Privacy Policy

1. Data controller and legal framework

gigg.me is operated by Bongga S.A.S., a Colombian company identified with NIT 901.991.482, domiciled in Medellín, Colombia, which acts as the Data Controller of your personal data. This policy is issued in compliance with article 15 of the Colombian Political Constitution, Law 1581 of 2012 (general regime for personal data protection / habeas data), Decree 1377 of 2013, and other related rules of the Republic of Colombia.

2. Information we collect

• Account data: artist or promoter name, legal name, email, phone, encrypted password and authentication credentials.
• Public profile data: biography, photos, videos, links, music and material you choose to publish.
• Open call and Application data: what a Promoter posts (city, date, format, conditions) and what an Artist proposes when applying, including the fee.
• Date and contract data: place, date, agreed terms and the identification data of the parties (name, ID document, address, email, phone) needed for the performance agreement.
• Tax identity: when a Date requires it, the ID or tax number and the tax data needed to calculate withholding and prepare the tax support document. They are requested attached to a specific Date, never at sign-up.
• Payment data: when there is a charge, it is processed by an authorized payment gateway; we do not store your full payment method data.
• Usage and technical data: browsing behavior, logs, IP address, device identifiers and cookies (see our Cookie Policy).

3. Purposes of processing

We process your personal data for the following purposes:

• Creating and managing your account and providing you the Platform features.
• Publishing the Artist's profile and the Promoter's Open calls, which are publicly accessible content by their nature.
• Connecting whoever books with whoever plays: showing Open calls that match a profile and processing Applications.
• Recording agreed Dates, generating the performance agreement and preparing the paperwork regulation requires, including the withholding calculation and the tax support document.
• Charging the commission owed by whoever books.
• Sending you operational communications, alerts and, if you authorize it, product news.
• Producing public profile metrics and aggregate usage statistics.
• Ensuring security, preventing fraud and complying with legal obligations.

We do not sell your personal data. We do not use it for purposes other than those disclosed without your prior authorization.

4. Authorization and third-party data

By registering and accepting this policy, you grant your free, prior, express, and informed authorization for the processing of your data under the terms described here. We are not authorized to process sensitive data or data belonging to minors: the Platform is for people over 18 only.

If you upload third-party personal data (for example, booking contacts or a contracting party's data for a contract), you state that you have the authorization or legal basis to do so, and that you informed those people about the processing gigg.me will carry out as processor or controller, as applicable.

5. Intellectual property rights over your content

The music data and content you upload remain your property. gigg.me does not acquire copyright or related rights over your music; it only processes it to provide you the Service, under the limited license described in our Terms of Use and in accordance with Law 23 of 1982, Law 1915 of 2018, and Andean Community Decision 351 of 1993.

6. Your rights as a data subject (habeas data)

Under Law 1581 of 2012, as a data subject you have the right to:

• Know, update, and correct your personal data.
• Request proof of the authorization granted.
• Be informed about the use given to your data.
• File complaints with the Superintendence of Industry and Commerce (SIC) for violations of the law.
• Revoke the authorization and/or request the deletion of your data when there is no legal or contractual duty to retain it.
• Access your personal data free of charge.

7. Procedure to exercise your rights and delete your data

You can exercise your rights to access, update, correct, revoke, or delete in two ways:

• From the Platform: by editing your profile or deleting your account from settings. When you delete your account, the associated data is irrevocably erased within the following 30 days, except for data we must retain due to a legal obligation.
• By email: by writing to support@bongga.dev, stating your request and information that allows us to identify you.

We will handle inquiries within a maximum of ten (10) business days and complaints within a maximum of fifteen (15) business days, in accordance with Law 1581 of 2012, extendable under the terms of the law. If the account has active contracts, settlements, or obligations, we may retain the information strictly necessary while the legal or contractual duty remains.

8. Data retention

We retain your data while your account is active and for as long as necessary to fulfill the purposes described and any legal obligations (for example, tax or contractual). Once those periods expire, the data is securely deleted or anonymized. Information is hosted on cloud infrastructure contracted with providers acting as Data Processors.

9. Processors and international transfers

To operate the Platform we use providers that act as Data Processors and that may store or process data outside Colombia (mainly in the United States):

• Cloud infrastructure providers: database, authentication, and file storage.
• Payment gateway: processing of payments made through the Platform.
• Spotify: metadata integration for your profile analytics.
• Messaging and email providers for operational notifications.

These transfers are carried out adopting measures that ensure adequate levels of protection under Law 1581 of 2012 and SIC guidelines. We do not share your personally identifiable information or your financial data with third parties for commercial purposes without your explicit consent.

10. Security measures

We implement reasonable technical, human, and administrative measures to protect your data, including encryption, role-based access control, database-level security policies (RLS), and strengthened authentication. In the event of a security incident that compromises your data, we will notify affected individuals and the competent authority in accordance with applicable law, where possible within 72 hours of detection.

11. Minors

The Platform is intended exclusively for people over 18 years old. We do not intentionally collect data from minors. If we become aware that we have collected data from a minor, we will delete it in accordance with applicable Colombian law.

12. Changes to this policy

We may update this policy periodically. If there are substantial changes to how your data is processed, we will notify you through the Platform or by email before they take effect.

Contact

For privacy inquiries, exercising your rights, or data deletion requests, write to us at: support@bongga.dev
Bongga S.A.S., NIT 901.991.482, Medellín, Colombia.