1. Who we are and when this policy applies
This policy explains how Eventroo Participações Ltda. (“Eventroo”), registered under CNPJ no. 63.010.384/0001-43, headquartered at Rua Zeila Moura dos Santos, 101, conj. 1120, 11º andar (Time Work Station), Cristo Rei, Curitiba/PR, CEP 80050-605 processes personal data as a controller under the LGPD.
It applies to eventroo.music (and eventroo.com.br), to Eventroo Publishing (eventroopublishing.com), to the Eventroo Account (conta.eventroo.com.br) and to the services offered on them: Pitching, Eventroo Publishing (songwriters, publishers and artists), the Artist area, Smart Link (go.eventroo.music), playlist requests, the newsletter and customer support. It also applies to the Partner API (api.eventroo.music), through which partner companies offer Eventroo Pitching, and to its documentation (developers.eventroo.music).
Services hired under their own contract, such as music distribution and the Publishing administration agreement, may have additional privacy clauses. In those cases, the contract and this policy complement each other.
2. What data we collect
We only collect data you give us or that is generated when you use the site. What we collect depends on what you do:
| When you… | Data processed |
|---|---|
| Contact support | Name, email, subject, message and attached files. |
| Subscribe to the newsletter | Email, language, sign-up and confirmation dates (double opt-in). |
| Submit a pitch | Email, contact name, company or label, Eventroo account ID, release details (title, artist, UPC, ISRC, dates, genre, language), links and numbers from your social and streaming profiles, pitch texts, uploaded images, chosen plan and payment region. |
| Buy a pitch through a partner company | The same pitch data, received from the partner company, plus: the code the partner uses to identify you, its reference for the order and the record of your acceptance of these documents (accepted versions, date and time, IP address and browser), collected by the partner. |
| Pay for a pitching plan | Payment is processed by Mercado Pago or, for payments in US dollars, by Stripe. We receive the confirmation, amount and payment method; we never receive or store your card number. We send Stripe your email, the amount and the pitch number. |
| Request a playlist add | Name, email, artist, track, track link, genre, message, the link to the playlist you want to join and the record (date and time) of your statement that you completed the steps asked in the form. |
| Use the Artist area | At sign-up: name, email, mobile / WhatsApp and, if you provide it, the link to your profile (Instagram, Spotify or website). Afterwards: tracked tracks and positions in Eventroo's official playlists. If you choose, your consent to receive news. |
| Use the Eventroo Account | Name, email, password (stored only as a hash), language, your CPF or CNPJ as username (when you provided it in Publishing), the registered authenticator app (required for the team, optional for everyone else) and sign-in and sign-out records (date, time, IP address and browser). It is the single account for Eventroo's services: once you sign in to one, you don't need to type your password again in another. If you sign in with Google, Google sends us your name, confirmed email and profile photo; your Google password never reaches Eventroo. |
| Use Eventroo Publishing | Name or company name, email, mobile / WhatsApp, news consent (if checked), Brazilian CPF/CNPJ or foreign document, password (stored only as a hash), works, lyrics, co-writers and shares, recordings and ISRCs, uploaded audio files, payout details (bank account or PayPal, stored encrypted) and messages exchanged with our team. Also: pseudonym, secondary email, address (optional), profile photo, signed contracts, the log of what the people on your account did and the history of changes to payout details. To register works and collect royalties: collective management society and IPI/CAE number, yours and those of the co-writers you add, and your date of birth. For artists: artist name, link to their work, favorite works, permission requests and the log of which unreleased works you listened to (date, time and IP address). |
| Add people to your Publishing account | For the spouse, administrator and heirs: name, CPF and, if the person can sign in, email and password (hash only). For the guardian of an heir under 18: name and CPF. |
| Verify your identity | Automatic (Didit): images of the front and back of your ID and a selfie with liveness check. Eventroo receives and keeps only the result: document type, issuer, name on the document, the last digits of the number and whether the CPF and name match. ID sent to the team: the image or PDF, stored encrypted. |
