Privacy Policy

This Privacy Policy explains how personal data is processed when you visit the official Benjamin Alba website, contact the Artist, or follow links to music and third-party platforms.

1. Data controller

Xolo Go OÜ
Registry code: 14717109 · EU VAT number / Local tax number: EE102156920
Paju tn 1a, 50603 Tartu, Tartu Maakond, Estonia
Official artist website: Benjamin Alba
Privacy contact: contact@benjaminalba.com

2. Scope

This Policy covers personal data processed through this website, including first-party audience measurement, technical security data and information submitted through the contact form. It does not govern the independent processing activities of Apple Music, X or other third-party services linked from the site.

3. Personal data processed

• Contact data: name, email address and message content that you submit voluntarily.
• Audience and technical data: date and time, page visited, referrer, approximate country, region and city, IP address, browser, device category and user-agent string.
• Preview listening data: release and track preview played, date and time, approximate location, browser and device category. A play is recorded only after at least three seconds of actual playback.
• Bot classification: whether a request appears to come from a human visitor, a recognised crawler or an unclassified client, including the crawler name where identifiable.
• Professional correspondence: information contained in collaboration, composition, songwriting, licensing or other business enquiries.

Please do not send sensitive personal data unless it is genuinely necessary for your request.

4. Purposes and legal bases

• Operating, securing and troubleshooting the website: legitimate interests in providing a safe, reliable service.
• Private first-party audience and listening measurement: legitimate interests in understanding aggregate readership, popular pages, Apple preview engagement, approximate locations, referrers and crawler activity so the site and catalogue presentation can be improved and maintained.
• Answering enquiries: steps taken at your request before a contract, performance of a contract where applicable, or legitimate interests in managing correspondence.
• Legal, licensing and accounting administration: contractual necessity, legal obligations and legitimate interests in establishing or defending claims.

Contact details are not used for newsletters or promotional email unless you separately and expressly agree.

5. Private website statistics

Audience and qualified preview-play statistics are collected directly by this website and stored in a private MySQL database. They are not sent to Google Analytics or an advertising analytics provider. The dashboard is restricted to the site operator by password, time-based verification code, secure session controls and rate limiting.

Recognised search engines and crawlers are counted separately from likely human visitors. Unknown or unusual user agents are kept in an “unclassified” category rather than automatically treated as human. A pseudonymous visitor value derived from IP address and user agent is used only to estimate unique visitors within the private dashboard; it is not used for advertising, profiling across websites or automated decisions.

Country, region and city are estimated locally on this server with MaxMind’s GeoLite2 City database; visitor IP addresses are not sent to MaxMind for these lookups. Historical rows can be recalculated from the same local database so that one IP is not assigned conflicting locations. IP geolocation is inherently approximate: a city can be wrong or unavailable and must never be understood as a precise address or the location of an individual.

6. Contact form and email

Submitting the form sends your name, email address and message to contact@benjaminalba.com. For spam prevention and troubleshooting, the message also includes the IP address and browser user-agent associated with the submission. The form uses a CSRF token, a hidden anti-spam field and connection-based rate limiting.

7. Apple Music, artwork and affiliate links

Release information and artwork are obtained from Apple services. Artwork may be loaded from Apple-operated content-delivery domains, which can receive ordinary request data such as IP address, browser information and the referring page.

Audio previews are streamed directly from Apple only when you press Play; the website does not download or cache the audio. The current release’s Apple Music destination is displayed next to the preview. After three seconds of playback, the website records one qualified play for private aggregate statistics.

Some Apple Music links contain an affiliate or campaign identifier. Apple and its partners may attribute a visit or transaction to this website. This does not change the price paid by the visitor. Apple handles data under its own privacy terms.

8. Cookies and local storage

The public catalogue does not use advertising or behavioural-tracking cookies. A strictly necessary session cookie is created when you open the contact page so the form can be protected against cross-site request forgery. The private dashboard uses a separate, strictly necessary secure authentication session.

If the site operator explicitly selects “Trust this device” during a password-and-verification-code sign-in, a secure, HttpOnly, SameSite cookie may remain on that browser for up to 365 days. The server stores only a keyed hash of the random device token and a reduced browser signature in protected private storage. The token is limited to the dashboard path, can be revoked from the dashboard, is removed for the current browser on sign-out, and is never used for advertising or cross-site tracking.

9. Recipients and international transfers

Data may be processed by providers used for hosting, content delivery, security, email, backups and technical maintenance, only as needed to provide those services. MaxMind supplies the periodically downloaded geolocation database but does not receive visitor IP addresses from local lookups; Apple delivers artwork, release information, previews and destination links. Data may also be disclosed to advisers, courts, regulators or public authorities where required by law or necessary to establish, exercise or defend legal claims.

Some providers or external platforms may process data outside the European Economic Area. Where the controller is responsible for a transfer, an appropriate GDPR mechanism is used when required, such as an adequacy decision or Standard Contractual Clauses with supplementary safeguards.

10. Retention

• Private audience and preview-listening statistics: normally 180 days, configurable by the site operator between 7 days and five years; the active setting is applied through automated cleanup.
• Approximate geolocation cache: normally 30 days and automatically removed after it is no longer useful; it stores a keyed IP hash rather than the raw IP address.
• Contact messages: normally up to 24 months after the last meaningful interaction, unless an active project, contract, dispute or legal duty requires longer.
• Contracts, invoices, licensing and accounting records: for the period required by applicable tax, accounting and commercial law.
• Security rate-limit records: short-lived and automatically removed after they are no longer needed.
• Trusted-device records: until their selected expiry, for no longer than 365 days, or earlier when the operator signs out or revokes trusted devices.

11. Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, consent may be withdrawn without affecting earlier lawful processing. You may also complain to a competent supervisory authority; in Estonia this is the Andmekaitse Inspektsioon.

12. Security, children and automated decisions

Technical and organisational safeguards include encrypted transport where available, restricted administration, hashed credentials, two-step verification, secure session cookies, access controls and database query parameterisation. No internet service can be guaranteed completely secure.

The site is intended for a general audience and is not designed to knowingly collect data from children. Collected information is not used for solely automated decisions that produce legal or similarly significant effects.

13. Requests and changes

For a privacy request, email contact@benjaminalba.com with the subject “Privacy Request”. Reasonable identity verification may be required. This Policy may be updated when the website, providers, practices or legal requirements change; the date above identifies the current version.