Version 2026.1.0
1.1 This privacy policy (“Policy”) describes how NOCTA-FLOW AB, reg. no. 559521-2589 (“NOCTA-FLOW”), processes personal data in connection with NOCTA-FLOW’s platform and service (“Service”). The Policy applies to Users, contact persons of Users, Invitees (persons whom a User invites to a booking through the Service, as defined in the Terms and Conditions) and other persons whose personal data appear in the Service.
1.2 NOCTA-FLOW is the controller for the processing described in the Policy, unless otherwise stated.
1.3 Processing is carried out in accordance with Regulation (EU) 2016/679 (“GDPR”) and supplementary Swedish data protection legislation.
1.4 Terms defined in NOCTA-FLOW’s Terms and Conditions have the same meaning in the Policy unless stated otherwise.
1.5 NOCTA-FLOW’s contact details for data protection matters are hello@nocta.se.
Account data: name, artist name, email address, telephone number, role in the Service, company name and, where NOCTA-FLOW requests supporting documentation under the Terms and Conditions, such documentation. The email address is also used to authenticate the User at login.
Profile data: descriptive text, music styles, experience, previous performances, references, price indications, availability, geographical area, images uploaded by the User, and links to external services such as SoundCloud and Spotify. Only images can be uploaded to the Service; audio and video are linked from external services and are not stored by NOCTA-FLOW.
Booking data: requests, confirmations, changes and cancellations, dates and times, venue, fees and terms, schedules, rosters, technical information about the venue, and information on performances registered by the User after the event.
Invitee data: name, email address and, where provided by the inviting User, telephone number and role, together with the booking-related information sent to the Invitee.
Communications: messages between Users in the Service and communications with NOCTA-FLOW’s support.
Technical data: IP address, information about device and browser, logins, timestamps, event logs, error reports and information on how the Service is used.
Data collected through cookies and similar technologies as set out in section 9.
NOCTA-FLOW does not request sensitive personal data. Users must not provide information about health, religious or political beliefs, sexual orientation, trade union membership or similar matters in the Service.
Personal data is collected from the User upon registration and through use of the Service, from other Users (for example when a Booker registers information about an Artist or a contact person, or when a User invites an Invitee), automatically through the User’s use of the Service and, to the extent NOCTA-FLOW verifies information under the Terms and Conditions, from public registers and publicly available sources.
4.1 NOCTA-FLOW processes personal data for the following purposes and on the following legal bases:
1. creating and administering accounts, authenticating Users at login, providing the Service in accordance with the Terms and Conditions, and providing support: performance of a contract,
2. displaying the User’s profile, information and availability to other Users: performance of a contract,
3. facilitating, documenting and administering booking requests, Bookings and planning: performance of a contract,
4. sending invitations to Invitees at the request of a User and administering bookings between a User and an Invitee: legitimate interest,
5. enabling communication between Users in the Service: performance of a contract,
6. operations, security, logging, troubleshooting and protection against misuse, fraud and unauthorised access: legitimate interest,
7. analysing usage, producing statistics, and developing and improving the Service, including matching and recommendation features: legitimate interest,
8. marketing the Service to the User, such as information about new functions and subscriptions: legitimate interest,
9. handling legal claims and complying with obligations under law or decisions by public authorities: legitimate interest and legal obligation.
4.2 NOCTA-FLOW’s legitimate interests consist of providing a functioning and secure platform, administering bookings with Invitees at the request of Users, developing and improving the Service, and marketing its business. Where the User is a legal person, personal data relating to its representatives and contact persons is processed on the basis of NOCTA-FLOW’s legitimate interest in entering into and performing the agreement with the User.
4.3 Account data is required to create an account. Without it, NOCTA-FLOW cannot provide the Service. Profile data is provided voluntarily, and the User decides what to include in the profile.
4.4 NOCTA-FLOW does not make decisions based solely on automated processing that produce legal effects concerning a person or similarly significantly affect a person. Matching and recommendation features in the Service provide suggestions only; Users decide whom to contact and engage.
5.1 The Service is based on Users being able to find and see each other. Profiles are visible only to registered Users; there are no publicly visible profiles. Profile data as set out in section 2 is available to other registered Users in the Service. The User decides which information is published in the profile and can change or remove it.
5.2 When a User sends or responds to a booking request, contact details, profile data and booking-related information are shared with the counterparty, to the extent needed for the dialogue and the Booking.
