Privacy policy

We collect little: your email, what you declared about the show you want and, if you choose to, a few details about you that help us size the event. We don't sell data. We don't use advertising networks. We don't set tracking cookies.

You can take everything we have about you, in a file, directly from your account. You can delete your account from there too, without writing to us.

The sections below describe the fan account. If you are an artist, management or a promoter, section 5 is yours: it sets out what we collect in addition and who sees what.

If you just want to ask us something or complain about something: office@unbooked.ro.

Tune Score SRL, with the identification details on the About the operator page, decides why and how the data described here is processed. You can get in touch with us at office@unbooked.ro.

We have no legal obligation to appoint a data protection officer and we have not appointed one: we do not process data on a large scale and we do not systematically monitor anyone. Questions on this subject go to the same address.

When you create your account and sign up: your email, the city and the artist, the number of tickets you declared, the maximum amount you would pay for a ticket (we don't ask for it for a show whose tickets are already on sale) and, if you write one, the optional sign-up message.

A Founding Fan code, which you don't give us but which we create for you when your account is created: six random characters, only one per account, the same across all your shows. It says nothing about you and cannot be turned back into data; it exists so that the organiser can give you the promised discount without finding out who you are. It disappears together with the account.

Your phone number, if you want to give it to us: it is optional. We use it for two things: so that we can notify you by means other than email about the show you requested, and so that the same number cannot be on two accounts, so that one person is not counted twice. If the number you enter already belongs to another account, the form stops before anything is created and tells you so, and you can delete it and continue without it. You can add, change or delete it at any time from your account, and signing up works without it too.

Optionally, at any time from your account ("About you"): your age range (not your date of birth), your gender, the locality where you live and how you found out about the show. You can skip any of them, and change or delete them at any time.

Technically, to keep the platform running: the IP address is used to limit abuse (how many sign-ups and how many codes start from the same place). We don't keep it in clear text: it is transformed through a hash with a secret key, and the row is deleted automatically after 30 days.

If you reach a ticketing platform through an UNBOOKED link, we record the click with a pseudonymised technical identifier (a hash of the IP address and of the browser), so that we can link a sale to a city. The organiser may later tell us that your sign-up turned into a ticket.

UNBOOKED does not collect or store payment data. We don't see your card, we don't see your billing address and we don't receive your purchase history: those stay with the ticketing platform.

So that the account and the sign-up exist, that is, the service you asked us for: the email, the city, the artist, the quantity and the declared amount. The legal basis is the performance of the contract between us (Art. 6(1)(b) GDPR); without them we cannot sign you up.

To tell you what is happening with your show (confirmation, venue, the opening of the sale, a reminder if you haven't bought yet): also the performance of the contract. Reminders can be turned off with a single switch, from your account.

To protect the platform from abuse (bots, codes requested in a chain): our legitimate interest in keeping the figures accurate for artists and promoters (Art. 6(1)(f) GDPR). This covers the hashed IP address, the traffic limits and, if you give it, your phone number: a number that already belongs to another account stops the sign-up before the account is created or any code is sent. The phone number remains optional, so signing up works without it.

The optional details about you (age, gender, locality, source): your consent (Art. 6(1)(a) GDPR), which you give by filling them in and withdraw by deleting them. We analyse them only in aggregate, by city and by campaign; they are not displayed publicly and no individual decisions are made on the basis of them.

The newsletter about the artist and the show, if you ticked it: your consent. You can unsubscribe at any time, from any email you receive or from your account.

When you sign up for an artist, you stay connected to them: we will write to you when they confirm a show, when they open a new city or when their team has something to say to fans. The legal basis is the performance of the contract: you asked for that show and you have the right to know what happens with it. It stops with a single click, from any email you receive or from the My artists page in your account, and stopping it does not affect your sign-ups in cities. The artist sees only figures, never your name or your address.

Measuring use of the site (section 10): the legitimate interest in fixing the path to signing up, with a measurement that writes no cookie and does not recognise you from another site.

We do not take automated decisions with legal effects on you and we do not carry out individual profiling. The Founding Fan number is the order of sign-up, nothing else.

Sections 3 and 4 describe the fan account. If you claim an artist profile, manage an organisation, create a promoter account or list your venue, we additionally process the data below. It is professional data, yours as the representative of a company, not consumer data.

From an artist organisation: the legal name, the CUI (Romanian tax identification code), the number in the Trade Register, the registered office, and the contact email and phone number. From an artist's team: each member's email, their role and their rights in Studio. Plus the materials you upload, which are the artist's page itself: stage name, photos, covers, posters, texts and links.

