in your browser.

The legal basis of our own visitor count is our legitimate interest in a simple measurement of reach (Article 6(1)(f) GDPR). You can object to this processing at any time (Article 21 GDPR): if your browser sends the Global Privacy Control or Do Not Track signal, we do not count your visit. You can also send us a short email to the address under Privacy contact. Our own visitor count sets no cookies and stores nothing on your device; only your choice itself is stored there so that it still applies on your next visit. We enable Vercel Web Analytics and Speed Insights only with your consent (Article 6(1)(a) GDPR); you can withdraw it at any time through the privacy settings with effect for the future. Web Analytics and Speed Insights remain disabled until you make a choice.

Embedded videos, maps, social or scheduling content loads only after your consent or a deliberate action. Approved Google reviews are instead delivered from our own system, so viewing them creates no direct connection to Google. Only the link to the original opens Google.

Depending on the content you activate, this may include YouTube and Google services, Instagram and WhatsApp from Meta, Spotify, Vimeo and Calendly. External links open the relevant provider’s website, where that provider is independently responsible for further processing.

Where consent is required, the legal basis is Article 6(1)(a) GDPR. You can withdraw consent at any time with future effect. Editorially approved Google reviews are published on the basis of Article 6(1)(f) GDPR; our legitimate interest is to provide a verifiable account of genuine customer experience. You may object to this processing on grounds relating to your particular situation.

Data is shared only with service providers needed for hosting, email, communication or the specific event delivery, and with participating partners when this is necessary for your enquiry or contract. Processors are bound under Article 28 GDPR where required. We use Resend as the email processor for the private notification sent to the website owner. Resend receives the configured business recipient address and the form details you submit about the event, date, location, guest count, contact details, address, music, production requirements, message and your choices on the agency recommendation and other suppliers; your email address is also set as Reply-To so the owner can respond directly to your enquiry. The technical delivery outbox stores no form-content fields. It does store the private recipient address, the internal inquiry reference, delivery status, lock and retry data, and the provider message ID. The static subject, application URLs, technical logs and provider receipt contain no form values; the internal inquiry reference does not appear in the subject. For automatic translation in the protected CMS, only deliberately approved public marketing copy is sent to OpenAI Ireland Ltd. as a processor. Booking, contact, email, telephone, legal and admin content is technically excluded. Processing supports consistent multilingual publishing on the basis of legitimate interests under Article 6(1)(f) GDPR. According to the provider, API content is not used for training by default unless explicitly shared for that purpose. Storage of responses for later retrieval is disabled for this feature. Abuse monitoring logs may contain content for up to 30 days by default; longer retention is possible when required by law or to protect the service and third parties. This is not a Zero Data Retention commitment. For customers in the EEA, OpenAI Ireland Ltd. is the contracting entity; transfers outside the EEA rely on adequacy decisions or EU Standard Contractual Clauses under the OpenAI DPA. The feature remains disabled without a server-side API key. The enquiry inbox, the admin area and the website media are hosted by Supabase Inc. (USA) as a processor; data is stored in the eu-central-1 (Frankfurt, EU) region, and transfers to the USA rely on EU standard contractual clauses under the Supabase DPA. Your confirmation email is also sent through Resend; it contains your name, the event type, date and location of your enquiry.

Deliberately activated services may process data outside the European Economic Area. Such a transfer takes place only on the basis of a valid adequacy decision or appropriate safeguards under Chapter V GDPR. The specific provider information is displayed with the relevant service or in that provider’s privacy notice.

New and active enquiries are stored in the enquiry inbox for no longer than 180 days. Enquiries marked as closed or spam are deleted within 30 days. If an enquiry becomes a contract, the inbox record is deleted no later than 30 days after the required contract data has been transferred; contract and billing data remains only for statutory retention periods. The notification status and technical delivery metadata are linked to the enquiry through the outbox and are deleted with it; the recipient-change audit is stored for no longer than 365 days. According to Resend's current provider documentation, Resend retains email data for 30 days across all plans; production backups are also retained for 30 days. These periods are separate from our local enquiry inbox and the owner's email mailbox. Local deletion does not automatically remove an already-sent notification from the email mailbox and does not mean immediate deletion from Resend backups. Messages in the email mailbox are not deleted automatically; they are deleted manually once enquiry handling is complete and no required contractual or legal retention reason remains. Because Resend keeps backups for 30 days, we do not promise immediate deletion from all provider backups. For imported Google reviews, we remove the reviewer name, star rating and review text no later than 30 days after the last successful sync. Technical abuse-prevention keys expire after no more than 24 hours.

The individual events of our own visitor count are deleted after 90 days at the latest; only daily figures without any personal reference remain. The daily key (random value) from which the visitor key is built is deleted no later than the second day after the visit.

For every enquiry we anonymously count, on receipt, the week it arrived, the country, the event type, the language version and the channel – each item separately, without name, contact details or message. These weekly figures remain after the enquiry has been deleted; from then on rare values are merged, and after 25 months the figures are deleted as well. The legal basis is our legitimate interest in evaluating demand (Art. 6(1)(f) GDPR).

Subject to the statutory conditions, you may exercise the following rights:

• Access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent for the future.

You may lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or the place of the alleged infringement. The authority responsible for the controller is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es.

Technically necessary storage may be used to provide the website securely. Non-essential cookies or comparable technologies are activated only after consent. Consent can be withdrawn for the future at any time through the privacy settings offered on the website.

A message is sufficient for privacy questions or to exercise your rights. Please do not send sensitive information that is not required to handle your request.

Email: info@dj-robinho.com