Privacy and cookie policy

1. Controller and contact

Michel Allard is the controller for processing decisions made for this website under the name KRT Production. This is a personal, independent, non-commercial and voluntary artistic project based in Brussels, Belgium. It is neither a company nor a registered non-profit association. Contact: contact@krtproduction.be.

2. Visiting the website and hosting

The website presents musical creations and voluntary support for emerging bands, with no shop, visitor account or order form. It is published through ChatGPT Sites, using OpenAI and Cloudflare deployment infrastructure; OVHcloud manages the domain and email, not the website. Necessary connections may involve an IP address, browser details, the requested resource and technical data. The legitimate interest pursued is to deliver and secure the website. The Sites terms designate OpenAI Ireland Ltd for the EEA. The account’s applicable DPA governs service provision during the agreement and termination obligations, including deletion, subject to legal requirements. Sites documentation includes logs, usage data and device details. The individual-services DPA, business DPA or a separate agreement applies according to the account; official links are below. No precise log deletion interval or hosting country for this particular website has been verified. ChatGPT conversation retention periods are not applied to visitors.

3. Your choices: denied by default

Google Analytics, YouTube, SoundCloud and Spotify remain blocked until you permit them. The website loads no Google Analytics script or player from these platforms before permission. You may refuse everything and still read the text and view the images. The banner offers separate choices for statistics, YouTube, SoundCloud and Spotify. A placeholder button permits only the named provider's players across this website; it does not enable statistics. The legal basis for these optional activations is your consent. Permission to load is not blanket permission for every subsequent use of data. KRT checkboxes do not simulate a platform’s internal settings.

4. Necessary storage of your choices

Your browser's local storage on the krtproduction.be domain holds the key krt-privacy-consent-v2: the preference version, choices for each provider, and saving and expiry dates. Its purpose is to respect your decisions, without an advertising identifier or transmission of this preference to a KRT Production server. It expires 180 days after your last explicit choice; simply visiting does not extend that period. The website then asks again. The old krt-ga4-consent-v1 key is deleted and no longer counts as consent. This preference storage is strictly necessary to manage your decisions. If your browser blocks storage, your choice cannot be remembered between pages or visits.

5. Google Analytics 4

Only with your permission does the website load Google Analytics 4, measurement ID G-0RFHWPXC68, to measure audience activity. Google may process pages viewed, their addresses and titles, the referring website, usage events, cookie identifiers and technical browser or device information. Connection data, including an IP address, is necessarily involved in communicating with Google; the absence of an IP address from reports does not make all processing anonymous. The website uses basic consent mode: no Analytics tag or transmission before permission. Advertising signals and personalisation are disabled in the website configuration; all three advertising consent settings remain denied, even after ‘Accept all’.

6. Analytics cookies and retention

Following Analytics permission, first-party _ga and _ga_* cookies distinguish visitors and sessions. The V52 code requests expiry after 180 days without automatically extending it on each visit, on the website domain and path /. Your browser may shorten this period. The website attempts to remove these cookies on withdrawal. According to the property settings for G-0RFHWPXC68 checked by the publisher in GA4 on 19 October 2026: event data retention is 2 months, user data retention is 14 months, and reset on new activity is enabled. The latter may renew the retention period for relevant user data under Google’s rules; it is separate from the website’s cookie_update:false setting. These values are neither the lifetime of all Google cookies nor retention periods for all data held by Google. Standard aggregated reports follow different rules. These account settings were reported by the publisher, rather than inspected directly by the preparation assistant.

7. YouTube, SoundCloud and Spotify

Placeholders replace players until permission for the chosen provider, without loading external thumbnails beforehand. One activation permits that provider’s players across the website for the remembered choice; it does not enable Analytics or other platforms. After activation, YouTube (Google), SoundCloud or Spotify may receive an IP address, technical details, the referring page and interactions, and use cookies or local storage under their own rules and depending on whether the visitor is signed in. No automatic playback is requested. The record below distinguishes cookies reported by the publisher on 19 October 2026 in Chrome private browsing after acceptance, functions described by providers, and unestablished information. No cookie was visible under the YouTube entry after the playback test; this demonstrates neither an absence of trackers nor an absence of network transmissions or processing by Google. Two additional entries, __Secure-BUCKET and __Secure-YEC, were subsequently reported in another view after playback on Funkle Ace®; their .youtube.com domains and / paths are now confirmed by the publisher and the past expiry of __Secure-YEC is explicitly flagged in the record. Platform policies also describe measurement and, depending on choices and context, advertising or personalisation: enabling a player does not guarantee that it only plays an audio or video file. Withdrawal removes players; the website cannot delete cookies on third-party domains. V52 uses www.youtube-nocookie.com for the three existing videos (two on Funkle Ace and one on Studio Lambermont), only following permission. YouTube describes limits on experience and advertising personalisation, not a complete absence of cookies, measurement or technical data. Earlier Chrome observations are retained as observations of the previously tested mode; they are not a new inventory of enhanced mode.

8. Messages and external links

The contact link opens the visitor’s email software. OVHcloud hosts contact@krtproduction.be and manages the domain; Outlook is the software the publisher uses to read messages, not the identified host of this mailbox. An email address, any name, the message and attachments are processed to reply and, where relevant, organise an artistic project, relying on the legitimate interest in managing correspondence. OVHcloud’s data processing agreement provides for processing during the contract and deletion of content at the end of the service under its terms, subject to legal obligations; this does not determine how long each message stays in the publisher’s mailbox. Proposed criteria for approval: keep necessary correspondence until the enquiry is resolved or the relevant project closes; thereafter keep only records needed to exercise rights or meet an applicable obligation, for the corresponding limitation period or proceedings. This correspondence management rule remains subject to approval and is not an automatic deletion setting already in place. Backup periods for the actual email product and any delegated access have not been verified. Platform and social links take visitors away from this website, where the destination’s rules apply.

