DRAFT FOR LEGAL REVIEW. Not yet approved by Technotainment's CLO. Do not publish until the placeholders in [SQUARE BRACKETS] are filled in and the notes marked "Legal review" are resolved.
Privacy Notice: Technotainment's Music Summit Malta Talent Search
In collaboration with Music Summit Malta.
Version 2026-09-24
This notice explains what personal data we collect when you take part in the Talent Search, why we collect it, and what your rights are. We have tried to write it so that anyone aged 16 or over can follow it. If anything is unclear, email us at [DPO/PRIVACY CONTACT EMAIL] (suggested: privacy@technotainment.com).
This notice covers four groups of people:
- Applicants: artists, bands, DJs and producers who apply. For a band or duo, this means the person who fills in the form and any members named in it.
- Parents and guardians: the adult who confirms consent for an applicant aged 16 or 17.
- Audience voters: people who vote at the live showcase.
- Judges and staff: the panel and the people who run the event.
1. Who we are
The Talent Search is run by [LEGAL ENTITY NAME], trading as Technotainment ("we", "us"). Company registration number [COMPANY REG. NO.]. Registered address: [REGISTERED ADDRESS].
We are the controller of your personal data. This means we decide how and why it is used, and we are responsible for protecting it.
The event is run in collaboration with Music Summit Malta. [CONFIRM: whether Music Summit Malta receives any personal data from the Talent Search. If it does, say what it receives and whether it acts as a separate controller, a joint controller or a processor.]
Privacy contact: [DPO/PRIVACY CONTACT EMAIL]. [CONFIRM: whether Technotainment has appointed a Data Protection Officer. If yes, give their name or role here.]
2. The key dates
- Applications close on 5 October 2026 at 23:59 Malta time.
- Day 1, 8 October 2026: A&R listening session. The panel listens to and scores entries.
- Day 2, 9 October 2026: live showcase at Hard Rock Cafe Malta. Shortlisted acts perform and the audience can vote.
3. What we collect and where it comes from
3.1 Applicants
You give us this information in the application form:
- About you: your full name, email address, phone number, city and country, and date of birth.
- About your act: act name, type of act (solo, duo, band, DJ or producer), main genre and a short bio.
- Your music: links to 1 or 2 songs (for example Spotify, YouTube, SoundCloud, Apple Music, Bandcamp, Dropbox or Google Drive), or audio files you upload (MP3 or WAV, up to 30 MB each). We also record whether a song is a cover.
- Your socials: Instagram, TikTok and streaming links, if you give them.
- Showcase details: how you would perform and any technical needs.
- Your answers to any extra questions on the form.
- Your confirmations and consents: which boxes you ticked, the exact wording you saw, and the date and time.
We also create some information about you:
- A reference ID and a private link to your status page.
- Your application status and its history (for example "screening", "shortlisted" or "withdrawn").
- Judges' votes, scores and notes about your entry, and the decisions the team makes. These are personal data about you.
- A record of the emails we send you.
Please do not put sensitive information in your bio or answers. That includes health, religion, political views or sexual orientation. We do not need it.
3.2 Parents and guardians
If the applicant is 16 or 17 on 8 October 2026, the applicant gives us the guardian's name, email address and phone number. When the guardian confirms, we record the date and time of confirmation.
3.3 Audience voters
- Your email address, which you give us so we can send you a 6-digit code.
- We turn your email address into a hash. See section 7. We keep the hash and the time you verified it, not your email address.
- Your votes.
- Your email address in readable form, only if you tick the separate, optional box to hear from Technotainment.
3.4 Judges and staff
- Name, email address and role.
- Login records, and a record of actions taken in the admin and judging screens.
- Votes, scores and notes you give.
- Conflict of interest flags.
- Judges' names, photos and short bios appear on the public event page.
3.5 Technical data (everyone)
When you use the website, we and our service providers process technical data. This includes your IP address, browser type and the time of your visit. We use it to keep the site working and secure, to limit abuse, to stop bots (using Cloudflare Turnstile) and to spot fake votes. [CONFIRM: whether IP addresses are stored alongside applications or votes, and for how long.]
4. Why we use your data, and our legal basis
Data protection law says we must have a legal reason, called a "lawful basis", for each use of your data. Here are ours.
