Israeli Jazz Council

1.General

1.1

Israeli Jazz Council (registered non-profit association) (the "Association") respects the privacy of everyone who uses its website and services. This policy explains what personal information the Association collects, for what purposes, who receives it, how long it is kept, how it is protected and what rights you have under the Privacy Protection Law, 5741-1981, as amended by Amendment 13 (the "Privacy Law").

1.2

The policy covers all information collected on the website, in the personal area, in the app, through messages the Association sends and at event entry. In addition, each form that collects information carries a short notice under section 11 of the Privacy Law; that notice and this policy complement each other.

2.Who Is Responsible for Your Information

2.1

The Association is the controller of the databases in which your information is kept. For any privacy matter, and to exercise the rights described under "Your Rights", contact:

Name: Israeli Jazz Council (registered non-profit association)
Address: Tel Aviv, Israel
Phone: 052-258-0547
Email: info@jazzcouncil.org.il
Website: jazz.ross-developers.com
Privacy enquiries: info@jazzcouncil.org.il

3.What We Collect

3.1

The Association collects only what the service you chose requires. By service:

Your account: name, email address, phone (optional), preferred language, password (stored as a one-way hash, never as text), two-step verification settings and notification preferences. If you sign in with Google, also the name, email address and profile picture Google passes on.
Membership application and membership: name, ID number (stored encrypted), address, city, date of birth, membership type and plan, and invoice details; plus profile details you choose to give, such as a stage name, biography, instruments, genres, education, awards, ensembles, discography, links, a photo and documents (for example a student card, CV or press kit). If you choose, also your preferred form of address, an emergency contact (stored encrypted) and any accessibility needs you mention.
Electronic signature of the application: the information described under "Electronic Signature and Evidence Record".
Ticket purchases: name, email address, phone (optional), order and ticket details, and a record of entry when your ticket is scanned.
Donations: name, email address, phone and address for the receipt; ID number (stored encrypted), only if you asked for a section 46 receipt under the Income Tax Ordinance; amount and frequency; dedication (the honoree's name and the email address of anyone you asked us to notify); a personal message; and whether you chose to give anonymously or to appear on the donor wall or in the directory, in which case also a public name, biography and photo.
Payments: card details are typed into the payment company's secure page; the Association never sees or stores the full card number. We keep the reference number, card brand, last four digits and expiry date, and, for recurring charges you approved, an encrypted token issued by the payment company.
Mailings and notifications: your address on the mailing list, consents and withdrawals (time, wording version, IP address and browser), channel preferences, push subscriptions (your browser's push-service address and its encryption keys), delivery data and bounce or complaint reports from the email provider. Some mailings also measure opens and clicks, as described under "Mailings, Advertising and Donation Requests".
Enquiries: what you tell us in the contact form, a cancellation notice, an event waiting list or a request to produce an event.
Technical data: IP address and browser and device type when you sign in and when you take sensitive actions, an activity log (audit log) and security data. The Association uses no third-party analytics, advertising or tracking tools. For cookies, see "Cookies and Browser Storage".

4.How We Use It

4.1

We use the information only to:

open your account, identify you when you sign in and keep the account secure;
keep the register of members required by section 18 of the Associations Law, 5740-1980, handle membership applications and renewals and manage members' rights;
process purchases, issue tickets and check them at the door;
collect payments and donations, issue receipts and report donations to the Israel Tax Authority where the law requires;
send service messages and answer enquiries, cancellation notices and accessibility requests;
send news, advertising and donation requests, in line with your consent and the law;
show details in the members directory and on the donor wall, only as you choose;
keep evidence of electronic signatures and of consents given;
protect information, prevent fraud and misuse and meet legal obligations;
improve the service using aggregated data that identifies no one.

4.2

The Association will not use the information for a purpose that does not fit these purposes without telling you in advance and, where needed, asking for your consent.

5.Do You Have to Provide It

5.1

You are under no legal duty to give the Association information, except in these cases:

Membership application: your name, ID number and address, which the Association must record in the register of members under section 18 of the Associations Law. Without them you cannot become a member.
Section 46 receipt: your name and ID number, which Tax Authority rules require for a receipt that qualifies for the tax credit. Without them you receive an ordinary receipt that does not qualify.

5.2

Everything else is given voluntarily and with your consent. Some of it is needed to provide the service, such as an email address to send your tickets to, and without it we cannot provide that service. Profile details, a photo, a directory listing and consent to mailings are never a condition of any service.

