Privacy Policy

Last updated: 3 September 2026

1. Who is responsible

The controller of the personal data described here is Pedro Ciordia, who performs and produces as Peter Base, in Spain. A postal address is available on request to the mailbox below.

For anything in this policy, including any of the rights in section 8, write to hello@peterbase.pro. That mailbox is read by the controller and is the fastest route to an answer.

2. What this policy covers

This site, the mail we send from it, and the private links we use to send unreleased music to labels, DJs and press. Those private links live at /p/ and carry a per recipient token. They are the most detailed processing described here, so they have their own section below.

3. What we collect, why, and on what legal basis

Visiting the website

Our hosting providers record the technical details of every request, including your IP address, the page requested and your browser, for a short period. We use it to keep the site running and to investigate abuse. Legal basis: our legitimate interest in operating and securing the site (Art. 6(1)(f) GDPR).

The site loads its typeface from Google Fonts, which means Google receives your IP address when a page loads. Pages that show music or video embed players from Spotify and YouTube, which set their own cookies and receive your IP address once an embed loads. The Meta advertising pixel loads only if you accept marketing cookies in the banner, and not before. Legal basis for the pixel: your consent (Art. 6(1)(a) GDPR and Art. 22.2 LSSI-CE). You can withdraw it at any time from the cookie policy.

Booking and contact requests

When you write to us through the site we hold your name, email address, company, city, country, the message itself and whatever budget or date detail you choose to give. We use it to answer you and to arrange the booking. Legal basis: steps taken at your request before a contract, and our legitimate interest in replying (Art. 6(1)(b) and (f) GDPR).

Newsletter and guest lists

If you subscribe we hold your email address and the date you subscribed. If you join a guest list we hold your name, email address and the number of companions. Legal basis: your consent for the newsletter (Art. 6(1)(a) GDPR), which you can withdraw with the unsubscribe link in every message; and the performance of your request for a guest list entry. If you ask us to stop, we stop on every list we keep, not only the one you were writing about.

Private links to unreleased music

We keep a working contact list of professionals in the music industry: name, work email address, role, company, country and where the address came from. We use it to send unreleased music to people whose job is to receive it. Legal basis: our legitimate interest in promoting our own work to professional contacts (Art. 6(1)(f) GDPR, read with Art. 19 of the Spanish LOPDGDD, which covers professional contact data of people acting on behalf of a company).

When you open a private link, the page records which seconds of the track were played and how many times, whether the page was opened at all, whether you asked for the WAV, whether you shared the link and which contact button you tapped. It also records your browser time zone and language (so "Europe/Berlin, de-DE", not a place) and a one way fingerprint built from your browser, your language and a coarsened form of your network address, salted per link, which is used only to tell one listener from two on the same link. We do this so we know whether the music we sent was actually listened to, which is the entire point of sending it. Legal basis: our legitimate interest in knowing that (Art. 6(1)(f) GDPR).

Because this involves reading and storing information on your device, the page tells you before it records anything, in its first screen, and it carries a control that switches the measurement off in one tap. Switch it off and the track still plays, the download still works, and nothing further is recorded. You can also object at any time by writing to hello@peterbase.pro, and we will stop and delete what that link recorded.

We do not track email opens. There is no tracking pixel in our messages and link rewriting is switched off, so the address in the message is the address you see. What we know is that a link was opened, not that a message was read. A page open on its own is not evidence that a person saw anything: corporate mail filters open every link in every message before it is delivered, and we count those separately for exactly that reason.

4. Where we got your address

If we contacted you about music and you never gave us your details, we obtained them from a public professional source such as a label or agency contact page, an artist roster or a public industry directory. We tell you which one in the first message we send you, and you can ask us at any time. We never buy contact lists and we do not use addresses collected for one purpose, such as a newsletter or a guest list, to send unreleased music.

5. Who else handles it

We do not sell personal data and we do not share it for anyone else's marketing. It is handled on our behalf by:

  • Supabase: database, file storage and server functions. Our project runs in the European Union (Ireland).
  • Vercel: website hosting and content delivery.
  • Resend: sends our email. Our sending region is Europe.
  • ImprovMX and Google: mail addressed to peterbase.pro is forwarded to a Gmail mailbox, so both handle the messages you send us.
  • Google: serves the typeface the site is set in.
  • Meta, Spotify and YouTube: only through the advertising pixel you consented to, or an embedded player you loaded.

Several of these companies are established in the United States, so your data may be transferred outside the European Economic Area. Those transfers rely on the data processing terms each provider publishes. Write to hello@peterbase.pro if you want to know which agreement covers a given provider.

Our hosting providers keep their own request logs, which include IP addresses, for their own retention periods. We do not use those logs to identify anyone and we never join them to the listening data described in section 3.

6. How long we keep it

  • The second by second detail of what you played on a private link12 months, then deleted
  • The rest of the listening record (plays, downloads requested, shares)24 months, then deleted
  • Session detail on a private link (browser fingerprint, time zone, language)24 months, then erased in place, leaving only the counts
  • The text of a promotional message we sent you24 months, then deleted
  • A professional contact we never sent anything to and who never opened a link36 months, then deleted
  • Newsletter subscriptionUntil you unsubscribe, plus a record of the unsubscribe so we do not mail you again
  • Booking enquiries, contact messages and guest list entriesAs long as needed to deal with the enquiry and any booking that follows it

The deletions in the first four rows run automatically. The rest are reviewed by hand, because there is no volume here that justifies pretending otherwise.

7. Automated decisions

We make no automated decisions that produce legal effects for you, and we do not profile you. The listening data from a private link is read by a person, and the only decision it informs is who we send music to next.

8. Your rights

Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict what we do with it, or to receive it in a portable format. You can withdraw any consent you gave, with effect from the moment you withdraw it.

You also have the right to object to anything we do on the basis of legitimate interest, which includes both the contact list and the listening measurement on a private link. If you object to promotional messages we stop immediately and without asking why.

Write to hello@peterbase.pro. We answer within one month. Booking enquiries are better sent to booking@peterbase.pro, which reaches the same person faster for that purpose.

If you are not satisfied with our answer you can complain to the Agencia Española de Protección de Datos (AEPD), the Spanish supervisory authority, at aepd.es. You can complain to them directly; you do not have to come to us first.

9. Changes to this policy

If we change what we collect, we change this page in the same release, and the date at the top moves. If a change materially affects people we already hold data on, we tell them.