Privacy policy

1. Controller and contact

The controller for personal data processed through this storefront, accounts, digital delivery, support and marketing is:

Quantum Qube Mateusz Wójt-Mossakowskiul. 1 Maja 10, 96-100 Skierniewice, PolandNIP: 8361820177VAT-UE: PL8361820177Email: support@elmagicobeats.com

For privacy requests, email support@elmagicobeats.com. Stripe/Link may act as a separate controller for payment, merchant-of-record, fraud-prevention and buyer services, under its own privacy notice.

2. Information, purposes and legal bases

• Orders and delivery: email address, order identifier, products, purchase status, amount, currency, country and payment references received from Link; to fulfill downloads, maintain entitlements and provide order support (GDPR Article 6(1)(b), performance of a contract, and where applicable Article 6(1)(f), legitimate interests in administering purchases).
• Accounting and compliance: transaction and settlement information necessary for tax, bookkeeping and legal obligations (Article 6(1)(c)).
• Optional accounts: name if provided, email, authentication identifiers, session data and purchase library information to operate an account (Article 6(1)(b)). Our authentication provider processes sign-in information on our behalf or under its own terms as applicable.
• Downloads and security: download identifier, timestamp, requested file and relevant technical information such as IP-derived approximate location, to deliver files, prevent unauthorized distribution and investigate abuse (Article 6(1)(b) where necessary for delivery; otherwise Article 6(1)(f), our legitimate interest in securing our services and licensed content).
• Customer support: messages, contact details and relevant order history to respond to requests and complaints (Article 6(1)(b), Article 6(1)(c) where legally required, or Article 6(1)(f) for general inquiries).
• Reviews: review text, rating, order-verification status and public display name, to publish and moderate genuine reviews (Article 6(1)(f), our legitimate interest in providing reliable customer feedback). Do not include sensitive information in reviews.
• Newsletter: email address, consent timestamp and signup source, to send optional marketing messages (Article 6(1)(a), consent). You may withdraw consent at any time through an unsubscribe link or by contacting us. Withdrawal does not affect earlier lawful processing.
• Technical operation and diagnostics: limited request, device, browser, error and security-event data needed to operate and protect the website (Article 6(1)(f), our legitimate interests in reliability, abuse prevention and service security).

Information necessary to complete an order, deliver purchased files, or maintain an account must be provided for those services to work. Account registration and newsletter subscription are optional. We obtain some order information from Link following a purchase and some technical data automatically when you use the website.

3. Payment information and merchant of record

Payment credentials are entered into Link/Stripe's checkout, not our own card-collection forms. We receive order and payment-status information necessary to fulfill purchases and assist customers, but not full payment card numbers. Link processes transaction information according to its own terms and privacy disclosures.

4. Service providers and recipients

• Stripe / Link: merchant-of-record checkout, payment, transaction taxes, billing documents, fraud prevention and buyer support.
• Clerk: authentication and account management.
• Convex: application data storage and backend services.
• Cloudflare: hosting, content delivery, file storage, security, Turnstile and privacy-oriented analytics.
• Resend: purchase, account and opted-in newsletter emails.
• Sentry: technical error monitoring and diagnostics.
• Google (YouTube): product videos are embedded through youtube-nocookie.com and load only after you click play; until then, video thumbnails are served from our own domain.
• Professional advisers and authorities: where necessary for accounting, legal claims or compliance with law.

These recipients act as processors, independent controllers, or both depending on the particular service and processing activity. We disclose only information reasonably needed for their functions.

5. Cookies and similar technologies

We use essential cookies or local storage where necessary for authentication, shopping cart functionality, security and currency preferences. We use Cloudflare Web Analytics for aggregate, cookieless website statistics. Even cookieless services may process limited technical data such as network information. We do not intentionally use advertising or cross-site behavioral tracking cookies. If we introduce optional analytics or marketing technologies that require consent, we will obtain that consent before enabling them.

6. International transfers

Some service providers or subprocessors may access or process information outside the European Economic Area. Where a transfer requires a GDPR Chapter V safeguard, we rely on an applicable adequacy decision (including the EU–US Data Privacy Framework for appropriately certified recipients) or appropriate safeguards such as the European Commission's Standard Contractual Clauses, together with supplementary measures where required. Contact us for information about safeguards relevant to your data.

7. Retention

• Tax and accounting records: for the period required by applicable Polish tax and accounting laws, generally calculated by reference to the relevant statutory limitation periods.
• Account information: while your account is active, then deleted or minimized within a reasonable administrative period, except for records we must retain for legal obligations, claims or purchase entitlement verification.
• Order and entitlement records: while necessary to provide access to purchases, restore downloads, comply with law or handle claims.
• Newsletter information: until consent is withdrawn; minimal suppression or consent evidence may be retained where necessary to honor opt-outs and establish compliance.
• Download and security logs: up to two years where justified for fraud prevention and security investigations, unless a shorter period is sufficient or longer retention is required for a specific incident or claim.
• Reviews: while published or needed to administer disputes, subject to valid erasure or objection requests and applicable exceptions.
• Support correspondence: for the period necessary to resolve the request and defend or pursue legal claims.

8. Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it at any time. We normally respond within one month, subject to permitted extensions. You may complain to a supervisory authority, including the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) in Poland.

9. Automated decisions

We do not use your storefront data to make decisions based solely on automated processing that produce legal or similarly significant effects within the meaning of GDPR Article 22. Link or other independent controllers may conduct their own payment-risk assessments under their notices.

10. Changes

We may update this policy to reflect changes in our services, providers or legal requirements. The current version is published here, with the date of its latest revision.