| Create a Smart Link (artist) | Release data (name, artists, ISRC, UPC, date), platform links, uploaded cover art and audio clip (re-encoded without metadata) and a record of what you did. On the public profile (go.eventroo.music/@): artist name, @, bio, photo and social links, which become public when you publish. |
| Open a Smart Link page (fan) | Nothing that identifies you. We count visits and clicks per day, by platform, source (e.g. Instagram or QR code), approximate country and city (provided by Cloudflare), device type and hour. To count unique visitors, the IP address and browser are turned, on the spot, into a code that cannot be reversed and changes every day; that code is deleted after 2 days and the IP is not stored. The page uses no cookies. |
| Ask for a release reminder on a Smart Link (fan) | Email, WhatsApp (if you provide it), language, date, which artist and release you came from, approximate city and state (provided by Cloudflare; the IP is not stored), device type, the exact consent text (which includes the permission to share your contact with the artist) and the dates of the reminder and of unsubscribing. |
| Report a Smart Link | Reason, details and, if you want, an email for a reply. |
| Ask to integrate your company (Integrate with Eventroo page) | Company name, country, website, name and email of the technical contact and, if you provide them, of the business contact, products of interest, estimated monthly volume, message and language. To stop abuse, we keep a code derived from the IP address, not the IP. |
| Represent a partner company | Name and email of the technical, business and support contacts, and the log of calls to the API (date, time, route, result and a code derived from the IP address, not the IP). |
| Browse the site | IP address, date and time, browser type and pages visited, in security and access logs. Cookies are described in the Cookie Policy. |
| Browse the site (audience measurement) | Nothing that identifies you. We count, per day, page and language: visits, unique visitors, clicks on create account and sign in, forms sent, the source of the visit by category (search engine, artificial intelligence, social network, another site or direct, without storing the address you came from) and the device type (phone or computer). To count unique visitors, the IP address and browser are turned, on the spot, into a code that cannot be traced back to them and that changes every day; this code is deleted within 2 days and the IP is not stored. The numbers are kept for up to 25 months. We also use Cloudflare Web Analytics, which counts visits and page performance in aggregate. Neither measurement uses cookies. |
Contact support
- Data processed
- Name, email, subject, message and attached files.
Subscribe to the newsletter
- Data processed
- Email, language, sign-up and confirmation dates (double opt-in).
Submit a pitch
- Data processed
- Email, contact name, company or label, Eventroo account ID, release details (title, artist, UPC, ISRC, dates, genre, language), links and numbers from your social and streaming profiles, pitch texts, uploaded images, chosen plan and payment region.
Buy a pitch through a partner company
- Data processed
- The same pitch data, received from the partner company, plus: the code the partner uses to identify you, its reference for the order and the record of your acceptance of these documents (accepted versions, date and time, IP address and browser), collected by the partner.
Pay for a pitching plan
- Data processed
- Payment is processed by Mercado Pago or, for payments in US dollars, by Stripe. We receive the confirmation, amount and payment method; we never receive or store your card number. We send Stripe your email, the amount and the pitch number.
Request a playlist add
- Data processed
- Name, email, artist, track, track link, genre, message, the link to the playlist you want to join and the record (date and time) of your statement that you completed the steps asked in the form.
Use the Artist area
- Data processed
- At sign-up: name, email, mobile / WhatsApp and, if you provide it, the link to your profile (Instagram, Spotify or website). Afterwards: tracked tracks and positions in Eventroo's official playlists. If you choose, your consent to receive news.
Use the Eventroo Account
- Data processed
- Name, email, password (stored only as a hash), language, your CPF or CNPJ as username (when you provided it in Publishing), the registered authenticator app (required for the team, optional for everyone else) and sign-in and sign-out records (date, time, IP address and browser). It is the single account for Eventroo's services: once you sign in to one, you don't need to type your password again in another. If you sign in with Google, Google sends us your name, confirmed email and profile photo; your Google password never reaches Eventroo.
