Privacy Policy

Website hosting and logs

The website is hosted by Vercel Inc. Technical request data such as IP address, date, time, requested page, referrer, browser and device information may be processed to deliver the website, maintain security and diagnose errors. This processing is based on our legitimate interest in providing a secure and reliable website (Art. 6(1)(f) GDPR).

Catalog, account, order and booking data is stored using Neon-hosted PostgreSQL. Media is stored in Amazon S3-compatible infrastructure and served through media.loumirecords.com. Service providers process data on our behalf and may use safeguards such as the EU-US Data Privacy Framework or EU Standard Contractual Clauses where data is transferred outside the EEA.

Accounts and authentication

When you create or use an account, we process your name, email address, encrypted login credentials, session information and account role to provide and secure the account. The legal basis is performance of a contract or steps requested before entering a contract (Art. 6(1)(b) GDPR) and our security interests (Art. 6(1)(f) GDPR).

Orders and payments

For purchases we process contact details, ordered products, amounts, payment status and fulfilment information. Payments are handled by Stripe Payments Europe, Limited; payment card details are submitted directly to Stripe and are not stored by us. Processing is necessary to perform the purchase contract (Art. 6(1)(b) GDPR) and meet accounting and tax obligations (Art. 6(1)(c) GDPR).

Contact and studio bookings

If you contact us or request a studio booking, we process the information you provide, including contact details, project information, requested dates and message content. Email delivery is provided by Resend. Processing is based on your request (Art. 6(1)(b) GDPR) or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Spam protection

We use Cloudflare Turnstile to protect forms and the displayed contact address against automated abuse. Turnstile may process technical request and device data. If Turnstile is not configured, Google reCAPTCHA may be used instead. Processing is based on our legitimate interest in preventing spam and misuse (Art. 6(1)(f) GDPR).

Cookies, local storage and Meta Pixel

The site stores your cookie choice and shopping cart in your browser. Essential storage is used to remember these choices and operate account sessions and the cart. With your consent, Spotify redirect links may load Meta Pixel to measure a visit before continuing to Spotify. Meta may receive your IP address, browser information and the visited link. The legal basis for Meta Pixel is consent (Art. 6(1)(a) GDPR), which you may withdraw by clearing or changing your cookie choice.

Retention

We retain personal data only as long as necessary for the stated purpose. Contract and accounting records are kept for applicable statutory retention periods. Enquiries and booking requests are deleted when no longer required unless legal obligations or potential claims require longer storage. Account data is retained until the account is deleted, subject to mandatory retention requirements.

Your rights

Subject to the conditions of the GDPR, you may request access, correction, deletion, restriction, data portability, or object to processing based on legitimate interests. You may withdraw consent at any time with effect for the future. You may also lodge a complaint with a data-protection supervisory authority; the competent authority is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg.