Rocklab One

Centre de Musiques Amplifiées, établissement public, (hereinafter “the CMA”) is committed to protecting the personal data and privacy of the members, artists, bands, other music professionals, partners and visitors of the Rocklab One platform, accessible at www.one.rocklab.lu.

All processing of personal data is carried out in compliance with applicable regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the “GDPR”), as well as applicable Luxembourg data protection legislation.

The purpose of this privacy policy (hereinafter the “Policy”) is to inform you:

The nature of the personal data processing activities we carry out concerning you.
The categories of personal data we collect about you.
How your personal data is processed by the CMA.
The terms and conditions governing the use of your personal data and your rights in this regard, in compliance with European and Luxembourg legislation applicable to the CMA.

The CMA attaches particular importance to privacy and is committed to protecting your personal data with full transparency and in accordance with the principles of lawfulness, fairness, data minimization, and security.

1. IDENTITY OF THE DATA CONTROLLER

Centre de Musiques Amplifiées, établissement public, hereinafter the CMA, with its registered office located at L-4361 Esch-sur-Alzette, 5 avenue du Rock’n’Roll, represented by its General Director, Mr. Olivier TOTH.

2. DATA PROTECTION OFFICER (DPO)

For any questions regarding the processing of your personal data by the CMA, you may contact the Data Protection Officer (DPO) designated by the Commission Nationale pour la Protection des Données (CNPD):

Centre de Musiques Amplifiées, établissement public
Attention : DPO
L-4361 Esch-sur-Alzette, 5 Avenue du Rock’n’Roll

By email: [email protected]

3. DESCRIPTION OF THE PROCESSING OF YOUR PERSONAL DATA

In connection with the operation of the Rocklab One platform on www.one.rocklab.lu, the CMA collects data about you. This personal data is processed in accordance with and limited to the purposes specified at the time of collection.

3.1 Member registration and account management

a) Legal basis and purposes of personal data processing

The purposes of the processing are to create and manage your Rocklab One member account, to verify your eligibility and keep your profile up to date.

The processing is based on the performance of the membership contract between you and the CMA (code of conduct, T&Cs).

The processing of your photo is based on your consent.

b) Categories of personal data

To fulfill these purposes, the CMA collects the following categories of personal data: identification data, personal/artistic information, login and authentication data, content of published posts.

c) Retention periods

Your account data is retained for the duration of your membership. If you deactivate your account, your data is kept for a 6-month grace period during which you can reactivate your account by logging back in. After 6 months, your account is deleted.

If you delete your account, your personal data is immediately deleted, subject to the retention periods for post board and community announcements (section 3.5).

However, financial and ticketing records are retained for 10 years in accordance with Article 16 of the Luxembourg Commercial Code (accounting and financial records).

In the event of a complaint or dispute regarding your Rocklab One membership, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff.
Data processors responsible for hosting and administration of the platform.
Anthropic PBC (Claude AI) for automated post moderation (see section 3.5).

Apart from these recipients, your personal data is not shared with third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.2 Event and services registration

a) Legal basis and purposes of personal data processing

The purposes of the processing are to manage your registration for Rocklab events and services and your application to performance-based Rocklab activities.

The management of your registration is based on the performance of the membership contract between you and the CMA.

b) Categories of personal data

To fulfill these purposes, the CMA collects the following categories of personal data: identification data, event-related data and history.

c) Retention periods

Your account registration and attendance data is retained for the duration of your membership. However, financial and ticketing records are retained for 10 years in accordance with Article 16 of the Luxembourg Commercial Code (accounting and financial records).

In the event of a complaint or dispute regarding Rocklab events and services, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff.
Data processors responsible for hosting and administration of the platform.
Ticketmatic, the data processor responsible for ticketing and event registration.

Apart from these recipients, your personal data is not disclosed to third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.3 Rehearsal and production room subscription and booking

a) Legal basis and purposes of personal data processing

The purposes of the processing are to manage your subscription and booking for Rocklab rehearsal and production rooms.

The processing is based on the performance of the membership contract between you and the CMA.

b) Categories of personal data

To fulfill these purposes, the CMA collect the following categories of personal data: identification data, booking-related data and history.

c) Retention periods

Your account data is retained for the duration of your membership. However, financial and ticketing records are retained for 10 years in accordance with Article 16 of the Luxembourg Commercial Code (accounting and financial records).

The personal data contained in rejected subscription applications is anonymized 6 months after the rejection.

In the event of a complaint or dispute regarding room subscription and booking, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff.
Data processors responsible for hosting and administration of the platform.

