Privacy Policy

hexagonhq.com is run by Hexagon HQ B.V., Henri Polaklaan 40B, 1018 CT Amsterdam, the Netherlands (registered office: Amsterdam; Chamber of Commerce no. 69392927; RSIN 857857691). Hexagon HQ B.V. is the controller for the personal data collected through hexagonhq.com: it decides what happens with that data. HEXAGON HQ is the record label founded by Don Diablo. When this policy says “we”, “us” or “HEXAGON HQ”, we mean Hexagon HQ B.V., the company that runs this site.

Questions about this policy or your data: privacy@hexagonhq.com. You can write to us in English or Dutch.

Hexagon HQ B.V. also runs Don Diablo’s website, dondiablo.com, which has its own privacy policy. Both sites use the same database, one mailing list and one fan overview: section 7 explains how.

• We use your details to give you what you signed up for. Our sign-up forms (the community, event and merch sign-ups, release receipts, and creator applications if you give your email address) also sign you up for news, drops and offers from Don Diablo and HEXAGON by email and SMS, as the text above the button says. You can unsubscribe at any time and keep what you signed up for.
• Receipts for release extras are read by an AI model, only through AI providers that don’t keep your receipt or train on it. The model never turns anyone down: anything that isn’t clearly OK goes to a person on our team. We delete the receipt file within 60 days of our decision.
• “First come, first served” means the order in which our server registered the entries. There is no draw. One entry per person.
• Your details go onto one mailing list and into one fan overview that we keep for both Don Diablo and HEXAGON. We share data with the services that run this site and, only if you accept cookies, with Meta for our ads. We don’t sell your data.
• You can ask us at any time what we have about you, or ask us to delete it: privacy@hexagonhq.com.

What we collect depends on what you do on the site. For each activity: what we collect, what we use it for, and the legal basis under the GDPR (the EU privacy law).

Our sign-up forms (the community, event and merch sign-ups, release receipts, and creator applications if you give your email address) show this text right above the button: “By submitting you agree to receive news, drops and offers from Don Diablo and HEXAGON by email and SMS. Unsubscribe anytime.” With your sign-up we store that exact text, its version and the time. Section 7 explains what happens next. Other forms, such as the artist forms in a welcome deck or looking up your receipt entry with your email address, don’t sign you up for anything.

Joining the community (hexagonhq.com/community). Your email address and mobile number; if you choose to give them, your name or DJ name, city, country and Instagram handle; the campaign details of the link you came from (such as utm tags or a Facebook click ID); and the exact consent text you agreed to, its version and the time. We use this to make you a member, to give you the link to our WhatsApp community, and to send you news, first access, free events, giveaways, presales, music and merch from Don Diablo and HEXAGON by email and SMS (section 7) and, if you join it, in our WhatsApp community. Legal basis: your consent, which you can withdraw at any time (section 11).

Signing up for an event or merch. Your name, email address, mobile number, city and country, the exact time our server received your sign-up, and the consent text above the button with its version and time. We use this to give you the early access or the place you signed up for (section 5 explains the order) and to send you news, drops and offers from Don Diablo and HEXAGON by email and SMS (section 7). Legal basis: carrying out what you signed up for (contract) and, for those messages, your consent.

Unlocking release extras with a receipt. Your name or DJ name, your email address, your receipt, and the consent text above the button with its version and time. Section 4 explains exactly what happens with your receipt: we only use the receipt itself to check your purchase. We also use your name and email address to send you news, drops and offers from Don Diablo and HEXAGON (section 7). Legal basis: carrying out what you asked for (contract: we check your purchase and unlock the extras), our legitimate interest in preventing fraud and, for those messages, your consent.

Applying as a creator (hexagonhq.com/creators/…). Your TikTok username, PayPal address, any notes you add and, if you give it, your email address. We also automatically look up the public information on your TikTok profile: follower count, display name, verified badge and profile picture. We use this to choose creators for paid promotions, to contact you and to pay you. If you give your email address, the text above the button applies and we store it with your application, with its version and time; creator applications are not added to our mailing list automatically. Legal basis: taking steps toward, and carrying out, an agreement with you, our legitimate interest in checking your public reach and, for news by email, your consent.

