Privacy Policy

Last updated: 28 September 2026

This privacy policy explains how personal data is collected and used when you visit www.spotsound.co.uk, create an account, place an order or contact us, and what rights you have over your data. It is provided in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (Loi Informatique et Libertés).

1. Who is responsible for your data

The data controller is:

BLUECHOU EI, publisher of www.spotsound.co.uk
113 avenue de Saint-Ouen, 75017 Paris, France
SIRET: 510 397 623 00032 – EU VAT number: FR60510397623
Privacy contact: [email protected]

2. What data we collect

  • Customer account: title, first and last name, email address, password (stored encrypted), date of birth if you choose to give it, company name and VAT number for business customers.
  • Orders and delivery: billing and delivery addresses, telephone number, ordered products and customisation options, order history, invoices, returns.
  • Payment: payments are processed directly by our payment providers. We never receive or store your full card number; we only keep the transaction reference, amount and status.
  • Customer service: messages sent through the contact form, live chat, email or quote requests, and any files you attach.
  • Newsletter: your email address and your subscription status if you subscribe.
  • Customer reviews: the review, rating and name or pseudonym you publish.
  • Affiliate programme: if you join it, your identification and payment details for commissions.
  • Technical data: IP address, browser and device type, pages viewed, approximate country (used to display the right language and currency), and data from cookies and similar technologies (see section 8).

Fields marked as required in our forms are necessary to process your request or order; without them we cannot serve you.

3. Why we use your data and on what legal basis

  • Managing your account, orders, payment, delivery, returns and after-sales service – performance of the contract (Art. 6(1)(b) GDPR).
  • Invoicing, accounting and tax obligations – legal obligation (Art. 6(1)(c) GDPR).
  • Answering your questions and quote requests – pre-contractual measures or our legitimate interest in answering you.
  • Fraud prevention and website security (including spam protection of forms) – our legitimate interest in protecting our customers and our business.
  • Newsletter and promotional emails – your consent, which you can withdraw at any time via the unsubscribe link.
  • Audience measurement and improvement of the website, and measurement of our advertising campaigns – our legitimate interest or your consent where the law requires it.
  • TikTok features (see section 5) – your consent, given when you authorise the connection on TikTok.

4. Who receives your data

Your data is only accessible to our team and to the service providers we need to run the shop, who act on our instructions and are bound by confidentiality and security obligations. We do not sell your personal data.

  • Payment: Revolut, Stripe and our bank for bank transfers.
  • Delivery: the carrier you choose (for example Chronopost, FedEx, UPS, USPS, Canada Post), which receives your name, delivery address, telephone number and email for delivery tracking.
  • Hosting and security: Namecheap, Inc. (web hosting, United States) and Cloudflare, Inc. (content delivery network and protection against attacks).
  • Customer service: tawk.to (live chat).
  • Audience measurement and advertising: Google (Google Tag Manager, Google Analytics, Google reCAPTCHA) and Meta Platforms (Meta Pixel).
  • Management tools: IT tools used by our team to process orders and customer service, including artificial intelligence services.
  • Authorities: courts, police or tax authorities, when required by law.

5. TikTok integration

We use TikTok Login Kit and the TikTok Content Posting API so that users can connect their TikTok account and send videos to it.

  • Data received with your authorisation (scope user.info.basic): your TikTok open_id (a unique identifier specific to our application), your display name and your avatar.
  • Video upload (scope video.upload): only when you explicitly request it, we send videos to your TikTok account as drafts. Nothing is published automatically: you can edit and publish them yourself from the TikTok app.
  • Use: this data is used only to provide these features (identifying your connected account and sending the videos you request). It is not sold, not shared with third parties other than TikTok, and not used for advertising or profiling.
  • Retention: the access tokens and the TikTok data above are kept for as long as your TikTok account remains connected, then deleted within 90 days after you disconnect it, revoke the access or ask us to delete them. Videos are not kept by us for TikTok purposes after they have been sent.
  • Revoking access: you can revoke our access at any time in the TikTok app: Settings and privacy → Security → Manage app permissions, then remove our application.
  • Deletion request: you can ask us to delete your TikTok data at any time by writing to [email protected].
  • TikTok's own processing of your data is governed by the TikTok Privacy Policy.

6. How long we keep your data

  • Customer account: until you delete it, and at the latest 3 years after your last activity.
  • Orders and invoices: 10 years, to meet our accounting and tax obligations.
  • Customer service messages and quote requests: 3 years after our last exchange.
  • Newsletter: until you unsubscribe, and at the latest 3 years after your last contact with us.
  • Customer reviews: as long as the review is published, unless you ask us to delete it.
  • Technical logs: 12 months.
  • Cookies: 13 months at most.
  • TikTok data and tokens: as long as your account is connected, then deleted within 90 days (see section 5).

At the end of these periods, the data is deleted or irreversibly anonymised.

7. Transfers outside the European Union

Some of our providers (in particular Namecheap, Cloudflare, Google, Meta, tawk.to and some carriers) are located in or process data in countries outside the European Economic Area, notably the United States. These transfers are protected by an adequacy decision of the European Commission (such as the EU-US Data Privacy Framework for certified companies) or, failing that, by the European Commission's Standard Contractual Clauses. You can obtain a copy of these safeguards by contacting us.

8. Cookies and similar technologies

Cookies are small files stored on your device when you visit the website. We use:

  • Essential cookies: needed for the website to work (shopping cart, login, language and currency, security). They cannot be disabled on our side.
  • Preference and service cookies: for example to remember your choices or to provide the live chat.
  • Audience measurement and advertising cookies: set by Google (Google Tag Manager, Google Analytics) and Meta (Meta Pixel) to measure traffic and the performance of our advertising, and by Google reCAPTCHA to protect our forms against spam.

How to manage cookies: you can accept, block or delete cookies at any time in your browser settings (for example Chrome, Firefox, Safari or Edge: Settings → Privacy → Cookies). You can also block third-party cookies only. Blocking essential cookies may prevent some features, such as the shopping cart, from working. Cookies are kept for 13 months at most.

9. Your rights

Under the GDPR, you have the right to:

  • access your data and obtain a copy of it;
  • have inaccurate or incomplete data corrected;
  • have your data erased, where the law allows it;
  • restrict the processing of your data;
  • object to processing based on our legitimate interest, and object at any time to direct marketing;
  • receive your data in a structured, commonly used format (data portability);
  • withdraw your consent at any time, without affecting processing already carried out;
  • give instructions on what should happen to your data after your death.

To exercise your rights, write to [email protected] or to the postal address in section 1. If you have an account, you can also view and change most of your data in My account. We answer within one month, and may ask you for proof of identity if we have a reasonable doubt.

10. Security

We take appropriate technical and organisational measures to protect your data: encrypted HTTPS connection, encrypted passwords, payments handled by certified providers (PCI-DSS), restricted access to data, regular backups and protection against attacks. No system is completely secure; if a data breach is likely to put your rights at risk, we will inform you and the competent authority as required by law.

11. Children

Our website is intended for adults. We do not knowingly collect data from children under 15 without the consent of a parent or guardian. If you believe a child has sent us personal data, contact us and we will delete it.

12. Complaints and supervisory authority

If you believe your rights have not been respected, you can contact us first at [email protected]. You also have the right to lodge a complaint with the French data protection authority, the CNIL (Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 – www.cnil.fr), or with the supervisory authority of the EU country where you live.

13. Changes to this policy

We may update this policy to reflect changes in our services or in the law. The date of the last update is shown at the top of this page. In the event of a significant change, we will inform you by a notice on the website or by email.