From a promoter account, in addition to the company details: the name of the legal representative, whether your company finances the shows or you represent someone else, the artists you have promoted in the last 12 months, references from agents and managers, and the venues you work with. We ask for them so that we have something to verify an account against; without them it stays pending and does not see the fans' figures.

From a venue account: the venue's name, its city and address, its type and how many people it holds, what facilities it has and what events have been held there before, plus the name of the contact person, the email and, if you give it, the phone number. Optionally, the legal name and the CUI, which we ask for only so that we can verify the venue; without them the listing stays pending. Plus the venue's photos, its social media accounts and the artists you have requested in your city, if you have requested any.

The legal basis is the performance of the contract between us (Art. 6(1)(b) GDPR): without this data we cannot open the account and cannot support the service you asked us for. The verification of a promoter additionally relies on our legitimate interest (Art. 6(1)(f)) in not opening the figures declared by fans to someone who does not produce shows.

Who sees what, in short. The artist's name, photos and campaign materials are public: that is the whole point of the page, and what you allow us to do with them is set out in section 8 of the Terms. Of the organisation behind an artist, the public sees only its name and page address; the legal name, the CUI, the registered office and the contacts appear nowhere on the site. A promoter's file is seen only by us, the UNBOOKED team: it reaches neither artists nor other promoters.

Of a verified venue, the public sees the venue's name, the city, its type, the capacity, the website and the social media accounts if you gave them, and the photos you upload. The address, email, phone number, legal name and CUI do NOT appear publicly: only we, the UNBOOKED team, see them, and the contact details are passed on only to whoever asks for them through us. While the venue is under verification or rejected, it appears nowhere.

If you turn on notifications on your phone, we keep the address of your device given by your browser and the two keys with which the message is encrypted. That address is personal data: whoever has it can send you notifications. We use it for exactly two things, also written on screen when you turn it on · when your city reaches its threshold and when tickets open · and for nothing else. The message leaves encrypted: neither we nor the push service (Google, Apple, Mozilla) can read it after it has left, only your browser. You turn them off from the same screen where you turned them on, or from your phone's settings, and we then delete the address. It is also deleted when you delete your account.

If you write to the assistant on the site, the question and the conversation go to Anthropic, which writes the answer, and we do not save them. The assistant answers only from what is public on the site and cannot see your account. Don't write personal data to it. If you press “Send to the team”, we keep your email, the question, the conversation if you left the box ticked, and our reply, so we can answer you.

If you request an artist in your city, the page of that city shows publicly that your venue has offered to host, with its name, type and capacity and with its first photo. You withdraw it yourself, from the portal, and the offer disappears from the page.

At the same time, your contact details · the contact person, the email, the phone number and the venue's address · reach the organisation that holds the profile of the requested artist and its team, by email and in their portal, so that they can contact you directly. That is the very point of the request: that there should no longer be an intermediary between your venue and a show. If the artist's profile has not been claimed by anyone, the data stays with us until someone claims it. We use and pass on the data only for the discussion about a show; the legal basis is the legitimate interest of both parties (Art. 6(1)(f) GDPR) in connecting a venue that wants an artist with the artist that is wanted. If you don't want this, don't open the request or withdraw it: the venue's listing stays public without contact details, as before.

The terms of an offer (the venue, the date, the fee, what you cover) are seen by the other party to the negotiation and by us. Other promoters see nothing of your offer, not even its content: on the city page they are shown only how many have already claimed it, as a number.

How long we keep it and how it is deleted. The account data remains for as long as the account exists. An artist organisation can delete itself from Studio, and the artist's profile becomes unclaimed again. For a promoter account and for a venue we have not yet built deletion from the portal: it is done by writing to office@unbooked.ro, and we carry it out within the legal time limit. We prefer to write this rather than give the impression of buttons that don't exist.

The offers and messages in a negotiation remain for as long as the campaign they relate to exists, because they are the history of a commercial arrangement between two companies, not consumer data.

With the providers the platform depends on, which process the data only for us and according to our instructions: Supabase (the database and authentication), Cloudflare (hosting of the site), Resend (sending emails), Google (the email inbox through which you write to us) and Anthropic (the assistant on the site, which receives your question to write the answer). With each of them we have the contractual arrangements required by the GDPR.

With the artist's organisation and with promoters verified by us: only in aggregate form, by city and by campaign. They see how many fans have signed up, how many tickets they would buy, the average and the distribution of the declared amounts and the distributions of age, gender, residence and source. They do not see emails, phone numbers or individual answers, and they cannot contact anyone on the basis of them.

