This policy sets out how FirstChair handles personal information. It covers musicians and assistants who use FirstChair, people who join the waitlist, couples and clients who inquire with or book a musician who uses FirstChair, and visitors to the site.
1. The controller
FirstChair is operated by MILAN SYSTEMS, LLC, a limited liability company established in Texas, United States, doing business as FirstChair. References in this policy to FirstChair are references to that company.
FirstChair may be contacted upon any matter arising under this policy at privacy@firstchairmusicians.com.
2. Who is responsible for what
Musicians’ clients. Musicians use FirstChair to conduct their own businesses. Where an inquiry was submitted on a musician’s own booking page, or a musician entered particulars from their own records, that information belongs to the musician. The musician is the controller; FirstChair holds it solely on the musician’s behalf, as processor, under a written agreement binding FirstChair to the musician’s instructions and to the protections set out in this policy.
A request to access, correct or delete information of that kind should be made to the musician. Where the musician cannot be reached, FirstChair will on request transmit the matter to them and ensure that it is answered.
3. Information collected, the purpose, and the lawful basis
On inquiry or booking.
- Names, email address, and a telephone number where given, so that the musician may reply and so that the agreement may be sent. Basis: steps taken at the request of the data subject prior to a contract.
- Particulars of the event: type, date, venue, city, and repertoire requested. Same purpose and same basis.
- Budget and message, so that the musician may answer to the point. Same basis.
- On signature of an agreement: full name, postal address and telephone number, together with a record of the signature comprising the name typed, the time, the internet protocol address and browser from which it was made, and a copy of the document exactly as it stood at signature. That record is what constitutes an electronic signature. Basis: performance of the contract, and the legitimate interest of FirstChair in being able to establish what was agreed should it be disputed.
- Payments are taken by Stripe into the musician’s own Stripe account. Card particulars pass to Stripe and never to FirstChair. FirstChair receives the amount, the date and whether the payment succeeded, so that the dashboard may show the musician what has been paid. Basis: performance of the contract.
- Email correspondence between the client and the musician, where it passes through the platform, so that the thread is held in one place for both. Basis: performance of the contract.
The waitlist.
- Name, email address, what the person plays, city, Instagram where given, and any page name they reserve, so that FirstChair may invite them and hold the name for them. FirstChair is the controller. Basis: the person’s request to join. The entry is deleted on request.
Mail through FirstChair.
- Letters a musician sends through FirstChair carry a small image and rewritten links, so that the musician can see whether a letter was delivered, opened or bounced, and whether a link in it was opened. The time and the event are recorded; nothing else about the reader is. Basis: the musician’s instructions, as processor for the musician.
- Mail sent to a musician’s FirstChair address which is not part of a client thread is passed to the musician’s own email address and is not kept by FirstChair.
Musicians and assistants using the dashboard.
- Email address, name, instrument, city, home airport, the address from which mail is sent, and any rules written concerning the inquiries sought, so that the dashboard functions and mail is despatched in the musician’s name. Basis: performance of the contract with the musician.
- The contents of the musician’s book: clients, bookings, fees, messages, travel and payments. FirstChair holds these as processor for the musician. Basis: the musician’s instructions.
- Records of acceptance of the terms, with the time and internet protocol address. Basis: the legitimate interest of FirstChair in being able to establish what was agreed.
Visitors.
- The hosting provider retains ordinary server logs, including the internet protocol address and the pages requested, for a short period, to keep the site running and secure. Basis: the legitimate interest of FirstChair in operating a working and secure site.
- FirstChair operates no advertising or analytics trackers and uses no third-party cookies. Signed-in users receive a session cookie so that the session persists. The site stores certain preferences, such as the display theme, in the visitor’s own browser, and those are never transmitted to FirstChair.
4. Automated sorting of inquiries
A musician may record, in their own words, what makes an inquiry worth their time. Where they have done so, an automated model reads each new inquiry and marks it as a good fit or otherwise, with a single line of reasoning the musician may see and disagree with.
The model receives the name given, the event type, date, venue, budget and message, and nothing further. It determines nothing: every inquiry reaches the musician whether or not it is marked, and the mark is an indication to the musician rather than an answer to the client. The model is provided by Anthropic on terms which prohibit the use of that information to train any system.
5. Disclosure
- The musician to whom the inquiry was addressed or the booking made, so that the engagement may be performed.
- The service providers which operate the platform, listed with the function of each and its location at the Sub-processor list. Each is bound by contract to use the information only in providing its service to FirstChair.
- Stripe, which takes payments. Stripe is a separate controller in respect of the payment itself, under its own privacy policy.
- A court, regulator or authority where required by law, and then only to the extent required.
FirstChair does not sell personal information and does not disclose it for advertising.
6. Place of processing
The systems of FirstChair are located in the United States. Where the data subject is in the European Economic Area, the United Kingdom or Switzerland, information accordingly leaves that region. FirstChair relies upon the EU-US Data Privacy Framework where a provider is certified to it, and upon the European Commission’s standard contractual clauses with providers which are not. A copy of those clauses is available on request.
7. Retention
- An inquiry which does not result in a booking: two years from the last message, and then deleted.
- A booking which proceeds: the agreement, the signature record and the payment record are retained for so long as either party might bring a claim under it, which FirstChair treats as seven years from the date of the event, and are then deleted.
- Email threads: with the booking or inquiry to which they belong.
- The fee records of FirstChair: seven years, as required by tax law.
- A musician’s account: until closed by the musician, together with thirty days against the possibility of reinstatement, and then deleted, save for the records above, which are retained with names removed where the law permits.
8. Rights of the data subject
Wherever the data subject resides, they may request the information FirstChair holds concerning them, request its correction, request its deletion, and complain to FirstChair.
A data subject in the European Economic Area or the United Kingdom additionally has the right to restrict or object to processing, to receive a copy in a portable format, and to complain to their national data protection authority. FirstChair does not use personal information for decisions producing legal or similarly significant effects.
Any of these rights may be exercised by writing to privacy@firstchairmusicians.com from the address held. FirstChair responds within one month. Where the information belongs to a musician’s own book rather than to FirstChair, the data subject will be informed and the request transmitted to that musician.
Residents of Texas: the Texas Data Privacy and Security Act confers comparable rights against the businesses it covers. FirstChair does not presently meet its thresholds but will honor those rights regardless.
9. Security
Every record in the database carries the identifier of the musician to whom it belongs, and the database itself enforces that a signed-in user sees only their own. Information is encrypted in transit to and from the systems of FirstChair and at rest in its database. Card particulars never reach FirstChair. The founder of FirstChair may access records for support and for the operation of the service; that access is confined to what those purposes require.
10. Children
The service is intended for adults. FirstChair does not knowingly collect information from any person under eighteen years of age. Where FirstChair is informed that it has done so, the information will be deleted.
11. Amendment
Where this policy is amended in a material respect, the new version will be published here bearing a new date, and signed-in musicians will be notified by email. Earlier versions are available on request.