BandRoom Privacy Policy

Version 1.0 of 13.10.2026

1. General Provisions

This Privacy Policy explains what personal data is processed when you use the BandRoom service, for what purposes and on what legal grounds, who receives it, how long it is kept, and what rights you have.

BandRoom (the Service) is an online booking service for rehearsal rooms and recording studios in Serbia. The Service is available on the website bandroom.rs, as an app that can be installed on a phone's home screen, and in Telegram as the @bandroom_bot bot and a mini app. Musicians find a venue, see free time slots and prices, and send a booking request; venue owners and their assistants accept requests and manage the schedule in the owner dashboard.

The personal data controller is the BandRoom service administration (the Operator). Contact for any personal data questions: info@bandroom.rs.

This document is prepared in accordance with the Law of the Republic of Serbia on Personal Data Protection (Zakon o zaštiti podataka o ličnosti, "Službeni glasnik RS", br. 87/2018) and applies to the extent that personal data processing is carried out in connection with the operation of the Service in Serbia.

Your BandRoom account is kept in the Operator's shared account system. If you are already registered with another service of the Operator using the same email address, Google account, Yandex ID or Telegram, signing in to BandRoom opens that same account.

2. The Operator and Venue Owners

The Operator determines the purposes and means of data processing in the Service: accounts, the catalog, requests and bookings, notifications, logs and analytics.
A venue owner and the assistants they appoint (the venue team) receive the data of your requests to that venue in order to decide on the request, contact you and hold the session. When the venue team uses this data to provide its own service (room rental, recording), it acts as an independent controller and is itself responsible for that use, including outside the Service (for example, when it calls you or copies a booking into its own calendar).

3. What Data We Process

Account. The name you enter or that the sign-in provider passes to us; email address and whether it is confirmed; password in hashed form (bcrypt algorithm) if you register with email; interface language; registration and last sign-in dates; acceptance of documents and their versions; sign-in sessions (device type and validity period).

Sign-in with Google: Google account ID, name, email address and whether it is verified, profile photo link.
Sign-in with Yandex ID: ID, name, email address, profile photo link.
Sign-in with Telegram (website widget, the @bandroom_bot bot or the mini app): Telegram ID, username, name, profile photo link, Telegram language.

Requests and bookings. Venue and room, date and time, weekly repetition, selected equipment, purpose of the session (category and/or comment), price according to the venue's price list at the time of the request, status (pending, confirmed, rejected, cancelled, rescheduling, no-show), who cancelled a booking and when, late-cancellation flag, rescheduling history. Your phone number, if you enter it in a request: without a linked Telegram account it is required so that the venue can contact you. If your profile has no phone number yet, this number is also saved to your profile.

Other actions of a musician. Waitlist entries (the room and time you are waiting for), favorite venues, opt-outs from venue promotional messages, reviews and ratings, suggestions of new venues for the catalog (name, address, contact, comment).

Information about you from a venue team. Decisions on requests and rescheduling, no-show marks, closing a specific venue's booking to you, as well as private notes about a client (up to 500 characters) that the team of a venue where you have booked may keep for itself. Notes are visible only to that venue's team.

Booking summary. The Service automatically counts, across your bookings, how many sessions took place, how many bookings you cancelled, including late cancellations (after the venue's free cancellation period), and how many no-shows there were. This summary is shown to the team of the venue you send a request to (section 6).

Owners and assistants. Venue card data: name, address and coordinates, contacts (phone, email, website, Instagram, Telegram), photos, description, rooms, equipment, prices and packages, opening hours, cancellation rules. Team members and assistant permissions, assistant invitations. The venue calendar link and the events received through it; settings for writing bookings to Google Calendar. Dashboard activity log: who changed what and when in settings, prices, bookings and the team. Records of venue listing fees, if introduced: period, amount, method and date of payment.

Notifications. Push notification subscriptions: the subscription address issued by your browser's push service, encryption keys, browser type. Delivery log: to whom, for which event and through which channel (Telegram, push, email) a notification was sent and whether it was delivered. The text of messages is not stored in the log.

Technical data. IP address, device and browser type, operating system, browser language, the page address, referral source and UTM tags (including visits via the QR code on a venue poster), date and time, cookie and browser local storage identifiers, page loading speed metrics.