Artists we work with (welcome decks). The forms in a welcome deck ask for details such as your full legal name, postal address, country, email address, date of birth, publisher, copyright society, IPI/CAE number, profile links and biography. We use them to release, register and promote your music and to pay royalties, and we may email a PDF of your answers to our team. We record when a deck is opened, without your IP address. Legal basis: our agreement with you, and legal obligations such as tax and royalty records.

Link pages (hexagonhq.com/r/…). Which button you clicked and when, the page you came from, the campaign tags in the link (utm tags, which show which ad, ad set, campaign and placement you came from), the Facebook click ID if you came from a Facebook or Instagram ad, your country, your type of device (iOS, Android, computer or other) and the app you opened the page in (for example Instagram, Facebook or TikTok, or a normal browser). We also count that the page was opened, with the page you came from, the campaign tags in the link, your country, your type of device and the app, without cookies and without the Facebook click ID. We work out your country from your IP address with a database on our own server, so your IP address isn’t sent to anyone for this, and we don’t store it. We work out the type of device and the app from the technical description your browser sends with every request (the user agent); we store only these broad categories, not the description itself. We use this to see which releases, platforms, ads and placements work, and, if you accepted cookies, to measure our ads (section 6). Legal basis: our legitimate interest in measuring our promotion. Our country database: IP Geolocation by DB-IP, licensed under CC BY 4.0.

Demo submissions. The demo form on our homepage is run by TrackStack. What you upload there goes to TrackStack and is handled under TrackStack’s own privacy policy; we see your submission in TrackStack.

Confidential documents for business partners (personal links). If we invite you, through a personal link, to review a business opportunity, we keep your name, email address and our notes. If you sign our Confidentiality Agreement online, we store your name, title, email address, the company details you enter (company name, country of incorporation, which decides how disputes are resolved, and registration number), your typed signature, the time, your IP address and browser details, and the exact version of the agreement, and we add these to the signed PDF. If we later ask for a co-obligor and it signs a deed of accession through its own link, we store the same kind of details for that company and the person who signs for it. When we countersign, we add the name of the person who signed for us, the time and their IP address. To protect the information and as evidence, we keep an activity log of each personal link: when it is opened and from which IP address (with the addresses passed on by proxies), the browser and type of device, a random device code that the page stores in your browser (only to see whether the link is used on another device), which pages are viewed and for how long, downloads, attempts to print, save or copy, and attempts to use the link after it was closed or replaced. We also log what our own team does with the link. We do not record your location. We use this to conclude and prove the agreement, to give and end access, to protect our confidential information, to detect misuse and to follow up on the opportunity. Legal basis: entering into and performing the agreement with your company, and our legitimate interest in proving it, protecting our information and knowing which parts of our documents were read.

Visiting the site and emailing us. To show you the site and to protect it against abuse, our server processes technical data such as your IP address, browser and device. We don’t store this in our own database, but our hosting provider may keep it in technical logs. If you email us, we use your message to answer you. Legal basis: our legitimate interest in running a secure website and answering questions.

Do you have to give us your details? No, but without them we can’t do what you ask: to join the community we need your email address and mobile number; to unlock release extras, your name, email address and receipt; for an event or merch sign-up, the fields the form marks as required. Fields marked optional are optional. News, drops and offers come with these forms; if you don’t want them, unsubscribe at any time (section 11). You keep your membership, your place in a drop and the extras you unlocked.

What you send. Your name or DJ name, your email address and a photo, screenshot or PDF of your Beatport receipt (up to 10 MB). A receipt can show more than we need, such as your address and payment details. Feel free to blur or cover those: we only need the order number, the date and the track.

