Privacy Policy

1. Introduction

Welcome to Cadenza ("we," "our," or "us"). Cadenza is a performing arts hiring platform that connects musicians and performing artists with organizations seeking their services. We are committed to protecting your privacy and handling your personal data in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) where applicable.

Cadenza is operated by Kalinklo Ltd, a Hong Kong company, which is the data controller responsible for the personal data described in this policy. References to "Cadenza," "we," "our," or "us" mean Kalinklo Ltd.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights regarding your data. By using Cadenza, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

2.1 Account Information

When you create an account on Cadenza, we collect:

• Name
• Email address
• Password (encrypted and securely stored)
• Account type (musician/artist or organization)
• Authentication method (email/password or Google OAuth)

If you sign up using Google OAuth, we receive basic profile information from Google, including your name, email address, and profile picture, in accordance with Google's authorization process.

2.2 Profile Information

Depending on your account type, you may provide:

• Professional bio and description
• Location and contact details
• Professional experience and qualifications
• Instruments, specializations, and skills
• Website and social media links
• Profile photos, logos, and cover images
• Resume or CV files
• Organization details (name, type, size)

2.3 Usage Data

We automatically collect information about how you use Cadenza, including:

• Pages viewed and time spent on pages
• Listings you view, save, or interact with
• Search queries and filters applied
• Alerts and notifications you configure
• Organizations and artists you follow
• Device information (browser type, operating system, IP address)
• Referral source and navigation patterns

2.4 Payment Information

When you make a payment through Cadenza (such as for premium features or job listings), payment processing is handled by our payment processor, Airwallex. We do not store full credit card numbers on our servers. We may receive and store:

• Transaction IDs and payment status
• Payment method type (e.g., credit card brand, last four digits)
• Billing address information
• Transaction amount and date

2.5 Communications

We collect data from your communications with us, including messages sent through our contact forms, emails to our support team, and any feedback you provide.

2.6 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and collect usage data. See Section 8 (Cookie Policy) for detailed information.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Service Provision

• Creating and managing your account
• Displaying your profile to relevant users
• Enabling job listings and applications
• Processing payments and managing subscriptions
• Providing customer support
• Maintaining and improving platform functionality

3.2 Communication

• Sending transactional emails (account confirmations, password resets, receipts)
• Delivering job alerts and notifications you've subscribed to
• Sending platform updates and important service announcements
• Responding to your inquiries and support requests
• Sending marketing communications (with your consent, where required)

3.3 Analytics and Improvement

• Analyzing usage patterns to improve the platform
• Understanding which features are most valuable to users
• Identifying and fixing technical issues
• Conducting research and development
• Generating aggregate, anonymized statistics

3.4 Security and Legal Compliance

• Detecting and preventing fraud, abuse, and security incidents
• Enforcing our Terms of Service
• Complying with legal obligations and responding to lawful requests
• Protecting our rights, property, and the safety of our users

4. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), United Kingdom, and other jurisdictions where GDPR applies, we process your personal data based on the following legal grounds:

4.1 Contractual Necessity

Processing is necessary to perform our contract with you (providing the Cadenza service), including account management, profile display, and core platform functionality.

4.2 Legitimate Interests

We process certain data based on our legitimate interests in operating, improving, and securing the platform, such as analytics, fraud prevention, and system maintenance. We balance these interests against your rights and freedoms.

4.3 Consent

Where required by law, we obtain your explicit consent before processing certain data, such as for marketing communications or non-essential cookies. You may withdraw consent at any time.

4.4 Legal Obligations

We process data when necessary to comply with legal requirements, such as tax regulations, court orders, or regulatory requests.

5. Data Sharing and Third Parties

We share your personal data with the following third parties:

5.1 Service Providers

• Airwallex: Payment processing for credit card and bank transfer transactions. Airwallex processes payment information according to their privacy policy and PCI-DSS standards.
• Resend: Email delivery service for transactional emails, alerts, and notifications. Resend processes email addresses and message content as a data processor.
• Cloudflare R2: Cloud storage for uploaded files (logos, cover photos, resumes). Cloudflare stores files securely and processes data according to their privacy policy.
• Neon: Database hosting for application data. Neon hosts our PostgreSQL database with enterprise-grade security measures.
• Better Auth: Authentication infrastructure for secure login and identity management.
• Google: When you use Google OAuth to sign in, Google processes authentication data according to their privacy policy.
• Vercel: Application hosting and infrastructure. Vercel serves the Cadenza application and, as part of delivering and securing the site, processes request and traffic data such as IP address, browser type, and pages requested.
• Inngest: Background jobs, scheduled handoffs, and recovery workflows. Inngest runs asynchronous and scheduled tasks (such as sending queued emails, reminders, and digests) and processes the related application data as a data processor.
• Sentry: Error monitoring and performance diagnostics. Sentry processes technical event data (error messages, stack traces, browser and device information, and IP address) so we can detect and fix problems.
• PostHog: Product analytics. With your consent, PostHog processes usage events (such as pages viewed and features used) to help us understand and improve the service. These analytics are gated behind your cookie-consent choice and are not collected if you decline.

5.2 Other Users

Profile information you choose to make public will be visible to other Cadenza users. This may include your name, bio, location, professional details, and contact information depending on your profile settings.

5.3 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or if we believe in good faith that such disclosure is necessary to protect our rights, your safety, or the safety of others.

5.4 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the acquiring entity. We will notify you of any such change in ownership or control of your personal data.

5.5 Aggregated Data

We may share aggregated, anonymized data that does not directly identify you with partners, researchers, or the public for analytical or promotional purposes.

6. International Data Transfers

Cadenza operates globally, and your data may be transferred to and processed in countries outside your country of residence, including countries that may not have the same data protection laws as your jurisdiction.