What we do not process. BandRoom does not request your device's geolocation. The Service does not accept payments, so it does not receive bank card numbers or other payment data of musicians. We do not ask for information about health, political opinions or other special categories of data; please do not include such information in comments and notes.

4. Purposes of Processing and Legal Grounds

We process personal data only when there is a legal basis and to the extent necessary for a specific purpose:

Performance of a contract (the Terms of Use) and steps taken at your request before entering into it: registration and sign-in, the catalog and search for free time, passing your request to the venue team, confirmation, cancellation and rescheduling, the waitlist, reminders 24 hours and 1 hour before a session and other service notifications, the owner and assistant dashboard, assistant invitations, connecting a venue via an invitation link, writing bookings to the owner's calendar as configured by the owner.
Legitimate interests of the Operator and venue owners: Service security and abuse prevention (request rate limits, checks on sign-in forms); activity and delivery logs for handling complaints and disputes; the booking summary and venue team notes (protecting venues against no-shows and late cancellations); venue promotional messages to their own clients with the option to unsubscribe; filling the catalog with venue information from public sources and a single message to a venue owner via the venue's public contacts offering to join; our own visit statistics and improvement of the Service. You have the right to object to such processing (section 13).
Consent: optional analytics cookies and services (section 5), browser push notifications (you enable them yourself), linking Telegram for notifications, optional data you provide voluntarily. You can withdraw consent at any time; this does not affect the lawfulness of processing before the withdrawal.
Compliance with legal obligations: responding to lawful requests from state authorities, keeping records of listing fee payments by venue owners (if introduced) as required by accounting and tax legislation.

5. Cookies, Local Storage and Analytics

The Service uses cookies and browser local storage:

Necessary: sign-in data (session tokens are kept in the browser's local storage), interface language, short-lived service cookies during sign-in with Google or Yandex ID (protection against request forgery), visit identifiers for our own statistics. The Service does not work without them.
Form protection: Cloudflare Turnstile runs on the email sign-in and registration forms to check that a form is filled in by a person and not a program.
Analytics (optional): Google Analytics and Yandex Metrica (including click maps). They show which pages are opened and where the interface is inconvenient. We do not pass your account identifier to these services and do not link their data to your profile. The Service does not record actions on the page (Yandex Metrica Webvisor, Microsoft Clarity). These scripts are not loaded on the page of a venue owner's personal invitation link.

By continuing to use the Service after reading this Policy, you agree to the use of analytics cookies. You can opt out at any time: delete or block cookies in your browser settings, enable tracking protection or a content blocker, or install the Google Analytics opt-out add-on (tools.google.com/dlpage/gaoptout). Opting out of analytics does not affect booking. If you disable all cookies and browser storage, sign-in and some features will stop working.

We do not sell personal data and do not share it with third parties for their own advertising. Data is shared only to the extent necessary for the purposes in section 4.

The team of the venue you send a request to: your name, a link to your Telegram profile (if linked), the phone number from the request, the date, time, room, equipment and purpose of the session, your bookings at this venue, the summary of your bookings in the Service and that venue team's notes. If the owner has turned on showing details to visitors, other visitors see only the session category next to a booked time slot. Your name, phone number and comment are in any case visible only to the venue team.

Other users: your review of a venue is published after moderation together with the name from your profile. Venue card information (name, address, contacts, photos, prices) is public.

Processors and third-party services:

netcup GmbH (Germany) - hosting of the Service's servers and database.
Brevo (France) - sign-in emails: email confirmation code, sign-in link, email change confirmation.
Google (Google Ireland Limited and Google LLC) - the Google Workspace email service used to send emails about requests and bookings; sign-in with Google; the Google Calendar API for writing bookings to an owner's calendar with the owner's permission; Google Analytics; Google Fonts; the push service of the Chrome browser (Firebase Cloud Messaging).
Yandex (Russia) - sign-in with Yandex ID, if you choose it; Yandex Metrica.
Cloudflare, Inc. (USA) - Turnstile on the sign-in and registration forms.
Telegram - the @bandroom_bot bot, sign-in with Telegram, the mini app, notifications and venue promotional messages in Telegram. The Service's pages load a Telegram script required for the mini app.
Browser push services (Google, Mozilla, Apple, Microsoft) - delivery of push notifications. The content of a notification is passed to them in encrypted form.
OpenStreetMap (OpenStreetMap Foundation, United Kingdom) - map tiles on a venue page when you expand the map.
Third-party machine translation services and language models - translation of venue card texts (descriptions, names of rooms, equipment and packages) into the Service's languages. Musicians' data (requests, comments, contacts, reviews) is not sent for translation.

