Privacy Policy

1. Who we are

Vinyl Vault Compact Disc Co. ("Vinyl Vault", "we", "us") is the data controller responsible for your personal data. We are a retailer of physical compact discs, registered as [Your Legal Entity Name] at [Your Registered Address], company registration number [Company Registration Number].

If you have any questions about this policy or how we handle your data, email privacy@musiccdshop.com.cn.

2. What we collect

Data you give us directly

Data we collect automatically

• Device and usage data — IP address, browser type, operating system, pages viewed, time on page, and referring URL.
• Cookie data — session identifiers, cart contents, and analytics identifiers. See section 4.
• Location data — approximate country and region inferred from your IP address, used to display the correct currency and tax treatment. We do not collect precise GPS location.

What we do not collect

We do not collect your full payment card number, CVV, or bank credentials. We do not buy personal data from third-party data brokers. We do not collect biometric data.

3. Why we collect it, and our legal basis

Under the UK GDPR and EU GDPR we must have a lawful basis for each use of your data. Here is ours:

4. Cookies and tracking

A cookie is a small text file stored in your browser. We use four categories:

Managing cookies

You can change or withdraw your cookie consent at any time using the Cookie preferences link in the footer of every page. You can also block or delete cookies through your browser settings — see aboutcookies.org. Blocking strictly necessary cookies will prevent checkout from working.

Do Not Track and Global Privacy Control

We honour the Global Privacy Control (GPC) signal. If your browser sends GPC, we treat it as a valid opt-out of the sale or sharing of your personal data.

5. Who we share your data with

We never sell your personal data. We share it only with the service providers who help us run the shop, and only to the extent they need it:

We may also disclose data where we are legally required to — for example in response to a valid court order or tax authority request.

International transfers

Some of our providers are based in the United States. Where we transfer personal data outside the UK or EEA, we rely on the UK International Data Transfer Addendum or the EU–US Data Privacy Framework, together with standard contractual clauses, to ensure your data receives an equivalent level of protection.

6. How long we keep it

7. Your rights

Depending on where you live, you have some or all of the following rights. We respond to all requests within 30 days, free of charge.

If you are in the UK or EEA (GDPR)

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data.
• Right to erasure — ask us to delete your data, subject to our legal record-keeping obligations.
• Right to restrict processing — ask us to pause processing while a dispute is resolved.
• Right to data portability — receive your data in a machine-readable format (JSON or CSV).
• Right to object — object to processing based on legitimate interests, including profiling.
• Right to withdraw consent — withdraw cookie or marketing consent at any time.
• Right to lodge a complaint — with your national data protection authority. In the UK this is the Information Commissioner's Office.

If you are in California (CCPA / CPRA)

• Right to know — what categories of personal information we collect and why.
• Right to delete — request deletion of personal information we collected from you.
• Right to correct — request correction of inaccurate personal information.
• Right to opt out of sale or sharing — we do not sell personal information. You may opt out of sharing for cross-context behavioural advertising via the Cookie preferences link.
• Right to non-discrimination — we will not charge you more or give you worse service for exercising your rights.

8. How we protect your data

• All traffic to and from this site is encrypted using TLS 1.3 (HTTPS).
• Payment card data is tokenised by Stripe and never stored on our servers.
• Access to customer data is limited to staff who need it to fulfil orders, protected by two-factor authentication.
• Passwords are hashed with bcrypt. We cannot read them, and neither can an attacker who obtains the database.
• We take encrypted backups daily and test restoration quarterly.

No system is perfectly secure. If a data breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours of becoming aware of it, as GDPR requires.

9. Children

This shop is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, contact us and we will delete it promptly.

10. Changes to this policy

We may update this policy to reflect changes in our practices or in the law. The "Last updated" date at the top of this page always reflects the current version. If we make a material change that affects how we use your data, we will notify you by email (if you have an account or an active order) at least 14 days before it takes effect.

11. Contact us

For any privacy question, request, or complaint: