Privacy Policy

Effective date: 01 November 2026
Last updated: 01 November 2026

This website is the personal music portfolio of Brendon Mario Fernandes, professionally known as Brendon Mario (the "Artist"), an independent artist based in Mumbai, India. In this Policy, "you", "your" and "User" refer to any visitor to the Website. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Artist is the Data Fiduciary, and for visitors in the European Economic Area or the United Kingdom the Artist is the data controller, for the personal data described in this Policy.

You can contact the Artist about anything in this Policy using the details in Section 14.

This Policy explains what personal data the Artist collects when you visit https://www.brendonmario.com (the "Website") or contact the Artist through it, why the Artist collects it, how the Artist uses and protects it, and the rights you have. It applies only to this Website. It does not apply to streaming platforms, video platforms or social networks that the Website links to or embeds, which have their own privacy policies.

3.1 Data you provide through the contact form
The only form on the Website is the contact form. When you submit it, the Artist collects:

• Name – so the Artist knows who is making the enquiry;

• Email address – so the Artist can reply to you;

• Subject – to understand the nature of your enquiry (for example a booking, collaboration, licensing or press request);

• Requirement / message – the details of your enquiry, in your own words.

​

The Artist does not ask for, and requests that you do not include in your message, any financial details, government identity numbers, passwords, health information or other sensitive information. If you include it anyway, the Artist will use it only to respond to you and will delete it when it is no longer needed.

3.2 Data collected automatically
Like most websites, when you visit the Website, some technical information is collected automatically by the Artist’s hosting provider and, only if you agree, by analytics tools. This may include your IP address, browser type and version, device type, operating system, approximate location (country/city level, derived from IP address), the pages you view, the time and date of your visit and the website that referred you. Details of the cookies and similar technologies involved are set out in the Cookie Policy.

3.3 Data collected by embedded content
The Website embeds content such as music players and videos from third-party platforms (for example YouTube, Spotify, Apple Music, Amazon Music, Instagram). When you play or interact with embedded content, those platforms may collect information about you directly, under their own privacy policies. The Artist does not control and does not receive that information. See Section 9.

The Artist uses your personal data only for the purposes described below. For each purpose, the data used and the lawful basis for processing it are set out.

4.1 Replying to your enquiry
The Artist uses your name, email address, subject and message to reply to your enquiry and continue the conversation with you. Lawful basis: your consent under Section 6 of the DPDP Act. For visitors in the EEA or UK, the basis is steps taken at your request before entering into a contract, or the Artist’s legitimate interests.

4.2 Managing bookings, collaborations, licensing and press requests
Where you raise a booking, collaboration, licensing or press request, the Artist uses your name, email address, subject, message and any later correspondence to discuss and manage it. Lawful basis: your consent, and performance of, or steps towards, a contract with you.

4.3 Keeping the Website secure
The Artist uses technical data and form submission data to keep the Website secure and to prevent spam and abuse. Lawful basis: legitimate use for security purposes. For visitors in the EEA or UK, the basis is the Artist’s legitimate interests.

4.4 Understanding how visitors use the Website
Only if you accept analytics cookies, the Artist uses technical and usage data to understand how visitors use the Website. Lawful basis: your consent.

4.5 Complying with the law and protecting legal rights
The Artist may use any relevant data to comply with the law, respond to lawful requests and protect the Artist’s legal rights. Lawful basis: compliance with legal obligations, and legitimate uses permitted under Section 7 of the DPDP Act.

The Artist will not use your contact details to send you newsletters or promotional messages unless you separately and expressly ask to receive them. The Artist does not sell, rent or trade your personal data, and does not use it for automated decision-making or profiling.

Before you submit the contact form, you will be asked to confirm that you have read this Privacy Policy and consent to the Artist processing your data to respond to your enquiry. Your consent is free, specific, informed and limited to that purpose.

You may withdraw your consent at any time, as easily as you gave it, by sending a request via the contact form with the subject line "Withdraw consent". Withdrawal does not affect anything the Artist did lawfully before you withdrew. Once you withdraw, the Artist will stop processing your data and erase it within a reasonable time, unless the Artist is required by law to keep it.