Use Eventroo Publishing
- Data processed
- Name or company name, email, mobile / WhatsApp, news consent (if checked), Brazilian CPF/CNPJ or foreign document, password (stored only as a hash), works, lyrics, co-writers and shares, recordings and ISRCs, uploaded audio files, payout details (bank account or PayPal, stored encrypted) and messages exchanged with our team. Also: pseudonym, secondary email, address (optional), profile photo, signed contracts, the log of what the people on your account did and the history of changes to payout details. To register works and collect royalties: collective management society and IPI/CAE number, yours and those of the co-writers you add, and your date of birth. For artists: artist name, link to their work, favorite works, permission requests and the log of which unreleased works you listened to (date, time and IP address).
Add people to your Publishing account
- Data processed
- For the spouse, administrator and heirs: name, CPF and, if the person can sign in, email and password (hash only). For the guardian of an heir under 18: name and CPF.
Verify your identity
- Data processed
- Automatic (Didit): images of the front and back of your ID and a selfie with liveness check. Eventroo receives and keeps only the result: document type, issuer, name on the document, the last digits of the number and whether the CPF and name match. ID sent to the team: the image or PDF, stored encrypted.
Create a Smart Link (artist)
- Data processed
- Release data (name, artists, ISRC, UPC, date), platform links, uploaded cover art and audio clip (re-encoded without metadata) and a record of what you did. On the public profile (go.eventroo.music/@): artist name, @, bio, photo and social links, which become public when you publish.
Open a Smart Link page (fan)
- Data processed
- Nothing that identifies you. We count visits and clicks per day, by platform, source (e.g. Instagram or QR code), approximate country and city (provided by Cloudflare), device type and hour. To count unique visitors, the IP address and browser are turned, on the spot, into a code that cannot be reversed and changes every day; that code is deleted after 2 days and the IP is not stored. The page uses no cookies.
Ask for a release reminder on a Smart Link (fan)
- Data processed
- Email, WhatsApp (if you provide it), language, date, which artist and release you came from, approximate city and state (provided by Cloudflare; the IP is not stored), device type, the exact consent text (which includes the permission to share your contact with the artist) and the dates of the reminder and of unsubscribing.
Report a Smart Link
- Data processed
- Reason, details and, if you want, an email for a reply.
Ask to integrate your company (Integrate with Eventroo page)
- Data processed
- Company name, country, website, name and email of the technical contact and, if you provide them, of the business contact, products of interest, estimated monthly volume, message and language. To stop abuse, we keep a code derived from the IP address, not the IP.
Represent a partner company
- Data processed
- Name and email of the technical, business and support contacts, and the log of calls to the API (date, time, route, result and a code derived from the IP address, not the IP).
Browse the site
- Data processed
- IP address, date and time, browser type and pages visited, in security and access logs. Cookies are described in the Cookie Policy.
Browse the site (audience measurement)
- Data processed
- Nothing that identifies you. We count, per day, page and language: visits, unique visitors, clicks on create account and sign in, forms sent, the source of the visit by category (search engine, artificial intelligence, social network, another site or direct, without storing the address you came from) and the device type (phone or computer). To count unique visitors, the IP address and browser are turned, on the spot, into a code that cannot be traced back to them and that changes every day; this code is deleted within 2 days and the IP is not stored. The numbers are kept for up to 25 months. We also use Cloudflare Web Analytics, which counts visits and page performance in aggregate. Neither measurement uses cookies.
Other people's data: in Publishing you may enter co-writers' names and shares and the details of the people on your account (spouse, administrator, heirs and guardians). By doing so, you confirm you are authorized to share this data and that it is accurate. In the Marketing area, Eventroo may use emails of people who engaged with partner events for promotional communications, always with an unsubscribe option in every message.
The only sensitive data we process is biometric (an image of your face), and only for identity verification, with your specific consent, given in its own checkbox before you start. Eventroo does not receive or keep your selfie. We don't ask for other sensitive data (such as racial origin, health or religion): please don't send it in open fields.
