How we look after
your information.

Who is responsible

Resonans is a non-commercial student project run by Benjamin Gillis, Copenhagen, Denmark. It is not an official service of the Royal Danish Academy of Music (DKDM). Benjamin is the data controller for the personal data described here. Contact: kontakt@resonansmusik.dk.

What we collect

• Account: your email address, the name you give us, your role (musician or seeker), an optional organisation, and when you signed up and last signed in. Your password is handled by our sign-in provider and stored only in scrambled (hashed) form — we never see it.
• Musicians: the portfolio you write (bio, repertoire, what you are looking for, area, fees, availability), your photo, links to your YouTube or Vimeo recordings, the contact details you choose to add (email, phone), and whether you have confirmed your account this year.
• People looking for musicians: the gigs you post (title, description, line-up, date, place, postal code, fee), plus a private address and email that only you and the moderator can see.
• Using the site: your conversations, reports you send, people you block, musicians and gigs you save, alerts you set up, and notices we send you.
• Technical data: our hosting providers keep short-lived server logs (IP address, browser, time) to keep the service running and secure.

Why we use it, and our legal basis

• To run Resonans for you — accounts, portfolios, gigs, messages and service emails (sign-in links, new-message emails, the yearly confirmation email). Legal basis: our agreement with you (GDPR art. 6(1)(b)).
• To keep the platform safe — handling reports, automatic checks for hurtful messages and for gigs that ask for personal characteristics, removing content, and security logs. Legal basis: our legitimate interest in a safe, lawful platform (art. 6(1)(f)).
• To keep the directory to current students — the yearly confirmation of musician accounts. Legal basis: legitimate interest (art. 6(1)(f)).
• Where the law requires it, for example answering authorities. Legal basis: legal obligation (art. 6(1)(c)).

We never sell your data, show advertising or use your data for marketing. We don’t ask for sensitive data such as health, religion or CPR number — please don’t put it in your portfolio or messages.

Who can see what

• Visitors who are not signed in see the basics of live portfolios and a short version of each gig, without the poster’s name or the fee.
• Signed-in members see full portfolios. Signed-in musicians also see who posted a gig and what it pays.
• Email addresses and phone numbers are only shown to signed-in members, and only if the musician chose to show them.
• Conversations are visible only to the two people in them. The moderator can read a conversation only after one of them has reported it.
• The moderator sees member lists and reports in order to keep the site safe. Statistics show totals, not people. Every moderator action is logged.

Services that process data for us

• Supabase — database, sign-in and photo storage. Our data is stored on servers in Stockholm, Sweden (EU).
• Vercel — hosts the website, served from Stockholm, Sweden (EU).
• Brevo (France, EU) — sends our emails.

They process data only on our instructions, under data processing agreements. Supabase and Vercel are US companies: the data is stored in the EU, but their staff may access it from the US for support and security. These transfers are covered by the EU Standard Contractual Clauses in their agreements and, where the company is certified, the EU–US Data Privacy Framework.

YouTube (Google) and Vimeo are separate companies with their own privacy policies. A recording only loads from them when you press play; then they receive your IP address and browser details. We use YouTube’s privacy-enhanced mode and Vimeo’s “do not track” setting.

Cookies and similar

We only use what is strictly necessary, so there is no cookie banner: a sign-in cookie that keeps you signed in, a language cookie when you choose Danish or English, and small settings saved in your own browser (for example sound and motion preferences). No analytics, no advertising, no tracking. Our fonts are served from our own site, so loading a page doesn’t contact Google.

How long we keep it

• Your account and everything in it stay until you delete them. When you delete your account it happens straight away and cannot be undone: your profile, portfolio, photo, gigs, saved items, alerts and reports are removed, and your name is removed from the moderator’s log.
• Conversations: the messages you sent stay in the other person’s inbox, shown as from “Deleted member” — they were sent to them. A conversation is removed completely when both people have deleted their accounts. Each conversation keeps only its latest 1,000 messages; older ones are deleted automatically.
• Musicians confirm their account every January. If you haven’t confirmed within 3 months, your account becomes inactive and your portfolio is hidden. If you still haven’t confirmed after 6 months, your account and everything in it is deleted.
• Gigs close automatically after their date. Server logs are kept only for the short periods our hosting providers need. Copies in our providers’ backups disappear when those backups expire.

Your rights

You can see and download your data (Settings → Download my data), correct it by editing your profile, and delete your account (Settings → Delete account). You also have the right to restrict or object to how we use your data, and to data portability. For anything else, write to kontakt@resonansmusik.dk and we will answer within one month.

If you are unhappy with how we handle your data, you can complain to Datatilsynet, the Danish Data Protection Agency: www.datatilsynet.dk, Carl Jacobsens Vej 35, 2500 Valby.

Age

You must be at least 15 years old to create an account.

Security

The site only works over an encrypted connection (HTTPS). Access to the systems is protected with two-factor authentication. If a security breach puts your data at risk, we report it to Datatilsynet within 72 hours and tell you directly if the risk to you is high.

Changes

If this policy changes, we update the date above. Important changes are announced on the site.