Privacy Policy
Last updated: 23 October 2026
This privacy policy explains which personal data Rekort Music processes when you visit rekort.nl, create an account, submit a demo or work with us on a release, why we do this and what your rights are. We process personal data in line with the General Data Protection Regulation (GDPR / AVG).
1. Who we are
The controller for the processing described here is:
Rekort Music (eenmanszaak)
Mathildadonk 87, 4707 VD Roosendaal, The Netherlands
Chamber of Commerce (KvK): 42188760
Email: info@rekort.nl
2. What we process, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Reviewing your demo and replying to you | Email address, the audio file or link you submit, our feedback | Taking steps at your request before entering into an agreement (art. 6(1)(b)) | 12 months after our reply if we don't release the track; for releases, see below |
| Your Rekort account | Artist / display name, email address, password (stored hashed), API tokens you create, and the bio and profile picture you add | Performance of the agreement (art. 6(1)(b)) | Until you delete your account, then removed within 30 days |
| Protecting our contact form against spam | IP address, as a counter of recent messages | Legitimate interest in keeping the form usable (art. 6(1)(f)) | 1 hour |
| Releasing, distributing and promoting your music, and paying your revenue share | Name and artist name, contact details, payment details, release and revenue data | Performance of the agreement (art. 6(1)(b)); legal obligation for our accounts (art. 6(1)(c)) | For the term of the agreement; financial records 7 years (Dutch tax law) |
| Emails and messages you send us, including through the contact form on our For Business page | Name, email address, company name, the content of your message | Legitimate interest in answering you (art. 6(1)(f)) | Up to 2 years after the conversation ends |
| Running and securing the website | IP address, browser and device data in server logs; session cookie when signed in | Legitimate interest in a secure, working website (art. 6(1)(f)) | Server logs up to 30 days |
| Website statistics (Google Analytics) | Pages visited, device and browser data, approximate location, online identifiers | Your consent (art. 6(1)(a)) | 14 months |
| Advertising and campaign measurement (Meta, TikTok) | Pages visited, actions on the site, online identifiers | Your consent (art. 6(1)(a)) | As set by Meta and TikTok, see their policies |
We do not sell your personal data and we do not use it for automated decision-making that has legal or similarly significant effects on you.
3. Cookies
When you first visit rekort.nl we ask which cookies you allow. Only necessary cookies are used without your permission. You can change or withdraw your choice at any time via “Cookie settings” at the bottom of every page; withdrawing does not affect processing that took place before.
| Category | Cookies / service | Purpose | Lifetime |
|---|---|---|---|
| Necessary (always on) | rekort_consent; rekort_dsp; next-auth.* / __Secure-next-auth.* | Remembering your cookie choice; remembering the streaming platform you follow playlists on; keeping you signed in and protecting forms | 12 months; session or up to 30 days |
| Analytics | Google Analytics 4: _ga, _ga_* | Statistics on how the site is used | Up to 2 years |
| Marketing | Meta Pixel: _fbp, _fbc; TikTok Pixel: _ttp | Measuring campaigns and showing relevant ads on Meta and TikTok | Up to 13 months |
| Embedded media | Spotify players on the playlist pages (cookies set by Spotify) | Playing playlist previews | As set by Spotify |
4. Who we share data with
We only share personal data where necessary for the purposes above:
- Our hosting provider, which runs the website, our API and our email on our behalf (processor).
- Google Ireland Ltd. for Google Analytics, only with your consent.
- Meta Platforms Ireland Ltd. and TikTok Technology Ltd., only with your consent. For the pixel data, Meta and TikTok act as joint controllers with us for collecting and transmitting it.
- Spotify AB, when you load a Spotify player.
- Distribution partners, streaming platforms and payment providers, when we release your music under an agreement with you.
- Authorities, where we are legally required to.
Google, Meta and TikTok may transfer data to countries outside the European Economic Area, including the United States. Those transfers rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on the European Commission's standard contractual clauses.
Our pages link to our social media profiles, the Spotify and YouTube Music apps and our merchandise shop on Spreadshop. Those services have their own privacy policies; their own terms apply once you open them.
5. Security
We protect your data with appropriate technical and organisational measures, including encrypted connections (HTTPS), hashed passwords and restricted access to our systems.
6. Your rights
You have the right to:
- access the personal data we hold about you and receive a copy;
- have incorrect data corrected and have data deleted;
- restrict processing, or object to processing based on legitimate interest;
- receive data you gave us in a machine-readable format (data portability);
- withdraw your consent at any time, for cookies via “Cookie settings”.
Email info@rekort.nl to exercise your rights. We reply within one month. We may ask you to confirm your identity first.
If you are not satisfied with how we handle your data, you can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own EU country.
7. Changes
We may update this policy when our services or the law change. The date at the top shows the latest version. If a change affects you significantly, we will tell you by email or on the website.