Privacy Policy

Controller
Provision of the website, hosting and server log files
Cookies and consent management
Customer account
Orders and digital downloads
Contact form
Newsletter
Payment processing (PayPal, credit card, Apple Pay and Google Pay)
Storage period
Rights of data subjects

1. Controller

The controller responsible for the processing of personal data on this website is:

Soundsoft – Professional Midifiles
Owner: Sven Gebauer
Loderslebener Str. 15
06268 Leimbach
Germany

Phone: +49 (0)34771 23721
Email: info@soundsoft.de

No data protection officer has been appointed, as there is currently no legal obligation to do so.

2. Provision of the website, hosting and server log files

2.1 Nature and purpose of processing

When you access our website, the web server automatically collects information and temporarily stores it in so-called server log files. This may include in particular the following data:

Date and time of access
IP address of the accessing device
Host name of the accessing computer
Browser used, including browser type and version
Operating system used
Referrer URL through which you reached our website
Pages and files accessed
HTTP status code of the respective page request
Amount of data transferred

The temporary processing of this data is necessary to deliver the content of our website to your device and to ensure the technical functionality of the online shop.

In addition, the data may be processed to detect and prevent attacks, analyse errors and ensure the security and stability of our information technology systems.

2.2 Legal basis

Processing is based on Art. 6(1)(f) GDPR.

Our legitimate interest lies in the secure, stable and uninterrupted provision of our online shop and in protecting our systems against misuse and unauthorised access.

2.3 Hosting

Our website is hosted by the following service provider:

ALL-INKL.COM – Neue Medien Münnich
Owner: René Münnich
Hauptstraße 68
02742 Friedersdorf
Germany

The hosting provider processes the data required to provide and secure the website on our behalf. We have concluded a data processing agreement with the hosting provider pursuant to Art. 28 GDPR.

2.4 Storage period

Server log files are stored only for as long as necessary to ensure the security, stability and functionality of our website.

Longer storage may occur in individual cases if there are specific indications of unlawful use, a security incident or an attack on our systems. In such cases, the relevant data may be stored until the matter has been fully clarified.

3. Cookies and consent management

3.1 Use of cookies and comparable technologies

Our website uses cookies and comparable technologies. Cookies are small text files that can be stored on your device or can read information already stored there.

Cookies may be necessary to provide our website technically, ensure its security and make certain functions of the online shop available. These include, in particular, the shopping cart, the ordering process, login to the customer account and the provision of purchased digital content.

Some cookies and comparable technologies are technically necessary for the operation of our website. Others are used only if you have expressly consented beforehand.

3.2 Consent management with Shopware

We use the consent manager integrated into Shopware to manage your consent.

When you first visit our website, you can select the categories of cookies and comparable technologies to which you wish to consent. Your selection is stored so that it can be taken into account on subsequent page views.

Where the consent manager stores information on or reads information from your device, technically necessary operations are carried out on the basis of Section 25(2) TDDDG.

Where you have consented to the use of optional cookies or comparable technologies, access to your device is based on Section 25(1) TDDDG. The associated processing of personal data is based on Art. 6(1)(a) GDPR.

The processing and documentation of your consent decision is carried out to fulfil our legal obligations to provide evidence on the basis of Art. 6(1)(c) GDPR.

3.3 Technically necessary cookies

Technically necessary cookies and comparable technologies are used in particular to

provide the shopping cart and store its contents,
carry out the ordering and payment process,
store your cookie and consent settings,
enable login to and use of a customer account,
ensure the secure operation of our website,
prevent misuse and unauthorised access,
securely provide purchased digital content and carry out the download process.

Where personal data is processed in this context, processing is carried out – depending on the respective purpose – in particular on the basis of Art. 6(1)(b) GDPR for pre-contractual measures or performance of a contract and on the basis of Art. 6(1)(f) GDPR to ensure a secure and functional online shop.

Technically necessary cookies cannot be disabled via the consent manager because otherwise the website or individual functions expressly requested by you could not be provided properly.

3.4 Optional cookies and comparable technologies

Optional cookies and comparable technologies are used only if you have expressly consented beforehand.

Depending on the services activated on our website, such technologies may be used in particular to

provide optional convenience functions,
integrate external payment functions,
protect forms against automated input and misuse,
provide other services expressly selected by you.

The optional services and technologies actually used depend on the functions activated on our website and the consent you have given in the consent manager.

3.5 Changing and withdrawing your consent

You may change or withdraw consent you have given at any time with effect for the future via the consent manager used on our website.

