1. Who we are
The controller of personal data processed via SplitVault is Tona Digital, established in the Netherlands.
- Product: SplitVault — digital split sheets and related tools
- Contact: contact form or info@tonadigital.com
- Website: splitvault.tonadigital.com
Chamber of Commerce (KvK) details, if applicable, can be provided on request via the contact form.
2. What data we process
Depending on how you use SplitVault, we may process:
- Account data: name, artist name, e-mail, password hash, optional IPI / PRO fields, verification status
- Project data: titles, identifiers (ISRC/UPC), collaborator names/e-mails, roles, split percentages
- Signature evidence: typed legal name, signature status, IP address, browser user-agent, timestamps
- Audit trail: hash-chained log of security-relevant actions on a project
- PRO checklist: territories, responsible contacts, status notes you enter
- Technical data: session cookies, CSRF tokens, security rate-limit records, server logs
- Support: messages you send via the contact form
3. Purposes and legal bases (GDPR Art. 6)
| Purpose | Legal basis |
|---|---|
| Create and operate your account; provide split sheets, invites, PDF export | Contract (Art. 6(1)(b)) |
| Record signatures, IP/UA, audit chain for evidence integrity | Contract; legitimate interests in security & dispute evidence (Art. 6(1)(f)) |
| Security, abuse prevention, rate limiting | Legitimate interests (Art. 6(1)(f)) |
| Support e-mails / contact form | Contract or legitimate interests; consent where required |
| Non-essential cookies (if enabled later) | Consent (Art. 6(1)(a); ePrivacy) |
| Legal compliance (e.g. tax, court orders) | Legal obligation (Art. 6(1)(c)) |
4. Who receives data
We do not sell your personal data. We use processors necessary to run the service, in particular:
- Hostinger — website hosting, MySQL database, and (where configured) outbound e-mail / SMTP
- Collaborators you invite receive project and invite content you choose to share with them
Hosting and infrastructure are typically located in the EU/EEA (Hostinger regions). If a transfer outside the EEA ever applies, we will use appropriate safeguards (e.g. Standard Contractual Clauses).
5. Retention
- Account & projects: for as long as your account remains active and as needed to provide the service
- Signature & audit records: retained while the project exists; may be kept longer where needed for legitimate interests in evidence integrity or legal claims (limitation periods under Dutch law)
- Security logs / rate limits: short-lived operational retention
- Contact form: as long as needed to handle your request, then deleted or minimized
You may request deletion of your account; some evidence may need to be retained or anonymized where legally required.
6. Your rights
Under the GDPR you may have the right to:
- Access, rectification, erasure
- Restriction of processing
- Data portability
- Object to processing based on legitimate interests
- Withdraw consent (where processing is consent-based)
- Lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens
To exercise rights, use the contact form (Privacy topic).
7. Cookies
We use strictly necessary cookies for session login, security (CSRF), and storing your cookie preference
(sv_cookie_consent.
We currently do not load third-party advertising or analytics trackers.
You can change preferences via the cookie banner when it is shown.
See also our FAQ.
8. Security
We apply technical and organisational measures appropriate to the risk, including HTTPS, hashed passwords, prepared SQL statements, CSRF protection, access controls, and a tamper-evident audit log for project events. No method of transmission or storage is 100% secure.
9. Children
SplitVault is aimed at professionals and adults. We do not knowingly offer the service to children under 16 without appropriate authorisation. Contact us if you believe a minor has provided data.
10. Changes
We may update this policy. The “Last updated” date will change when we do. Material changes may be highlighted in the product or by e-mail where appropriate.