1. Who we are and when this policy applies
This policy explains how Eventroo Participações Ltda. (“Eventroo”), registered under CNPJ no. 63.010.384/0001-43, headquartered at Rua Zeila Moura dos Santos, 101, conj. 1120, 11º andar (Time Work Station), Cristo Rei, Curitiba/PR, CEP 80050-605 processes personal data as a controller under the LGPD.
It applies to eventroo.com.br (and eventroo.music) and the services offered there: Pitching, Eventroo Publishing (songwriters, publishers and artists), the Artist area, playlist requests, the newsletter and customer support.
Services hired under their own contract, such as music distribution and the Publishing administration agreement, may have additional privacy clauses. In those cases, the contract and this policy complement each other.
2. What data we collect
We only collect data you give us or that is generated when you use the site. What we collect depends on what you do:
| When you… | Data processed |
|---|---|
| Contact support | Name, email, subject, message and attached files. |
| Subscribe to the newsletter | Email, language, sign-up and confirmation dates (double opt-in). |
| Submit a pitch | Email, contact name, company or label, Eventroo account ID, release details (title, artist, UPC, ISRC, dates, genre, language), links and numbers from your social and streaming profiles, pitch texts, uploaded images, chosen plan and payment region. |
| Pay for a pitching plan | Payment is processed by Mercado Pago. We receive the confirmation, amount and payment method; we never receive or store your card number. |
| Request a playlist add | Name, email, artist, track, link, genre and message. |
| Use the Artist area | Email, tracked tracks and positions in Eventroo's official playlists. |
| Use Eventroo Publishing | Name or company name, email, Brazilian CPF/CNPJ or foreign document, password (stored only as a hash), works, lyrics, co-writers and shares, recordings and ISRCs, uploaded audio files, payout details (bank account or PayPal, stored encrypted) and messages exchanged with our team. For artists: artist name, link to their work, favorite works and permission requests. |
| Browse the site | IP address, date and time, browser type and pages visited, in security and access logs. Cookies are described in the Cookie Policy. |
Contact support
- Data processed
- Name, email, subject, message and attached files.
Subscribe to the newsletter
- Data processed
- Email, language, sign-up and confirmation dates (double opt-in).
Submit a pitch
- Data processed
- Email, contact name, company or label, Eventroo account ID, release details (title, artist, UPC, ISRC, dates, genre, language), links and numbers from your social and streaming profiles, pitch texts, uploaded images, chosen plan and payment region.
Pay for a pitching plan
- Data processed
- Payment is processed by Mercado Pago. We receive the confirmation, amount and payment method; we never receive or store your card number.
Request a playlist add
- Data processed
- Name, email, artist, track, link, genre and message.
Use the Artist area
- Data processed
- Email, tracked tracks and positions in Eventroo's official playlists.
Use Eventroo Publishing
- Data processed
- Name or company name, email, Brazilian CPF/CNPJ or foreign document, password (stored only as a hash), works, lyrics, co-writers and shares, recordings and ISRCs, uploaded audio files, payout details (bank account or PayPal, stored encrypted) and messages exchanged with our team. For artists: artist name, link to their work, favorite works and permission requests.
Browse the site
- Data processed
- IP address, date and time, browser type and pages visited, in security and access logs. Cookies are described in the Cookie Policy.
Other people's data: in Publishing you may enter co-writers' names and shares. By doing so, you confirm you are authorized to share this data and that it is accurate. In the Marketing area, Eventroo may use emails of people who engaged with partner events for promotional communications, always with an unsubscribe option in every message.
We don't ask for sensitive data (such as racial origin, health, religion or biometrics). Please don't send it in open fields.
3. Why we use data and on what legal basis
Every processing activity has a defined purpose and a legal basis under article 7 of the LGPD:
| Purpose | Legal basis |
|---|---|
| Provide the services you asked for (pitching, Publishing, Artist area, playlist, support) | Performance of a contract or preliminary steps (art. 7, V) |
| Process payments and pay out royalties | Performance of a contract (art. 7, V) and legal obligation (art. 7, II) |
| Send service emails (confirmation, pitch result, status of a work) | Performance of a contract (art. 7, V) |
| Protect accounts, prevent fraud and verify identity | Legitimate interest (art. 7, IX) |
| Send the newsletter | Consent (art. 7, I), which you can withdraw at any time |
| Promotional messages to contacts from partner events | Legitimate interest (art. 7, IX), with unsubscribe in every email |
| Load Spotify and YouTube players | Consent (art. 7, I), given in the cookie notice |
| Keep access logs and meet tax and regulatory obligations | Legal obligation (art. 7, II), including Brazil's Internet Civil Framework |
| Defend Eventroo in judicial, administrative or arbitration proceedings | Regular exercise of rights (art. 7, VI) |
| Improve the site and support | Legitimate interest (art. 7, IX), with no advertising profiles |
Provide the services you asked for (pitching, Publishing, Artist area, playlist, support)
- Legal basis
- Performance of a contract or preliminary steps (art. 7, V)
Process payments and pay out royalties
- Legal basis
- Performance of a contract (art. 7, V) and legal obligation (art. 7, II)
Send service emails (confirmation, pitch result, status of a work)
- Legal basis
- Performance of a contract (art. 7, V)
Protect accounts, prevent fraud and verify identity
- Legal basis
- Legitimate interest (art. 7, IX)
Send the newsletter
- Legal basis
- Consent (art. 7, I), which you can withdraw at any time
Promotional messages to contacts from partner events
- Legal basis
- Legitimate interest (art. 7, IX), with unsubscribe in every email
Load Spotify and YouTube players
- Legal basis
- Consent (art. 7, I), given in the cookie notice
Keep access logs and meet tax and regulatory obligations
- Legal basis
- Legal obligation (art. 7, II), including Brazil's Internet Civil Framework
Defend Eventroo in judicial, administrative or arbitration proceedings
- Legal basis
- Regular exercise of rights (art. 7, VI)
Improve the site and support
- Legal basis
- Legitimate interest (art. 7, IX), with no advertising profiles
When we rely on legitimate interest, we first assess that it doesn't override your rights, and you can object at any time.