Apart from these recipients, your personal data is not disclosed to third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.4 Artist/band profile and electronic press kit (EPK)

a) Legal basis and purposes of personal data processing

The purpose of the processing is to promote artists visibility and professionalism with an updatable public-facing Electronic Press Kit (EPK) page presenting the artists projects.

b) Categories of personal data

To fulfill this purpose, the CMA collects the following personal data: identification data, professional/artistic data.

c) Retention periods

Your public-facing EPK data is retained until it is deactivated, or the account is deactivated or deleted.

In the event of a complaint or dispute regarding your public-facing EPK, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff.
Other Rocklab One members.
General public.
Data processors responsible for hosting and administration of the platform.

Apart from these recipients, your personal data is not disclosed to third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.5 Post board and community announcements

a) Legal basis and purposes of personal data processing

The purpose of the processing is to manage publication of structured announcements on a community post board accessible to other authenticated members.

To preserve the relevance and professionalism of the board, every post is automatically pre-screened by an artificial-intelligence content-moderation service (Claude AI, provided by Anthropic PBC) before being reviewed and published, edited, or rejected by Rocklab administrators. No fully automated decision is taken: a Rocklab One administrator always review a rejected post before it is permanently rejected.

The publication of posts is based on the performance of the membership contract and the moderation step (including the use of Claude AI) is based on our legitimate interest in protecting the community and the reputation of the platform.

b) Categories of personal data

To fulfill these purposes, the CMA collects the following categories of personal data: identification data, post content.

c) Retention periods

If your account is deactivated, your data will be masked for 6 months until your account is reactivated.

If your account is not reactivated or if you request the deletion of your data, measures to remove and mask identifying information will be implemented before the data is archived for security purposes.

In the event of a complaint or dispute regarding your post board and community announcements, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff.
Data processors responsible for hosting and administration of the platform.
Anthropic, PBC (Claude AI), the third-party service provider responsible for the automated pre-screening of posts.

Apart from these recipients, your personal data is not disclosed to third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.6 Newsletter management

a) Legal basis and purposes of personal data processing

The purpose of the processing is to send Rocklab One members news about Rocklab, agenda additions as well as ticket offers.

The sending of the newsletter is based on your explicit consent, given by ticking the dedicated checkbox at registration or in your profile settings.

b) Categories of personal data

To fulfill these purposes, the CMA collects the following categories of data from you: identification data.

c) Retention periods

Your data is retained until you withdraw your consent or after 3 years of inactivity.

In the event of a complaint or dispute regarding Rocklab One newsletter, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff.
One Dry Nugget (Delight Data), the processor responsible for managing newsletters.
Data processors responsible for hosting and administration of the platform.

Apart from these recipients, your personal data is not disclosed to third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.7 Support tickets and contact requests

a) Legal basis and purposes of personal data processing

The purpose of the processing is to receive, manage and reply to your support requests (technical issues, booking problems, membership questions, etc.) submitted through the dedicated support form on the platform.

The processing is based on our legitimate interest in providing help and assistance to our members.

b) Categories of personal data

To fulfill these purposes, the CMA collects the following categories of data: identification data and data related to your request.

c) Retention periods

Your support tickets and related data are retainedduring your membership.

In the event of a complaint or dispute regarding support tickets, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff.
Data processors responsible for hosting and administration of the platform.

Apart from these recipients, your personal data is not disclosed to third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.8 Music scene directory and ecosystem cartography

a) Legal basis and purposes of personal data processing

The purpose of the processing is to map the Luxembourgish music ecosystem on the platform through: the music scene directory, which allows you to be discovered by other members of the platform and to be contacted directly by them via the contact channels you have made visible, and a structured directory of partner organizations contributing to Rocklab activities, so that members can identify and contact relevant organizations.

The visibility of your member profile in the directory and the listing of partner organizations is based on our legitimate interest in providing a community platform that fulfils its core function of connecting Luxembourgish music professionals and reflecting the diversity of the ecosystem.

b) Categories of personal data

To fulfill these purposes, the CMA collects the following categories of data: identification data, professional/artistic data.

c) Retention periods

Your data is visible in the directory for as long as you are a member or partner and have not opted out.

In the event of a complaint or dispute regarding our music scene directory and ecosystem cartography, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff.
Rocklab One members.
Data processors responsible for hosting and administration of the platform.