The full report for a city, which the artist can issue as a document and can send to a promoter, a venue or a sponsor, contains the same aggregate distributions and nothing more. A promoter receives it only after the artist accepts their claim on that city. When fewer than five fans have signed up in a city, the distributions are not shown anywhere and are not printed in any report, because with small numbers a distribution can point to a particular person.

Your Founding Fan code, when the show reaches the ticket stage. It is a code we give you, only one per account, and it is the only individual item that can leave us for the organiser or their ticketing platform: only the list of valid codes for that city, so that they receive the promised discount. No names, no emails, no phone numbers and not the amounts you declared. The code cannot reveal who you are and no one can contact you on the basis of it.

With the ticketing platform: apart from the codes above, nothing from our side. When you press the ticket link, you go to them as to any other site, and what happens there is governed by their policy.

With the authorities, if the law requires us to. We do not sell or rent data to anyone.

The data is stored on servers in the European Union. The providers above are companies with a presence in the United States, and for situations in which data would end up outside the Union we rely on the standard contractual clauses approved by the European Commission.

The account and the sign-ups: for as long as you have an account. When you delete it, they disappear the same day.

The log of the emails we have sent you: for as long as you have an account, so that we don't send you the same message twice.

The technical data for limiting abuse (the hashed IP address): 30 days, then it is deleted automatically.

Questions sent to the team from the assistant: 12 months, then they are deleted automatically.

The measurement of site use: at most 180 days, then it is deleted automatically.

After the account is deleted, a line remains with no name, no email and no phone number, which says only that someone once asked for a show in a city. We keep it because the Founding Fan numbers of the other fans are assigned in order, and deleting the line would move all the others from their place. The line can no longer be linked to you.

You have the right of access, rectification, erasure, restriction, portability and objection, plus the right to withdraw your consent at any time, without affecting the processing carried out before.

Two of them are exercised directly from your account, immediately: "Download my data" gives you a file with everything we have about you, and "Delete account" removes you from all shows and deletes the data. You don't need us in order to use them.

The two buttons belong to the fan account. For an artist, organisation or promoter account, the rights are the same, but they are exercised by writing to us: see section 5.

For the rest, write to us at office@unbooked.ro. We reply within one month at most.

If you are not satisfied with how we handle your data, you can complain to the National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro), with its headquarters at B-dul G-ral. Gheorghe Magheru 28-30, Bucharest.

We use only strictly necessary cookies: the account session and the referral code, kept for 30 days. We don't use advertising cookies or cookies for measurement.

The Spotify player on artist and campaign pages is someone else's content and sets its own cookies. That is why it doesn't start on its own until you press "Start the player" once. Your choice stays in your browser, so the question appears only once, and after that the players start on their own.

The details, including how you change your choice, are in the Cookie policy.

To know where people get stuck on the way from a city page to signing up, we measure the funnel ourselves, with our own log. We use no external tracking service, no advertising network and no identifier that would recognise you from another site.

What we record at each step (for example "city page displayed", "form reached the screen", "sign-up completed"): a random session identifier, kept in the memory of the browser tab and deleted when you close it, the page path, a screen-width category (phone, tablet, desktop), the domain you came from (not the full address), the campaign parameters in the link if there are any, a few technical measurements of the step and the moment, taken from the server clock.

What we do NOT record: your name, email, phone number or the text you wrote. A filter on the server automatically discards, before writing, any value that looks like an email address or a phone number. The IP address is not stored in this log. If you are logged in, your steps may be linked to your account, so that we can respond to a request for access or erasure; if you are not, there is nothing that identifies you.

We use them only in aggregate, only ourselves, only to fix the path to signing up. We do not sell them, do not pass them on and do not make individual decisions on the basis of them. We keep them for at most 180 days, then they are deleted automatically.

If your browser sends the "Do Not Track" signal, we measure nothing. Because we write no cookie, do not recognise you across sites and nothing survives closing the tab, this first-party audience measurement does not require consent. If you still want to object, write to us at office@unbooked.ro.

The platform is not made for children under 16 and we do not ask them for data. 16 is the age from which Romanian law considers that you can consent on your own to the processing of your data in an online service.

If we find out that an account belongs to a child under 16, we delete it. If you are a parent and you think we have your child's data, write to us at office@unbooked.ro and we will sort it out immediately.

Access to data is restricted at database level: each row has rules that say who can read it, and the artist, promoter and administration portals see only what they are entitled to see. Traffic is encrypted, and the technical data that could identify someone is kept as a hash with a secret key.

If a breach occurs that puts your rights at risk, we notify the authority within 72 hours and we also notify you, directly.

When we change something important, we also change the date at the top of the page and we tell you by email if the change concerns you directly.

The version in force is the one published here.