| What we do | Whose data | Lawful basis |
|---|---|---|
| Receive and process your application, check you are eligible, send you your reference ID and status link, and keep you updated | Applicants | Taking steps at your request before entering into an agreement, and performing that agreement (GDPR Article 6(1)(b)). You ask to enter, and our entry terms apply. |
| Have the panel listen to, vote on and score your music, and decide the shortlist, showcase line-up and US picks | Applicants | Performing the agreement (Article 6(1)(b)) |
| Organise the showcase, including running order and technical needs | Shortlisted applicants | Performing the agreement (Article 6(1)(b)) |
| Ask a parent or guardian to confirm an applicant aged 16 or 17, send a reminder after 48 hours, and record the confirmation | Applicants aged 16 or 17, and guardians | Legitimate interests (Article 6(1)(f)). Our interest is protecting young people who may travel and perform in public. See section 5. |
| Use the confirmations you tick (for example that you have the rights to your recordings) | Applicants | Performing the agreement (Article 6(1)(b)) |
| Film and photograph the showcase | Performers and people at the venue | Legitimate interests (Article 6(1)(f)) in keeping a record of the event. Legal review: see section 4.1. |
| Use showcase footage and photos of your performance to promote the Talent Search and Technotainment | Performers | Consent or legitimate interests with a right to opt out. Legal review: see section 4.1. |
| Verify audience voters by email code and count votes | Audience voters | Performing the voting arrangement you asked to join (Article 6(1)(b)), and legitimate interests (Article 6(1)(f)) in fair voting |
| Stop bots, fake votes, spam and abuse, and keep the site secure | Everyone | Legitimate interests (Article 6(1)(f)) in running a fair and secure event |
| Send news and updates from Technotainment | Audience voters who tick the optional box, [and applicants who tick an optional box, if offered] | Consent (Article 6(1)(a)). You can withdraw it at any time. |
| Let judges and staff log in, and keep an audit log of their actions | Judges and staff | Legitimate interests (Article 6(1)(f)) in keeping the judging secure and accountable |
| Keep records we need for legal, tax or accounting reasons, or to deal with legal claims | Anyone, as needed | Legal obligation (Article 6(1)(c)) or legitimate interests (Article 6(1)(f)) |
Where we rely on legitimate interests, we have weighed our interests against your rights. We give extra weight to the rights of anyone under 18. You can object to any use based on legitimate interests. See section 10.
4.1 Filming and photography at the showcase
The showcase is a public event. It will be filmed and photographed. Shortlisted acts will get clear information about this, and a separate showcase release to sign, before the showcase. You can tell us that you do not want footage or photos of your performance used to promote the Talent Search. See our entry terms for details.
Legal review: Decide whether promotional use of performances relies on consent (opt in) or on legitimate interests with an opt out. Performers' consent to record and publish a performance may also be needed under Maltese copyright law (Cap. 415). For applicants aged 16 or 17, the guardian should also sign the release.
5. Young people: our extra care
In Malta, the law lets people aged 13 or over consent on their own to online services (Subsidiary Legislation 586.11, made under the Data Protection Act, Cap. 586). You do not need a parent's permission under data protection law to fill in our form.
We still ask for a parent or guardian for anyone under 18. This is our own policy. Shortlisted acts may need to travel to Malta and perform in public, at a venue that serves alcohol, in front of a crowd and cameras. We want a responsible adult to know about it and agree.
How it works:
- You must be at least 16 on 8 October 2026. We cannot accept younger applicants.
- If you are 16 or 17, you give us your parent or guardian's name, email and phone.
- We email your guardian a link. The email explains what they are agreeing to.
- Your guardian opens the link and clicks a button to confirm. We do not count the link as confirmed just because it was opened.
- We hold your application until your guardian confirms. The panel will not review it before then.
- If your guardian has not confirmed after 48 hours, we send them a reminder.
We use the guardian's details only for this confirmation and for safety and logistics if you are shortlisted. We do not send guardians marketing.
Young people can use their own data protection rights (section 10). A parent or guardian can also contact us for a young person.
6. Who we share your data with
We do not sell your personal data.
The panel and our team. Authorised judges and event admins can see applications, play your music, and see votes and scores. The judges are Eddie Wenrick, Wesley Ellul, Aidan Somers and Jerry "Wonda" Duplessis. We may add judges; if we do, they get the same access and the same duties. Judges only see what they need for the round they are judging. They cannot see other judges' scores until the round is locked.
Service providers (processors). These companies run parts of the platform for us. They may only use your data on our instructions.
| Provider | What it does |
|---|---|
| Vercel Inc. | Hosts the website and app. Stores uploaded audio privately (Vercel Blob). |
| Neon (Databricks, Inc.) [CONFIRM contracting entity] | Hosts our database. |
| Resend (Plus Five Five, Inc.) [CONFIRM contracting entity] | Sends our emails from technotainment.com. |
| Cloudflare, Inc. | Checks that form users are human (Turnstile). |
The venue and event partners. If you are shortlisted, we may share your act name, running order and technical needs with Hard Rock Cafe Malta and our production crew so they can run the showcase. [CONFIRM: what, if anything, is shared with Music Summit Malta.]
Record labels. [CONFIRM: We will not share your entry with any other record label or partner company without telling you first and, where the law requires it, asking for your consent.]
Public information. Shortlisted and winning act names, photos and footage from the showcase may be shown publicly, as described in section 4.1 and the entry terms. Audience voters are never named publicly.
Authorities. We may share data where the law requires it, or to protect someone's safety.
7. How we protect audience voters' email addresses
When you vote, you give us your email so we can send you a 6-digit code. The code expires after 10 minutes.
Before we store anything, we "normalise" your email. For example, we make it lowercase and remove extras such as "+tag". Then we turn it into a hash. A hash is a scrambled code made from your email. We can check whether the same email tries to vote twice, but we cannot turn the hash back into your email.
A hash still counts as personal data under the law, so we protect it and delete it on schedule.