Apart from these recipients, your personal data is not disclosed to third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.9 Reporting & analytics (data driven dashboard)

a) Legal basis and purposes of personal data processing

The purpose of the processing is to monitor membership activity, room and event usage, and aggregated engagement statistics, to manage operations, support programming decisions and improve the service.

The processing is based on our legitimate interest in monitoring and improving the platform and its services.

b) Categories of personal data

To fulfill these purposes, the CMA collects the following categories of data: activity and behavioral data.

c) Retention periods

Your data is retained as long as you are a member, unless you have exercised your rights to erasure or to object to the processing of your personal data for statistical purposes.

Anonymized or aggregated statistics, which can no longer be linked to you, may be retained for longer periods for statistical analysis and service improvement.

In the event of a complaint or dispute regarding reporting and analytics, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff.
Data processors responsible for hosting and administration of the platform.

Apart from these recipients, your personal data is not disclosed to third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.10 Security: fraud prevention, system monitoring and troubleshooting

a) Legal basis and purposes of personal data processing

The purpose of the processing is to ensure the security of your account and of the platform, by detecting and preventing unauthorized access and by recording sensitive administrative actions in audit logs.

The processing is based on our legitimate interest in protecting your account and the platform, and where applicable on the performance of the membership contract (code of conduct, T&Cs).

b) Categories of personal data

To fulfill these purposes, the CMA may collect and process the following data: login and authentication data.

c) Retention periods

Authentication sessions expire after 7 days (28 days if you select “remember me”) and refresh tokens are deleted upon logout or after 28 days at the latest.

System logs are retained for 90 days.

In the event of a complaint or dispute regarding reporting and analytics, the data will be retained until the procedural deadlines have expired.

d) Recipients or persons accessing your personal data

Your personal data is accessible only to:

Authorized CMA staff responsible for the security and operation of the platform.
Data processor responsible for hosting and administration of the platform.

Apart from these recipients, your personal data is not disclosed to third parties. However, the CMA may be required to disclose your personal data to authorized third parties to comply with its legal obligations, particularly in the event of a court order.

3.11 Cookie management

See our Cookie policy: one.rocklab.lu/cookie-policy

4. TRANSFER OF YOUR PERSONAL DATA OUTSIDE THE EUROPEAN UNION

The personal data collected by the CMA is primarily processed within the European Union: the platform is hosted on infrastructure located in Luxembourg, and administrative reporting is handled internally within the European Union.

However, certain third-party services may involve the transfer of your data outside the EU. The post board moderation feature relies on automated content analysis performed by Claude AI, a service provided by Anthropic, PBC, established in the United States (48 Market St, PMB 90375, San Francisco, CA 94104). Anthropic, PBC acts as a data processor of the CMA under a data processing agreement.

The content sent to Claude AI is strictly limited to the text of the post submitted for moderation (title, description, post type and publicly accessible image links). No identification data (name, email address, or member identifier) is transmitted. Anthropic retains the submitted content for a maximum of 30 days, after which it is automatically deleted, and does not use it to train its models.

The transfer is governed by the standard contractual clauses adopted by the European Commission. You may obtain a copy of the applicable safeguards by contacting the DPO at the address indicated above.

5. SECURITY OF YOUR PERSONAL DATA

Considering technological developments, implementation costs, the nature of the data to be protected, and the risks to individuals’ rights and freedoms, the CMA implements all appropriate technical and organizational measures to ensure the security of the personal data collected.

These measures include:

The use of physical and logical security measures to ensure the availability, integrity, and confidentiality of information systems and processed data,
The protection of data against any security breach resulting, accidentally or unlawfully, in the destruction, loss, alteration, unauthorized disclosure of personal data, or unauthorized access to such data (personal data breach).

6. WHAT ARE YOUR RIGHTS AS A DATA SUBJECT?

Within the limits and under the conditions permitted by the GDPR, you have the right to request from the data controller access to your personal data, the rectification or erasure of such data, and the restriction of the processing of your personal data.

You also have the right to object to the processing of your personal data, particularly the right to object to the use of your data for marketing purposes.

If, after contacting us, you believe that your rights regarding your personal data have not been respected, you may file a complaint with the Commission Nationale de la Protection des Données (CNPD) or the supervisory authority in your place of residence.

How do you exercise your rights?

To exercise these rights or for any questions regarding the processing of your data, you may contact us by verifying your identity and addressing your inquiry to the CMA via email: [email protected]

We recommend that you send this email with a reading receipt. Please note that the CMA reserves the right to refuse requests that do not meet legal requirements or that are otherwise unfounded or excessive under applicable law.