3. Why we use data and on what legal basis
Every processing activity has a defined purpose and a legal basis under article 7 of the LGPD:
| Purpose | Legal basis |
|---|---|
| Provide the services you asked for (pitching, Publishing, Artist area, playlist, support) | Performance of a contract or preliminary steps (art. 7, V) |
| Receive pitches sent by partner companies and tell them the status and result of each one | Performance of a contract (art. 7, V) |
| Keep the record of the acceptance given at the partner company | Regular exercise of rights (art. 7, VI) |
| Review integration requests and manage the relationship with partner companies | Preliminary procedures and performance of a contract (art. 7, V) and legitimate interest (art. 7, IX) |
| Process payments and pay out royalties | Performance of a contract (art. 7, V) and legal obligation (art. 7, II) |
| Send service emails (confirmation, pitch result, status of a work) | Performance of a contract (art. 7, V) |
| Maintain the Eventroo Account and single sign-on across services | Performance of a contract (art. 7, V) |
| Protect accounts and prevent fraud | Legitimate interest (art. 7, IX) |
| Log who listened to each unreleased work in the catalog, to protect the works against leaks | Legitimate interest (art. 7, IX) and regular exercise of rights (art. 7, VI) |
| Register works with collective management societies and ECAD and collect royalties (society, IPI/CAE, date of birth) | Performance of contract (art. 7, V) and regular exercise of rights (art. 7, VI) |
| Verify your identity with biometrics (selfie and ID) | Specific and highlighted consent (art. 11, I) and fraud prevention and the data subject's security (art. 11, II, g) |
| Sign contracts electronically | Performance of a contract (art. 7, V) |
| Send the newsletter | Consent (art. 7, I), which you can withdraw at any time |
| Send Eventroo news by email and WhatsApp to people who checked that option | Consent (art. 7, I), given in a separate unchecked box, which you can withdraw at any time |
| Contact you by phone or WhatsApp about the service you use (works, contract, payouts, requests) | Performance of a contract (art. 7, V) |
| Bring together, in an internal team list, the sign-ups from Eventroo's services, for support and to know who can receive news | Legitimate interest (art. 7, IX); marketing only with your consent |
| Promotional messages to contacts from partner events | Legitimate interest (art. 7, IX), with unsubscribe in every email |
| Load Spotify and YouTube players | Consent (art. 7, I), given in the cookie notice |
| Keep access logs and meet tax and regulatory obligations | Legal obligation (art. 7, II), including Brazil's Internet Civil Framework |
| Defend Eventroo in judicial, administrative or arbitration proceedings | Regular exercise of rights (art. 7, VI) |
| Show the Smart Link page and give the artist visit and click stats (anonymous counting) | Legitimate interest (art. 7, IX), with no cookies and without identifying the visitor |
| Send fans the release reminder they asked for and Eventroo music news (including that artist’s next releases), by email or WhatsApp | Consent (art. 7, I), given in a separate box, which can be withdrawn with one click |
| Share the fan’s contact with the artist of that Smart Link | Consent (art. 7, I), stated clearly in the consent itself, which can be withdrawn at any time |
| Review reports and take down links that infringe rights or these terms | Legitimate interest (art. 7, IX) and regular exercise of rights (art. 7, VI) |
| Improve the site and support | Legitimate interest (art. 7, IX), with no advertising profiles |
Provide the services you asked for (pitching, Publishing, Artist area, playlist, support)
- Legal basis
- Performance of a contract or preliminary steps (art. 7, V)
Receive pitches sent by partner companies and tell them the status and result of each one
- Legal basis
- Performance of a contract (art. 7, V)
Keep the record of the acceptance given at the partner company
- Legal basis
- Regular exercise of rights (art. 7, VI)
Review integration requests and manage the relationship with partner companies
- Legal basis
- Preliminary procedures and performance of a contract (art. 7, V) and legitimate interest (art. 7, IX)
Process payments and pay out royalties
- Legal basis
- Performance of a contract (art. 7, V) and legal obligation (art. 7, II)
Send service emails (confirmation, pitch result, status of a work)
- Legal basis
- Performance of a contract (art. 7, V)
Maintain the Eventroo Account and single sign-on across services
- Legal basis
- Performance of a contract (art. 7, V)
Protect accounts and prevent fraud
- Legal basis
- Legitimate interest (art. 7, IX)
Log who listened to each unreleased work in the catalog, to protect the works against leaks
- Legal basis
- Legitimate interest (art. 7, IX) and regular exercise of rights (art. 7, VI)
