1. Who This Policy Covers
1.1 This Privacy Policy applies to personal data processed through the TrackSet website, campaign pages, TrackSet-operated shop, customer support, newsletters, artist submission process, release administration and related business communications.
1.2 It covers website visitors, account holders, fans, Backers, buyers, newsletter subscribers, artists, artist representatives, label contacts, suppliers and other people who communicate or do business with TrackSet.
1.3 It should be read with the Fan & Buyer Terms, Shipping, Refund & Claims Policy and Cookie Policy. Artist agreements or submission forms may provide additional information for a specific processing activity.
2. Controller and Privacy Contact
2.1 Erkan Blattner, Ditta Individuale, trading as “TrackSet”, is the controller for the processing described in this Policy unless a specific notice identifies another controller or a joint-controller arrangement.
2.2 Questions and data-protection requests should be sent to privacy@trackset.studio. If TrackSet appoints a Data Protection Officer or EU representative in the future, the applicable contact details will be published here.
3. Personal Data We Collect
| CATEGORY | EXAMPLES |
|---|---|
| Identity and contact | Name, username, email, telephone, billing and delivery address, country, language |
| Account and authentication | Account ID, login records, password hash, verification and account preferences where accounts are offered |
| Campaign and order | Backings, products, quantities, campaign participation, order status, returns, refunds and purchase history |
| Payment and transaction | Payment method type, transaction ID, authorisation status, fraud signals and limited billing details received from the payment provider |
| Delivery and fulfilment | Recipient, address, carrier, tracking, customs information, delivery status and returned-parcel records |
| Communications and claims | Messages, support history, complaints, withdrawal requests, photographs, videos and evidence submitted for a claim |
| Artist and professional | Artist or company name, representatives, biography, photographs, social links, credits, metadata, rights information and contract contacts |
| Technical and usage | IP address, device, browser, timestamps, logs, security events, referring pages and interactions with the website |
| Marketing and preferences | Newsletter status, artist-follow choices, consent records, campaign interests and communication engagement where lawfully measured |
4. Payment Information
4.1 Payment services are provided through the provider identified at checkout. Full card or bank credentials should be entered directly into the provider’s secure interface. TrackSet normally receives only the transaction reference, status, method type and information required for accounting, fraud prevention and support.
4.2 A payment provider may process certain data as an independent controller under its own privacy notice as well as acting as TrackSet’s processor for specified services. The exact provider and role must be shown at checkout and in the provider schedule before launch.
5. Sources of Personal Data
5.1 TrackSet receives data directly from the person concerned, from devices and browsers, and from service providers involved in payments, hosting, security, analytics, delivery, fulfilment, email and customer support.
5.2 For artist discovery, curation and due diligence, TrackSet may use professional information made public by the artist or representative, such as release history, public profiles, websites, social metrics and contact information. TrackSet will provide the required information when contacting a person whose data was obtained indirectly, unless a lawful exception applies.
6. Special-Category Data and Children
6.1 TrackSet does not intentionally request health, biometric, political, religious, sexual-orientation or other special-category data. People should not include such information in free-text messages or claim evidence unless it is necessary and legally justified.
6.2 TrackSet services are not intentionally directed at children below the applicable digital-consent age. A minor may place an order only with the involvement of a parent or guardian where required. If TrackSet learns that personal data was collected unlawfully from a child, it will take appropriate steps to delete it.
