Electrobuzz Privacy & GDPR Notice

Electrobuzz Privacy & GDPR Notice on Electrobuzz PRO. Home

1. Who are we

Electrobuzz operates two related services:

Unless we say otherwise, [LEGAL ENTITY NAME, e.g., Electrobuzz Media Ltd.] ("Electrobuzz", "we", "us", "our") is the data controller for your personal data under the EU & UK GDPR.

Registered address: [Company address].
Company number / VAT: [if applicable].
Primary contact for privacy: [[email protected]].
EU GDPR representative (if company is outside EEA): [Name / Service / Contact].
UK GDPR representative (if outside UK): [Name / Contact].

2. What data we collect & why (by category)

We collect only what we need to deliver the service. Here’s a quick map:

Data categoryExamplesWhere collectedWhy we use itLegal basisAccount & loginemail, username, password hashSign‑up on Classic or PROcreate & secure your accountContract performance; Legitimate interests (security)Subscription / billingplan tier, transaction IDs, last4 card (tokenised), PayPal IDVia payment processormanage paid access, prevent fraud, tax recordsContract; Legal obligation (tax)Usage & libraryplaylists, favourites, followed artists/labels, downloads historyPRO app interactionssave your music, show recommendations, sync devicesContract; Legitimate interests (product improvement)Content submissionsuser comments, uploaded artwork (if allowed), support ticketsClassic & PROcommunity features; supportContract; Legitimate interestsTechnical & deviceIP, device type, browser UA, cookies, crash logssite/app visitsperformance, security, abuse prevention, analyticsLegitimate interests; Legal obligation (security logs)Marketing prefsopt‑in to newsletters, genre alertssettings / sign‑upsend updates you asked forConsent

3. Detailed purposes & legal bases

3.1 Run your account & deliver the services

We use your email/credentials to authenticate you, provide access to PRO features, save playlists/favourites and deliver downloads. Legal basis: contract performance.

3.2 Process payments & subscriptions

Payments are handled by [Stripe / PayPal / other]. We store only reference tokens; card data stays with the processor. We keep basic billing records for accounting and tax. Legal bases: contract; legal obligation.

3.3 Improve search, recommendations & site performance

Aggregate usage (e.g., popular artists, skipped tracks, error logs) helps us tune genre filters and speed up load times. Data is either aggregated or pseudonymised before analysis. Legal basis: legitimate interests (improving service). You can object—see Section 10.

3.4 Send email notifications (optional)

If you opt in, we’ll email release alerts, playlist tips, or product news. You can unsubscribe in any message or in account settings. Legal basis: consent.

3.5 Security, fraud & abuse prevention

We log IPs and device info to detect credential‑stuffing, scraping, and suspicious downloads. Legal bases: legitimate interests; legal obligation in some jurisdictions.

4. Cookies & similar tech

We use:

TypeExamplesPurposeControlStrictly necessarysession cookie, CSRF tokenkeep you logged in, protect formsrequired for site to workAnalytics[Google Analytics / Plausible / self‑hosted Matomo]understand traffic & feature usageopt‑out link belowPreferencetheme (dark/light), volume levelremember your settingsbrowser cookie controlsMarketing (if used)email open tracking pixelonly if you opted in to marketingunsubscribe / disable images

Cookie choices: Visit [cookie settings link] to change your preferences. Most browsers also let you block or delete cookies.

5. Data we do not intentionally collect

  • Government ID numbers

  • Precise GPS location

  • Special category data (health, religion, etc.) If you put personal or sensitive data in a playlist name, comment, or upload field, you are choosing to make that information available under the settings you use.

6. Sharing & processors

We share personal data only with service providers who help us run Electrobuzz and who are bound by data‑processing agreements.

ProviderRoleData sharedLocation / safeguardsCloudflareCDN, DDoS, DNSIP, request metadataEU‑US Data Privacy Framework SCCs[Stripe / PayPal]Paymentsbilling tokens, amountEU & US; SCCs / DPFEmail service (e.g., Mailgun, Sendgrid)transactional & marketing mailemail, name, notification prefsSCCsAnalytics providerusage metricspseudonymised IDs, device data[region]Hosting providerservers / storageall site data (encrypted at rest)[region]

We do not sell personal data.

7. International transfers

If data leaves the EEA/UK we rely on: (i) adequacy decisions; (ii) Standard Contractual Clauses; or (iii) Data Privacy Framework participation where applicable. Copies of relevant safeguards are available on request.

8. How long we keep data

DataRetention ruleAccount (active)as long as you maintain an accountClosed accountanonymise or delete within 30 days (logs up to 180 days for security)Billing records7 years (tax law)Playlists / favouritesuntil deleted by you or account closureEmail unsubscribeskept to honour opt‑out (suppression list)

9. Your rights (EU/UK GDPR)

You can:

  • Access – get a copy of your data.

  • Rectify – fix inaccurate info.

  • Erase – ask us to delete data (some records may remain if required by law).

  • Restrict – stop us processing some data while a request is resolved.

  • Object – to processing based on legitimate interests (e.g., analytics).

  • Portability – export playlists, favourites, and account data in a machine‑readable format.

  • Withdraw consent – marketing emails stop immediately.

How: email [[email protected]] from the address tied to your account, or visit Account → Privacy → Export / Delete in PRO (coming soon if not yet live).

You also have the right to complain to your local data‑protection authority. See Section 13.

10. Automated decisions / profiling

We don’t make legal or similarly significant decisions by automation. We do use lightweight recommendation logic (e.g., “You liked X, try Y”). You can turn personalised recommendations off in settings; results become generic.

11. Security basics

  • Encryption in transit (HTTPS) everywhere.

  • Passwords stored using modern, salted hashing (bcrypt/argon2).

  • Role‑based admin access; MFA for staff.

  • Continuous patching of infrastructure; Cloudflare WAF + DDoS protection.

No system is 100% secure, but we work hard to protect your data. If we learn of a breach that affects you, we will contact you and regulators if required by law.

12. Children

Electrobuzz is not directed to children under 16 (set local age threshold as required). Do not create an account if you are under the minimum age in your country. Parents/guardians: contact us to remove data collected from a minor.

13. Supervisory authority contacts (examples)

If you are in the EEA you can complain to your local authority. A full list is available from the European Data Protection Board. Key contacts:

  • Ireland (DPC) – if our EU representative is in Ireland.

  • UK ICO – for UK users.

(We’ll insert the correct regulator once your legal entity location is confirmed.)

14. Changes to this notice

We’ll post updates here and, if changes are significant, notify you by email or in‑app banner at least 14 days before they take effect. We log version history below.

Current version: v1.0 – [DATE].