Privacy Policy — Política de Privacidad
Data controller
Hugo Miguel Carvalho Lopes (NIF Y4925309B) is the data controller for all personal data collected through Soundbank.Studio. "Soundbank.Studio" is a trade name of this legal person.
Contact: hello@soundbank.studio · +34 605 011 596
Address: Despacho 204, planta alta — CID ZAFRA Río Bodión, Avda. de los Cameranos 47,
06300 Zafra (Badajoz), España.
Purposes and legal bases
| Purpose | Legal basis | Data processed |
|---|---|---|
| Purchase and digital delivery | Contract (Art. 6.1.b GDPR) | Email, billing country, payment confirmation |
| Tax invoicing and accounting | Legal obligation (Art. 6.1.c GDPR) | Name, email, billing address, transaction amount, date |
| Newsletter subscription | Consent (Art. 6.1.a GDPR) | Email, consent timestamp |
| Server security and error logging | Legitimate interest (Art. 6.1.f GDPR) | IP address, request metadata, timestamps |
| Cookie consent management | Legal obligation (Art. 6.1.c GDPR) | Consent preferences (localStorage) |
Processors and international transfers
| Processor | Purpose | Data | Country | Role | Transfer mechanism (CONFIRM before launch) |
|---|---|---|---|---|---|
| Netlify, Inc. | Hosting and Blobs storage | Request data, order records, product file | US | Processor | To be confirmed before launch (EU-US DPF / SCCs) |
| Stripe Payments Europe / Stripe, Inc. | Payment processing + Stripe Tax | Name, email, billing country, VAT / tax ID, fraud signals | IE / US | Processor + independent controller (fraud/compliance) | To be confirmed before launch (DPF / SCCs) |
| Brevo | Transactional email and newsletter double opt-in | Email, order details in transactional messages, newsletter consent | EU / international subprocessors | Processor | To be confirmed before launch (DPF / SCCs) |
| Plausible Insights OÜ | Cookieless analytics | Aggregated page events (no cookies, no advertising IDs or cross-site tracking) | EU (Estonia) | Processor | EEA — no transfer required |
Data retention
| Data category | Retention period |
|---|---|
| Order / invoice / consent evidence | Spanish tax/commercial law (~6 years) |
| Download grants / access logs | Until expiry (30 days) + 30-day grace, then purged |
| Newsletter subscription + opt-in proof | Until unsubscription; suppression list retained indefinitely |
| Transactional email logs | Up to 6 months for support purposes |
| Server / security logs | Provider-default (Netlify — approximately 30 days) |
| Cookie-consent record | 24 months after last interaction |
Your data-subject rights
Under the GDPR, you have the following rights regarding your personal data:
- Right of access — request a copy of the data we hold about you.
- Right of rectification — request correction of inaccurate or incomplete data.
- Right of erasure ("right to be forgotten") — request deletion of your data, subject to legal retention obligations.
- Right to restriction of processing — request that we limit how we use your data.
- Right to data portability — receive your data in a structured, machine-readable format.
- Right to object — object to processing based on legitimate interest (including analytics).
- Right to withdraw consent — withdraw consent at any time (does not affect lawfulness of prior processing).
- Right to lodge a complaint — with the Spanish Data Protection Agency (AEPD).
To exercise any of these rights, contact: hello@soundbank.studio. We will respond within one month.
Spanish Data Protection Agency (AEPD)
C/ Jorge Juan 6, 28001 Madrid
www.aepd.es