Privacy policy
KATSEYE Music Box · Last updated: September 29, 2026
1. Data controller
- Controller: KATSEYE Music Box
- Contact: eyekons@katseyemusicbox.com
2. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Processing your order, shipping and billing | Name, address, email, phone, payment data | Performance of a contract (GDPR Art. 6(1)(b)) | 6 years (tax and commercial obligations) |
| Answering your questions | Name, email, phone, message content | Consent / legitimate interest (GDPR Art. 6(1)(a) and (f)) | 1 year from the last contact |
| Sending you marketing emails | Name, email | Consent (GDPR Art. 6(1)(a)) or legitimate interest if you are already a customer | Until you unsubscribe |
| Measuring and personalizing advertising | Device identifiers, browsing, purchase events | Consent (cookies) | According to each provider's policy |
| Handling returns and claims | Order data and bank details for the refund | Performance of a contract and legal obligation | 3 years + 6 years for tax purposes |
We do not process health data. We don't ask for or store information about medical conditions, diagnoses or treatments. If you choose to write to us about your health, we will use that message only to reply to you and will delete it afterwards.
3. Payment data
Your card details never pass through our servers and we do not store them. They are processed directly by Stripe, a payment provider certified under the PCI-DSS standard.
4. Recipients
We only share data with providers acting as data processors, under a signed agreement in line with GDPR Art. 28:
| Provider | Role | Location |
|---|---|---|
| Stripe | Payment processing | EU / US |
| Supabase | Database and hosting | EU |
| Brevo | Transactional and marketing emails | EU (France) |
| Meta Platforms | Advertising measurement and remarketing | US |
| Web analytics | US | |
| Shipping carrier | Delivering your order | Along the shipping route to the US or Canada |
We also share data with tax authorities and other public bodies when required by law.
5. International transfers
Some providers are located outside the European Economic Area. These transfers are covered by the EU-US Data Privacy Framework or, where that does not apply, by the Standard Contractual Clauses approved by the European Commission, together with additional security measures.
6. Your rights
You can exercise your rights of access, correction, deletion, objection, restriction of processing and data portability, and your right not to be subject to automated decisions, at any time by emailing eyekons@katseyemusicbox.com and stating which right you are exercising. We will reply within one month at the latest.
If you believe we have not handled your request properly, you can file a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (www.aepd.es · C/ Jorge Juan 6, 28001 Madrid, Spain).
7. Minors
Purchases on this site are for people aged 18 or over. We do not knowingly collect data from minors.
8. Security
We apply appropriate technical and organizational measures (encryption in transit with TLS, access control and activity logging) to protect your data against unauthorized access, loss or alteration.
9. Changes
We may update this policy to reflect changes in the law or in our services. The current version will always be published on this page, with its update date.