Who is responsible
The data controller is [TBC: company legal name], [TBC: registered address], [TBC: country]. Contact for anything about your data: [TBC: privacy email].
What we collect and why
When you join the mailing list we collect:
- your email address, so we can email you;
- your country and, if you give it, your city, so we can tell you about shows near you and show promoters where fans are;
- the date and time of your consent and the version of the signup form, as a record that you agreed.
We use this only to send you news about Red Dot: new releases, shows and merch drops. We don’t sell it or share it with anyone for their own marketing.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: every email has a one-click unsubscribe link, or you can write to the contact above.
Who processes it for us
- Shopify stores the mailing list and sends the emails (Shopify Email). It also runs the merch store: on the merch page, product photos, prices and your cart load from Shopify, and checkout and payment happen on Shopify’s pages (shopreddot.com).
- Cloudflare hosts this website, checks signups for bots (Turnstile) and counts visits without cookies (Web Analytics). Your IP address is processed briefly to block abuse and is not stored with your signup.
[TBC: legal review: where each processor stores data, and the transfer mechanism for transfers outside the EU (e.g. the EU-US Data Privacy Framework or standard contractual clauses).]
How long we keep it
Until you unsubscribe or ask us to delete it. [TBC: legal review: retention after unsubscribing, e.g. keeping only a suppression record so we never email you again.]
Cookies
This site sets no tracking or advertising cookies. If you add merch to the cart, your browser stores the cart’s ID so the cart is still there when you come back; it’s used for nothing else, and you can clear it with your browser’s site data. Visit counts come from Cloudflare Web Analytics, which doesn’t use cookies. Embedded Spotify and YouTube players only load when you tap them; once loaded, those services’ own privacy policies apply.
Your rights
You can ask to see, correct, export or delete your data, object to how it’s used, or withdraw consent. You can also complain to a data protection authority, for example the one where you live. [TBC: lead supervisory authority, depending on where the controller is based.]
Changes
If this policy changes, the date below changes too. Last updated: [TBC: date of the final, reviewed version].