State authorities, courts and law enforcement agencies - upon a lawful request.

If a notification about a request or rescheduling has not reached the venue team, the Service administrator receives a message about it in order to help get in touch with the venue.

7. Google Account Data

When you sign in with Google, BandRoom requests only basic permissions: your email address and basic profile information (email, profile). We receive your Google account ID, name, email address and whether it is verified, and your profile photo link.
This data is used only to create your account or sign you in, show your name in your profile and in the requests you send to venues, and send service notifications to that email address.
The Google access token is used once to retrieve your profile data and is not stored. Signing in with Google does not give us access to your Gmail, calendar, contacts or files.
We do not sell data received from Google, do not use it for advertising and do not share it with third parties, except as described in section 6 (for example, a venue team sees your name in a request) and as required by law. We do not use this data to train artificial intelligence models.
The Google Calendar integration for venue owners works separately and is not related to signing in with Google (section 8).
BandRoom's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke BandRoom's access to your Google account at myaccount.google.com/permissions. You can have the received data deleted by deleting your BandRoom account or by writing to us.

8. Venue Owner's Calendar

Reading. An owner can enter a link to the venue calendar in the dashboard (for example, the secret iCal address of a Google calendar or a schedule page). Every few minutes the Service reads it to show room availability and stores the time, title and description of events. Visitors see only that a time is busy. Event titles are shown to them only if the owner has turned on showing details or marked an event as a public event.
Writing. If an owner has given the BandRoom service account access to their Google calendar with permission to make changes to events, the Service creates, updates and deletes in that calendar only the events of its own bookings. An event contains the venue and room, the time, the client's name, the purpose of the session and a link to the dashboard; the client's phone number and Telegram username are not written, and events are created as private. The owner can revoke access in the calendar's sharing settings at any time, after which writing stops.
A musician can add their own booking to a personal calendar (Google Calendar or an .ics file) with a button in "My bookings".

9. Sources of Data

You: at registration, in requests, in your profile and in the dashboard.
Sign-in providers (Google, Yandex ID, Telegram), if you choose such a sign-in method.
Venue teams: decisions on requests, no-show marks, notes; an owner can add you as an assistant by your email address or Telegram username.
Venue owners: venue information and venue calendar events.
Public sources: catalog information about venues (name, address, phone, website, social media pages, photos, opening hours) may be collected from the venues' own websites and pages and from public maps (OpenStreetMap, Google Maps). If you own a venue and the information is inaccurate, or you do not want the venue listed, write to us or connect the venue and correct its card.
Automatically: technical data and logs.

10. Cross-Border Data Transfers

The Service's servers and database are located in Germany (European Union). Some providers are located outside the Republic of Serbia:

European Union - netcup (Germany), Brevo (France), Google Ireland (Ireland).
United Kingdom - OpenStreetMap.
United States - Google LLC, Cloudflare, Inc. (transfers are based on the EU-US Data Privacy Framework), as well as browser push services.
Russia - Yandex: sign-in with Yandex ID (at your choice) and Yandex Metrica.
Telegram - servers in various countries, under Telegram's rules; the transfer happens when you yourself use Telegram for sign-in or notifications.

Transfers to countries that the Republic of Serbia does not recognize as ensuring an adequate level of protection take place only on grounds provided by law: standard contractual clauses, your consent, or the necessity to perform a contract with you at your choice (for example, when you sign in with Yandex ID or Telegram).

