Privacy Policy

5. Photos & Videos You Upload (Moments)

After some shows we share a link (dondiablo.com/moments/…) where fans who were there can upload their photos and videos. This section explains which data that involves and what we do with it. The licence you give us for your uploads is set out in our Terms.

What we collect.

• The photos and videos themselves, including the people who can be seen or heard in them.
• Metadata stored inside the files, which can include when and where a photo or video was taken (time, location) and which device was used. Before sending, your device normally resizes photos and removes their metadata (including location), and converts videos larger than 40 MB or above 1080p to at most 1080p without metadata. Videos up to 40 MB and 1080p, GIFs, and files your device cannot convert (for example some HEIC photos in some browsers) are sent as they are, with their metadata; we do not use it to profile you.
• Your email address and, if you give it, the name or Instagram handle you want to be credited with.
• Which show you uploaded for, and when.
• Your IP address and browser information (user agent), to prevent abuse.
• A record of what you agreed to: the exact licence text and its version, and the date and time. If you also chose to receive emails, we store that choice with its exact text and version as well.

What we use it for. Reviewing the uploads; using the photos and videos we select in our content (such as social media, ads, aftermovies, our website and press), with credit where possible; contacting you about your upload if needed; preventing spam, abuse and illegal content; keeping proof of the licence and of your choices; and — only if you ticked the separate, optional box — sending you news by email. If you tick that box, your email address is added to our mailing list (Brevo) and counted in our fan database (section 6).

Legal basis.

• Contract: the licence agreement you enter into when you upload (your uploads, email address, credit and the licence record).
• Legitimate interest: for the people who can be recognised in uploads (sharing footage of a public show to promote it), and for preventing abuse (IP address and user agent). You can object at any time.
• Consent: for emails, if you ticked that box. You can withdraw it at any time with the unsubscribe link in any email.

Storage and sharing. Uploads are stored in private storage with our hosting provider Supabase and are not publicly accessible; our team views them through links that expire. We may share selected uploads with the parties we work with to make and publish content (such as editors, labels and agencies). Once we publish an upload, it is public.

How long we keep it.

• Uploads that were started but never finished: deleted automatically after 24 hours.
• Uploads we turn down: deleted 30 days after we have reviewed them.
• Uploads we have not reviewed within 6 months: deleted automatically.
• Uploads we keep for possible use: kept until we turn them down or you ask us to remove them (see Removal below).
• Uploads we use: kept for as long as we use them.
• The record of the licence and of your choices: kept for as long as the licence runs, as proof.
• Your IP address and browser information: deleted automatically after 90 days.
• Your email address for news (if you opted in): used for news until you unsubscribe; see section 11 for what we keep after that.

Removal. Want an upload removed — your own, or one in which you can be recognised? Email info@dondiablo.com with the show and a description or screenshot of the photo or video. We will delete it from our storage and not use it in anything new. We cannot recall content that has already been published or that others have already shared. Your other rights (section 7) apply as well.

6. Our Fan Database & Shared Mailing List

To understand where our fans are and how we can reach them, we keep one overview with one entry per fan (the "fan database"). It combines data we already have from:

• sign-ups on dondiablo.com (drops and city requests) and the Hexagonia waitlist;
• Hexagonia accounts, including activity such as meetups, push notifications, likes and comments;
• our mailing list at Brevo, including the people HEXAGON HQ added to it (see below) and — for customers of our webshop — the number of orders and the total amount spent, which Brevo receives from the webshop;
• Moments uploads, only if you chose to receive emails;
• HEXAGON HQ (hexagonhq.com), the record label founded by Don Diablo, which we also run and which uses the same database: members of the HEXAGON community (not members it blocked) and sign-ups for HEXAGON events and merch (name, email address and, where given, phone number, city and country), and approved release receipts (name and email address only, never the receipt itself).

For each fan it shows the country and city, which channels we may use (email, SMS, push — taking unsubscribes and STOP replies into account), when we first and last saw you, and a "superfan" score based on your activity, such as the drops you signed up for, purchases, community membership and uploads. We use it to plan shows, drops and releases and to decide where to focus. It is updated automatically every 15 minutes, so unsubscribes and deletions in the sources carry through.

The score only helps us understand our audience: it does not decide whether you can take part in anything, and it has no legal or similar effect on you. Being in the fan database does not by itself mean we send you messages: we only contact you through the channels you signed up for with us, on dondiablo.com or hexagonhq.com.

Legal basis: our legitimate interest in understanding our audience and planning our work. You can object at any time (section 7). How HEXAGON HQ handles your data is explained in its own privacy policy at hexagonhq.com/privacy; if you ask HEXAGON HQ to delete your data, it is also removed from our fan database and, if you came onto our mailing list through hexagonhq.com, from the mailing list.

