Privacy statement

Version of 13 October 2026

This statement describes how BandPage processes personal data. For newsletter subscriber data, BandPage acts as a processor; the customer sending the newsletters is the controller. For customer account data, BandPage is itself the controller.

What data we process

• Account data: name, email address, hashed password, two-factor settings.
• Subscribers/contacts: email address, first and last name, subscription status and date, unsubscribe reason.
• Sending data: delivery status, bounces, complaints and (if enabled) open and click events per newsletter, with their browser information and the network part of the IP address, to recognise automatic opens and clicks by security software. This per-recipient data is deleted after 180 days.
• Security logs: IP address, browser information and request data for blocked bot/spam attempts, account registrations, and sign-ins and sign-in attempts.
• Billing details: name, company name, address, postcode, city, country and VAT number; with a VAT number also the name and address the EU has registered under it; and the country a payment comes from, derived from the payment itself, because it counts for the VAT.
• Payment data: payment references and amounts. The payment provider Mollie keeps a customer record with the company or contact name and the email address of the page owner; that record is removed as soon as the page is erased for good.

Legal basis and purpose

• Performance of the contract (providing the service, sending newsletters).
• Consent (double opt-in) for receiving newsletters.
• Open and click measurement is off per newsletter unless the sender enables it. As the controller, the sender is responsible for its legal basis and for telling their subscribers.
• Legitimate interest (security, abuse prevention, billing).
• Legal obligation (issuing invoices and keeping them for the tax authorities).

Sub-processors

We use the following parties. Account, contact and sending data is stored and processed within the EEA.

Sentry only receives something when an error occurs in our software. Such a report holds technical details about the error and the address of the page, without IP address, cookies, form contents or email addresses. The data is kept in Sentry's EU data centre in Frankfurt. Because Sentry is an American company, the transfer is also covered by the EU-US Data Privacy Framework and standard contractual clauses.

Invoices are issued in the own invoicing system of amphora.interactive, the company behind BandPage. That is not a third party. If you fill in a VAT number, we check it with the VIES service of the European Commission, which receives only the VAT number.

Retention periods

• Security logs (bot blocks): 90 days.
• Registration logs (account creation): 180 days.
• Sign-in logs (sign-ins and sign-in attempts): 90 days.
• Accounts whose email address was never confirmed: 14 days.
• Per-recipient sending logs: 180 days.
• Deleted pages, including their contacts, lists, newsletters and sending logs: erased for good 30 days after deletion, except for the invoices.
• Invoices, with the billing details on them: 7 years, because tax law requires it, then erased automatically. This also applies when the page is deleted earlier.
• Account and contact data: for as long as the account/subscription exists, then deleted on request.

Your rights

You have the right to access, rectify and erase your data. Subscribers can unsubscribe from every newsletter. Requests can be directed to the sender of the newsletter; for account data, contact us via the details on our website. You may also lodge a complaint with the Dutch Data Protection Authority.