Register works with collective management societies and ECAD and collect royalties (society, IPI/CAE, date of birth)
- Legal basis
- Performance of contract (art. 7, V) and regular exercise of rights (art. 7, VI)
Verify your identity with biometrics (selfie and ID)
- Legal basis
- Specific and highlighted consent (art. 11, I) and fraud prevention and the data subject's security (art. 11, II, g)
Sign contracts electronically
- Legal basis
- Performance of a contract (art. 7, V)
Send the newsletter
- Legal basis
- Consent (art. 7, I), which you can withdraw at any time
Send Eventroo news by email and WhatsApp to people who checked that option
- Legal basis
- Consent (art. 7, I), given in a separate unchecked box, which you can withdraw at any time
Contact you by phone or WhatsApp about the service you use (works, contract, payouts, requests)
- Legal basis
- Performance of a contract (art. 7, V)
Bring together, in an internal team list, the sign-ups from Eventroo's services, for support and to know who can receive news
- Legal basis
- Legitimate interest (art. 7, IX); marketing only with your consent
Promotional messages to contacts from partner events
- Legal basis
- Legitimate interest (art. 7, IX), with unsubscribe in every email
Load Spotify and YouTube players
- Legal basis
- Consent (art. 7, I), given in the cookie notice
Keep access logs and meet tax and regulatory obligations
- Legal basis
- Legal obligation (art. 7, II), including Brazil's Internet Civil Framework
Defend Eventroo in judicial, administrative or arbitration proceedings
- Legal basis
- Regular exercise of rights (art. 7, VI)
Show the Smart Link page and give the artist visit and click stats (anonymous counting)
- Legal basis
- Legitimate interest (art. 7, IX), with no cookies and without identifying the visitor
Send fans the release reminder they asked for and Eventroo music news (including that artist’s next releases), by email or WhatsApp
- Legal basis
- Consent (art. 7, I), given in a separate box, which can be withdrawn with one click
Share the fan’s contact with the artist of that Smart Link
- Legal basis
- Consent (art. 7, I), stated clearly in the consent itself, which can be withdrawn at any time
Review reports and take down links that infringe rights or these terms
- Legal basis
- Legitimate interest (art. 7, IX) and regular exercise of rights (art. 7, VI)
Improve the site and support
- Legal basis
- Legitimate interest (art. 7, IX), with no advertising profiles
When we rely on legitimate interest, we first assess that it doesn't override your rights, and you can object at any time.
We don't make automated decisions that affect your interests without human review: pitches, works and artist access are reviewed by our team.
4. Who we share data with
Eventroo does not sell personal data. We only share what is necessary with:
- Technology providers that run the site for us: server hosting, Cloudflare (site delivery, attack protection and aggregate visit statistics, without cookies) and email service.
- Mercado Pago and Stripe, to process pitching payments, and financial institutions or PayPal, for Publishing payouts.
- Digital platforms and music partners, when needed for the service you asked for: for example, presenting a release to platforms in pitching, or registering works with collective management organizations and rights societies in Publishing.
- The partner company you bought the pitch through: it receives the order status, the price, the dates and the curators' feedback. Internal team notes are never sent, and each partner only sees the pitches it created.
- Have I Been Pwned, to check whether a password has appeared in public breaches. The password never leaves our server: we only send the beginning of a code derived from it (k-anonymity), which can't reveal it.
- Google, when you choose to sign in with your Google account: Google confirms who you are and sends us your name, confirmed email and profile photo. Eventroo sends Google nothing about you beyond the sign-in request and never receives your Google password.
- Autentique, for the electronic signature of Publishing contracts (name, Eventroo email, the contract PDF and the signature record).
- Didit, for automatic identity verification (ID images and selfie). Didit acts as a processor: it handles this data only for the verification, for the period set in its contract with Eventroo.
- The artist who owns a Smart Link: only the numbers (how many people asked for a reminder). The contacts stay with Eventroo. A fan’s contact is only shared with the artist with the permission written in the consent they ticked; in that case, the artist becomes responsible for how they use it.
- Apple, only when you press play on a preview on a Smart Link page: the audio comes from Apple's servers, which then receive your IP address. Before you press play, the page does not contact them.