The lawfulness of processing carried out on the basis of your consent before its withdrawal remains unaffected.

3.6 Note on digital content

Technically necessary cookies and session information are used to provide purchased MIDI files so that the ordering, payment and download process can be carried out properly and securely.

4. Customer account

4.1 Creating a customer account

You have the option of creating a personal customer account on our website. Registration is voluntary and is intended to make future orders easier and to provide your order history and downloads.

During registration, we process in particular the following data:

Title (optional)
First and last name
Billing and delivery address (where required)
Email address
Telephone number (optional)
Password (stored in encrypted form)

4.2 Purpose of processing

Processing is carried out to create and manage your customer account, process orders, provide your purchased digital content and communicate with you in connection with your customer account.

4.3 Legal basis

Processing is carried out pursuant to Art. 6(1)(b) GDPR for pre-contractual measures and for performance of the contract concluded between you and us.

4.4 Storage period

The data in your customer account is stored for as long as the customer account exists.

After deletion of your customer account, personal data will be deleted unless statutory retention obligations or legitimate interests prevent deletion.

Data that must be retained under commercial or tax law will remain stored until the respective statutory retention periods have expired.

4.5 Password

Your password is stored exclusively in encrypted form. We are unable to know your password.

5. Orders and digital downloads

5.1 Order processing

When you place an order in our online shop, we process the personal data required to conclude and perform the contract.

This includes in particular:

Title
First and last name
Billing address
Email address
Telephone number (if provided)
Order data
Payment information
Time of order

Processing is carried out exclusively to process your order, handle payment, provide the purchased digital content, fulfil legal obligations and communicate with customers.

5.2 Legal basis

Processing is based on Art. 6(1)(b) GDPR for performance of the contract concluded between you and us and for pre-contractual measures.

Where statutory retention obligations apply, processing is based on Art. 6(1)(c) GDPR.

5.3 Provision of digital content

Our shop offers exclusively digital MIDI files and digital song packages for download.

After successful completion of the order and – where required – successful receipt of payment, the purchased digital content will be made available for download in your customer account and via the order confirmation.

Order and transaction data are processed to provide the downloads.

5.4 Download logs

Download processes may be logged to protect against misuse and to ensure the proper provision of digital content.

In particular, the following data may be processed:

Order number
Product
Date and time of download
IP address
Browser information

This processing is carried out exclusively to ensure the proper provision of our digital products, for error analysis, fraud prevention and to safeguard our legitimate interests.

5.5 Legal basis for download logs

Processing is based on Art. 6(1)(f) GDPR.

Our legitimate interest lies in protecting our digital content, preventing misuse and ensuring a proper download process.

5.6 Storage period

Order and invoice data are stored in accordance with statutory commercial and tax retention obligations.

Download logs are stored only for as long as necessary to detect misuse, analyse errors or enforce legitimate claims. They are then deleted or anonymised unless statutory retention obligations prevent this.

6. Contact form

6.1 Nature and purpose of processing

If you contact us using the contact form provided on our website, we process the personal data you enter solely to handle your enquiry and any follow-up questions.

Depending on the nature of your enquiry, the following data in particular may be processed:

First and last name
Email address
Telephone number (if provided)
Subject of your enquiry
Message content
Date and time of transmission
IP address (to ensure system security and prevent misuse)

You provide your data voluntarily. However, without the information marked as mandatory, it may not be possible to process your enquiry.

6.2 Legal basis

Processing is carried out pursuant to Art. 6(1)(b) GDPR if your enquiry concerns pre-contractual measures or performance of a contract.

In all other cases, processing is based on our legitimate interest in handling contact enquiries pursuant to Art. 6(1)(f) GDPR or – where you have expressly consented – on your consent pursuant to Art. 6(1)(a) GDPR.

6.3 Recipients of the data

Your enquiry is processed exclusively by the employees responsible for this purpose. Your data will be disclosed to third parties only where this is necessary to process your enquiry or where we are legally obliged to do so.

6.4 Storage period

Data transmitted when you contact us is stored only for as long as necessary to process your enquiry or for as long as statutory retention obligations apply.

After your enquiry has been finally processed, the data will be deleted unless statutory retention obligations or legitimate interests prevent deletion.

7.1 Newsletter subscription

You have the option of subscribing to our newsletter. The newsletter regularly informs you about new MIDI files, new products, special promotions and other offers relating to our range.

For newsletter distribution, we process in particular the following data:

Email address
Date and time of registration
IP address at the time of registration
Date and time of confirmation of registration (double opt-in)
IP address at the time of confirmation

7.2 Double opt-in procedure

Registration for our newsletter uses the double opt-in procedure. After registering, you will receive an email asking you to confirm your registration. Your email address will be added to our newsletter distribution list only after this confirmation.

