Privacy Policy

Last updated: November 16, 2025

1) Who we are

Xolo Go OÜ - Benjamin Alba
Registry code: 14717109 - EU VAT number / Local tax number: EE102156920
Paju tn 1a, 50603 Tartu, Tartu Maakond, Estonia
Contact: contact@benjaminalba.com

2) Scope

This Policy explains how we process personal data when you browse this website, contact us, purchase or license music, submit demos, or collaborate with the label. We comply with the EU General Data Protection Regulation (GDPR) and Estonian law.

3) Data we process

• Core technical data: IP address, device, browser, timestamps, pages (for security, performance, analytics).
• Contact data: name, email, message content (when you write to us or submit forms).
• Business data: contracts, invoices, licensing and collaboration details.
• Artist/roster data: public links, artwork, release metadata from third-party stores.
• Cookies: functional and limited analytics (see section 10).

4) Purposes & legal bases

• Site operation & security (Art. 6(1)(f) GDPR – legitimate interests: safe, functional service).
• Replies to inquiries & collaborations (Art. 6(1)(b) – pre-contractual steps; (f) for general inquiries).
• Licensing & sales administration (Art. 6(1)(b) – contract; (c) – legal obligations incl. tax/accounting).
• Marketing & updates (Art. 6(1)(a) – consent; you can withdraw at any time).
• Fraud prevention & legal claims (Art. 6(1)(f) – legitimate interests).

5) Retention

• Contact emails/forms: up to 24 months after last interaction, unless needed longer for a contract or claim.
• Contracts, invoices, royalties: as required by Estonian accounting/tax law.
• Logs & security data: typically up to 12 months, unless incident.

6) Sharing & processors

We may use reputable processors for hosting, email, analytics, fraud detection, and content delivery. They act under written data processing agreements and only on our instructions. We disclose data to authorities when legally required.

7) International transfers

If processors are outside the EEA, we rely on GDPR mechanisms (e.g., EU adequacy decisions or Standard Contractual Clauses) and implement additional safeguards where appropriate.

8) Your rights

• Access, rectification, erasure, restriction, portability, and objection (Arts. 15–21 GDPR).
• Where processing is based on consent, you can withdraw consent anytime (without affecting prior lawfulness).
• Right to lodge a complaint with a Supervisory Authority. In Estonia: Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate).

9) Security

We apply technical and organizational measures (encryption in transit, access controls, least-privilege, backups). No system is perfectly secure; we commit to good-faith efforts and incident response.

10) Cookies & analytics

We use essential cookies for basic functionality and may use lightweight, privacy-friendly analytics (aggregated or IP-truncated). Where required, we obtain consent via a banner before setting non-essential cookies. You can change preferences in your browser or via our cookie banner (when implemented).

11) Children

Our site is not intended for children under applicable local age of digital consent. We do not knowingly collect data from minors. If you believe we inadvertently collected such data, contact us to delete it.

12) AI & music creation (transparency)

Some musical works in our catalogue are AI-assisted in composition and production. Lead vocals are performed by human artists. We treat AI as a creative instrument-supervised by humans, with editing, quality control, and respect for rights. We do not knowingly ingest or train on unlawfully obtained datasets. If you have questions about a specific work, contact us.

13) Contact

For privacy requests, send an email to contact@benjaminalba.com with subject “Privacy Request”. We may ask for reasonable proof of identity.

14) Changes to this Policy

We may update this Policy. The “Last updated” date shows the latest version; material changes will be communicated on this page.