Before it leaves your device. Your browser makes photos smaller (at most 2000 pixels on the longest side) and saves them again as a JPEG. This removes hidden information stored in the photo, such as the location where it was taken and the camera details. Small PNG screenshots, GIFs and PDFs are sent as they are: screenshots normally contain no location, but a PDF can contain document details such as its author. If your browser can’t convert a photo, the original is sent.

The automatic check. Our server sends the receipt, together with the name of the release and its track(s), to an AI model through OpenRouter. Every request tells OpenRouter to use only AI providers that don’t keep your receipt after reading it (“zero data retention”) and don’t collect it for other purposes, such as training. A PDF is read by the model itself, not by a separate conversion service. At the moment that is Google’s Gemini model, run by Google; we record which provider read your receipt. If we switch to another model, the same conditions apply. If no such provider is available, the automatic check is skipped and a person on our team looks at your receipt instead: we never send it without these conditions. The model only reads the receipt and reports what it shows: whether it is from Beatport, whether it is a completed purchase, the order number, the purchase date, the tracks, the total amount, visible signs of editing and a short note. It does not decide anything.

Who decides. Our own system then applies fixed rules: the receipt is from Beatport, shows a completed purchase, has a readable order number and purchase date, was bought on or after the day the drop started (unless we accept earlier purchases for that drop) and not in the future, includes the track of the drop and shows no signs of editing. If everything checks out, your extras unlock right away. If anything is unclear, or the check doesn’t work, the receipt goes to a person on our team. The AI model never turns a receipt down: a rejection comes from a person, and you will see the reason on the release page. You can then upload a better receipt.

Two things happen automatically. Each order number counts once per release: if someone else already used it, an upload with that number is refused. And if you upload a new receipt while your earlier one is still waiting for review, the new one replaces the earlier one. If you send a new receipt, for example after a rejection, your place in line is based on the new one (section 5).

No decision by computer alone. The AI model never turns a receipt down. Only two things happen without a person: an order number that was already used is refused, and a newer upload replaces your earlier one that was still waiting. Neither has legal or similarly significant effects for you, and if you disagree, email privacy@hexagonhq.com and a person will look at it.

Where it’s stored. Receipts are kept in private storage (Supabase, in the EU). Only our team can open them, through links that expire within an hour.

What we keep, and for how long.

• The receipt file: deleted automatically 60 days after it was approved or rejected. If nobody has decided on it by then, it is deleted 60 days after you uploaded it; your entry stays, without the file, until a person decides.
• The rest of your entry (your name, email address, the order number and purchase date, what the check read such as the tracks, total and note, which provider read it, the outcome, when and by whom it was decided, and the record of your consent) and a record of which extras you downloaded: kept until 12 months after the release closed (its end date, or the last entry if that is later), or earlier if you ask us to delete it (section 11). We keep it so we can answer questions or deal with fraud.
• After those 12 months we remove your name, email address, what the check read, who decided and the record of your consent, and the record of your downloads. Only the order number, purchase date and outcome stay, for another 12 months, so the same receipt can’t be used twice. Then they are deleted too. If you are on our mailing list because of this receipt, we first keep a copy of the record of your consent, with your email address, for as long as you are on that list (section 12).
• If you agreed to hear from us, your email address stays on our mailing list until you unsubscribe, also after your entry is deleted (section 7).
• A cookie on your device remembers your entry for that release for up to a year (section 10).

For some drops, places or rewards go to the first people in. This is how we keep that fair:

• The order is the moment our server registered your entry, to a fraction of a second. For a sign-up, that is the moment it arrives. For a receipt, it is the moment the receipt has been received and read, which usually takes a few seconds. Not the moment you pressed the button, and not what your own clock said.
• Only entries between the opening time and the closing time of the drop count.
• One entry per person. Entries with the same email address (also with dots or a +tag in a Gmail address, for example) or with the same phone number count as one person; only the first one counts.
• A rejected receipt doesn’t count. If you send a new receipt, for example after a rejection, your place in line is based on the new one.

