Privacy Policy

Danburite House CRM — operated by ProgTrack, LLC · Effective [[effective date]] · Version 1.0

This policy explains what personal data the Danburite House management system handles, why, and the rights you have. It applies to the talent we represent, the brand and business contacts we work with, and people who correspond with us. It is written to describe what the system actually does today.

1. Who we are (the data controller)

Danburite House, operated by ProgTrack, LLC (United States), is the data controller for personal data processed in this system. For any privacy question, or to exercise the rights in §7, contact us at [[[email protected]]].

For individuals in the European Union / EEA, our EU representative under Article 27 GDPR is [[EU representative — name & contact route, once appointed]].

2. Who this policy covers

Talent we represent or are in discussions with (including a talent-facing portal where signed talent can view their own contracts, invoices and deliverables).
Brand, agency and business contacts we manage commercial relationships with.
People who email us, whose correspondence we keep as part of operating our business.

3. What data we hold

Category	Examples
Identity & contact	Name (legal and preferred), pronouns, date of birth, email, phone/WhatsApp, postal address, country, time zone.
Professional / public profile	Social-media handles, follower and engagement figures (often drawn from public profiles), representation and agency notes, rate cards.
Commercial & financial	Opportunities, contracts and their values, commissions, invoices and payments, VAT details, and — for talent we pay — a tax identifier and a linked Stripe payout account reference. We do not store bank-card numbers or bank-account details; those are collected and held by Stripe (see §5).
Correspondence	Emails sent and received through the system, including the message bodies and the addresses involved.
Account & security	For people with a login: username, a securely hashed password (never stored in plain text), and access/audit logs.

We do not collect special-category data (such as health, biometric, or belief data), and we keep minors' personal data out of the system.

4. Why we use it, and our legal basis

To represent the talent we work with — performing our representation agreement (GDPR Art. 6(1)(b)): managing their profile, securing and running brand deals, invoicing on their behalf, and arranging their payouts.
To manage our commercial relationships with brands and contacts, and to assess and pursue opportunities — our legitimate interests in running the agency (Art. 6(1)(f)); you may object at any time (§7).
To keep records of correspondence — our legitimate interest in operating a business inbox and maintaining an accurate record (Art. 6(1)(f)).
To meet legal, accounting and tax obligations — a legal obligation (Art. 6(1)(c)); this is why financial records are kept even after other data is deleted (§7).
Marketing or non-essential messages, where applicable, are sent only with your consent (Art. 6(1)(a)); you can withdraw it at any time.

5. Who we share it with (our service providers)

We do not sell personal data. We use a small set of trusted providers ("processors") who act only on our instructions under data-processing agreements; where they are outside the EU/EEA, the transfer is covered by the European Commission's Standard Contractual Clauses (and any applicable framework):

Provider	Purpose	Where
Hetzner	Hosting our database and application	Germany (EU)
Cloudflare	Content delivery and edge security	Global edge; EU traffic
Mailgun	Sending our outbound email (we use its EU service endpoint)	EU endpoint; US parent company
Migadu	Our mailboxes (inbound email)	EU
Stripe	Payment, invoicing and talent payouts; Stripe collects and holds any bank/card details directly	United States (with EU processing where applicable)

We may also disclose data where required by law, to establish or defend legal claims, or with your consent.

6. Where your data is stored

Our database and files are hosted in Germany (EU). Some of our providers (notably Stripe, and Mailgun's parent company) are based in the United States; where personal data of EU/EEA individuals reaches a US provider, that transfer is governed by Standard Contractual Clauses or another lawful transfer mechanism.

7. Your rights

Depending on where you live (including under the EU/UK GDPR and applicable US state laws such as the Texas and California privacy laws), you may have the right to:

Access the personal data we hold about you, and receive a copy (Art. 15 / Art. 20).
Correct inaccurate data (Art. 16).
Delete your data — the "right to be forgotten" (Art. 17). When we action a deletion we anonymize your CRM record; we retain financial records (invoices, payments, contracts) for the period the law requires for accounting and tax (currently [[retention period — e.g. 7 years; confirm ES + TX]]), as the law expressly permits.
Object to or restrict processing based on our legitimate interests (Art. 21 / Art. 18), and withdraw consent for anything based on consent (Art. 7).

To exercise any right, email us at [[[email protected]]]. We action requests manually and aim to respond within [[30]] days. You also have the right to complain to your data-protection authority — in Spain, the Agencia Española de Protección de Datos (AEPD); in the EU, your local authority; in the US, your state Attorney General where applicable.

8. How long we keep it

Talent, contact and CRM data: kept while the relationship is active and for a defined period after the last activity (default [[12–24 months]]), then deleted or anonymized.
Financial and legal records: kept for the statutory accounting/tax period ([[retention period]]).
Correspondence: kept for [[email retention window]], then deleted.
Backups: rotated and deleted on our host's schedule.

9. Security

We protect the system with role-based access (people see only the records their role allows), per-person records filtering, securely hashed passwords, encryption in transit (TLS), EU hosting, and access logging. We continue to strengthen these measures (including stronger sign-in for privileged accounts).

10. Children

This system is for our business operations and is not directed to children. We do not knowingly hold the personal data of minors.

11. Changes

If we add features that change how data is handled — for example, optional AI assistance for sorting email — we will update this policy before turning them on, so that what it says always matches what the system does.

12. Contact

Danburite House (ProgTrack, LLC) — [[[email protected]]]. EU/EEA Article 27 representative: [[EU representative contact, once appointed]].