Privacy Policy
This page explains what personal data this website collects, why, and what rights you have over it. The short version: this is my personal website, I collect as little as I can, I never sell anything about you, and my visitor statistics use no cookies.
Last updated: 17 September 2026
Who is responsible
josaxmusic.com is the personal website of Jovan Pastar, a saxophonist based in Vienna. It is not run by a company. I am the data controller for the personal data collected here under the EU General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG), and you can reach me directly at any time.
- Responsible person
- Jovan Pastar
- Based in
- Vienna, Austria
- [email protected]
What I collect and why
I only process what is listed here, for the purposes given. Nothing on this site asks for more than it needs.
Booking inquiries
When you send the booking form on the contact page or the live page, I receive your name, email address, the type of event and your message, plus whatever else you choose to fill in: phone number, date, venue, whether a DJ is already booked and how you heard about me. The form delivers your inquiry to my mailbox and also files it in my private inquiry list, which runs on the same server as this website, so that nothing gets lost and I can follow up. Only the fields marked as required are needed; the rest are optional.
Legal basis: Taking steps at your request before a possible booking, and my legitimate interest in answering you (Art. 6(1)(b) and (f) GDPR).
Direct contact
If you email me or message me on WhatsApp through the link on the live page, I process the details you send me to reply and to arrange the performance. WhatsApp is a link on this site, not something embedded in it: nothing is shared with Meta until you open the app yourself, and your conversation there is covered by WhatsApp's own privacy policy.
Legal basis: Steps at your request before a possible booking, and my legitimate interest in replying (Art. 6(1)(b) and (f) GDPR).
Reviews
After a performance I may send you a personal link to a short review form. It asks for a rating and a few words, and optionally your name, your city and a photo. I read every review first; once I approve it, it appears on this website with the name, city and photo you chose to give. Any location or camera data hidden in a photo file (EXIF data) is stripped before the photo is saved. You can ask me to change or remove your review at any time.
Legal basis: Your consent, given by submitting the form (Art. 6(1)(a) GDPR). You can withdraw it at any time, and I will then remove the review.
Videos (YouTube)
The video clips on the home page and the live page are hosted on YouTube, a service of Google Ireland Limited. Until you press play, each clip is only a still image from my own server, and nothing is requested from YouTube or Google. When you press play, the player loads from youtube-nocookie.com, YouTube's privacy-enhanced mode: YouTube then receives your IP address, details of your browser and device and the page you are on, and it may store information on your device and link the view to your Google account if you are signed in. What YouTube does with that data is covered by Google's privacy policy (policies.google.com/privacy).
Legal basis: Your consent, given by pressing play on a clip (Art. 6(1)(a) GDPR, § 165(3) TKG 2021). Without that click nothing is loaded from YouTube.
Anonymous visitor statistics
On every page the site records one anonymous measurement: the page viewed, the site you arrived from, your browser and operating system by name, whether you are on a phone, tablet or desktop, your country and the language your browser uses, plus how far you scrolled and how long the page was open. If you arrive from an advert or a campaign link, the campaign tags in that link (source, medium and campaign name) are recorded too. It sets no cookies and stores nothing on your device. Visitors are counted with a code computed on my server from your IP address, your browser signature and a secret that changes every day; the secret is deleted after two days, after which the records can no longer be linked to you or to each other. Your IP address itself is never stored.
Legal basis: My legitimate interest in understanding how the site is used, by a means that does not identify you (Art. 6(1)(f) GDPR). Because nothing is stored on or read from your device, no consent is required under § 165(3) of the Austrian Telecommunications Act (TKG 2021).
Technical logs and abuse protection
Like every website, the server that delivers this site keeps standard access logs: your IP address, browser type, the time of each request and the page or file requested, including the photos you load. When you send the booking form, the server also notes the IP address the inquiry came from, to block spam and automated abuse. A hidden form field catches bots; if it is filled in, nothing is sent or stored. Repeated requests from one address are limited by counters that live only in the server's memory.
Legal basis: My legitimate interest in keeping the site secure and running (Art. 6(1)(f) GDPR).
Settings stored on your device
If you switch the language of this site (English, German or Serbian), the site remembers your choice in a cookie for one year so you land in the right language next time. That is the only cookie this site sets itself. It holds a language code and nothing else, and it is never used to track you.
Legal basis: Strictly necessary for a function you asked for (§ 165(3) TKG 2021, Art. 6(1)(f) GDPR).
International data transfers
The servers that host this site and its database are in the United States, and so are the servers of Cloudflare and EmailJS; the studio that maintains the site works from Bosnia and Herzegovina. Data you send through this site may therefore be processed outside the European Economic Area. If you play a video, YouTube (Google Ireland Limited, together with Google LLC in the United States) processes the data described above.
Each of these transfers is covered by safeguards recognised under the GDPR: Cloudflare and Google are certified under the EU-U.S. Data Privacy Framework, and the other providers are bound by the European Commission's Standard Contractual Clauses, so your data keeps a level of protection equivalent to the one it has in Austria. You can ask me for a copy of the relevant clauses.
How long I keep your data
I keep personal data only as long as I need it for the purpose it was collected for:
- Booking inquiries stay in my mailbox and inquiry list while I handle them and, if a performance follows, for as long as the engagement runs. Records connected to a paid booking are kept for the seven years that Austrian tax law requires for business records. Inquiries that do not lead to a booking are deleted once they are closed.
- Reviews stay on the site for as long as they are published, or until you ask me to remove them.
- The visitor statistics are kept as anonymous figures. The daily secret that could link a record to a person is deleted after two days, and the records themselves hold no IP address and no identifier.
- Server logs are kept for a limited time by my hosting provider for security purposes and then rotated out.
- The website's database is backed up every night. Backups are kept for seven days on the same provider's servers and then overwritten.
Your rights
Under the GDPR and the Austrian Data Protection Act you have the right to:
- access the personal data I hold about you and receive a copy of it;
- have inaccurate data corrected;
- have your data erased;
- restrict the processing of your data, or object to it where I rely on a legitimate interest;
- receive the data you gave me in a portable format;
- withdraw a consent at any time, without affecting the processing that took place before.
To exercise any of these, email me at the address below. I will answer within the period the GDPR sets, and I will ask for proof of identity only where I cannot tell that a request really comes from you.
If you believe that the processing of your data breaches data protection law, you can also lodge a complaint with the Austrian supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, [email protected], www.dsb.gv.at. If you live in another EU or EEA country, you can turn to your own data protection authority instead.
Children
This website is not directed at children, and the booking form is meant for adults arranging an event. I do not knowingly collect personal data from anyone under 14, the age from which a person can give their own consent in Austria. If you believe a child has sent me data, contact me and I will delete it.
Security
The site is served only over an encrypted HTTPS connection and tells browsers to use nothing else. The booking form and the review form send data to my own servers over the same encryption, photos are re-encoded without their metadata before they are stored, submissions are checked against a hidden bot field and rate limits, and inquiries and reviews are visible only to me and to the studio that maintains the site. No transmission over the internet is ever completely secure, but I keep the data this site handles to a minimum and choose providers with their own security measures.
Changes to this policy
I may update this policy when the site or the law changes. The date at the top of this page shows when it was last revised.
Contact
Questions about this policy or about your data? Write to me directly:
[email protected]