We use this list to choose the people who get the places, and to contact them by SMS, email or WhatsApp. To send those messages, we may export their names and contact details to our SMS or email provider. Legal basis: carrying out the drop you entered (contract) and our legitimate interest in a fair drop without abuse.

Meta Pixel, only with your consent. If you click “Accept” in the cookie banner, we load the Meta Pixel (Facebook and Instagram). It places cookies (_fbp and _fbc) and tells Meta which pages you visit and what you do there, such as signing up. Our link pages (/r/…) use a separate pixel for the same purpose. For collecting this data, we and Meta are jointly responsible. Our arrangement with Meta is Meta’s Controller Addendum (facebook.com/legal/controller_addendum); you can also exercise your rights with Meta. What Meta then does with the data is covered by Meta’s own privacy policy. Legal basis: your consent.

Server-side events (Conversions API), also only with your consent. If you clicked “Accept”, our server also tells Meta when you join the community, sign up for an event or merch, or click a streaming-service button on a link page, so we can measure and improve our ads (including custom and lookalike audiences). With a sign-up we send the email address, name, phone number, city and country you gave us in hashed form (scrambled with SHA-256). Hashing is not anonymisation: Meta can still match the result to your Facebook or Instagram account, if you have one. We also send your IP address and browser details and, on link pages, Meta’s click identifiers (fbp and fbc) if available: from Meta’s cookies on your device, or from the Facebook click ID in the link you came from. These are not hashed. If you decline cookies, or haven’t made a choice yet, our server sends nothing to Meta, and when you decline we remove Meta’s cookies from this site. Legal basis: your consent, which you can withdraw at any time with “Cookie settings” (section 10).

Hexagon HQ B.V. runs both hexagonhq.com and Don Diablo’s website, dondiablo.com, and both sites use the same database. That is why they share one mailing list and one fan overview.

The mailing list. If you join the community, sign up for an event or merch, or send a receipt, and we stored your consent with it (section 3), we add you to our mailing list at Brevo. This is the same list that Don Diablo’s fans from dondiablo.com are on: messages on it come from Don Diablo and from HEXAGON. We add your email address, your mobile number for SMS if you gave one, your name, city and country, and where you signed up (for example the HEXAGON community, a drop or a release). This happens automatically, usually within a few minutes. We never add you (again) if you unsubscribed, or if we blocked you from the community; if we block you later, we take you off the list again, unless you are also on it through dondiablo.com or our webshop. If you replied STOP to our texts, we add your email address but not your number. If you were already on the list, we only fill in details that are missing. If you joined the community before 13 October 2026, you agreed to messages from HEXAGON HQ only, so we don’t add you to this list unless you sign up again. Legal basis: your consent, which you can withdraw at any time (section 11).

The fan overview. We also keep one overview of our fans (the “fan database”) that combines fans from dondiablo.com and hexagonhq.com and everyone on the mailing list. It shows where fans are, how many we can reach and through which channel, and which fans are most active: a “superfan” score based on things like sign-ups, purchases and community membership. The score only helps us understand our audience: it doesn’t decide whether you can take part in anything. From hexagonhq.com it includes:

• community members: email address, name, phone number, city, country and the date you joined (not members we have blocked);
• event and merch sign-ups: email address, name, phone number, city, country, which sign-up and when;
• approved receipts: name, email address, which release and when. Not the receipt itself, the order number or the result of the check.

We don’t use the fan overview itself to send messages: we only message people who agreed to it, or about a drop they entered. It is updated every 15 minutes from our records and the mailing list, so changes, unsubscribes and deletions carry through. Legal basis: our legitimate interest in understanding our audience and planning shows, drops and releases. You can object at any time (section 11). More about the fan overview: dondiablo.com/privacy.