6.1

The Association does not sell personal information or give it to third parties for their own use. It is passed only to these recipients, for these purposes:

Service providers that process information for the Association, only as far as their service requires: the payment company the Association uses (PayPlus, CardCom or Tranzila), to take payments and keep the token; the server hosting provider; the email service (Resend, or a mail server the Association configures); the SMS service (Twilio), when enabled; browser makers' push services (such as Google, Apple and Mozilla), which receive notification content encrypted; Google, for sign-in, if you choose it; and a cloud file-storage service (Cloudflare R2), if introduced.
A timestamping service (DigiCert, with FreeTSA as backup): receives only a cryptographic digest (hash) of the signed document, with no personal details, to certify when it was signed.
An artificial-intelligence provider (Anthropic or OpenAI): only if the Association has turned on the staff assistant; see "The Staff Assistant".
Members of the Association: under section 39(a) of the Associations Law, the register of members (name, address, ID number and the dates membership began and ended) is open to inspection by the Association's members.
Members who produce an event: where the Association lets a member produce an event on the Site, that member may receive the buyers' names and email addresses for that event, solely to manage it.
The public: only details you chose to show in the members directory or on the donor wall.
Authorities: the Israel Tax Authority (reporting section 46 donations), the Registrar of Associations, and any authority the Association must or may disclose information to by law or court order.
Advisers: the Association's accountant, auditor and lawyer, who are bound by confidentiality.

6.2

Each provider receives only the information it needs and is bound to protect it and use it only to provide its service to the Association.

7.Transfers Outside Israel

7.1

Some providers process information outside Israel: Resend, Twilio, Google, Anthropic, OpenAI and Cloudflare, in the United States and other countries; and DigiCert and FreeTSA, in the United States and Germany (digests only). The website's servers and data are hosted in Israel or in a member state of the European Union.

7.2

Transfers follow the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001: either to a country covered by European Union data-protection rules, or under the provider's contractual undertaking to meet the conditions that apply to a database in Israel, to take adequate measures to protect the information and not to pass it on.

8.Electronic Signature and Evidence Record

8.1

The membership application is signed electronically under the Electronic Signature Law, 5761-2001. So that it can be shown who signed, when and which wording, the signature record keeps: the text of the document and its cryptographic digest, the signer's name and signature image, verification of the email address (and, where needed, the phone), IP address, browser type and language, time zone and screen size, the times the form was opened, the declarations accepted and the signature made, a certified timestamp, and a cryptographic chain to earlier records that prevents later changes.

8.2

Two PDF documents are produced from the record, the signed application and the evidence report, which are sent to the signer and kept by the Association. The record is kept for the membership year plus seven years and is used only to prove the signature and to examine any claim about it.

9.Members Directory and Donor Wall

9.1

Appearing in the public members directory and on the donor wall is entirely optional. In your profile settings you choose whether to appear and which details are shown (for example name, photo, category, short biography, city, instruments and links), and you can change or withdraw that choice at any time. ID numbers, full addresses, dates of birth and payment details are never shown.

9.2

The Association may hide an entry from the directory, but will never list anyone who has not chosen to appear. Anonymous donations are never shown on the donor wall. Information published online may stay in search engines after it is removed from the Site; the Association will ask for its removal where possible.

10.Mailings, Advertising and Donation Requests

10.1

Advertising by email, SMS or push notification is sent only to people who gave explicit prior consent, in line with section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982. Newsletter sign-up must be confirmed through a link sent by email. A donation request may be emailed without prior consent, as the law allows a non-profit association, unless you have told us you do not want such messages.

10.2

Every advertising message is marked "Advertisement" or "Donation request" in its subject line and includes the Association's details and an unsubscribe link. You can withdraw consent at any time, free of charge: through the link in the message, in your notification settings or by writing to info@jazzcouncil.org.il; we act on it promptly. Service messages, such as tickets, receipts and membership renewal, continue after you unsubscribe from mailings.

10.3

In some mailings the Association measures whether the message was opened and which links were clicked, using a tiny image and redirected links, to improve content and sending frequency. You can prevent this by blocking images in your email program.

10.4

A mailing to a group selected by characteristics (for example instrument or region) states, as section 17F of the Privacy Law requires, the Association's identity and address and your right to be removed from the mailing list, and the Association will remove you on request.

11.Push Notifications

11.1

Push notifications are sent only if you allowed them in your browser or device and turned them on in the personal area. You can turn them off at any time in your notification settings or your browser settings.

12.The Staff Assistant

12.1

The Association can turn on an AI-based assistant that helps staff with routine work. It is off by default and is for staff only. When it is on, only minimised operational data is sent to the provider (Anthropic or OpenAI), such as identifiers, statuses, dates, amounts, names and titles, and never email addresses, phone numbers, ID numbers, payment details or the content of messages.