When we transfer personal data from the EEA or UK to other countries, we implement appropriate safeguards to protect your data, such as:

• Standard Contractual Clauses approved by the European Commission
• Ensuring third-party service providers have adequate data protection measures
• Relying on adequacy decisions where the destination country provides adequate protection

Our service providers (Airwallex, Cloudflare, Neon, Resend, Vercel, Inngest, Sentry, PostHog) implement appropriate technical and organizational measures to protect your data in accordance with applicable data protection laws.

7. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy:

• Account Data: Retained for the duration of your account's active status. After account deletion, most data is removed within 30 days, though some information may be retained for legitimate business purposes (e.g., fraud prevention, legal compliance) or in backup systems for up to 90 days.
• Transaction Records: Retained for at least 7 years to comply with tax and accounting requirements.
• Usage Data and Analytics: Typically retained for 24-36 months, after which it may be aggregated and anonymized for statistical purposes.
• Communications: Support tickets and correspondence are retained for 3 years for quality assurance and legal purposes.
• Marketing Data: Retained until you unsubscribe or request deletion, after which it is removed within 30 days.

You may request deletion of your data at any time (subject to legal retention requirements). See Section 9 for information about your rights.

8. Cookie Policy

8.1 What Are Cookies

Cookies are small text files stored on your device when you visit our website. They help us recognize you, remember your preferences, and improve your experience.

8.2 Types of Cookies We Use

• Essential Cookies: Required for basic site functionality, including authentication and security. These cookies cannot be disabled.
• Functional Cookies: Remember your preferences and settings to enhance your experience.
• Analytics Cookies: Help us understand how visitors use the site by collecting information about page views, time spent, and navigation patterns. This data is typically aggregated and anonymized.
• Marketing Cookies: Used to deliver relevant advertisements and track campaign effectiveness (only with your consent where required).

8.3 Managing Cookies

You can control and manage cookies through your browser settings. Most browsers allow you to block or delete cookies. However, disabling essential cookies may affect the functionality of Cadenza.

For non-essential analytics cookies, you can change or withdraw your consent at any time — including after you first accept or decline. Use cookie preferences to re-open the consent banner and make a new choice; withdrawing consent stops analytics from loading on your next choice.

For more information about managing cookies, visit your browser's help documentation or visit www.allaboutcookies.org.

9. Your Rights

Depending on your location, you have certain rights regarding your personal data. If you are in the EEA, UK, or other jurisdictions with comprehensive data protection laws, you have the following rights:

9.1 Right of Access

You have the right to request a copy of the personal data we hold about you. You can access most of your data through your account settings. For a complete copy, contact us at hello@cadenza.work.

9.2 Right to Rectification

You have the right to correct inaccurate or incomplete personal data. You can update most information through your profile settings or by contacting us.

9.3 Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected, or if you withdraw consent. You can delete your account through account settings or by contacting us.

Note that we may retain certain information where we have a legitimate reason to do so, such as for legal compliance, fraud prevention, or to resolve disputes.

9.4 Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, and machine-readable format and to transmit that data to another service provider. Contact us at hello@cadenza.work to request a data export.

9.5 Right to Restriction of Processing

You have the right to request that we limit how we use your personal data in certain circumstances, such as while we verify the accuracy of the data or assess whether we have legitimate grounds to process it.

9.6 Right to Object

You have the right to object to our processing of your personal data based on legitimate interests or for direct marketing purposes. You can opt out of marketing communications by clicking "unsubscribe" in any marketing email or updating your notification preferences in account settings.

9.7 Right to Withdraw Consent

Where we process your data based on consent, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing before consent was withdrawn.

9.8 Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with a data protection authority. In the EU, you can contact your local data protection authority. A list of authorities is available at edpb.europa.eu.

9.9 Exercising Your Rights

To exercise any of these rights, please contact us at hello@cadenza.work. We will respond to your request within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

10. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL protocols
• Encryption of sensitive data at rest
• Secure password hashing using industry-standard algorithms
• Regular security assessments and vulnerability testing
• Access controls and authentication requirements for internal systems
• Monitoring and logging of system access and activities
• Regular backups and disaster recovery procedures
• Employee training on data protection and security practices

While we strive to protect your personal data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to using reasonable measures to protect your information.

If we become aware of a data breach that affects your personal data, we will notify you and relevant authorities as required by applicable law.

11. Children's Privacy

Cadenza is open to users aged 13 and older. We do not knowingly collect personal data from children under 13. If you are under 13, please do not use Cadenza or provide any personal information to us. If you are between 13 and 18 (or under the age of digital consent in your jurisdiction), please use Cadenza with the awareness and permission of a parent or legal guardian.

If we become aware that we have collected personal data from a child under 13 without parental consent, we will take steps to delete that information as quickly as possible. If you believe we have collected information from a child under 13, please contact us at hello@cadenza.work.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make changes, we will update the "Effective Date" at the top of this policy.

If we make material changes that significantly affect your rights or how we process your data, we will notify you by email (to the address associated with your account) or through a prominent notice on our website prior to the changes taking effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. Your continued use of Cadenza after changes take effect constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us:

We will respond to your inquiry as promptly as possible, typically within 30 days.

14. Additional Information for Specific Jurisdictions

14.1 European Economic Area (EEA) and United Kingdom

If you are located in the EEA or UK, you benefit from the rights and protections outlined in the GDPR. This includes the rights described in Section 9 and the data processing principles described throughout this policy. The data controller for your personal data is Cadenza.

14.2 California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to delete personal information, and the right to opt-out of the sale of personal information (note: we do not sell personal information).

14.3 Other Jurisdictions

If you are located in a jurisdiction with specific data protection laws not mentioned above, we will comply with applicable local requirements. Please contact us if you have questions about how local laws apply to your data.