We don’t sell your data. These parties receive or store it, only for the purposes in this policy:

• Supabase: our database and private file storage, including receipts. The data is stored in the EU (Sweden); Supabase is a US company.
• Railway: runs our website servers. The server of hexagonhq.com is located in the United States; everything you send through this site, including receipts, passes through it.
• OpenRouter, Google, Anthropic and Amazon Web Services: the AI services that can read receipts (section 4). OpenRouter passes the receipt on only to providers that don’t keep it or train on it; at the moment that is Google.
• Brevo: our mailing list for Don Diablo and HEXAGON, which sends our emails and text messages (section 7), and sends copies of signed agreements.
• sms.to: to send text messages.
• Meta: ads and measurement, only with your consent (section 6), and WhatsApp for our community. Once you join our WhatsApp, WhatsApp’s own terms and privacy policy apply, and depending on WhatsApp’s settings other members may see your name and number.
• OpenStreetMap (Nominatim): suggests the right city and country when you type a city in a form. Only the text you type is sent, from our server.
• PayPal: to pay creators.
• Embedded services: the Spotify player and the TrackStack demo form on our homepage, the Weeztix ticket shop (when you open it) and YouTube video thumbnails on link pages (the YouTube player itself only loads when you tap play). These load from their own servers, so they receive your IP address and browser details and may use their own cookies; their own privacy policies apply.
• Partners for events and presales: if a drop gives access to an event or a presale run by a promoter or ticket shop, we may share the names on the list with them, only to give you that access.
• A new owner: if our business, or part of it such as the label, is sold or reorganised, your data may pass to the new owner, who must keep to this policy.
• Authorities: when the law requires it.

Service providers that process data for us may only use it to provide their service to us.

Some of these parties are based in the United States, or handle data there: Railway (the hexagonhq.com server), OpenRouter, Google, Anthropic, Amazon Web Services, Meta, and Supabase (the company; our data is stored in the EU). When we use providers in the United States, we rely on the EU–US Data Privacy Framework for providers that are certified under it, and otherwise on the European Commission’s standard contractual clauses. You can ask us for a copy of these safeguards at privacy@hexagonhq.com.

We only use cookies for ads and measurement if you click “Accept”. You can change your choice at any time with “Cookie settings” at the bottom of this page or in the footer.

Always on, because the site needs them or because they remember your own choices:

• your cookie choice, your language, and whether you have seen or closed a pop-up or announcement (stored in your browser);
• whether you joined the community, with the WhatsApp link, so the page remembers it (stored in your browser);
• the campaign link you arrived from, until you close the tab (stored in your browser);
• on link pages: when you opened that page, so that reloading it within 30 minutes isn’t counted as a new visit, until you close the tab (stored in your browser, section 3);
• a cookie per release (hxd_…) that remembers your receipt entry, for up to a year;
• for artists: a cookie (hxdeck_…) that remembers the password of a welcome deck for 60 days, and drafts of the forms you are filling in (stored in your browser);
• for business partners using a personal link: a random device code (hxr-d), only to see whether the link is opened on another device (stored in your browser, section 3);
• for our own team only: their login (stored in their browser).

Only with your consent: the Meta Pixel cookies (_fbp and _fbc), see section 6.

The server-side events to Meta in section 6 are not cookies, but they follow the same choice: they are only sent after “Accept”. If you decline, or change your choice, we remove Meta’s cookies (_fbp and _fbc) from this site. The embedded services in section 8 load without asking and may set their own cookies.

You can ask us to:

• see the data we have about you and get a copy;
• correct data that’s wrong;
• delete your data;
• restrict what we do with it, for example while we look into a question or complaint;
• object to what we do based on legitimate interest (see “Right to object” below);
• take your data with you in a common file format (portability);
• have a person look at your receipt (again);
• withdraw your consent at any time. This doesn’t affect what we did before.

Right to object. You can object at any time to anything we do based on legitimate interest (the fan overview in section 7 and measuring our link pages in section 3), and always to marketing. We then stop, unless we have compelling reasons that outweigh yours.