5.3 Where another User accesses personal data through the Service and subsequently processes it for their own purposes, that User is an independent controller for that processing. NOCTA-FLOW is not responsible for such processing. Under the Terms and Conditions, information about other Users may only be used for booking and collaboration with the User concerned.
6.1 NOCTA-FLOW engages suppliers who process personal data on NOCTA-FLOW’s behalf. The Service is operated on the Lovable Cloud platform, with data, including uploaded images and files, stored with Supabase within the EU/EEA. Lovable is NOCTA-FLOW’s processor and Supabase is a sub-processor. NOCTA-FLOW also engages suppliers for email delivery. These suppliers are processors and process the data only on NOCTA-FLOW’s instructions and under data processing agreements.
6.2 Personal data may be disclosed to legal and other advisers where needed to establish, exercise or defend legal claims.
6.3 Personal data is disclosed to public authorities where NOCTA-FLOW is required to do so by law or by a decision of a public authority.
6.4 In the event of a merger, acquisition or transfer of NOCTA-FLOW’s business or part of it, personal data may be transferred to the acquirer.
6.5 NOCTA-FLOW does not sell personal data.
7.1 NOCTA-FLOW aims to ensure that personal data is processed within the EU and the EEA. The Service is hosted, and data is stored, within the EU/EEA.
7.2 If personal data is transferred to a country outside the EU and the EEA, the transfer is based on a European Commission adequacy decision, or on the Commission’s standard contractual clauses together with the supplementary safeguards deemed necessary in the individual case.
8.1 NOCTA-FLOW processes personal data for as long as necessary for the purposes stated in section 4. As a starting point, the following applies:
1. account data and profile data are kept while the account is active and for 90 days thereafter, in accordance with the Terms and Conditions,
2. booking data and communications in the Service are kept while the account is active and for 12 months thereafter, as the information may be needed to show what the Users have agreed,
3. data about Invitees is kept for the same period as booking data,
4. technical logs are kept for 12 months,
5. support cases are kept for 24 months from the closing of the case,
6. data needed to handle a legal claim is kept until the claim has been finally resolved.
8.2 Data may be kept for a longer period where required by law or by a decision of a public authority.
8.3 Anonymised and aggregated information that cannot be linked to an identifiable person does not constitute personal data and may be kept without time limitation.
9.1 The Service only uses cookies and similar technologies that are necessary to provide the Service. Such cookies are used for login, session management, security, load balancing and basic functionality.
9.2 Necessary cookies may be used without consent under the Swedish Electronic Communications Act (2022:482), as they are needed to provide a service expressly requested by the User. The Service therefore does not use a cookie consent banner.
9.3 NOCTA-FLOW does not currently use cookies for statistics, analytics or marketing. If such cookies are introduced, consent will be obtained before they are placed on the User’s device, and the Policy will be updated.
9.4 Cookies can be blocked or deleted in the browser settings. If necessary cookies are blocked, the Service may stop working.
NOCTA-FLOW takes appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction and unlawful processing. The measures include access control, encryption of traffic, logging, backups, access restrictions and incident management procedures.
The User is responsible for ensuring that personal data the User registers or provides in the Service about other persons, such as its own employees, artists, contact persons or partners, may be processed, and that the persons concerned receive the information they are entitled to. The User must not provide more personal data in the Service than is needed for booking, planning and collaboration.
12.1 A person whose personal data is processed has the right to:
1. obtain information about and access to the personal data being processed,
2. have inaccurate personal data rectified and incomplete data completed,
3. have personal data erased, unless there are grounds for continued processing,
4. request that processing be restricted,
5. object to processing based on legitimate interest, including processing for direct marketing,
6. under certain conditions, receive the data provided in a structured, commonly used and machine-readable format and transfer it to another controller, and
7. withdraw consent where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.
12.2 Requests are made to hello@nocta.se. NOCTA-FLOW responds to a request without undue delay and at the latest within one month of receipt. NOCTA-FLOW may need to verify the identity of the person making the request.
12.3 Deletion of an account does not affect data NOCTA-FLOW is required to retain by law, data needed to handle a legal claim, or data other Users have already received within the framework of a Booking.
12.4 Anyone dissatisfied with NOCTA-FLOW’s processing of personal data may lodge a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten), imy.se.
13.1 NOCTA-FLOW may update the Policy. The latest version is always available in the Service.
13.2 In the event of material changes, NOCTA-FLOW informs Users by email or by notice in the Service.