Soundwax — Privacy Policy

1. Controller Identity

Soundwax, a sole proprietorship (eenmanszaak) registered in the Netherlands under KvK number 87865955 (hereafter "Soundwax"), is the data controller for personal data processed in connection with the Service within the meaning of Article 4(7) GDPR.

Where required by applicable law, Soundwax has appointed a Data Protection Contact reachable at info@soundwax.com.

2. Data We Collect

Category	Data elements	Source
Account data	Email address, hashed & salted password	Provided by you
Billing data	Billing name, address, VAT ID (if provided), payment token	Provided by you / payment processor
Technical data	IP address, browser type & version, device type, operating system	Collected automatically
Usage data	Pages visited, features used, search queries within the Service, session duration	Collected automatically
Audio preview data	Low-fidelity, highly compressed 30-second audio excerpts derived from publicly available sources, stored solely to power in-platform music discovery. No full-length audio is stored.	Derived from public sources by Soundwax
Communications	Content of support requests or correspondence you send us	Provided by you

Soundwax does not collect or process sensitive data as defined in Article 9 GDPR. We do not use audio previews accessed through the Service to derive personal data about users.

3. Purposes and Legal Bases

Purpose	Legal basis (GDPR Art. 6)
Create and manage your account	Art. 6(1)(b) — performance of contract
Process payments and issue invoices	Art. 6(1)(b) — performance of contract; Art. 6(1)(c) — legal obligation (tax/VAT)
Provide and maintain the Service	Art. 6(1)(b) — performance of contract
Improve the Service and analyse usage	Art. 6(1)(f) — legitimate interests (product development)
Prevent fraud, abuse, and security incidents	Art. 6(1)(f) — legitimate interests (security)
Comply with legal obligations (e.g. tax records)	Art. 6(1)(c) — legal obligation
Analytics cookies (where opted in)	Art. 6(1)(a) — consent
Respond to rights requests and complaints	Art. 6(1)(c) and (f)

Where we rely on legitimate interests, we have conducted a balancing test and concluded that our interests do not override your rights and freedoms. You may request a copy of that assessment by contacting us.

4. Data Processors (Article 28 GDPR)

We engage the following categories of sub-processors who process personal data solely on our documented instructions under Data Processing Agreements (DPAs) meeting the requirements of Article 28 GDPR. All processors are subject to confidentiality obligations and appropriate technical and organisational security measures.

Cloud hosting provider: stores account and usage data on infrastructure located in the EU/EEA.
Payment processor: processes billing data to complete subscription transactions. We do not store full card numbers — payment data is tokenised.
Analytics provider: processes usage data to generate aggregated statistics. Only activated where you have consented to analytics cookies.
Transactional email provider: delivers account-related emails (e.g. password reset, invoices).

A current list of sub-processors is available upon request. We will notify you of any intended additions or replacements with reasonable advance notice.

5. International Transfers

We endeavour to process personal data within the EEA. Where a processor is established or processes data outside the EEA, we ensure that appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs) adopted by the European Commission;
An adequacy decision by the European Commission; or
Binding Corporate Rules where applicable.

You may request details of the applicable safeguards for any specific transfer by contacting us.

6. Retention Periods

Data category	Retention period
Account data	Duration of your account, plus 30 days following deletion request (to allow recovery), then securely deleted
Billing records	7 years from the transaction date (Dutch tax law obligation)
Technical & usage logs	90 days (rolling), then aggregated or deleted
Support communications	2 years from last interaction
Consent records	3 years from withdrawal or account deletion

7. Your Rights

As a data subject under GDPR, you have the following rights. All requests should be addressed to info@soundwax.com. We will respond within one calendar month (extendable by two further months for complex requests with prior notice).

Right of access (Art. 15): obtain a copy of personal data we hold about you.
Right to rectification (Art. 16): correct inaccurate or incomplete data.
Right to erasure (Art. 17): request deletion of your data where no overriding legitimate purpose or legal obligation applies.
Right to restriction (Art. 18): restrict processing in specified circumstances.
Right to data portability (Art. 20): receive your account data in a structured, machine-readable format.
Right to object (Art. 21): object to processing based on legitimate interests (Art. 6(1)(f)), including for direct marketing.
Right to withdraw consent (Art. 7(3)): withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.
Right to lodge a complaint: you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority in your EU Member State of habitual residence.

We will not discriminate against you for exercising your rights.

8. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, or alteration, including:

encryption of data in transit (TLS 1.2+) and at rest;
hashing of passwords using a modern adaptive algorithm (e.g. bcrypt or Argon2);
access controls and least-privilege principles for staff;
regular security testing and monitoring.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours (Art. 33 GDPR) and inform you without undue delay (Art. 34 GDPR) where required.

9. Account Deletion

You may request deletion of your account at any time via your account settings or by emailing info@soundwax.com. Upon deletion, personal data will be erased or anonymised within 30 days, subject to our legal obligations to retain certain data (see Section 6).

10. Changes to this Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you by email or via a prominent notice in the Service at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the current version.