7. Why We Use Personal Data and Our Legal Bases
| PURPOSE | DATA GENERALLY USED | LEGAL BASIS |
|---|---|---|
| Operate and secure the website | Technical, usage, account and security data | Legitimate interests; legal obligation where applicable |
| Create and manage accounts | Identity, contact, authentication and preferences | Contract or steps requested before contract; legitimate interests |
| Run campaigns and process Backings | Identity, campaign, order, transaction and communication data | Contract or requested pre-contract steps |
| Take payment and prevent fraud | Transaction, device, account and risk data | Contract; legal obligation; legitimate interests |
| Manufacture, deliver and support orders | Order, delivery, contact, claims and communications | Contract; legal obligation |
| Manage withdrawals, refunds and claims | Order, payment, delivery, evidence and support history | Contract; legal obligation; legal claims |
| Review artist submissions and administer releases | Artist, professional, contact, metadata and agreement data | Requested pre-contract steps; contract; legitimate interests |
| Accounting, tax and compliance | Identity, order, payment, contract and invoice data | Legal obligation; legal claims |
| Improve services and understand aggregate use | Usage, technical, campaign and support data | Legitimate interests where privacy impact is limited; otherwise consent |
| Send optional marketing and artist-follow updates | Contact, preferences, consent and engagement data | Consent or another specifically applicable lawful basis |
| Use non-essential cookies or similar tracking | Cookie identifiers, device and usage data | Consent where required |
8. Legitimate Interests
8.1 Where TrackSet relies on legitimate interests, those interests may include securing the service, preventing fraud and abuse, maintaining records, responding to enquiries, improving functionality, measuring performance in a privacy-protective manner, defending legal claims and developing professional relationships with artists and partners.
8.2 TrackSet will use legitimate interests only after considering necessity, proportionality and the person’s rights and reasonable expectations. A person may object to processing based on legitimate interests as described below.
9. Consent and Marketing Choices
9.1 Consent is freely given and separate from acceptance of the Terms. Refusing optional marketing or non-essential tracking does not prevent a person from placing an order or submitting a release.
9.2 Consent may be withdrawn at any time through the unsubscribe link, cookie controls or privacy@trackset.studio. Withdrawal does not affect processing that was lawful before withdrawal.
9.3 Marketing email measurement, including tracking pixels, will be used only if the implemented configuration has a valid legal basis and is transparently disclosed. TrackSet must align the final notice with its actual email provider and consent settings.
10. Who Receives Personal Data
10.1 TrackSet shares personal data only where reasonably necessary for the purposes in this Policy, under appropriate contractual and security safeguards. Recipient categories may include:
- website hosting, cloud storage, database, security and technical-support providers;
- payment, fraud-prevention, bookkeeping and tax-service providers;
- pressing plants, manufacturers, packaging suppliers, fulfilment partners, carriers and customs agents;
- email, newsletter, customer-support, survey and communication providers;
- consent-management and analytics providers used in accordance with the Cookie Policy;
- professional advisers, insurers, auditors, banks and debt-recovery providers where necessary;
- courts, regulators, tax authorities, police or other public bodies where legally required; and
- a buyer, investor or successor in connection with a genuine business reorganisation or transfer, subject to lawful safeguards.
10.2 TrackSet keeps the information about material service providers and international data transfers in this Privacy Policy under review and updates it when the production setup changes.
11. Artists and Campaign Information
11.1 Artists may receive campaign-performance and sales information in aggregated or non-identifying form where possible. TrackSet does not provide an artist with a Backer’s or buyer’s identity, email, address or individual purchase history merely because the person supported that artist.
11.2 If a person actively chooses to follow an artist, receive artist-specific communication or share details with an artist, the collection interface will explain whether TrackSet sends the communication itself or whether data will be disclosed to the artist or another controller. Any disclosure requiring consent will occur only after separate valid consent.
11.3 Artist profile information, approved photographs, biographies, credits and release metadata may be published as part of campaign and release administration under the applicable artist agreement or permission.
12. No Sale of Personal Data
12.1 TrackSet does not sell personal data or disclose it to third parties in exchange for money. TrackSet does not use buyer data for unrelated third-party advertising without a separate valid legal basis and the transparency required by law.
13. Independent Controllers and External Services
13.1 Some recipients determine their own purposes and means of processing and therefore act as independent controllers, for example certain payment providers, carriers, tax authorities or social-media platforms. Their privacy notices apply to their independent processing.
13.2 Links, embedded media, Bandcamp, streaming services, social networks or other third-party sites are governed by their own privacy practices. TrackSet is not responsible for an external controller’s processing, but will configure integrations and consent controls as required for TrackSet’s own use of them.