9. Recipients and transfers

Recipients depend on choices: the publisher for enquiries, OpenAI and its hosting subprocessors for the website, OVHcloud for email and the domain, Google for Analytics and YouTube, and SoundCloud and Spotify for their players. Activation may also involve technical providers or partners described by each platform; an inventory specific to these integrations has not yet been established. Published OpenAI DPAs provide standard contractual clauses or an adequacy decision for relevant EEA transfers, depending on the account’s applicable agreement; no separate negotiated agreement has been inspected here. OVHcloud’s DPA also provides standard contractual clauses for relevant transfers; this does not establish a verified mailbox location or a guarantee of exclusively European processing. Google, SoundCloud and Spotify describe transfers and applicable mechanisms for their services in their policies. Official documents are linked below; a copy of information or applicable safeguards may be requested at contact@krtproduction.be. No website-specific hosting country, blanket absence of transfers or particular account certification is asserted. For EEA visitors, provider policies identify Google Ireland Limited for Google services unless a specific notice states otherwise, Spotify AB, and SoundCloud Global Limited & Co. KG outside the United States, with group responsibilities explained by SoundCloud. KRT remains responsible for operations it determines through its website, including integration and the collection or transmission it triggers; joint responsibility may depend on the operations concerned. Subsequent processing whose purposes and means are determined solely by a platform falls within that platform’s responsibility. This distinction does not remove KRT’s duties of prior consent and information for operations performed through this website.

10. Changing or withdrawing permission

On any public page, use ‘Privacy’ or ‘Manage my privacy choices’ in the footer. You may refuse each service separately. Disabling Analytics reloads the page to stop its code; Analytics cookies accessible to the website are deleted insofar as your browser allows. Refused players are removed. This prevents future loading from the website and does not undo processing lawfully carried out previously. To delete existing third-party cookies, use your browser settings and the relevant platform's controls. Choices on another device or browser are independent. Withdrawal through KRT stops loading the relevant players and their future operations through this website. It does not automatically erase information already received by a provider or purport to change a third-party account setting; use the platform’s choices and rights channels for its subsequent processing. KRT may be contacted about a request relating to its integration.

11. Your rights

Depending on the legal basis and the GDPR's conditions, you may request access, rectification, erasure, restriction or portability, object to processing, and withdraw consent at any time without affecting its previous lawfulness. Contact: contact@krtproduction.be. Proportionate identity verification may be necessary. You may complain to the Belgian Data Protection Authority: www.autoriteprotectiondonnees.be. The website itself implements no automated decision producing legal effects or purchase of advertising profiles; external platforms' own processing remains governed by their policies.

12. Document version

V52 — updated on 19 October 2026. The Chrome record is partial, reported by the publisher and specific to the tested private preview; it is not a comprehensive network audit of krtproduction.be. The eight domains, paths and expiries are preserved; secondary sources and unverified information remain flagged. Observed expiries are not treated as universal lifetimes or server retention periods. The 2024 __Secure-YEC expiry remains an anomaly, not proof of current activity. Enhanced YouTube mode does not guarantee an absence of trackers.

Players: purposes and scope of choices

The following information forms part of KRT Production’s policy. Provider links supplement it; they do not replace KRT’s information obligations. A separate choice for every cookie is not invariably required: non-essential purposes need sufficiently specific choices. KRT’s loading control does not configure all internal purposes.

Partial cookie and storage record — 19 October 2026

Observations supplied by the publisher after a manual check in Chrome private browsing, following acceptance, on the V52 preview. The supplement dated 19 October 2026 confirms the domains and / path for the eight cookies below. These attributes were confirmed by the publisher, not independently recorded by the preparation assistant. Creation times and setting responses are unavailable. UTC expiries remain those in the original record: they establish neither a lifetime since creation, server-side retention nor a universal duration. This inventory does not claim to cover every possible tracker.

Storage specified by the V52 code

krt-privacy-consent-v2: local storage tied to the website origin (not a cookie, so no cookie domain/path), containing only analytics/youtube/soundcloud/spotify choices and their dates; application validity of 180 days after the last explicit choice, without renewal merely by visiting. _ga and _ga_*: optional Google Analytics cookies distinguishing visitors and sessions, with the website domain and path / requested by the code, requested expiry of 180 days and cookie_update:false. Effective attributes and expiry were not recorded in this check. Google receives data only following Analytics permission; the choice storage is not sent to a KRT Production server.

YouTube: limited test finding

The publisher tested video playback. No cookie was visible under the YouTube entry in Chrome; however, __Secure-BUCKET and __Secure-YEC were recorded in another view with .youtube.com and path /, now confirmed by the publisher. Absence from one Chrome section establishes neither an absence of cookies nor an absence of local storage, network transmissions or trackers. The past expiry of __Secure-YEC remains unexplained: it is neither corrected nor converted into an active lifetime. The eight names reported across different views must not automatically be added to the nine rows for the selected origin.

Google / YouTube — cookies

Scope of the record: nine rows in a private preview view

The total of nine entries, compared with seven previously, comes from a private preview view. The supplement confirms Domain/Path for the eight names detailed above, not a complete mapping between all Chrome views. The total establishes neither nine first-party krtproduction.be cookies nor setting before consent. Preview authentication may differ from the public website. Other rows remain unattributed; their presence in this view alone does not establish an additional active tracker on the public website. Local preference storage is not a cookie.

Cookie values and personal identifiers have not been reproduced in this document.