Privacy Policy

Who is responsible

The controller of your personal data is SonicCast Audio P.C., Iera Odos 142, Gazi, 11854 Athens, Greece, company registry (ΓΕΜΗ) 158204601000, VAT EL801234567. Questions and requests go to [email protected] and are answered by a person, usually within two working days.

We are small enough not to need a Data Protection Officer under Article 37 GDPR, and we have not appointed one. The founders answer for this personally.

What we collect, and why

Forms

Your name, email and whatever you write in a contact, seat request, application, pitch or studio hire form. Kept so we can answer you.

Newsletter

Your email address and the date you subscribed. Nothing else.

Shop orders

Name, delivery address, email, phone and order contents. Card details never reach our server — see Payment Methods.

Play counts

A count per episode per month, and a short-lived hashed marker so one visitor is not counted twice within half an hour. No profile is built from it.

Server logs

IP address, request, browser string, kept 14 days for security and debugging.

There is no advertising pixel, no Google Analytics, no Meta tag and no third-party tracker anywhere on this site. The audio files are served directly rather than through a tracking redirect, which is unusual in podcasting and deliberate here.

Legal basis

• Answering a form you sent: performance of a contract or our legitimate interest in replying (Art. 6(1)(b) and (f) GDPR).
• Shop orders and tickets: performance of a contract (Art. 6(1)(b)).
• Newsletter: your consent (Art. 6(1)(a)), withdrawn with one click in every email.
• Play counts and security logs: legitimate interest in knowing what is listened to and keeping the site up (Art. 6(1)(f)).
• Invoices and tax records: legal obligation (Art. 6(1)(c)).

How long we keep it

Form submissions

Two years from the last message, then deleted.

Applications and pitches

Twelve months, so we can come back to you when a role opens.

Newsletter

Until you unsubscribe.

Orders and invoices

Ten years, because Greek tax law says so.

Server logs

Fourteen days.

Recordings you appear in

Indefinitely, as part of the published archive — see the Guest Release & Consent Policy for how to have a section removed.

Who else sees it

Only the processors we need, each under a contract under Article 28 GDPR: our hosting provider (Hetzner Online GmbH, servers in Germany), our email provider, Stripe and PayPal for shop payments, ACS and ELTA Courier for deliveries, and Patreon for membership. Nobody else, and no data broker at all.

We do not sell, rent or trade personal data, and we do not give advertisers listener-level information. Sponsors get counts, never people.

Transfers outside the EU

Hosting, email and delivery all stay inside the EEA. Stripe, PayPal and Patreon are US-linked companies and rely on Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. If you would rather not touch them, you can pay for merch by bank transfer and support us directly instead of through Patreon.

Your rights

You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. Write to [email protected]. We answer within one month, usually the same week, and we do not ask you to prove your identity beyond replying from the address the data is attached to.

If we get it wrong you can complain to the Hellenic Data Protection Authority, Kifisias 1–3, 11523 Athens, www.dpa.gr. We would rather you told us first, but that is your call, not ours.

Changes

When this document changes materially we say so in the newsletter and at the top of the next episode of The Sunday Brief. The date above is the last edit of any kind.