PRIVACY INFORMATION

The controller is MICHAIL SPANOS, operating as BlackBox Records, at ΠΑΝΟΥΡΓΙΑ 1, ΑΘΗΝΑ, 10443, GR. Contact orders@blackboxrecordsathens.com about personal data.

Email orders@blackboxrecordsathens.com for a question or request about personal data used by BlackBox Records. Include enough information to identify the relevant order, inquiry or email subscription. Please do not send full payment-card details or identity documents unless we explain why a proportionate verification step is needed.

When you start checkout, the website sends the selected items and quantities to our backend. Stripe collects payment, email and shipping/contact information. We use the order, payment reference and contact details to process payment, fulfil the purchase, send order information, handle returns and answer support requests. Processing needed to enter into and perform your purchase uses the contract basis; records required by applicable accounting or tax law use the legal-obligation basis.

A service inquiry contains your name, email, message and any project or service details you choose to give us. We use it to answer the inquiry and discuss the work you request, including steps you ask us to take before a contract. Please do not include sensitive information that we do not need.

Newsletter signup is optional and requires an unticked consent choice. We record your email and the consent context to send the release, distro and event updates you request. Buying or sending an inquiry does not subscribe you. A Notify me request uses its own one-off consent, stores your email with the selected item and sends an availability email; it does not create a newsletter subscription.

The site and hosting services process technical request information to deliver pages, investigate failures and protect the service. Necessary security and abuse-prevention processing serves our legitimate interest in protecting a reliable and secure service. Optional visit-statistics analytics is disabled.

The payment and contact/delivery details requested for an order are needed to complete payment and arrange delivery; without the necessary details we cannot complete the purchase. Newsletter and one-off availability signup are optional and are not a condition of buying. You choose whether to send a service inquiry and which optional project details to include.

If you use the online withdrawal function, we record the name, contract or order description, contact email and declaration you submit, together with the submission time. We use this information to acknowledge and handle your withdrawal, perform the related contract handling and meet applicable consumer-rights and legal obligations. The function also records a hashed technical requester identifier to limit repeated submissions. It does not collect payment-card details.

Stripe processes payment information and also acts as a controller for its own fraud prevention, legal and payment-network responsibilities. Cloudflare processes hosted website/backend data on our behalf. Resend processes order, inquiry and requested newsletter email on our behalf; a one-off availability email uses Resend's email service without adding the address to a newsletter contact list.

We provide BOX NOW with the details necessary for the manually arranged locker shipment. Authorised BlackBox operators use the information needed to fulfil orders and handle support. Accounting or tax information may also need to be disclosed where the law requires it.

When an embedded player or video loads, services such as Bandcamp, Tidal or YouTube receive the technical information needed to load that content and apply their own privacy rules. Links to another service take you to that service. The site's fonts are served by BlackBox rather than fetched from Google Fonts.

Resend's primary processing operations are in the United States. Its Data Processing Addendum incorporates the EU standard contractual clauses for transfers from an EEA controller to Resend as processor. You can read those safeguards at https://resend.com/legal/dpa or contact us for a copy relevant to your data. This is separate from the transfer arrangements for our other service providers.

Cloudflare and Stripe publish information about their processing and international transfers in their privacy and data-processing terms: https://www.cloudflare.com/privacypolicy/, https://www.cloudflare.com/cloudflare-customer-dpa/, https://stripe.com/privacy and https://stripe.com/legal/dpa. The service and processing purpose determine the applicable arrangements. Contact orders@blackboxrecordsathens.com for information about a provider involved with your data; we do not promise that all provider processing stays within Greece or the European Economic Area.

Your cart is kept in this browser's local storage so it can survive a page reload. Removing all cart items clears the cart's storage keys. You can also clear this website's data in your browser. Cart storage itself does not reserve stock or contain your payment-card details.

The backend deletes a one-off availability request after successful sending, after its final failed delivery attempt, or 12 months after the request, whichever happens first. This rule applies to the request in our backend; it is not a promise that an email provider's separate delivery records are deleted at the same time.

Order, payment, withdrawal, return and support records are kept to handle the transaction, support work and unresolved claims, and to meet applicable record-keeping duties. Inquiry correspondence is used for the requested discussion or work and any resulting record obligations. Newsletter sending stops when you withdraw consent; limited consent or suppression evidence may be needed to honour that choice. Technical logs are used to diagnose failures and protect the service. We do not promise a fixed automatic deletion date for these records. You can contact us about a record or ask for deletion; we assess the request against the purpose, outstanding work and applicable obligations.

You can ask for access to your personal data or correction of inaccurate information. Where the applicable conditions are met, you can request erasure, restriction or portability and object to processing based on legitimate interests. These rights have legal conditions; a request does not require us to erase records that must still be kept under law.

You can withdraw newsletter or one-off notification consent by emailing orders@blackboxrecordsathens.com. Withdrawal does not affect the lawfulness of earlier processing or stop necessary order messages. Tell us which email address and request you mean so we can identify it. We may need proportionate information to verify a data request.

We respond to a data-rights request without undue delay and normally within one month of receiving it. If its complexity or the number of requests requires up to two additional months, we explain the extension and its reasons within the first month. Requests are normally free of charge, subject to the exceptions permitted by data-protection law.

You can complain to the Hellenic Data Protection Authority at www.dpa.gr or another competent supervisory authority. The Hellenic authority explains its complaint process at https://www.dpa.gr/en/individuals/complaint-to-the-hellenic-dpa.