Privacy Policy

1. Who we are

party.dj and feest.dj are operated by the sole proprietorship of Paul Eijkemans, established at Zwaluwborch 29, 5247 TK Rosmalen, the Netherlands, registered in the Dutch Chamber of Commerce trade register under number 72373458, VAT identification number NL001170748B63, trading under the names feest.dj and party.dj. We are the controller for the processing described in this policy. Contact: legal@party.dj.

2. What we process, why and on which legal basis

Account and profile data

Name, email address, password (stored as a hash) and, for DJs, the profile you build: photos, biography, location, music styles, event types, prices, links and availability. Basis: performance of our agreement with you. Only the artist name and email address are required to create a DJ account; the rest of the profile is optional and you choose what to fill in. For an Organisation account, the organisation's name, type, a contact name and email address are required. Where a staff member of an Organisation is named as a contact person, our basis for processing that individual's name and email address is our legitimate interest in having a working point of contact for the Organisation we have an agreement with, not that staff member's own agreement with us.

DJ profiles are public. Everything you put on your profile is visible to visitors and, after launch, to search engines. Publish only what you want to share publicly.

Promotional use of profile photos (optional). In your dashboard you can separately give consent for your public profile photos to also be used on general content and SEO pages with which we promote the Platform itself, separate from your own profile. Legal basis: your consent, off by default and withdrawable at any time in that same dashboard; see article 8 of the terms for the exact scope and consequences of withdrawing.

An Organisation can add a DJ it manages to its roster before that DJ has their own account, entering at least the DJ's name. In that case we receive the DJ's data indirectly, from the Organisation rather than from the DJ. We inform the DJ about this processing within the statutory period of Article 14 GDPR: in principle no later than one month after we received the data, or sooner if our first contact with the DJ requires it, not only once their profile or account is set up, if that is later.

Requests, bookings and messages

When a Client submits an availability check or booking request we process event details (date, location, event type, guest count), contact details and the messages exchanged between Client and DJ. Basis: performance of the agreement for forwarding the request and facilitating the booking itself; legitimate interest for preventing fraud and keeping a record in case of a dispute about the booking.

Clients entered by an Organisation itself

An Organisation (booking agency) can enter a client into its private client management area itself, with name, contact details and booking details, where that client did not come in through the Platform. For that administration we are the Organisation's processor: the Organisation determines the purpose and, as controller, is also the party that informs you about it; it is obliged to do so under our data sharing and processor statement and confirms this when entering the data. We do not use this data for our own purposes, with one described exception: if you book through the Platform yourself, the completion process of section 6 may compare your email address and event date with open requests elsewhere on the Platform. That process only affects requests you submitted through the Platform yourself; with such a request of your own you see this privacy policy, so we inform you within the period of Article 14(3) GDPR (at the latest at that first contact). If anything is actually closed automatically, you immediately receive an email about it yourself, with a recovery option (see section 6).

Client account (optional)

Clients can create a free account to keep their request history. We then process the name, phone number, company name and linked email addresses you provide, to preserve your history and prefill forms for you. Basis: performance of the agreement, being the free account service you choose to use and can end yourself at any time.

Subscription and payment data

For paid plans our payment provider Mollie processes your payment details. We receive payment status, not your full bank details. Basis: performance of the agreement and legal (tax) obligations.

Calendar links and notifications

If a DJ connects an external calendar we store that calendar URL and read busy periods from it. If you enable push notifications we store the technical subscription for your device; you can switch this off at any time in the dashboard. Basis: performance of the agreement (at your request).

Reviews

Reviews are submitted through a personal link issued after a request or booking, so we can verify they come from real clients. The review, a first name and the event type may be shown publicly. Basis: legitimate interest in reliable, verified reviews.

Community, support and invitations

Posts and messages you post in the community channels are visible to other members of the same group. If you contact support we process your message and any attachments to help you; resolved support tickets are deleted automatically after the period set out in article 4. If you invite a colleague or are invited yourself, we process the inviter and invitee email addresses to administer that invitation and, where applicable, a referral reward. Basis: performance of the agreement (community and support are part of the service) and, for the welcome and informational emails we send, our legitimate interest in service-related communication; you can unsubscribe from non-essential emails at any time.

Technical data

Standard server logs (IP address, browser, pages visited) for security, abuse prevention and troubleshooting. Basis: legitimate interest. Logs are kept for 90 days.

