Privacy & Cookies Policy

1. Data Controller

The data controller responsible for your personal data on this website is:

• Name: Nicolas Simion
• Address: Germany, North Rhine-Westphalia, Postal Code 50678
• Email: nicolassimion@gmail.com
• Phone: +49-176-62787647

2. What Data We Collect

We collect and process the following categories of personal data:

• Identity & Contact Data: name, email address, billing and shipping address, phone number
• Payment Data: processed securely by Stripe — we do not store card details on our servers
• Technical Data: IP address, browser type, device information, pages visited, time of visit
• Transaction Data: details of products purchased and payment history
• Cookie Data: browsing preferences and session identifiers

3. Legal Basis for Processing (GDPR Art. 6)

We process your personal data based on the following legal grounds:

• Contract (Art. 6(1)(b)): processing necessary to fulfill your order and deliver your purchase
• Legal Obligation (Art. 6(1)(c)): compliance with tax, accounting, and consumer protection laws
• Legitimate Interest (Art. 6(1)(f)): website security, fraud prevention, and service improvement
• Consent (Art. 6(1)(a)): for non-essential cookies, where you have given explicit consent via our cookie banner

4. How We Use Your Data

Your personal data is used exclusively for:

• Processing and fulfilling your CD orders
• Sending order confirmations and shipping notifications
• Responding to customer service enquiries
• Legal and regulatory compliance
• Improving website performance and user experience

5. Data Retention

We retain your personal data only for as long as necessary:

• Order and transaction records: 10 years (German commercial law — HGB §257)
• Customer account data: until account deletion or 3 years of inactivity
• Technical and cookie data: up to 12 months

6. Data Sharing & Third Parties

We do not sell your personal data. We share information only with trusted service providers who process data on our behalf:

• Stripe Inc. (payment processing) — data may be processed in the USA under standard contractual clauses
• Shipping carriers (DHL, Deutsche Post) — name and address for delivery purposes only
• Hosting provider — for website operation and data storage within the EU
• CookieYes — cookie consent management

7. International Data Transfers

When data is transferred outside the European Economic Area (e.g., to Stripe in the USA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

8. Cookies Policy

We use cookies to enhance your browsing experience. Cookies are small files stored on your device that help us operate the website and understand how it is used.

We use the following types of cookies:

• Essential cookies: required for the website to function (cart, session, security) — no consent needed
• Analytical cookies: help us understand how visitors use our site — consent required
• Preference cookies: remember your settings and choices — consent required

9. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of Access (Art. 15): request a copy of your personal data
• Right to Rectification (Art. 16): request correction of inaccurate data
• Right to Erasure (Art. 17): request deletion of your data
• Right to Restriction (Art. 18): request limited processing of your data
• Right to Data Portability (Art. 20): receive your data in a structured, machine-readable format
• Right to Object (Art. 21): object to processing based on legitimate interest
• Right to Withdraw Consent: withdraw consent at any time without affecting prior lawful processing

To exercise any of these rights, contact us at nicolassimion@gmail.com. We will respond within 30 days.

10. Right to Lodge a Complaint

You have the right to lodge a complaint with the German Federal Commissioner for Data Protection and Freedom of Information (BfDI):

• Website: www.bfdi.bund.de
• Address: Husarenstr. 30, 53117 Bonn, Germany
• Email: poststelle@bfdi.bund.de