12.2

The assistant cannot make refunds, delete information, change settings or permissions, or export personal information. By default, any action it proposes is carried out only after a staff member approves it; the Association may let it carry out predefined routine actions on its own, within a daily limit. Everything it does is logged.

13.Cookies and Browser Storage

13.1

The Site uses only the cookies and storage it needs to work and to remember your preferences. It has no third-party cookies and no analytics or advertising tools, so it does not show a cookie consent request. If a non-essential tool is ever added, this policy will be updated and your consent asked before it runs.

13.2

The cookies the Site sets:

Sign-in cookies (names starting with better-auth): keep you signed in for up to 30 days, with temporary cookies for two-step verification and the session cache that last a few minutes. If you chose to trust a device for two-step verification, also a cookie that lasts 30 days.
NEXT_LOCALE: the site language you chose, for one year.
order_ followed by the order number: links your browser to an order in progress and its tickets, for seven days.
sidebar_state: whether the personal-area sidebar is open or closed, for seven days.
Further cookies used only by Association staff, for administration and previews.

13.3

In addition, your browser keeps some data on your own device (localStorage and sessionStorage) that is not sent to the Association: a notice you dismissed, when the app install suggestion was shown, the colour theme you chose in the personal area, drafts of forms and texts you are writing (the membership form draft is kept without your ID number or signature) and an order in progress. The app keeps a copy of pages and of your tickets so they are available offline. You can clear all of this in your browser settings.

13.4

YouTube and Spotify players load only after you click them; their operators' cookies and privacy policies then apply. The preview image of a YouTube video is loaded from Google's servers, so Google sees your device's IP address.

14.How Long We Keep It

14.1

Information is kept only as long as needed for its purpose, or for the period the law requires:

receipts, payments, donations and accounting records: at least seven years from the end of the tax year, as the Income Tax (Bookkeeping) Instructions require;
the register of members and membership details: while the membership lasts and for seven years after it ends;
the electronic signature record: the membership year plus seven years;
consents to mailings and their withdrawal: while the consent is in force and for seven years afterwards, as evidence;
security logs and the audit log: at least 24 months;
an account with no membership, donations or transactions: until you ask for it to be deleted.

14.2

At the end of the period the Association deletes the information or makes it anonymous.

15.Security

15.1

The Association protects information in line with the Privacy Protection (Data Security) Regulations, 5777-2017. Measures include: encrypted connections (HTTPS); encryption (AES-256-GCM) of ID numbers, emergency contacts, payment tokens and system credentials; storing user passwords as hashes; two-step verification; role-based permissions; re-authentication before sensitive actions; an audit log of actions; backups; and limiting access to the staff who need it.

15.2

No system is completely secure. Choose a strong, unique password and never share it.

16.Security Incidents

16.1

The Association records every security incident and deals with it at once. If personal information is materially exposed or corrupted, the Association will report to the Privacy Protection Authority where the law requires, and will inform the people who may be affected where that helps them protect themselves or where the Authority so instructs.

17.Your Rights

17.1

Under the Privacy Law you have these rights:

Access: to see the information the Association holds about you (section 13). The Association will provide access within 30 days of receiving your request.
Correction and deletion: to ask for information that is inaccurate, incomplete, unclear or out of date to be corrected or deleted (section 14). You will receive an answer within 30 days.
Removal from mailings: to be removed from a mailing list (section 17F) and to withdraw consent to advertising at any time.
Withdrawing consent: to withdraw a consent you gave, such as to a directory listing or to notifications; the withdrawal applies from then on.

17.2

You can see and update most details directly in your profile and account. For anything else, such as a copy of your information or deleting your account, write to info@jazzcouncil.org.il or to the contact under "Who Is Responsible for Your Information". We will verify your identity before acting on a request. Information the Association must keep by law, or needs to defend a claim, is not deleted before the required period ends.

17.3

If your request is refused, you will receive a reasoned notice. A refusal to give access or to correct information can be appealed to the Magistrates' Court, and you may also complain to the Privacy Protection Authority.

18.Minors

18.1

Minors (under 18) may use the Site and give information through it with the consent of a parent or guardian. Membership of the Association is open from age 17, as section 15 of the Associations Law provides. A parent or guardian may ask the Association to see or delete information about their child.

19.Changes to This Policy

19.1

The Association may update this policy. The date of the last update appears at the top of the page. A material change, especially a new use of information, will be announced on the Site and to account holders by email or in the personal area, and consent will be asked where needed.

Privacy Policy