We don't make automated decisions that affect your interests without human review: pitches, works and artist access are reviewed by our team.
4. Who we share data with
Eventroo does not sell personal data. We only share what is necessary with:
- Technology providers that run the site for us: server hosting, Cloudflare (site delivery and attack protection) and email service.
- Mercado Pago, to process pitching payments, and financial institutions or PayPal, for Publishing payouts.
- Digital platforms and music partners, when needed for the service you asked for: for example, presenting a release to platforms in pitching, or registering works with collective management organizations and rights societies in Publishing.
- Have I Been Pwned, to check whether a password has appeared in public breaches. The password never leaves our server: we only send the beginning of a code derived from it (k-anonymity), which can't reveal it.
- Public authorities, when required by law, court order or a competent authority's request.
- In a merger, acquisition or corporate reorganization, data may be transferred to the successor, who remains bound by this policy.
Our lookups to Spotify and Deezer to find recordings only use the searched title and artist, with no personal data of yours.
5. International transfers
Some providers, such as Cloudflare, Spotify, Google (YouTube) and hosting and email services, may process data on servers outside Brazil. In those cases, transfers follow article 33 of the LGPD, with providers that adopt protection safeguards compatible with Brazilian law, such as contractual clauses and security certifications.
6. How long we keep data
We keep data for as long as needed for the purpose and to meet legal obligations. After that, it is deleted or anonymized.
| Data | Period |
|---|---|
| Publishing and Artist area accounts | While the account is active and, after closure, up to 5 years to meet obligations and defend rights |
| Access logs (IP, date and time) | At least 6 months, as required by Brazil's Internet Civil Framework (art. 15) |
| Payments and tax documents | 5 years, under tax law |
| Pitches and playlist requests | Up to 5 years, for history, support and defense of rights |
| Newsletter | Until you unsubscribe; after that we only keep the unsubscribe record so we don't email you again |
| Support requests | Up to 5 years |
| Audio and work data | While the work is registered or until a deletion request, subject to the contract |
| Record of your cookie choices | Up to 5 years, as proof of consent |
Publishing and Artist area accounts
- Period
- While the account is active and, after closure, up to 5 years to meet obligations and defend rights
Access logs (IP, date and time)
- Period
- At least 6 months, as required by Brazil's Internet Civil Framework (art. 15)
Payments and tax documents
- Period
- 5 years, under tax law
Pitches and playlist requests
- Period
- Up to 5 years, for history, support and defense of rights
Newsletter
- Period
- Until you unsubscribe; after that we only keep the unsubscribe record so we don't email you again
Support requests
- Period
- Up to 5 years
Audio and work data
- Period
- While the work is registered or until a deletion request, subject to the contract
Record of your cookie choices
- Period
- Up to 5 years, as proof of consent
7. Your rights
Under the LGPD (art. 18), you may, at any time and free of charge:
- Confirm whether we process your data and access it.
- Correct incomplete, inaccurate or outdated data.
- Request anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully.
- Request portability of your data to another provider.
- Request deletion of data processed based on your consent.
- Know who we share your data with.
- Know that you may refuse consent and what the consequences are.
- Withdraw consent, such as leaving the newsletter or changing your cookie preferences.
- Object to processing based on legitimate interest.
- Request review of decisions made solely by automated processing.
To exercise any right, write to [email protected]. We may ask you to confirm your identity to protect you. We reply within 15 days and, if some data must be kept by law, we explain why.
You may also file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.
8. How we protect data
We take technical and administrative measures to protect data against unauthorized access, loss and leaks, including:
- Encrypted connection (HTTPS) across the whole site.
- Passwords stored only as hashes, never in plain text, and blocking of passwords known to be breached.
- Bank and payout details stored encrypted.
- Audio files kept in a private area, available only to the account owner, our team and approved artists.
- Internal access restricted to those who need it, with a log of who opened sensitive data.
- Backups and server monitoring.
No system is completely immune to incidents. If a security incident occurs that may cause relevant risk or harm, we will notify the ANPD and affected people, as the law requires.
9. Children and teenagers
Eventroo's services are intended for people aged 18 or over. Minors may only use them represented or assisted by their parents or legal guardians. If we find data of a child processed without a guardian's consent, it will be deleted.
11. Third-party links and services
The site has links to and content from other companies, such as Spotify, YouTube, Instagram and music platforms. When you use them, their privacy policies apply, and we recommend reading them.
12. Data protection officer and contact
Eventroo's data protection officer (DPO) is Douglas Fernandes Soares Bessa, reachable at [email protected].
Any questions?
Get in touch. We answer personal data requests within 15 days.
- Company
- Eventroo Participações Ltda.
- CNPJ
- 63.010.384/0001-43
- Address
- Rua Zeila Moura dos Santos, 101, conj. 1120, 11º andar (Time Work Station), Cristo Rei, Curitiba/PR, CEP 80050-605
- Data protection officer (DPO)
- Douglas Fernandes Soares Bessa
13. Changes to this policy
We may update this policy to reflect changes in our services or the law. The date of the current version appears at the top of the page. If a change is significant, we will let you know on the site or by email before it takes effect.