Privacy Policy & Data Protection Notice
TourAndTunes.com (“we”, “us”, “our”) respects your personal privacy and is committed to safeguarding personal data in accordance with the European Union General Data Protection Regulation (GDPR – Regulation (EU) 2016/679), the UK Data Protection Act 2018, the California Consumer Privacy Act (CCPA/CPRA), and international privacy frameworks.
Core Privacy Principle
TourAndTunes is built with privacy-by-design. We do not require you to create an account, enter credit card details, or provide your real name simply to discover concert dates. When tracking outbound referral clicks, we discard raw IP addresses and only retain cryptographically salted, non-reversible SHA-256 hashes.
1. Who We Are (Data Controller)
The data controller responsible for the processing of data on TourAndTunes.com is the TourAndTunes Platform Team. For any privacy-related questions or data rights requests, please contact our Data Protection Officer at privacy@tourandtunes.com.
2. Information We Collect & How We Use It
| Data Category | What We Collect | Legal Basis (GDPR Art. 6) | Retention Period |
|---|---|---|---|
| Outbound Referral Logs | Salted SHA-256 hash of IP address, timestamp, browser user-agent, target concert ID. | Legitimate Interests (Art. 6(1)(f)) for bot prevention and aggregate click counting. | 90 days rolling retention, then permanently deleted. |
| Newsletter Subscription | Your email address and chosen genre/city preferences. | Explicit Consent (Art. 6(1)(a)). | Retained until you click Unsubscribe. |
| Saved Concerts (Favourites) | Concert IDs and timestamps stored locally in your browser’s LocalStorage. | Device storage consent / strictly functional. | Stored solely on your device; never transmitted to our servers. |
| Contact Inquiries | Name, email address, inquiry topic, and message content. | Performance of a Contract / Pre-contractual steps (Art. 6(1)(b)). | 12 months after inquiry resolution. |
3. No Sale of Personal Data
We do not sell, rent, monetize, or lease personal information or user identities to third-party data brokers, advertising networks, or marketing agencies under any circumstances.
4. Third-Party Ticketing Platforms
TourAndTunes contains outbound links to authorised ticketing sellers including Ticketmaster, StubHub, TicketNetwork, and viagogo. Once you click a link and navigate away from TourAndTunes.com, your personal data and financial transactions are governed strictly by the privacy policy and terms of service of that specific provider. We encourage you to review their respective privacy policies prior to completing purchases.
5. Your Rights Under GDPR & International Law
Depending on your geographic jurisdiction (including the EU, UK, and California), you possess specific legal rights regarding your personal information:
- Right of Access (Art. 15 GDPR): Request confirmation of whether we hold personal data relating to you and obtain a copy.
- Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal records.
- Right to Erasure (“Right to be Forgotten” – Art. 17 GDPR): Request deletion of your personal data where retention is no longer justified.
- Right to Restrict Processing (Art. 18 GDPR): Limit how your personal data is utilized under specific contested circumstances.
- Right to Data Portability (Art. 20 GDPR): Receive your personal data in a structured, machine-readable format.
- Right to Object (Art. 21 GDPR): Object at any time to data processing carried out based on legitimate interests.
- California Consumer Rights (CCPA / CPRA): California residents have the right to know what personal information is collected, request deletion, and opt out of any data sharing.
To exercise any of these rights, simply email our compliance desk at privacy@tourandtunes.com. We respond to all verified requests within 30 days without fee.
6. Security Measures
We implement robust technical and organizational security measures to protect your browsing sessions, including 256-bit TLS/SSL encryption across all endpoints, automated bot scrubbing, strict firewall configurations, and regular vulnerability assessments.