14. International Data Transfers
14.1 TrackSet is established in Italy and aims to use providers within the European Economic Area where practical. Some providers or recipients may nevertheless process data in countries outside the EEA.
14.2 Where data is transferred outside the EEA, TrackSet will use a lawful transfer mechanism, such as an adequacy decision, approved Standard Contractual Clauses together with appropriate supplementary measures, or another mechanism permitted by Chapter V of the GDPR.
14.3 Information about the applicable safeguard and how to request a copy will be available through privacy@trackset.studio or the provider and transfer schedule. Commercially sensitive information may be redacted where legally permitted without preventing meaningful information about the safeguard.
15. Data Security
15.1 TrackSet uses technical and organisational measures appropriate to the nature and risk of the processing. Depending on the system, these may include access controls, strong authentication, encryption in transit, secure provider configuration, backups, logging, least-privilege access, software updates and incident-response procedures.
15.2 Only people and service providers who need personal data for an authorised task should receive access. They are subject to confidentiality, contractual or legal duties as appropriate.
15.3 No internet or storage system is completely secure. TrackSet cannot promise absolute security but will review its measures and address identified risks proportionately.
16. Personal Data Breaches
16.1 TrackSet will assess a suspected personal-data breach, contain it, document the response and notify the competent supervisory authority where legally required. Affected individuals will be informed without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
16.2 Anyone who believes an account, message or TrackSet communication has been compromised should contact privacy@trackset.studio promptly and avoid sending passwords or full payment credentials.
17. Automated Decisions and Fraud Screening
17.1 TrackSet does not currently intend to make decisions based solely on automated processing that produce legal or similarly significant effects without providing the disclosures and safeguards required by law.
17.2 Payment and fraud providers may apply automated risk checks under their own notices. Where TrackSet relies on a material automated decision, the person will be informed of the logic and available rights, including human review where applicable.
18. Data Minimisation and Accuracy
18.1 TrackSet seeks to collect only data relevant to a defined purpose and to keep it accurate. Individuals should update account, contact and delivery information and notify TrackSet of material inaccuracies.
18.2 Free-text fields and uploaded claim evidence should not contain unnecessary third-party data, passwords, full payment-card details or sensitive information.
19. How Long We Keep Personal Data
19.1 TrackSet retains personal data only as long as necessary for the stated purpose, legal obligations, accounting, dispute resolution and the establishment, exercise or defence of legal claims. The following periods are the recommended operational schedule and must be confirmed against the final systems and Italian legal advice:
| RECORD | RECOMMENDED RETENTION |
|---|---|
| Orders, invoices, payments and accounting | 10 years from the relevant accounting record or longer only where law or a pending proceeding requires |
| Contracts and release administration | For the contract term and ordinarily up to 10 years afterwards for claims and compliance |
| Cancelled or unsuccessful campaign Backings | 24 months after cancellation, except payment, accounting, consent or dispute records kept longer where required |
| Customer support, returns and claims | 3 years after closure, or with the related order record where needed for guarantee, dispute or legal obligations |
| Inactive customer account | 24 months after last activity following reasonable notice, except records that must be retained separately |
| Artist submission not selected | 24 months after the decision unless the artist requests earlier deletion or agrees to a longer talent-pool period |
| Marketing subscription and preference | Until withdrawal or persistent inactivity; consent and suppression evidence retained as necessary to demonstrate compliance |
| Security and access logs | Normally up to 12 months, longer only for an incident, fraud investigation, legal claim or binding requirement |
| Cookie and analytics identifiers | As stated in the Cookie Policy and consent interface for each tool |
| Backups | Deleted or overwritten on the normal backup cycle, targeted at no more than 90 days unless technically or legally necessary |
19.2 When a retention period ends, data is deleted, securely destroyed or irreversibly anonymised. Data held only in a restricted backup is not restored for ordinary use and is removed through the normal backup cycle.
19.3 A deletion request may not require immediate deletion of information that TrackSet must retain for tax, accounting, fraud prevention, legal claims or another overriding lawful reason. TrackSet will explain any applicable restriction.
