Last updated: February 25, 2026
ConcertsToAttend ("we", "us", "our") operates concertstoattend.com (the "Service"). This policy explains what personal data we collect, why we collect it, and your rights under the EU General Data Protection Regulation (GDPR).
The data controller is ConcertsToAttend. For privacy questions or data requests, email admin@concertstoattend.com.
When you create an account we store:
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide the Service (accounts, saved concerts, artist tracking) | Performance of contract |
| Send concert alerts and reminders you opted into | Consent |
| Send transactional emails (welcome, account changes) | Legitimate interest |
| Measure site usage with analytics (when you opt in) | Consent |
| Prevent abuse (rate limiting) | Legitimate interest |
We share data with the following processors, solely to operate the Service:
We also query public music APIs (such as Spotify, Ticketmaster, MusicBrainz, and YouTube) for artist and event metadata. No user personal data is sent to these services.
We do not sell your data to anyone.
We use a single session cookie to keep you signed in. It is strictly necessary for the Service to function and is not used for tracking or advertising.
If you give consent via our cookie banner, we enable Google Analytics, which sets its own cookies to measure how visitors use the site. IP addresses are anonymised. You can enable or disable analytics cookies at any time using the "Cookie Settings" link in the footer.
We do not use advertising cookies or third-party tracking cookies for ad targeting.
Under the GDPR you have the right to:
To exercise any of these rights, email admin@concertstoattend.com or use the relevant controls in your account settings.
Passwords are securely hashed. All connections use HTTPS. Database access is restricted to application services only.
Some of our processors (Vercel, Google, Mapbox) are based in the United States. Where data is transferred outside the EU/EEA, it is protected by the EU–U.S. Data Privacy Framework or Standard Contractual Clauses, as applicable.
The Service is not directed to children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
We may update this policy from time to time. Material changes will be communicated via email or a notice on the Service. The "Last updated" date at the top reflects the most recent revision.