Privacy policy
Last updated: 5 October 2026
Backline by Project BANG is software that event brands use to run their lineup, website, audience and paid campaigns. This page says what personal data we process, why, who we share it with, and how you can have it deleted.
1. Who we are
Backline is made and operated by Project BANG BV, Nieuwstraat 27, 9100 Sint-Niklaas, Belgium, enterprise and VAT number BE 1002.027.024 ("Project BANG", "we").
For any question about privacy, write to [email protected].
2. Our two roles
We handle personal data in two different roles, and the difference matters for whom you should contact.
- For our own business we are the controller. This covers people who contact us through this website, and the people at our clients who have a Backline account. Section 3 is about this.
- For our clients we are a processor. A festival, promoter or venue uses Backline to hold data about its own fans, artists and team. That organisation decides what happens with the data; we process it on its instructions, under a data processing agreement. Section 4 is about this.
3. Data we decide about
| Who | What | Why | Legal basis |
|---|---|---|---|
| People who use the contact form on this website | Name, email address, organisation, the message | To answer you and to plan a demo | Steps before a contract, at your request; our legitimate interest in answering enquiries |
| People with a Backline account (our clients' team members) | Name, email address, role, password (stored hashed), two-step sign-in secret, sign-in and activity records | To give access, keep accounts secure and keep an audit trail | The contract with the client; our legitimate interest in security |
| Billing contacts at our clients | Company name and address, VAT number, billing contact, payment status | To invoice and collect subscription payments | The contract; legal accounting obligations |
We never see or store card or bank details. Payments run through our payment provider, Mollie.
We do not sell personal data, and we do not use it for advertising of our own.
4. Data we hold for our clients
When an event brand uses Backline, it can hold the following data in it. The event brand is the controller; its own privacy policy tells you how it uses your data.
| Who | What | What it is used for |
|---|---|---|
| Fans who register on the event's website | Name, email address, country, favourite artists, personal schedule, consent choices, use of the fan tools on the website | Showing your own line-up and schedule, reminders you asked for, and telling the event which artists are in demand |
| Fans who allow notifications | The technical address your browser gives for push notifications | Sending the notifications you opted in to |
| Artists and their representatives | Name, email address, biography, press photos and other files you upload, approval decisions | Preparing and approving the event's line-up, artwork and website content |
| The event's team | Name, email address, role | Access to the event's workspace |
If you are a fan or an artist and want to see, correct or delete this data, the quickest route is the event itself. You can also write to us: we pass your request to the right organisation and help it answer you.
We process no special categories of data, such as health data or political opinions.
5. Meta and other ad platforms
A client can connect its own advertising account at Meta (Facebook and Instagram) to Backline, so that it can prepare, create and report on its own campaigns. This is what happens with data in that connection.
What we receive from Meta
- The name, status, currency and time zone of the client's ad account, and the name of the Facebook Page the ads run as.
- The campaigns, ad sets and ads that Backline created in that account, and their status.
- Performance figures for those campaigns: spend, impressions, clicks and conversions, as totals per day.
We do not receive profiles, friend lists, messages or any other personal data about people who use Facebook or Instagram. The figures we receive are totals, not data about individuals.
What we send to Meta
- The campaigns, ad sets, ads, images and texts the client chooses to create. Everything is created paused; only the client can start it.
- Only if a client chooses to build an audience from its own fans: the email addresses of fans who gave consent for this, scrambled first (SHA-256 hashing) so that Meta receives no readable address. Fans who did not consent are never included, and a fan who withdraws consent is removed at the next daily update.
How the connection is kept
- The access token of the client's ad account is stored encrypted and is used only for that client's workspace.
- We use data received from Meta only to show the client its own campaigns and results. We do not combine it across clients, sell it or use it for anything else.
- A client can remove the connection at any time. Section 11 says how data from Meta is deleted.
6. Who we share data with
We use the following companies to run Backline. Each one only gets the data it needs for its task.
| Company | What for | Where |
|---|---|---|
| TransIP B.V. | Hosting: servers, database and files | Netherlands |
| Ploi (WebBuilds B.V.) | Server management | Netherlands |
| Cloudflare, Inc. | Network security and encrypted backups | EU and United States |
| Functional Software, Inc. (Sentry) | Error monitoring | EU (Germany) |
| SMTP.com | Sending emails such as invitations, approvals and password resets | United States |
| Mollie B.V. | Subscription payments | Netherlands |
| Teamleader NV | Invoicing | Belgium |
| Google Ireland Ltd. | Website statistics from the client's own Google Analytics account (totals only) | EU and United States |
| Meta Platforms Ireland Ltd. | Campaigns, only for clients who connect their own ad account (see section 5) | EU and United States |
| Anthropic, PBC | AI features: the text or document a user sends for that feature. Not used to train AI models. | United States |
We also share data when the law obliges us to.
7. Transfers outside the EU
Backline's servers and database are in the Netherlands. Some of the companies above are based in the United States. Where personal data goes there, it is covered by the EU–US Data Privacy Framework or by the European Commission's standard contractual clauses.
8. How long we keep data
- Enquiries through this website: up to two years after our last contact.
- Accounts: for as long as the client's subscription runs. A team member's account is removed when the client removes it.
- Data we hold for a client: for as long as the client's subscription runs. When it ends, the client gets a full export and we delete the data within 30 days.
- Backups: encrypted backups are kept for up to six months and then deleted.
- Invoices and payment records: seven years, as Belgian accounting law requires.
9. Security
- All traffic is encrypted (HTTPS). Passwords are stored hashed; access tokens and other secrets are stored encrypted.
- Each client's data is separated from every other client's, and that separation is tested automatically at every release.
- Owners of a workspace and our own administrators sign in with two-step verification.
- Sign-ins, administrator access, exports and deletions are recorded in an audit log.
- If a breach affects your data, we tell the client concerned without undue delay, and the data protection authority where the law requires it.
10. Your rights
Under the GDPR you can ask to see your data, have it corrected or deleted, limit or object to its use, receive it in a portable form, and withdraw a consent you gave. Withdrawing consent does not affect what happened before.
Write to [email protected]. We answer within one month. If your data is held for an event brand, we pass your request on to that organisation and help it answer.
You can also complain to the Belgian Data Protection Authority: dataprotectionauthority.be, Drukpersstraat 35, 1000 Brussels.
11. Deleting your data
To have your data deleted, send an email to [email protected] with the subject "Data deletion request".
Tell us which event or organisation it concerns and the email address you used. We confirm within 7 days and complete the deletion within 30 days.
- Fans: the event can delete your record, favourites and notification settings directly in Backline; we do it for them if you ask us.
- Clients who connected an ad account: removing the connection in Campaigns deletes the stored access token at once. On request we also delete the campaign records and performance figures received from Meta. Campaigns in your own Meta account stay yours and are not affected.
- Clients who end their subscription: everything in the workspace is deleted within 30 days, after you received your export.
Data in backups disappears as the backups expire (section 8). We keep only what the law obliges us to keep, such as invoices.
12. Cookies
This website sets no cookies and uses no tracking. The Backline application sets only the cookies needed to keep you signed in and to protect forms; they need no consent.
The websites we build for event brands are separate sites with their own cookie notices.
13. Changes and contact
When we change this policy, we change the date at the top. For changes that matter, we tell our clients by email in advance.
Project BANG BV · Nieuwstraat 27, 9100 Sint-Niklaas, Belgium · [email protected]