Logging the registration and confirmation serves to demonstrate your consent in accordance with data protection requirements.

7.3 Mailing service provider

Our newsletter is sent using the Brevo service.

Brevo processes the personal data required to send the newsletter on our behalf. A data processing agreement pursuant to Art. 28 GDPR has been concluded with the service provider.

7.4 Legal basis

Our newsletter is sent exclusively on the basis of your express consent pursuant to Art. 6(1)(a) GDPR.

You may withdraw your consent at any time with effect for the future.

7.5 Unsubscribing from the newsletter

You may unsubscribe from the newsletter at any time using the unsubscribe link in every newsletter email or by contacting us using the contact details provided in the legal notice.

The lawfulness of processing carried out before withdrawal remains unaffected by the withdrawal.

7.6 Storage period

Your data is stored for newsletter distribution for as long as your consent remains valid. After unsubscribing, your data will be deleted unless statutory retention obligations or other legal grounds prevent deletion.

8. Payment processing (PayPal, credit card, Apple Pay and Google Pay)

8.1 Payment processing

For processing payments in our online shop, we offer various payment methods through the payment service provider PayPal.

Depending on the payment method you select, the personal data required for payment processing is transmitted to PayPal. This may include in particular:

First and last name
Billing address
Email address
Order number
Order value
Currency
Payment method
Transaction data

Data is transmitted only to the extent necessary to carry out the selected payment method and perform the purchase contract.

8.2 Legal basis

Processing is carried out for performance of the purchase contract concluded with you pursuant to Art. 6(1)(b) GDPR.

Where PayPal is legally obliged to process certain data, this is carried out on the basis of Art. 6(1)(c) GDPR.

8.3 Payment methods via PayPal

Depending on your selection and availability, PayPal may offer, among others, the following payment methods:

PayPal
Credit and debit card
Apple Pay
Google Pay

The respective payment is processed directly by PayPal or the relevant payment service as part of the payment method you selected.

8.4 Further information

Further information on data processing by PayPal can be found in PayPal's privacy information.

8.5 Storage period

We store data processed in connection with a payment only for as long as necessary for contract processing, compliance with statutory retention obligations or the establishment, exercise or defence of legal claims.

9. Storage period

As a general rule, we process and store personal data only for as long as necessary to fulfil the respective processing purposes or for as long as statutory retention obligations apply.

As soon as the respective purpose of processing no longer applies and no statutory retention obligations or legitimate interests prevent deletion, the personal data will be deleted or anonymised.

In particular, the following retention periods apply:

Order and invoice data are stored in accordance with commercial and tax law retention obligations.
Customer data are stored for as long as a customer account exists or as required for contract processing.
Contact enquiries are deleted after final processing unless statutory retention obligations apply.
Newsletter data are stored until you withdraw your consent or unsubscribe from the newsletter.
Server log files are stored only for the period necessary to ensure secure operation of the website.
Download logs are stored only for as long as necessary to prevent misuse, analyse errors or enforce legitimate claims.

After the respective statutory or contractual retention periods have expired, the relevant data are routinely deleted unless they are still required for performance of a contract or pre-contractual measures.

10. Rights of data subjects

Under the provisions of the General Data Protection Regulation (GDPR), you have the following rights with regard to the processing of your personal data:

10.1 Right of access

You have the right pursuant to Art. 15 GDPR to request information about the personal data we process.

10.2 Right to rectification

You have the right pursuant to Art. 16 GDPR to request the immediate rectification of inaccurate personal data or completion of incomplete personal data.

10.3 Right to erasure

You may request the erasure of your personal data under the conditions of Art. 17 GDPR.

10.4 Right to restriction of processing

Under the conditions of Art. 18 GDPR, you have the right to request restriction of the processing of your personal data.

10.5 Right to data portability

Where the statutory requirements are met, you have the right to receive the personal data you have provided in a structured, commonly used and machine-readable format or to request its transmission to another controller (Art. 20 GDPR).

10.6 Withdrawal of consent

You may withdraw consent you have given at any time with effect for the future. The lawfulness of processing carried out before withdrawal remains unaffected.

10.7 Right to object

Where we process personal data on the basis of legitimate interests pursuant to Art. 6(1)(f) GDPR, you have the right to object to such processing at any time on grounds relating to your particular situation.

10.8 Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data if you believe that it infringes the General Data Protection Regulation.