11. Retention Periods

Account data - while the account exists. When you delete your account, your name, email, phone number, photo and sign-in links (Google, Yandex ID, Telegram) are removed from the profile immediately, your phone number is erased from your requests, sessions and push subscriptions are deleted, you stop being an assistant at any venue, and your waitlist entries are deleted. A service copy of these identifiers is kept for up to 30 days in case of mistaken deletion and for handling disputes, and is then irreversibly deleted.
Booking history - while the account exists. After account deletion, bookings remain in the venue's records without your name and contacts, so that the venue keeps its session history.
Sign-in sessions - while valid (up to 30 days), then deleted within a week.
Notification delivery log and dashboard activity log - up to 12 months.
Push subscription - until you turn it off or the browser's push service reports that it is no longer valid.
Web server logs (IP address, time, request address, browser type) - about 10 days.
Records of our own visit statistics (the IP address is stored only as a hash) - up to 24 months; aggregated statistics not linked to a person - indefinitely.
Reviews - until you delete them. After account deletion, reviews remain without your name.
Venue card information - while the venue is in the catalog. At the owner's request, the card is unpublished.
Records of listing fee payments by venue owners - 5 years (tax legislation requirement).
Correspondence with support - up to 24 months.
Confirmation codes, sign-in links and invitation links - until they expire (from 10 minutes to 60 days).
Data in the analytics services (section 5) is kept under those services' rules.

12. Security Measures

We take reasonable technical, organizational and personnel measures to protect data from unauthorized access, disclosure, alteration, loss and destruction:

Connections are protected by TLS/HTTPS.
Passwords are hashed with bcrypt and are not stored in plain text.
Database access is restricted, and regular backups are made.
Client data in a request is visible only to the venue team; assistant permissions are set by the owner; dashboard actions are logged.
Sign-in links, invitations and links for deciding on requests are signed and time-limited or single-use.
Request rate limits and the Turnstile check protect against automated abuse.
Contractual data protection obligations of processors (DPA) and internal incident response procedures.

13. Your Rights

You have the right to:

Access your data (including in your profile and in "My bookings").
Request correction, completion or deletion of your data.
Request restriction of processing.
Receive your data in a machine-readable format (data portability).
Object to processing based on legitimate interest, including the booking summary and venue promotional messages.
Withdraw consent you have given.
Not be subject to a decision based solely on automated processing. Decisions on requests are made by the venue team, not by an algorithm; the booking summary is for information only.

Much of this you can do yourself: change your name and contacts in your profile; delete your account in your profile (the "Delete profile" button); unsubscribe from a venue's promotional messages via the link in the message; turn off push notifications in your browser or device settings; stop the @bandroom_bot bot in Telegram; revoke access to your Google account.

Your account is shared with SerbiaHub (serbiahub.com), so the "Delete profile" button deletes it there as well: your SerbiaHub listings and specialist card are unpublished and subscriptions are turned off. The owner of a venue that is in the catalog can delete the account only after the venue has been handed over to another owner or closed: write to info@bandroom.rs and we will help hand it over or close it.

For anything else, send a request to info@bandroom.rs. We respond within 30 days; in complex cases the law allows this period to be extended, and we will let you know. We may ask for additional information to verify your identity. Requests about data that a venue team uses outside the Service should also be sent to the venue itself.

14. Children's Data

The Service is not intended for persons under 15 years of age. If processing is based on consent in connection with information society services, a person who has reached 15 years of age may give consent themselves; for a person under 15, such consent must be given by a parent or other legal representative.

If you believe a child has provided us with data without proper consent, please contact us: info@bandroom.rs. We will delete such data.

15. Third-Party Websites and Services

The Service contains links to venues' websites and pages, their Instagram and Telegram profiles, maps and other third-party services. We do not control their content or data processing rules and recommend that you review their privacy policies yourself.

16. Changes to this Policy

We may update this Policy from time to time. The current version is published on https://bandroom.rs with the update date. In case of significant changes, we will additionally notify users through the Service interface or by email at least 14 days before the changes take effect.

17. Contacts and Complaints

For questions about personal data processing, write to info@bandroom.rs.

If you believe that the processing of your personal data violates the law, you have the right to lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (Poverenik za informacije od javnog značaja i zaštitu podataka o ličnosti, poverenik.rs).

BandRoom — rehearsal rooms and studios in Serbia