3. Who receives your data

We do not sell personal data. We use these processors and providers:

• Supabase: database, authentication and file storage (EU region).
• Vercel: hosting and content delivery.
• Resend: transactional email delivery.
• Mollie: payment processing for subscriptions (Mollie is an independent controller for its own payment services).
• Google: Analytics 4, and the Places API to show Google reviews on DJ profiles. We do not currently use Google Ads; we may add it in the future. The measurement code only loads after you have given consent for analytics; without that consent your browser loads no measurement code from Google and nothing is measured, see the Cookie Policy. We call the Places API exclusively from our own server, with the DJ's business details; no data about you as a visitor goes to Google in the process. If you choose to display Google reviews on a DJ profile, we retrieve the current reviews live at that moment and show them, including the reviewer's name and profile photo as supplied by Google, without storing any of it; those profile photos are also served through our own server. Preview images of embedded videos and music are served through our own server as well, so your browser makes no connection to Google or other media platforms for those either until you press play.
• Anthropic: the AI model behind the search assistant and the translation of DJ profile texts. Questions you type into the search assistant and the profile texts of DJs are sent to Anthropic for that purpose only; please do not enter sensitive personal data there. Anthropic does not use data submitted through its API to train its models.
• Meta: campaign measurement for our Meta (Facebook, Instagram) advertising, in two forms that run together. The Meta Pixel in your browser only loads after your consent for marketing and does nothing before that, see the Cookie Policy. In addition, our server separately sends the same conversion events (such as signing up as a DJ or Organisation, or confirming a booking) directly to Meta, so measurement keeps working even if an ad blocker, incognito mode or browser tracking protection blocks the Pixel itself; this server-side sending uses the same marketing consent as the Pixel and sends nothing without it. For this server-side sending we transmit your email address and/or phone number, always hashed (never in readable form) so Meta can match the event to an ad campaign, together with your IP address, browser user agent and Meta's own browser id cookies. A hashed value is not the same as anonymous data: it is specifically designed to let Meta match it to an account, so we treat and protect it as personal data.

Processors are bound by data processing agreements. Where providers process data outside the EEA (for example in the United States), transfers are safeguarded by the EU Standard Contractual Clauses or an adequacy decision such as the EU-US Data Privacy Framework.

In addition, the content of a request or message is shared with the DJ (or their agency) you contact, and vice versa; that is the purpose of the Platform. The DJ or agency becomes an independent controller for that data once received: they decide for themselves how they use it to prepare and deliver the booking (for example contacting you about the event), and are responsible for their own compliance for that use. The Platform remains the controller for its own processing of the same data for Platform purposes (for example matching, your client history across requests, and moderation).

4. Retention periods

We keep personal data no longer than necessary. For the periods below with a fixed end date, an automated daily routine enforces that; where there is no hard end date, the explanation below says why.

