Privacy Policy

1. Controller

The controller responsible for data processing in connection with this website and the EposScore music library is:

2. Categories of Data and Purposes

We process personal data only to the extent necessary to operate the website, provide the music library and fulfil licence purchases. This includes in particular:

• Technical data (e.g. IP address, browser type, device information, server logs) to deliver the website and maintain security and stability.
• Usage data (e.g. accessed pages, search queries, timestamps) to operate and improve the service.
• Order and licence data (e.g. licensed tracks or collections, licence tier, licence identifiers, download tokens) to issue and document licences. This includes purchase purpose, business name and optional VAT ID where supplied, checkout declaration text, version and timestamp, their order reference, archived contract documents, confirmation of receipt and download-link release times, and withdrawal or cancellation correspondence. Electronic withdrawals include the declaration, sender, contract identification, receipt time and delivery status of the acknowledgement. Short-lived hashed network identifiers help limit misuse of that form. These records document the contract and any reversal; checkout declarations are not consent to marketing.
• Contact and billing data (e.g. name, e-mail address, billing details) that you provide when checking out or contacting us.
• Payment metadata from payment providers (e.g. Stripe), limited to what is required to allocate payments to orders. We do not store full card numbers on our servers.
• Newsletter / updates (e-mail address and communication preferences) if you consent to receiving information about new releases and updates.

3. Legal Bases

Depending on the specific processing, we rely in particular on the following legal bases (GDPR):

• Art. 6(1)(b) GDPR – performance of a contract or steps prior to entering into a contract (e.g. processing licence purchases, providing downloads, issuing licence documents).
• Art. 6(1)(f) GDPR – legitimate interests (e.g. technical security of the website, defence against abuse, documentation of licences).
• Art. 6(1)(a) GDPR – consent (e.g. newsletter / update e-mails, certain analytics or cookies where required).
• Art. 6(1)(c) GDPR – legal obligations (e.g. accounting, tax law requirements, retention obligations).

4. Retention

We store licence and transaction data, including contact details provided at checkout and payment metadata, as long as needed to administer the licence, establish or defend legal claims and meet statutory accounting and retention duties. Duration depends on the licence term, applicable limitation periods and statutory duties. Records of abandoned checkouts are retained only as long as needed for their purpose and any legal obligations; cancellation does not require erasing records that must be retained.

Technical logs and security-related data may be stored for a shorter period where appropriate. Newsletter data is stored until you unsubscribe or revoke your consent.

5. Recipients and Processors

We may share data with service providers who support us in operating the website and processing orders, including:

• Hosting and infrastructure providers (e.g. for web and database hosting).
• Payment providers (e.g. Stripe) for processing payments.
• E-mail and mailing providers for transactional e-mails and updates.

These service providers act as processors or independent controllers, depending on their role, and are contractually or legally obliged to process data only as required and in compliance with data-protection law.

6. Cookies and Analytics

EposScore may use cookies and similar technologies to ensure basic functionality (e.g. keeping items in your cart) and, where applicable, for usage statistics. Where required by law, we will ask for your consent before setting non-essential cookies. You can adjust your browser settings to block cookies, although this may restrict certain functionality.

Licensing inquiries: We use your contact and project details to process your non-binding inquiry and prepare an individual quote. This does not subscribe you to a newsletter. Inquiry data is deleted when no longer needed, subject to any applicable legal retention duties.

7. Newsletter and Updates

Subscribing is optional and independent of your purchase or licence release. If selected at checkout, a separate confirmation email is sent after purchase. Your subscription is activated only after you expressly confirm it. We record the consent text, its version, and the request and confirmation timestamps as evidence. If you opt in to receive updates, we use your e-mail address to send information about new releases, updates and related EposScore news. You can unsubscribe at any time, for example by using an unsubscribe link in the e-mail or by contacting us directly. We will then stop sending such communications.

8. Your Rights

Under applicable data-protection law, you may have the following rights (subject to conditions and legal limitations):

• Right of access to your personal data.
• Right to rectification of inaccurate data.
• Right to erasure ("right to be forgotten") in certain circumstances.
• Right to restriction of processing.
• Right to data portability, where applicable.
• Right to object to processing based on legitimate interests.
• Right to withdraw consent at any time, without affecting prior processing.

To exercise these rights, please contact us using the contact details above. You also have the right to lodge a complaint with a supervisory authority, for example the Austrian Data Protection Authority.

9. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities or legal requirements. The current version is available on this page. For major changes, we may provide additional notice where appropriate.