Privacy Policy

This Privacy Policy explains how Muse Disc collects, uses, and protects your personal data when you visit musedisc.com or place an order with us. We comply with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.

1. Data Controller

The data controller for this website is Muse Disc, reachable at m@musedisc.com for any data-related request.

2. Data We Collect

We collect the following categories of personal data:

Identification data: first and last name, email address, phone number (optional)
Shipping & billing data: shipping address, billing address, country
Payment data: processed by Shopify Payments and Stripe; we never store full card numbers on our servers
Order data: order history, products purchased, order amounts
Browsing data: IP address, browser type, device, pages visited, time spent (via Shopify Analytics)
Marketing data: email address if you subscribe to our newsletter

3. Purpose of Data Collection

Your data is collected and used for the following purposes:

Processing and fulfilling your orders (legal basis: contract performance)
Customer service and communication about your order (legal basis: contract performance)
Sending marketing emails about new drops, only if you opt in (legal basis: consent)
Preventing fraud and abuse (legal basis: legitimate interest)
Improving the Site and user experience (legal basis: legitimate interest)
Complying with legal obligations such as accounting and tax reporting (legal basis: legal obligation)

4. Data Retention

Your data is retained for the following periods:

Order data: 10 years (French accounting requirement)
Customer account data: until account deletion request or 3 years of inactivity
Marketing data: until unsubscribe request or 3 years of inactivity
Browsing data: 13 months maximum (CNIL recommendation)

5. Data Sharing

Your data may be shared with the following trusted third parties, strictly for the purposes listed above:

Shopify Inc. — e-commerce platform and hosting (Canada / Ireland)
Shopify Payments / Stripe — secure payment processing
Shipping carriers — to deliver your order
Email service providers — for transactional and marketing emails (only if you've opted in)

We do not sell or rent your personal data to any third party.

6. International Data Transfers

Some of our service providers (such as Shopify) are based outside the European Union. When data is transferred outside the EU, we ensure adequate protection through standard contractual clauses or equivalent safeguards as required by GDPR.

7. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

Right to access — request a copy of the data we hold about you
Right to rectification — correct any inaccurate or outdated data
Right to erasure ("right to be forgotten") — request deletion of your data, subject to legal retention obligations
Right to restriction — limit how we process your data
Right to portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interest or for marketing purposes
Right to withdraw consent at any time, where processing is based on consent
Right to lodge a complaint with the French data protection authority (CNIL): www.cnil.fr

To exercise any of these rights, email m@musedisc.com. We will respond within 30 days.

8. Cookies

The Site uses cookies and similar technologies to ensure proper functioning, analyze traffic, and personalize your experience. Cookies are categorized as:

Essential cookies — required for the Site to function (cart, checkout, login). Cannot be disabled.
Analytics cookies — help us understand how visitors use the Site (Shopify Analytics)
Marketing cookies — used to deliver relevant advertising and measure campaign performance

You can manage your cookie preferences via the cookie banner displayed on your first visit, or through your browser settings.

9. Security

We implement reasonable technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Data is transmitted over secure HTTPS connections, and payment processing is handled by PCI-DSS compliant providers.

10. Children

The Site is not intended for children under the age of 16. We do not knowingly collect data from minors without parental consent.

11. Updates to This Policy

We may update this Privacy Policy from time to time. Changes will be reflected on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

12. Contact

For any privacy-related question or to exercise your rights, contact us at m@musedisc.com.