The Artist keeps your personal data confidential. The Artist shares it only in the following limited cases:

• Service providers (Data Processors) who help the Artist run the Website and the Artist’s inbox, acting only on the Artist’s instructions and under confidentiality obligations – currently: website hosting (Wix), contact-form delivery, email (Google Workspace) and, if you consent, analytics (Google Analytics 4);

• The Artist’s team or representatives (for example a manager, booking agent or label) – only where your enquiry needs their involvement, and only the information necessary for that purpose;

• Government or law-enforcement authorities, courts or regulators – where the Artist is required to do so by law or a lawful order;

• A successor – if the Artist’s music business or catalogue is transferred, reorganised or managed by another entity, subject to this Policy continuing to apply to your data.

Some of the Artist’s service providers store or process data on servers located outside India. The Artist transfers personal data outside India only to countries that are not restricted by the Central Government under Section 16 of the DPDP Act, and only to providers that maintain reasonable security safeguards. Where data of EEA or UK visitors is transferred to a country without an adequacy decision, the Artist relies on the provider's Standard Contractual Clauses or an equivalent lawful transfer mechanism.

• Contact form enquiries and related correspondence: up to 24 months after the last communication with you, after which they are erased – unless the enquiry leads to an ongoing engagement, in which case the Artist keeps the relevant records for as long as the engagement lasts and as required for legal, tax and accounting purposes.

• Logs of processing and security logs: for at least one year, or longer where applicable law requires.

• Analytics data (if you consented): for up to 14 months, in aggregated or pseudonymised form where possible.

​

When personal data is no longer needed, the Artist deletes it or irreversibly anonymises it.

The Website contains links to, and embedded players from, third-party services such as Spotify, Apple Music, Amazon Music, YouTube, JioSaavn, Instagram. These services operate independently and their use of your data is governed by their own privacy and cookie policies. Where technically possible, the Artist loads embedded content in privacy-enhanced mode (for example, YouTube's youtube-nocookie.com) and/or only after you have accepted the relevant cookies. The Artist is not responsible for the privacy practices of these services and encourage you to read their policies.

The Artist uses reasonable security safeguards appropriate to the nature of the data, including HTTPS/TLS encryption for all traffic to the Website, reputable hosting and email providers with industry-standard security, strong passwords and two-factor authentication on accounts that hold your data, and restricting access to your data to the Artist and anyone who needs it to handle your enquiry. No method of transmission or storage is completely secure, but the Artist takes reasonable steps to prevent unauthorised access, use, alteration or loss.

If a personal data breach occurs that affects you, the Artist will inform you and the Data Protection Board of India (and, where applicable, the relevant EEA/UK supervisory authority) in the manner and within the timelines required by applicable law.

Subject to applicable law, you have the right to:

• Access – obtain a summary of the personal data the Artist holds about you and how the Artist is processing it, and the identities of those with whom the Artist has shared it;

• Correction, completion and updating – have inaccurate or incomplete data corrected or completed;

• Erasure – have your data deleted when it is no longer needed for the purpose it was collected or you withdraw consent, unless the Artist must keep it by law;

• Withdraw consent – at any time, as described in Section 5;

• Grievance redressal – raise a complaint with the Artist and receive a response (see Section 14);

• Nominate – nominate another person to exercise your rights in the event of your death or incapacity.

​

If you are in the EEA or UK, you also have the rights to data portability, to object to processing based on legitimate interests, to restrict processing, and to lodge a complaint with your local data protection supervisory authority.

To exercise any right, you may contact us via the contact form. The Artist may need to verify your identity before acting on your request. The Artist aims to respond within 30 days, and in any event within the time required by applicable law. Exercising your rights is free of charge.

The Website is intended for a general audience and the contact form is not directed at children. The Artist does not knowingly collect personal data from anyone under 18 years of age without the verifiable consent of their parent or lawful guardian. If you are under 18, please ask your parent or guardian to contact the Artist on your behalf. If the Artist learns that the Artist has collected data from a child without such consent, the Artist will delete it promptly. The Artist does not track, behaviourally monitor or target advertising at children.

If you have any questions, requests or complaints about this Policy or how your data is handled, you may contact us via the contact form.
The Artist will acknowledge your grievance within 48 hours and aims to resolve it within 30 days of receipt. If you are not satisfied with the Artist’s response, you may, once the relevant provisions are in force, approach the Data Protection Board of India. EEA and UK visitors may contact their local supervisory authority.

The Artist may update this Policy from time to time, for example to reflect changes to the Website, the tools used or the law. The updated version will be posted on this page with a revised "Last updated" date. If changes materially affect how the Artist uses data you have already provided, the Artist will take reasonable steps to notify you and, where required, seek your fresh consent.

This Policy is published in accordance with the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the Digital Personal Data Protection Act, 2023 and the rules made under it, as applicable.