Email privacy@hexagonhq.com. We answer within one month; for complex requests we may need two more months, and we will tell you why within the first month. We may ask you to confirm it’s you, for example by writing from the email address you used with us.

Stopping messages. Use the unsubscribe link in any email from us, or reply STOP to any text. Because Don Diablo and HEXAGON share one mailing list (section 7), this stops messages from both. We keep your email address or number marked as unsubscribed, so we don’t add you again by mistake. Unsubscribing doesn’t cost you your membership, your place in a drop or the extras you unlocked. To leave our WhatsApp community, leave it in WhatsApp. You can also just email us.

Deleting your data. If you ask us to delete your data, we delete you and everything we have about you on hexagonhq.com (your membership, sign-ups, entries, receipts and creator applications), including the hexagonhq.com part of the fan overview and, if you came onto our mailing list through hexagonhq.com, your contact on that list (section 7), except what we must keep by law. If you are also on the list through dondiablo.com or our webshop, we ask you whether you want your data there deleted as well, because one company runs both sites. What we can’t undo: messages we already sent, data we already sent to Meta, and copies others already have, for example in a WhatsApp group. Your WhatsApp membership is managed in WhatsApp: leave the community there, or ask us to remove you. To show that we did it, we keep a short note of the deletion with a scrambled code of your email address, not the address itself. Signed confidentiality agreements are an exception: we keep them, with their evidence, for the period in section 12, because we may need them to establish or defend legal claims.

Complaints. If you think we handle your data wrongly, please tell us first. You also have the right to complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or to the data protection authority in the EU country where you live.

• Community membership: until you ask us to delete it.
• Blocked members: if we block someone (Terms, section 9), we keep their membership record, marked as blocked, for as long as the block applies, so the block works.
• Event and merch sign-ups, and the entries list: deleted 12 months after the drop closed (its end date, or the last entry if that is later), or earlier if you ask us to delete them.
• Receipts: the file is deleted 60 days after the decision, or 60 days after upload if nobody has decided yet; the rest of the entry 12 months after the release closed, except the order number, purchase date and outcome, which go after 24 months (section 4).
• The record of your consent (the text, its version, the time and where you gave it): kept with your membership, sign-up, receipt entry or creator application and, if you are on our mailing list, also as a copy with your email address (and your number, for SMS) for as long as you are on that list, so we can show that you agreed, also after your sign-up or entry is deleted. After you unsubscribe we keep only that you unsubscribed.
• Our mailing list: until you unsubscribe or ask us to delete you, also after your sign-up or entry is deleted. After you unsubscribe we keep your email address or number marked as unsubscribed, so we don’t add you again.
• Creator applications: until we remove that campaign from our system, or earlier if you ask. Payment records are kept as long as tax law requires (in the Netherlands, 7 years).
• Artist forms (welcome decks): as long as we keep that deck, and royalty and tax records as long as the law requires.
• Link clicks: 26 months. The Facebook click ID is removed after 90 days, from link clicks and from community memberships; after that we only keep that the click came from an ad.
• Link page visits: 26 months.
• The fan overview: follows our records and the mailing list (section 7).
• Confidential documents (personal links): signed agreements, deeds of accession and their evidence, including the activity log of the link (IP addresses, devices, pages viewed and actions): until five years after the obligations under the agreement end; invitations that were never signed, with their activity log and page views: 12 months after the link expired or was closed.
• Notes of deletions: we keep the last 500.
• Cookies and browser storage: see section 10.

HEXAGON HQ is not meant for children under 16, and you must be 16 or older to join the community or take part in a drop. If we find out we have data of someone under 16, we delete it.

Your data is kept in a database and in private storage that only our servers and our team can access, with their own logins. Receipts and other private files can only be opened through links that expire. If something goes wrong that puts your data at risk, we do what the law requires, including telling you where needed.

We update this page when we change how we handle data. The date at the top shows the latest version. If a change affects something you agreed to, we will ask you again or let you know.