Privacy policy
BTS Music Box · Last updated: 9 November 2026
1. Data controller
- Controller: BTS Music Box
- Contact: army@musicboxbts.com
2. What data we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Handling your order, shipping and invoicing | Name, address, email, phone, payment data | Performance of a contract (Art. 6(1)(b) GDPR) | 6 years (tax and commercial obligations) |
| Reminding you once about a cart you didn't finish | Email and the items in your cart | Legitimate interest (Art. 6(1)(f) GDPR); you can object by emailing us | 30 days |
| Answering your questions | Name, email, phone, message content | Consent / legitimate interest (Art. 6(1)(a) and (f)) | 1 year from the last contact |
| Sending you marketing communications | Name, email | Consent (Art. 6(1)(a)) or legitimate interest if you are already a customer (Art. 21 of the Spanish Information Society Services Act, LSSI) | Until you unsubscribe |
| Measuring and personalising advertising | Device identifiers, browsing, purchase events | Consent (cookies) | Depending on each provider (see the cookie policy) |
| Handling returns and guarantee claims | Order data and bank details for the refund | Performance of a contract and legal obligation | 3 years (guarantee period) + 6 years for tax purposes |
We do not process health data. We do not ask for or store information about medical conditions, diagnoses or treatments. If you choose to write to us about your health, we will use that message only to reply to you and will delete it afterwards.
3. Payment data
Your card details never pass through our servers and we do not store them. They are processed directly by Stripe, a payment institution certified under the PCI-DSS standard.
4. Recipients
We only share data with providers acting as data processors, under a signed agreement in line with Art. 28 GDPR:
| Provider | Role | Location |
|---|---|---|
| Stripe | Payment processing | EU / US |
| Supabase | Database and hosting | EU |
| Brevo | Transactional and marketing emails | EU (France) |
| Meta Platforms | Advertising measurement and remarketing | US |
| Web analytics | US | |
| Shipping carrier | Delivering your order | EU and the destination country |
We also disclose data to the tax authorities and other public bodies when required by law.
5. International transfers
Some providers are located outside the European Economic Area. These transfers are covered by the EU-US Data Privacy Framework or, where it does not apply, by the Standard Contractual Clauses approved by the European Commission, together with supplementary security measures.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and your right not to be subject to automated decisions, at any time by writing to army@musicboxbts.com and stating which right you are exercising. We will reply within one month at the latest.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos) (www.aepd.es · C/ Jorge Juan 6, 28001 Madrid, Spain).
7. Minors
Our products and this website are intended exclusively for people aged 18 or over. We do not knowingly collect data from minors.
8. Security
We apply appropriate technical and organisational measures (encryption in transit with TLS, access control and activity logging) to protect your data against unauthorised access, loss or alteration.
9. Changes
We may update this policy to reflect changes in the law or in our services. The current version will always be published on this page, with its update date.
Last updated: 13 September 2026