Privacy

Who is responsible

Under the GDPR there has to be someone who answers for what happens to your data. Here that is one person:

Trading as

TH6

Chamber of Commerce

91772893

E-mail

info@th6gotit.com

A shop this size does not need a data protection officer and does not have one. Mail goes straight to the person who runs it.

What is stored on your device

Three things, kept by your own browser: two settings so the site remembers how you left it, and your cart.

• th6-taal – whether you read the site in English or Dutch. This one only lasts until you close the tab; a new visit starts in English.
• th6-zuinig – whether the lighter version is on, the one that drops the glass and the moving background on slower machines.
• th6-mand: the beats in your cart, with the licence and master you picked, until you pay or empty the cart. To show the right price with any deal, the site sends the cart to its own server, which works out the total and keeps nothing.

None of them is a cookie. The two settings are never sent anywhere; the cart only goes to the site's own server: to work out the price, to count which beat and licence went into a cart, and as your order when you sign and pay. They sit in your browser's local storage, they say nothing about who you are, and clearing your browser data removes them.

If you buy something, one more thing is kept for a moment: th6-bestelling, the number of your order. It lives in that one tab only, so the page you land on after paying can ask Mollie how the payment went. It is removed as soon as the payment has gone through, and otherwise when you close the tab.

Pay by card, and Mollie's card fields add one item of their own to your browser's local storage: ally-supports-cache, a note on what your browser supports, for the accessibility of those fields. It says nothing about you and holds no card details; those go straight to Mollie and never pass through this site.

None of this is a cookie, and each of them is needed for something you asked for. That is why there is no cookie banner: there is nothing to ask permission for. The only cookie on th6gotit.com is for the owner of the shop himself, to log in to his own dashboard; visitors never get it.

What the server records

The site is hosted by Vercel. Like any web server, theirs writes a line for every request: an IP address, the moment, the page asked for, and what browser asked. That is unavoidable – without an address to send the page back to there is no website.

Those lines are not read, not analysed, and not linked to anything. They exist so a server can be kept running and abuse can be blocked. Legally that is a legitimate interest, and it is the narrowest one there is.

Besides that, the site keeps a few counts: how often each beat is played and when it last played, how many visits play at least one beat, and how many pages are viewed per day. When you arrive, it also counts in which ten minutes of the day that was, which page you landed on, the label of the link you followed if it has one (such as a campaign tag, or a discount code in a link from a creator), which site you came from (for example Google or Instagram, only the name of the site), which country the connection is in, and whether it is a phone, tablet or computer. The country is worked out from the connection by our host; your IP address itself is not kept. Only the totals are kept. There is no cookie in this and nothing that says who it was, so a count can never be traced back to you. The totals are stored at Upstash, a database service, and only the owner of the shop sees them.

When you put a beat in your cart, it counts which beat and which licence. For the owner's own app, the site also keeps a short list of what just happened: a beat that went into a cart, a beat that reached a number of plays, and a new visit, each with the beat, the licence, the country of the connection and the site you came from. That list holds nothing that says who you are, keeps at most the last 300 events and nothing older than seven days, sits at Upstash with the counts, and only the owner sees it.

What you send yourself

The contact form and the services brief write an e-mail and open it in your own mail program. So does the licence picker, if you choose to mail instead of pay. Nothing is sent by the site and nothing is stored on the way. You press send, or you do not.

What arrives, arrives as mail, in a mailbox at Soverin in the Netherlands. It holds whatever you chose to write, and it is kept as long as the conversation is worth keeping. The owner can also read that mail in his own app on his phone; on its way there it passes through the site's own server at Vercel, which keeps none of it.

Paying works differently. That is the next section.

What happens when you buy

A purchase is an order, and an order means data: your name, your artist name, your e-mail address, the beat and licence you chose, what you paid and when, and the moment you asked for the download to start right away. Tax law adds two things: the country you live in and the country your connection came from, because together they decide the VAT. Buying for a company adds its name and VAT number. All of it is needed to deliver what you bought, to put the right name on your licence, and to account for the VAT.