One mailing list with HEXAGON. Don Diablo and HEXAGON share one mailing list at Brevo, for email and SMS. Every sign-up form on hexagonhq.com (the community, event and merch sign-ups and release receipts) says that by submitting you agree to receive news, drops and offers from Don Diablo and HEXAGON by email and SMS, and HEXAGON HQ stores that consent (the text, its version and the time). If you joined the HEXAGON community, signed up for a HEXAGON event or merch, or sent a release receipt, and your consent to that text was stored, our server adds you to the list, usually within a few minutes: your email address, your mobile number for SMS if you gave one, your name, city and country, and where you signed up. Community members who joined before 13 October 2026 agreed to messages from HEXAGON HQ only, so we don't add them unless they sign up again. We never add anyone who unsubscribed, or whom HEXAGON HQ blocked from its community; if HEXAGON HQ blocks someone later, we take them off the list again, unless they are also on it through dondiablo.com or our webshop. If you replied STOP to our texts, we add your email address but not your number. If you were already on the list, we only fill in details that are missing. If you signed up on hexagonhq.com, or on dondiablo.com from 13 October 2026, messages can come from Don Diablo and from HEXAGON; if you signed up on dondiablo.com before that, they come from Don Diablo, as the text at sign-up said. Unsubscribing (the link in any email, or replying STOP) stops all messages on the list. Legal basis: your consent, which you can withdraw at any time.

10. Cookies & Ads Measurement (Meta)

Cookie banner. We only load the Meta Pixel (Facebook and Instagram) and Google Analytics if you click "Accept" in the cookie banner. They set cookies (such as _fbp and _fbc for Meta) to measure our ads and see how the site is used, including for custom and lookalike audiences. For collecting this data through the Pixel, we and Meta are jointly responsible. Our arrangement with Meta is Meta's Controller Addendum (facebook.com/legal/controller_addendum); you can also exercise your rights with Meta. Legal basis: your consent.

Changing your choice. You can change your choice at any time with Cookie settings here or in the footer of the site. If you switch to "Decline", we stop the Pixel, remove Meta's cookies (_fbp and _fbc) from this site, and our server stops sending events to Meta.

Server-side events (Conversions API), also only with your consent. If you clicked "Accept", our server also tells Meta when you sign up for a drop or for tour updates, ask for a show in your city, or send a booking request, so we can measure and improve our ads (including custom and lookalike audiences). We send the email address, phone number, name, city and country you gave us in hashed form (scrambled with SHA-256). Hashing is not anonymisation: Meta can still match the result to your Facebook or Instagram account, if you have one. We also send your IP address and browser details and, if available, Meta's click identifiers (from Meta's cookies on your device, or from the Facebook click ID in the link you came from); these are not hashed. If you decline cookies, or haven't made a choice yet, our server sends nothing to Meta. Legal basis: your consent, which you can withdraw at any time (see "Changing your choice" above).

Always on. Cookies and browser storage the site needs or that remember your own choices, such as your cookie choice, sound settings and logins for password-protected pages.

Other services. Some pages show content from other services, such as YouTube videos, the map on our tour page and Cloudflare's anti-spam check on forms. These load from those services' servers, so they receive your IP address and browser details and may use their own cookies; their own privacy policies apply.

11. Data Retention

How long we keep your data depends on what it is:

• Emails and text messages: we send them until you unsubscribe or reply STOP. After that we always keep a record of your opt-out (your email address or phone number, and your STOP reply), so we don't contact you again by mistake.
• Drop sign-ups: including the record of your consent (the text you agreed to, its version and time, your IP address and browser) and the record of which messages we sent you for that drop, deleted automatically 12 months after the drop ended (the latest of the show date, the presale, the general sale, the last message we scheduled for it and the last sign-up), or earlier if you ask. If you agreed to receive news, your email address and phone number stay on our mailing list until you unsubscribe, and before your sign-up is deleted we keep a copy of your consent (the text, its version and the time, with your email address and, for SMS, your phone number) for as long as you are on that list, so we can show that you agreed; once you unsubscribe, that copy is deleted too. If you unsubscribed, we keep only your email address and phone number and your opt-out (see above).
• City requests: kept to plan shows in your city, until you ask us to delete them. Unsubscribing stops the messages but does not delete these by itself.
• Purchase records from our webshop: as long as tax law requires (in the Netherlands, 7 years).
• Photos and videos you upload: see section 5.
• Contacts from hexagonhq.com on our mailing list: until you unsubscribe or ask us to delete them, like everyone else on the list (see above), with a copy of the record of your consent for as long as you are on the list. How long HEXAGON HQ keeps its own records is in its privacy policy.
• Our fan database: follows its sources (section 6).
• Anything else: as long as we need it for the purpose we collected it for, or as long as the law requires.

If you want us to delete your data altogether, email info@dondiablo.com and we will do so within one month, except for what we must keep by law.