20. Your Data-Protection Rights
20.1 Subject to the conditions and exceptions in applicable law, individuals may have the right to:
- receive clear information about how their personal data is used;
- obtain access to their personal data and a copy of it;
- correct inaccurate or incomplete personal data;
- request deletion where the data is no longer needed or processing is unlawful;
- restrict processing in specified circumstances;
- receive eligible data in a structured, commonly used and machine-readable format and transmit it to another controller;
- object to processing based on legitimate interests, including profiling based on those interests;
- object at any time to direct marketing, including related profiling;
- withdraw consent at any time without affecting earlier lawful processing; and
- obtain safeguards relating to qualifying automated decisions and request human intervention where applicable.
21. How to Exercise Your Rights
21.1 Send a request to privacy@trackset.studio and describe the right being exercised. TrackSet may request information reasonably necessary to confirm identity and prevent unauthorised disclosure. A copy of an identity document will be requested only where proportionate and should be redacted to the minimum information needed.
21.2 TrackSet will respond without undue delay and normally within one month. The period may be extended by up to two further months for a complex request or multiple requests; TrackSet will explain the extension within the first month.
21.3 Requests are normally free. TrackSet may charge a reasonable fee or refuse to act only where a request is manifestly unfounded or excessive and the law permits this. If TrackSet does not act, it will explain the reasons and the right to complain.
22. Direct Marketing Objection
22.1 An objection to direct marketing is absolute. TrackSet will stop the marketing communication concerned and may retain only the minimum suppression record needed to ensure that the person is not contacted again against their choice.
23. Complaints
23.1 TrackSet encourages individuals to contact privacy@trackset.studio first so that the concern can be investigated. This does not limit the right to complain directly to a supervisory authority.
23.2 The lead Italian supervisory authority is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy; email protocollo@gpdp.it; certified email protocollo@pec.gpdp.it; website www.garanteprivacy.it.
23.3 A person may also complain to the supervisory authority in the EU or EEA country of habitual residence, place of work or the alleged infringement where the GDPR permits.
24. Cookies and Similar Technologies
24.1 TrackSet may use strictly necessary technologies for security, checkout, account sessions, preferences and core website functions. These do not require consent where the legal exemption applies but must still be transparently described.
24.2 Analytics, advertising, social-media, personalisation or other non-essential technologies will be activated only after the consent required by applicable law. Rejecting them must be as easy as accepting them, and users must be able to change their choice later.
24.3 The separate Cookie Policy and consent interface will identify each implemented technology, provider, purpose, duration, access by third parties and available control. This Privacy Policy does not authorise a cookie or tracking tool that has not been properly configured and disclosed.
25. Newsletter and Artist-Follow Features
25.1 Newsletter and artist-follow subscriptions use a separate choice. TrackSet may use a confirmation step such as double opt-in and will keep the evidence necessary to demonstrate the subscription and later withdrawal.
25.2 Every marketing email will provide a simple unsubscribe method. Service messages about an order, campaign outcome, security issue, contractual change or claim are not marketing and may still be sent where necessary.
26. Third-Party Content and Social Media
26.1 Third-party embeds and social-media functions can disclose device or usage data to the provider. TrackSet will use consent controls or a click-to-load solution where required. Opening an external link is subject to the third party’s privacy notice.
27. Changes to This Policy
27.1 TrackSet may update this Policy when services, providers or law change. The effective date and version will be shown at the beginning. Material changes will be communicated through an appropriate channel and renewed consent will be requested where the new processing requires it.
27.2 Previous versions will be retained internally to demonstrate which information applied at a relevant time. The current public version will be available at https://trackset.studio/privacy/.
28. Language and Governing Framework
28.1 This Policy is drafted in English. Any translation is intended to provide equivalent information. Mandatory transparency requirements and the rights granted by the GDPR, Italian data-protection law and other applicable law remain unaffected.
29. Contact
29.1 Controller: Erkan Blattner, Ditta Individuale, trading as “TrackSet”, Strada Provinciale 72, 74023 Grottaglie (TA), Apulien, Italien. Privacy email: privacy@trackset.studio. Website: https://trackset.studio/.