• Account and profile data: for as long as your account exists. Cancelling your subscription on its own (without requesting deletion) keeps your profile online and bookable until the end of the period you already paid for, as usual, and your account then falls back to the free Starter plan: your profile keeps existing, just with that plan's limits, it does not disappear. Requesting account deletion is different and financially more significant: see article 5 of the terms for the precise consequences (profile offline immediately, running subscription cancelled immediately without a refund of the unused part; your statutory and contractual refund rights otherwise remain fully intact, see that article). An administrator can still restore the account for 30 days after that, at the request of or with the consent of the authorised user; after that period the login and remaining personal data are permanently erased, subject to the periods below. Taking your profile offline on its own, separately from a deletion request, is also possible and does not start this 30-day period. For an Organisation account, only the account owner can request or cancel deletion; all active team members are notified by email when either happens. Where an Organisation chooses, when closing its own account, to also remove the profiles of the DJs it managed rather than letting them continue independently, those DJs are informed that this was the Organisation's choice, not an automatic platform decision; they receive a support ticket they can reply to within 30 days to object; a timely objection pauses the permanent deletion of that profile until we have given a reasoned decision on it, which we also communicate to the DJ. What counts for timeliness is the moment the objection reaches us, not the moment an administrator subsequently processes or records it. The Organisation cannot itself dismiss or override that objection. If the DJ does not reply within that period, we read that as no objection (exactly what the DJ was told in advance) and close the ticket automatically; a reply from the DJ themself keeps it open for the reasoned decision described above. If reported to us outside that ticket (for example by email), we record it with the original date of receipt; a timely objection recorded this way blocks the permanent deletion just as much as a reply on the ticket itself, regardless of which channel it reached us through. The automatic closure above therefore only applies when we have not received or recorded any objection, never when one was received but not yet processed. By default we also keep a short additional safety margin on top of the 30 days before a profile is actually permanently erased; within that margin an administrator must explicitly confirm they have checked their own inbox for an objection not yet recorded, and permanent deletion waits as long as that confirmation is missing. That reduces the risk of a timely but not-yet-processed objection being overtaken; without automated processing of incoming email that risk cannot be fully removed.
• Availability checks, booking requests and client chats: kept until 2 years after the event date as a record for questions or disputes (unless you have a client account, see below). After that, chat messages are deleted and the name, email address, phone number, your free-text message, the specific venue name and the exact start/end time on the booking row are removed: we checked which fields our profile statistics actually use and only keep what is genuinely needed for them. The remaining booking data stays: event date, location (city/region), event type, guest count, music styles and the DJ involved, to keep the DJ profile's statistics (such as bookings and response speed) accurate. We treat this residual data as personal data, not as anonymous: a distinctive combination of date, location and DJ can in rare cases remain identifiable. The basis for this further retention is our legitimate interest in accurate profile statistics; the retention is tied to that purpose, so if the DJ profile concerned disappears and the row is not part of an organisation's administration either, the row itself is deleted automatically.
• Client account (optional): if you created a client account we keep your requests, chats and reviews for as long as your account exists; the 2-year removal of direct contact details described above then does not apply. You can delete your account yourself at any time via My party.dj, after which the normal periods apply again. If you do not sign in for 3 years we send a warning email and delete the account automatically 30 days later.
• Subscription and billing records of DJs and agencies: 7 years (statutory tax retention).
• Reviews: publicly visible for as long as the reviewed profile exists, even if the reviewer's client account is deleted. A booking does not require an account, so the two are already decoupled; on request we anonymise the reviewer's name.
• Community posts: a post nobody removes stays visible for as long as the community group exists. It serves as a lasting, shared knowledge resource for the participating DJs, comparable to a private trade forum (legitimate interest). If you or a moderator removes a post yourself, it is genuinely deleted, including its images, not just hidden. If you leave the community or your account is deleted, previously posted messages remain without the account link. The content of such a post does not change as a result: if your name is in the text or you are recognisable in a shared photo, the post is not anonymous because of that. So remove posts you do not want to leave behind before you go, or ask us (also afterwards) via a privacy request to delete the content too; we will then still do so (section 8).
• DJ-to-DJ direct messages: for as long as the accounts involved exist.
• Invitation codes: a code unused by anyone for 12 months is automatically deleted. Codes that have been used at least once are kept as the source of the referral-reward history; such a code contains no email address itself, only the code, the number of uses and a link to the inviting DJ. If the inviter's account disappears, that link lapses and a nameless code remains.
• Dashboard notifications: deleted automatically after 1 year, or earlier when you remove them.
• Push subscriptions: until you disable notifications, revoke the permission or the subscription technically expires.
• Calendar links: until you disconnect the calendar.
• Launch list signups and invitations: deleted automatically at the latest 12 months after you signed up, or earlier when you unsubscribe.
• Clients entered by an Organisation: this is the Organisation's own administration (see section 2); the Organisation determines, within its purpose, how long it needs this data and can delete it itself at any time. As an upper bound, our 2-year clean-up above also applies to these booking rows, including the Organisation's internal notes attached to them.
• Administrator logs: actions by platform administrators, including starting and stopping a temporary support session on an account, are logged (who, which account, when) and deleted automatically after 2 years.
• Support messages: up to 2 years after the ticket is resolved, then automatically deleted; attachments are removed earlier already, immediately once the ticket is resolved.
• Our own statistics: three separate, first-party measurement points, assessed individually below rather than as one.
  • Site events (our own conversion measurement: which step of a search or sign-up path visitors reach). Per event we store the event name, the page path and a random session number. That session number disappears from your browser's sessionStorage once you close the tab, but the events already stored using it can remain in our systems for up to 35 days (see retention below) — closing the tab ends the local session identifier, not the stored data. We use the session number only to link steps within that same session (for example: viewed a search result, then started a request) — not to recognise you across multiple visits or devices, and never linked to an account. We acknowledge that this session number itself does link events within one session; that a row cannot be linked to an account or IP address does not by itself prove the session as a whole is anonymous, so we treat this data as personal data out of caution. We process this session-bound statistical data based on our legitimate interest in understanding and improving the use and operation of the Platform. We limit the data to what is necessary for that, do not link it to user accounts, and do not use it to track visitors across different visits or devices. You can object to this processing via legal@feest.dj. The IP address is processed separately and briefly for this measurement point, on the separate basis of our legitimate interest in the security of the measurement point itself (a technical rate limit); it is not stored with the event and not used for any other purpose. We have checked that this measurement point is only called from public, non-personal pages, never from a page with a personal token or case number in the URL; a limited extra field from a fixed list may be included (for example which DJ a submitted request relates to), which is about the DJ, not about you as a visitor. We keep the linkage between events within one session, not just aggregated totals, because our admin conversion overview recalculates the trailing 30 days on every view and needs that linkage to do so; we checked that no feature uses the linkage beyond that period, so we keep it for 35 days (the 30 days actually used, plus a small margin), not longer. We retain this data for 35 days.
  • Profile views: only the id of the DJ profile viewed, with no session number, IP address or other characteristic of the visitor. The session link described above is therefore also absent here; with respect to you as a visitor, we assess this measurement point as genuinely anonymous. The DJ whose profile is counted is of course identifiable from the row; that this information is already public (that DJ's own profile) does not substitute for a basis, so for this part of the processing the basis is performance of our contract with that DJ, to the extent this count is necessary for it (this is part of the profile statistics we provide to the DJ as a service). Retention: 400 days.
  • Widget counts (the embeddable widget on a DJ's own site): only the DJ, the widget type and the domain the widget runs on, likewise no session number, IP address or other visitor characteristic; with respect to the visitor, we assess this measurement point as genuinely anonymous too, for the same reason as profile views above. Retention: 400 days (the dashboard display shows at most 365 days; the extra margin avoids the yearly overview missing an edge).
• Server logs: 90 days.
• Backups: the hosting provider makes automatic, periodic backups of the database; these necessarily also contain data already deleted or anonymised from the active database per the periods above. Our database backups have a rolling retention window of 7 days (verified 18 October 2026 in our own hosting dashboard); data removed from the active database can therefore still be present temporarily in a backup. After a restore, we reapply any deletions that were already carried out.

