Privacy Policy
This Privacy Policy corresponds to Beatriz González De Oliveira (hereinafter, the “Owner”), with Tax ID 48111109P, registered address at Ines De Castro 22, 15005 A Coruña, Spain, and contact email info@djdeoliveira.com . The associated website is djdeoliveira.com . The Owner processes users’ personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).
This policy outlines what data is collected, the purposes of processing, how it is used, and the rights that users may exercise.
Data Collected
Only the data strictly necessary to manage the relationship with the User and improve their experience on the website is requested and processed. Specifically:
Name, surname, email address, shipping address (in case of purchase), phone number (if provided for order management), country, and preferred language.
IP address, browser type, operating system, pages visited, access date and time, visit duration, and usage patterns. This may be collected via cookies and analytical tools (e.g., Google Analytics).
Products purchased, order history, support requests, incidents or returns submitted.
Information voluntarily provided via contact forms, newsletter subscriptions, or participation in promotions and surveys — including comments, reviews, or any other shared information.
Purposes and Legal Basis of Processing
The User’s personal data will be used for the following legitimate purposes:
To process payments, deliver purchased digital products, provide access to downloads, and contact the User if necessary (e.g., technical issues or product updates).
If the User has given consent, contact data may be used to send updates, music releases, offers, discounts, or events related to [ARTIST/PROJECT] or other Owner content. These communications are periodic, and the User may unsubscribe at any time.
To analyze User browsing (e.g., via analytics cookies) in order to understand site interactions, detect preferences, resolve usability issues, and optimize content and services.
For legal compliance: issuing invoices, managing returns, maintaining records for tax, consumer protection, and commercial law compliance.
Data Retention
Personal data will be retained only for the time necessary to fulfill the stated purposes, in accordance with applicable legal timeframes:
Contractual data will be stored during the purchase/download process and, afterward, kept duly blocked for the required time under Spanish commercial and tax law. In general, invoices and related records must be kept for 6 years from the last transaction or the end of the contractual relationship.
Marketing data will be stored as long as the User does not withdraw consent. The User may unsubscribe from newsletters or promotional emails at any time, after which such data will be deleted or anonymized.
Analytical data is stored in accordance with the Cookies Policy and the terms of analytics providers. For example, Google Analytics retains pseudonymized audience data for a standard retention period (usually 14 months) unless otherwise configured.
Customer service data will be kept for the time necessary to resolve the issue. If such data results in legal obligations (e.g., processing a return), it will be retained until those obligations expire.
Data Disclosure
The User’s personal data will not be shared with third parties for commercial purposes. It will only be disclosed in the following cases:
Where a legal obligation, public authority, or court ruling requires it (e.g., to tax authorities or law enforcement within a legal investigation).
To certain third-party service providers, strictly for operational purposes under the Owner’s instructions. This includes:
Hosting services for the online store (which store the database and content).
Payment gateways (e.g., Stripe, PayPal) — used to securely process transactions. These platforms receive the necessary transaction data, but the Owner does not store full credit card details.
Newsletter services (e.g., MailChimp, Sendinblue) — used to deliver email campaigns.
Analytics platforms (e.g., Google Analytics) — for anonymous or pseudonymized site traffic analysis.
Technical tools: cloud storage, CMS tools, or plugins that may incidentally process User data.
In all cases, these providers (data processors) offer appropriate security and confidentiality guarantees. The Owner has signed data processing agreements with them as required by Article 28 of the GDPR, ensuring they process data only for the purposes indicated and under strict instructions. When providers are located outside the EU (e.g., in the USA), additional safeguards are applied, such as Standard Contractual Clauses (SCCs) or ensuring an adequate level of protection.
User Rights
At any time, the User may exercise their data protection rights freely. These rights include:
Right of access: obtain confirmation of whether we are processing your data, and if so, receive a copy of the specific data held, including information on purposes, recipients, retention periods, etc. Data will generally be provided in electronic format.
Right of rectification: request correction of inaccurate, incorrect, or outdated personal data. The User may also complete incomplete data, where appropriate.
Right of erasure (“right to be forgotten”): request deletion of personal data when it is no longer necessary, when consent is withdrawn, or when the data is processed unlawfully. Data will be blocked and then permanently deleted after the statutory retention period.
Right to restriction of processing: request temporary restriction in certain cases (e.g., while accuracy is being verified, or during a legal claim). While restricted, the data will only be processed to fulfill legal obligations or defend claims.
Right to object: object, for reasons related to your specific situation, to processing based on public interest or legitimate interest. You may also object to direct marketing (e.g., promotional emails).
Right to data portability: receive your personal data in a structured, commonly used, and machine-readable format (e.g., CSV file), and transmit it to another controller. This applies when processing is based on consent or contract and carried out by automated means. Direct transmission to another controller is possible if technically feasible.
To exercise any of these rights, the User must send a request to info@djdeoliveira.com , indicating the right they wish to exercise and attaching a copy of a valid ID document (e.g., passport, national ID) to prevent unauthorized access to personal data. The Owner will respond within the timeframes established by the GDPR (max. 1 month, extendable to 2 months in complex cases with prior notice).
The User is also informed of their right to file a complaint with the relevant Data Protection Authority if they believe their data is being processed unlawfully. In Spain, this authority is the Agencia Española de Protección de Datos (AEPD). Visit their official website for further information on submitting a complaint.
Legal Basis for Processing
The Owner processes personal data on the following legal bases, depending on the purpose:
Consent: When the User subscribes to newsletters, makes a purchase, or accepts non-essential cookies, they provide explicit consent for the corresponding data processing (e.g., sending updates, managing their order). Consent may be withdrawn at any time without affecting the lawfulness of previous processing.
Performance of a contract: When the User places an order, the data is processed to fulfill the sales contract (billing, product delivery, post-sale support, handling returns, etc.). Without this data, the contract cannot be fulfilled.
Legal obligations: Certain data must be processed to comply with legal requirements (e.g., invoice retention under tax law, processing valid returns under consumer law, or maintaining records under accounting regulations). The GDPR itself also requires data processing for user rights, security breaches, or activity logs.
Legitimate interest: In specific cases, data may be processed based on a legitimate interest of the Owner or a third party, provided such interest does not override the User’s fundamental rights and freedoms. Examples include improving site security, preventing fraud, or sending relevant product updates. Where this basis applies, it will be clearly indicated and assessed case by case.
Security Measures
The Owner is committed to processing User data confidentially and applying appropriate technical and organizational security measures to protect it. These include:
Secure connections (HTTPS)
Encryption of sensitive data when appropriate
Firewalls, intrusion detection systems, access control protocols
Regular backups and system audits
However, the User should be aware that no internet system is entirely invulnerable. While the Owner cannot guarantee absolute security against all risks, it regularly updates and maintains security protocols to industry standards.
If a security incident affecting personal data is detected, the Owner will act diligently and notify the User and authorities in accordance with GDPR requirements.Updates to This Policy
This Privacy Policy may be modified or updated in the future — for example, to reflect legal changes, new case law, regulatory guidelines, service updates, or business practices. Any significant changes will be communicated via the website and/or by email (if required by law or the change materially affects Users).
Users are encouraged to review this Privacy Policy regularly to stay informed of any updates. The last revision date will be indicated at the top of the document. Continued use of the website after changes implies acceptance of the new terms with respect to data collected after the updated policy.
If a User does not agree with the changes, they should exercise their rights accordingly (e.g., delete their account, object to processing) or discontinue use of the service.Contact
For any questions regarding this Privacy Policy or how your personal data is handled, you may contact the Owner at info@djdeoliveira.com .