- Public authorities, when required by law, court order or a competent authority's request.
- In a merger, acquisition or corporate reorganization, data may be transferred to the successor, who remains bound by this policy.
Our lookups to Spotify, Deezer and Apple (iTunes) to find recordings only use the searched title, artist or codes (ISRC/UPC), with no personal data of yours.
5. Pitching through partner companies
Some companies, such as distributors and music platforms, offer Eventroo Pitching inside their own apps and websites through the Partner API (api.eventroo.music). In that case:
- Eventroo is the controller of your pitch data: it reviews, charges, refunds when applicable and answers to you for this processing.
- The partner company collects the data in its own environment, shows you these documents, records your acceptance and sends everything to us. Under its agreement with Eventroo, it may only send data of people who accepted and must protect it. What it does with your data in its own service follows its own privacy policy.
- Payment happens on an Eventroo page (Mercado Pago) or a Stripe page. The partner doesn't receive your card details.
- To exercise your rights over your pitch data, contact Eventroo at the data protection officer's email (section 13).
6. International transfers
Some providers, such as Cloudflare, Spotify, Google (YouTube), Didit (European Union), Stripe (United States), Autentique and hosting and email services, may process data on servers outside Brazil. If you live outside Brazil and buy a pitch, your data is processed in Brazil, where Eventroo's servers are, and, for payments in US dollars, also by Stripe in the United States; data exchanged with a partner company in another country follows the same safeguards. In those cases, transfers follow article 33 of the LGPD, with providers that adopt protection safeguards compatible with Brazilian law, such as contractual clauses and security certifications.
7. How long we keep data
We keep data for as long as needed for the purpose and to meet legal obligations. After that, it is deleted or anonymized.
| Data | Period |
|---|---|
| Eventroo Account, Publishing and Artist area accounts | While the account is active and, after closure, up to 5 years to meet obligations and defend rights |
| Access logs (IP, date and time) | At least 6 months, as required by Brazil's Internet Civil Framework (art. 15) |
| Eventroo Account sign-in and sign-out records | 180 days |
| Payments and tax documents | 5 years, under tax law |
| Pitches (including those sent by partner companies, with the acceptance record) and playlist requests | Up to 5 years, for history, support and defense of rights |
| Logs of calls to the Partner API | 90 days |
| Integration requests and partner company contacts | While the conversation or the partnership lasts and up to 5 years after, for defense of rights |
| Newsletter | Until you unsubscribe; after that we only keep the unsubscribe record so we don't email you again |
| News consent (email and WhatsApp) | Until you uncheck it; after that we keep only the record of the consent and its withdrawal, for up to 5 years, as proof |
| Support requests | Up to 5 years |
| Audio and work data | While the work is registered or until a deletion request, subject to the contract |
| Log of who listened to unreleased works in the catalog | 1 year |
| History of changes to payout details | While the account is active and, after it is closed, up to 5 years |
| Signed contracts | During the contract and up to 5 years after it ends, to meet obligations and defend rights |
| Identity verification result and ID sent to the team | While the account is active and up to 5 years after closure, as proof of verification and for fraud prevention |
| People on the account and the log of what they did | While the person is on the account and up to 5 years after, to defend rights |
| Smart Link counting | Daily visitor code: 2 days. Daily totals (no personal data): while the link exists |
| Contacts of people who asked for a Smart Link reminder | Until you unsubscribe or ask for deletion; after that, only the record of consent and withdrawal, for up to 5 years |
| Smart Link reports | Up to 5 years, for the defense of rights |
| Record of your cookie choices | Up to 5 years, as proof of consent |
Eventroo Account, Publishing and Artist area accounts
- Period
- While the account is active and, after closure, up to 5 years to meet obligations and defend rights
Access logs (IP, date and time)
- Period
- At least 6 months, as required by Brazil's Internet Civil Framework (art. 15)
Eventroo Account sign-in and sign-out records
- Period
- 180 days
Payments and tax documents
- Period
- 5 years, under tax law
Pitches (including those sent by partner companies, with the acceptance record) and playlist requests
- Period
- Up to 5 years, for history, support and defense of rights
Logs of calls to the Partner API
- Period
- 90 days