5. Security

All traffic is encrypted (TLS), data is stored encrypted at rest, passwords are hashed, and access to personal data is restricted to what is strictly necessary. No method is 100% secure, but we apply appropriate technical and organisational measures and review them regularly.

6. Automated processing

One process runs automatically and we describe it in full here: once a booking for a Client and date is completed through the Platform (you confirm a DJ, or a DJ accepts your request), the Platform automatically closes other, still-open requests, availability checks and marketplace posts from that same Client for that same date (matched by email address and event date) with other DJs or Organisations. Purpose: preventing other DJs from needlessly holding the date and you from receiving replies to requests you no longer need. Legal basis: our legitimate interest in a reliable mediation service, weighed as follows. The matching uses only your email address and the event date; the DJs involved are told only that the request for that date has lapsed, not who you booked, where, or for what amount. The closing does not run when an Organisation enters you manually into its own administration (no booking confirmed by you), and requests in which an Organisation has already sent you a quote are deliberately excluded. The records are kept (status and reason remain visible). Because one Client can genuinely need several DJs, venues or events on the same date, matching by email and date alone can close a request you wanted to keep. That is why you are informed by email the moment anything is closed, with a one-click link that reopens everything immediately; the DJs involved are then informed too, and the link works for 30 days. You can also always submit a new request.

We have also assessed this process against Article 22 GDPR (decisions based solely on automated processing with legal or similarly significant effects) and concluded it does not fall under it: it produces no legal effect and no similarly significant effect, because it only tidies up your own parallel requests after a booking for that date has been completed, and you can undo it yourself with one click. That conclusion does not replace the safeguards above; they apply in full. The order of search results is determined by the factors described in our Terms & Conditions.

7. Children

The Platform is intended for users of 18 years and older.

8. Your rights

You have the right to access, rectification, erasure, restriction, objection and data portability. Where we rely on your consent (for example analytics and marketing cookies), you can withdraw it at any time; this does not affect the lawfulness of processing we carried out before you withdrew it. Want details on the safeguards for a specific transfer outside the EEA mentioned in section 3? Email us and we will provide them. Email legal@party.dj; we respond within one month at the latest. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.

9. Cookies

We always use cookies necessary for the Platform to work. Measurement and marketing scripts (Google Analytics 4, Meta Pixel, and server-side the Meta Conversions API) only load or send after you have given consent for that category; before your choice, and after a "necessary only" choice, your browser loads no measurement or marketing code from Google or Meta and nothing is measured or sent. Google Ads conversion measurement is not active at this time; we may add it in the future. Withdrawing consent reloads the page so that previously loaded scripts are actually removed. See the Cookie Policy for the full overview and how to change your preference.

10. Changes

We may update this policy. Registered users are notified by email of significant changes; the date at the top shows the latest version.