placeholder for solicitor review
privacy policy
this is draft wording so the product can be used and discussed. it is not legal advice. a solicitor should adapt it to the operating company, the countries you serve, and the payment provider you appoint.
1. controller
the operator of muzobook is the controller of personal data processed through the platform. the legal entity, address, and a real privacy contact must be inserted here before launch. draft contact: privacy@muzobook.example.
2. who this is written for
the platform is used worldwide. this notice is written so it can meet the uk gdpr and the eu gdpr as a baseline for everyone, not only people in the uk or the eea. local laws may give you extra rights. a solicitor should confirm the international transfer tools and any country-specific notices.
3. data we process
account data (name, email, role), profile and listing content you choose to publish, gig posts, booking records, messages, reviews, and payment references (amount, currency, status, and a provider reference). we do not store full card numbers. in the preview checkout, the card number never leaves your browser. when stripe is used, card data is handled by stripe as a payment processor.
4. why we use it
to provide the account and the booking record (contract). to take the membership, booking fee, and featuring charges (contract). to keep the site secure and prevent abuse (legitimate interests). to meet accounting and legal duties (legal obligation). we do not sell personal data. we do not use it for unrelated advertising.
5. messages
messages are visible to the people on that thread and to operators who need them to investigate abuse or a legal request. do not send passport scans or other high-risk documents through the inbox unless you have a proper reason and a safer channel is not available.
6. international transfers
users and infrastructure may be in different countries. where data moves from the uk or eea to a country without an adequacy decision, the operator should use an approved safeguard (such as the appropriate standard contractual clauses) and record the transfer. this paragraph is a placeholder for that assessment.
7. how long we keep it
account data lasts while the account is open and for a short period after closure so bookings can be evidenced. payment records are kept for the period required by tax law. you may ask us to delete a profile; we may retain a limited record where the law requires it or where a dispute is open.
8. your rights
you can ask for access, correction, erasure, restriction, and a portable copy of data you provided, and you can object to processing based on legitimate interests. you can complain to the ico in the uk or to your local authority. we will not discriminate against you for exercising a right. some rights depend on the lawful basis and on whether we still hold the data.
9. cookies
we use essential cookies (and, in some embedded previews, a session token) to keep you signed in. we do not set advertising cookies in this product. if analytics are added later, they should be described here and, where required, gated on consent.
10. children
the platform is not directed at anyone under 18. do not create an account if you are under 18.