Integration requests and partner company contacts
- Period
- While the conversation or the partnership lasts and up to 5 years after, for defense of rights
Newsletter
- Period
- Until you unsubscribe; after that we only keep the unsubscribe record so we don't email you again
News consent (email and WhatsApp)
- Period
- Until you uncheck it; after that we keep only the record of the consent and its withdrawal, for up to 5 years, as proof
Support requests
- Period
- Up to 5 years
Audio and work data
- Period
- While the work is registered or until a deletion request, subject to the contract
Log of who listened to unreleased works in the catalog
- Period
- 1 year
History of changes to payout details
- Period
- While the account is active and, after it is closed, up to 5 years
Signed contracts
- Period
- During the contract and up to 5 years after it ends, to meet obligations and defend rights
Identity verification result and ID sent to the team
- Period
- While the account is active and up to 5 years after closure, as proof of verification and for fraud prevention
People on the account and the log of what they did
- Period
- While the person is on the account and up to 5 years after, to defend rights
Smart Link counting
- Period
- Daily visitor code: 2 days. Daily totals (no personal data): while the link exists
Contacts of people who asked for a Smart Link reminder
- Period
- Until you unsubscribe or ask for deletion; after that, only the record of consent and withdrawal, for up to 5 years
Smart Link reports
- Period
- Up to 5 years, for the defense of rights
Record of your cookie choices
- Period
- Up to 5 years, as proof of consent
8. Your rights
Under the LGPD (art. 18), you may, at any time and free of charge:
- Confirm whether we process your data and access it.
- Correct incomplete, inaccurate or outdated data.
- Request anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully.
- Request portability of your data to another provider.
- Request deletion of data processed based on your consent.
- Know who we share your data with.
- Know that you may refuse consent and what the consequences are.
- Withdraw consent, such as leaving the newsletter or changing your cookie preferences.
- Object to processing based on legitimate interest.
- Request review of decisions made solely by automated processing.
To exercise any right, write to privacidade@eventroo.com.br. We may ask you to confirm your identity to protect you. We reply within 15 days and, if some data must be kept by law, we explain why.
You may also file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.
9. How we protect data
We take technical and administrative measures to protect data against unauthorized access, loss and leaks, including:
- Encrypted connection (HTTPS) across the whole site.
- Passwords stored only as hashes, never in plain text, and blocking of passwords known to be breached.
- Sign-in through the Eventroo Account: your password is typed only at conta.eventroo.com.br (it never goes through the other services), with lockout after repeated attempts and two-step verification (password and authenticator app code) required for the team.
- Bank and payout details stored encrypted.
- Audio files kept in a private area, available only to the account owner, our team and approved artists; for artists, audio plays in parts, never the whole file at once, and without the MP3's internal tags.
- Internal access restricted to those who need it, with a log of who opened sensitive data.
- Backups and server monitoring.
No system is completely immune to incidents. If a security incident occurs that may cause relevant risk or harm, we will notify the ANPD and affected people, as the law requires.
10. Children and teenagers
Eventroo's services are intended for people aged 18 or over. Minors may only use them represented or assisted by their parents or legal guardians. If we find data of a child processed without a guardian's consent, it will be deleted.
12. Third-party links and services
The site has links to and content from other companies, such as Spotify, YouTube, Instagram and music platforms. When you use them, their privacy policies apply, and we recommend reading them.
13. Data protection officer and contact
Eventroo's data protection officer (DPO) is Douglas Fernandes Soares Bessa, reachable at privacidade@eventroo.com.br.
Any questions?
Get in touch. We answer personal data requests within 15 days.
- Company
- Eventroo Participações Ltda.
- CNPJ
- 63.010.384/0001-43
- Address
- Rua Zeila Moura dos Santos, 101, conj. 1120, 11º andar (Time Work Station), Cristo Rei, Curitiba/PR, CEP 80050-605
- Data protection officer (DPO)
- Douglas Fernandes Soares Bessa
14. Changes to this policy
We may update this policy to reflect changes in our services or the law. The date of the current version appears at the top of the page. If a change is significant, we will let you know on the site or by email before it takes effect.