We only keep your readable email if you tick the separate optional box to hear from Technotainment. Voting does not depend on ticking that box.
8. International transfers
Our service providers may process data in the European Union and in the United States. Some of our judges are based in the United States and may access applications from there.
When data leaves the European Economic Area, we protect it by:
- using providers certified under the EU-US Data Privacy Framework, where they are certified; or
- signing the European Commission's Standard Contractual Clauses with the recipient, with extra safeguards where needed.
Judges must follow our confidentiality and data handling rules wherever they are.
[CONFIRM: the storage region for each provider (for example an EU region for the database and file storage), and which transfer mechanism applies to each provider and to US-based judges.]
You can ask us for more information about these safeguards using the contact details in section 1.
9. How long we keep your data
| Data | How long |
|---|---|
| Applications, songs, uploaded audio, guardian details, votes, scores and notes | Until 12 months after the event ends. Then we delete it or make it anonymous. For this event, that is around 9 October 2027. |
| Audience voter hashes and votes | Until 12 months after the event ends |
| Email codes for voters | 10 minutes |
| Readable email of voters who opted in to hear from us | Until you unsubscribe or withdraw consent |
| Judge and staff accounts, and the audit log | [CONFIRM: retention period for staff accounts and audit log] |
| Backups | Deleted data can stay in backups for up to [BACKUP RETENTION PERIOD] before it is overwritten |
We may keep some data longer if the law requires it, or if we need it to deal with a complaint or legal claim. If you go on to work with Technotainment after the Talent Search, we will tell you how we use your data for that.
If you withdraw or ask us to delete your data, we act sooner than the dates above.
10. Your rights
You have these rights over your personal data:
- Access: ask for a copy of your data.
- Rectification: ask us to correct data that is wrong or incomplete.
- Erasure: ask us to delete your data.
- Restriction: ask us to pause using your data, for example while we check a complaint.
- Portability: ask for data you gave us in a common, machine-readable format, or ask us to send it to someone else.
- Objection: object to our use of your data where we rely on legitimate interests. You can always object to marketing.
- Withdraw consent: where we rely on consent, you can withdraw it at any time. This does not affect what we did before you withdrew.
How to use your rights:
- Email [DPO/PRIVACY CONTACT EMAIL].
- Applicants can also withdraw from the Talent Search at any time from their status page, or by emailing us.
- Voters can unsubscribe from Technotainment emails using the link in any email.
We may ask you to prove who you are before we act. We reply within one month. If the request is complex we may need up to two more months, and we will tell you why. Using your rights is free, unless a request is clearly unfounded or excessive.
Please note: if you withdraw or ask us to delete your application before the judging ends, we can no longer consider your entry.
11. Complaints
If you are unhappy with how we handle your data, please contact us first. We will try to fix it.
You also have the right to complain to the data protection authority. In Malta, that is the:
Information and Data Protection Commissioner (IDPC) Floor 2, Airways House, High Street, Sliema SLM 1549, Malta Website: idpc.org.mt Email: idpc.info@idpc.org.mt [CONFIRM: IDPC contact details are current before publishing.]
If you live or work in another EU country, you can also complain to the authority there.
12. Automated decisions
No decision about you is made only by a computer.
Judges give votes and scores. The platform adds them up and ranks entries, and at the showcase it combines judges' scores with audience votes. These totals are tools to help the panel. People make every decision: who is screened in, who is shortlisted, who performs, who wins and who is picked for the US. The team can change the outcome from the totals, and must record a reason when they do.
13. Cookies and similar technology
We only use what is strictly necessary to run the site:
- a session cookie that keeps judges and staff logged in; and
- Cloudflare Turnstile, which checks that forms are used by a human and not a bot. It may use cookies or similar storage to do this.
We do not use analytics, advertising or tracking cookies. Because these tools are strictly necessary, the ePrivacy rules (in Malta, S.L. 586.01) do not require us to ask for your consent. We still tell you about them here.
14. Security
We protect your data with measures including:
- encrypted connections (HTTPS) across the site;
- uploaded audio stored privately, and only playable by logged-in judges and admins who are allowed to see it;
- checks on every request that the person is allowed to see that data, for that event only;
- passwordless login for staff, using one-time email links;
- private status and guardian links that are long, random and stored only in scrambled (hashed) form;
- rate limits and bot checks on public forms; and
- a log of admin actions.
No system is perfectly secure. If a data breach puts your rights at risk, we will tell the IDPC within 72 hours of finding out, where the law requires it. If the risk to you is high, we will also tell you directly.
15. Changes to this notice
We may update this notice, for example if the event changes or the law changes. We will put the new version and date at the top. If a change affects you in an important way, we will tell you by email before it applies.
16. The law that applies
This notice is written to meet the EU General Data Protection Regulation (GDPR), the Maltese Data Protection Act (Cap. 586) and its subsidiary legislation, including S.L. 586.11 on children's consent, and the ePrivacy rules in S.L. 586.01.
[LEGAL ENTITY NAME] · [REGISTERED ADDRESS] · [DPO/PRIVACY CONTACT EMAIL]
Version 2026-09-24