That order is stored together with the payment, at Mollie; the signed licence agreement, with your name, IP address and signature, is stored at Upstash. Mollie also sees how you paid. This site never does, and no card number touches this server. If you pay by card, you type your card details on this page into fields from Mollie, which send them straight to Mollie; this site never sees or stores them.

If you choose to pay later or in parts with Klarna, your address also goes to Mollie and Klarna: Klarna needs it to check the payment and to collect it. Only then; nobody else is asked for an address.

After a purchase you get a code for your next order. That code is kept with your order number in the database at Upstash for at most 40 days, so it can be used only once. Nothing else about you is in it.

After a purchase you can also review the beat, on the page behind your download link. What you send is stored at Upstash: the stars, the name you choose to show, your text, the beat and your order number. The order number is how a review is tied to a real purchase, one per beat per order, and it is never shown. Every review is read before it goes online; once placed, the stars, the name you chose, your text and the date appear on the page of the beat. Reviewing is your choice, and your consent is the legal basis.

Before you pay, you sign the licence agreement for each beat. For that the site keeps the lines you drew, the name you typed, the moment you signed, the IP address and browser you signed from, and the agreement itself, at Upstash. If you do not pay, all of it is deleted, at the latest after 24 hours. If you pay, it becomes the signed agreement: the PDF with both signatures and these details goes by mail to you and to me. It is kept to prove what was agreed, for as long as the licence runs. A licence does not expire, so that means as long as the beat is in use, and always at least seven years after the purchase. The legal bases are the agreement itself, the legitimate interest in being able to prove it, and the legal duty to keep records.

If you report your release, the link and the date you give are stored at Upstash with your order number, so the credit and the splits can be checked.

Tax law requires those records to be kept for seven years. That is a legal obligation, not a choice, and it is the one case where a deletion request cannot be honoured in full.

Who else sees any of it

These companies, all because something has to run somewhere: Vercel, who host the site; Soverin, who host the mail you send me; Mollie, who handle the payment; Resend, who send the mail with your download link and your signed agreement; Cloudflare, where the files sit until you fetch them; and Upstash, the database with the anonymous counts, the discount codes (with the order number a code belongs to), the reviews, the signed agreements and the release reports. If you choose Klarna, Klarna also receives your name, address and the order lines, to check and collect the payment.

Mollie and Soverin are Dutch; what sits there stays in the Netherlands. Vercel, Resend, Cloudflare and Upstash are American, so data can be handled outside the EU; their privacy terms cover that transfer. With Resend it concerns your name, your email address and the mail itself, with the signed agreement attached; with Upstash the discount codes, the reviews, the signed agreements, the release reports and the order number that goes with them.

If you buy for a company and give a VAT number, that number is checked with VIES, the register of the European Commission. Nothing else goes with it.

Nobody else. Nothing is sold, nothing is shared with advertisers, and there is no mailing list you end up on by buying something.

How long it is kept

• Server logs – weeks, not years. Vercel clears them on their own schedule.
• Order mail sent – Resend keeps a record of what went out and clears it on their own schedule.
• Mail – as long as the conversation matters. Ask and it goes.
• Orders – seven years, because tax law says so.
• Reviews – as long as the beat is in the shop, or until you ask for yours to be changed or taken down. A review that is not placed is deleted right away.
• Signed agreements and release reports – as long as the licence runs, because they are your proof and mine of what was agreed; a licence does not expire, so that is as long as the beat is in use, and always at least seven years after the purchase. If a licence ends, five more years. A signature for a purchase that was not paid is deleted at once, at the latest after 24 hours.
• Browser settings – until you clear your own browser. They were never mine to keep.

Your rights

You can ask what is held about you, have it corrected, have it deleted, have its use limited, object to it being held at all, or ask for a copy to take elsewhere. One mail is enough and there is no form.

You get an answer within a month. In practice it is the same week, because there is not much to look through.

Complaining

If you think something is being handled wrongly, say so first – it is faster and it usually turns out to be a misunderstanding. You also have the right to go straight to the Dutch data protection authority, the Autoriteit Persoonsgegevens, and complain there. That right does not depend on asking me first.

Changes to this page

When the site starts doing something new with your data, this page changes with it. The date at the top always says when it was last touched.