Privacy Policy

Parcel’s Community artist community website

I. Introduction and terms

1. GENERAL

Under the URL [https://popshop.parcelsmusic.com] we provide and maintain our artist community website (hereinafter referred to as "Parcel’s Community website") By operating the Parcel’s Community website we process personal data. These are treated confidentially by us and processed in accordance with the applicable laws – in particular the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Telemedia Data Protection Act (TTDSG). With our Privacy Policy we want to inform you about what personal data we collect from you, for what purposes and on what legal basis we use it and, if applicable, to whom we disclose it. In addition, we will explain to you what rights you have to protect and enforce your data privacy.

2. DEFINITIONS

Our privacy policy contains technical terms that are in the GDPR and the German BDSG. For your better understanding, we want to explain these terms in simple terms in advance:

2.1 Personal data: "Personal data" is any information relating to an identified or identifiable person (Art. 4 No. 1 GDPR). Information of an identified person can be, for example, the name or the e-mail address. However, personal data is also data for which the identity is not immediately apparent, but can be determined by combining one's own information or that of others and thus finding out who it is. A person can be identified, for example, by providing your address or bank details, date of birth or user name, IP addresses and/or location data. Relevant here is all information that in any way allows a conclusion to be drawn about a person.

2.2 Processing: A "processing" is understood by Art. 4 No. 2 GDPR to mean any operation in connection with personal data. This applies in particular to the collection, recording, organization, arrangement, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or other form of making available, alignment or combination, restriction, erasure or destruction of personal data.

II. Data controller and data protection officer

3. CONTROLLER

Responsible for data processing is:

Company: [Parsells Merchandise GbR“,] („Parcels“, “we”) Legal representatives: [Noah Francis Hill, Louie Edward Swain, Jules Hendrix Crommelin, Patrick Scott Hetherington, Anatole John Serret] Address: [Aufgang V - Pfuelstraße 5- 10997 Berlin - Germany] Fax: [+49 30 6958088-29] Email: privacy (AT) parcelsmusic.com

4. DATA PROTECTION

Parcels is not obliged to appoint a data protection officer. For questions and concerns regarding data protection on our Parcel’s Community website and Parcels, you can contact us using the aforementioned contact details.

III. Scope of processing

5. SCOPE OF PROCESSING: PARCEL’S COMMUNITY WEBSITE

Regarding the Parcel’s Community website with the URL [https://popshop.parcelsmusic.com], we process the personal data from you listed in detail below in section IV. We only process data from you that you actively provide on the Parcel’s Community website (e.g. by filling out forms) or that you automatically provide when visiting our Parcel’s Community website.

Information provided directly by you to us If you register to join our Parcel’s Community website and/or use any of the services available on our Parcel’s Community website, you may provide and we may collect details of your name, address, email address, login details, blockchain address, and phone number, how you use and interact with Parcel’s community including feedback and improvement ideas, and your purchase/transactional data (including payment card details related to Parcel’s community. Information collected automatically through the Parcel’s Community website or via services When you visit the Parcel’s Community website and/or use any of the services available, we will collect the following information about you and your devices: your Internet Protocol “IP” address, Media Access Control “MAC” address. We will in limited situations also collect your geolocation data, for example to verify your attendance at a concert.

We will use the personal information collected to:

Manage any accounts you set up via this website Provide to you any music, video, media, digital and/or physical goods and services offered for free or purchased by you through the website and/or our community. Deliver news and other announcements/notifications to you related to the music group “Parcels” that you might be interested in and provide you a means of opting out of such contact. Contact you about products and services you might be interested in and provide you a means of opting out of such contact. Evaluate and analyse how people are using the website so that we can make it easy for you to use. Collect feedback and improvement ideas related to the community and provide these to Medallion, the community developer

Your data will be processed exclusively by us and will not be sold and/or shared with third parties. In particular we have not sold personal data in the preceding twelve (12) months and we do not sell personal data, including not selling the personal data of minors under 16.

If we use the help of external service providers to process your personal data, this is done within the framework of so-called data processing, in which we as the controller are authorized to issue instructions to our processor. To provide and host our Parcel’s Community website and facilitate transactions and communications on our Parcel’s Community website, we use the external service provider Medallion Arts Inc, [https://medallion.fm/]. Medallion's privacy policy can be found at the URL [https://medallion.co/privacy]. If further external service providers are used for individual processing operations listed in section IV., they will be named there.

As a matter of principle, we do not transfer data to third countries and do not plan to do so. We will provide information about exceptions to this principle in the processing operations described below. Any data transfer to third countries will then take place on the basis of the so-called EU standard contractual clauses.

IV. The processing operations in detail

6. PROVISION OF OUR PARCEL’S COMMUNITY WEBSITE

6.1 Description of the processing

Each time you access our Parcel’s Community website, we automatically record information that your browser transmits to our server. This is the following data:

IP address Media Access Control “MAC” address

The temporary storage of your IP address by the system is necessary to be able to deliver our Parcel’s Community website to a user's terminal device.

6.2 Purpose

The processing is carried out in order to deliver the Parcel’s Community website to you and to display it on your device.

6.3 Legal basis

The processing is necessary to protect the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose named in section 6.2.

6.4 Storage period

The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. In the case of the collection of data for the provision of the website, this is the case when the respective session has ended.

Recipients and transfer to third countries In order to process your personal data to deliver the Parcel’s Community website to you and to display it on your device we use the external service provider Medallion Arts Inc. [https://medallion.fm/] within the framework of so-called data processing, in which we as the controller are authorized to issue instructions to our processor.

7. REGISTRATION AND PROFILE

7.1 Description of the processing

Our Parcel’s Community website is available to registered users only. By registering, you enter into a free usage agreement with us. By registering, you will receive your own user account in our Parcel’s Community website. Registration takes place by filling out the registration form of our Parcel’s Community website at [popshop.parcelsmusic.com] and submitting it to us electronically. To register, you must enter your digital wallet account or e-mail-address. By clicking the "Log-In/Sign-Up" button, then you will receive a registration-code. Thereafter you must enter such registration-code as well as your name, the city and country you are living in and you submit such information to us. Your account will then be manually activated in our Parcel’s Community website. As a registered user, the following functions are available to you in our Parcel’s Community website: a platform on wich you, us and other user communicate with each other and where we may provide links to external websites where you – among other things- may buy our merchandise, records, tickets etc. or stream or download our music. Furthermore we will provide you with notification e-Mails with regard to our services and goods on our platform as well as news about the music group “Parcels”.

7.2 Purpose

The processing takes place in order to provide you with the functions of our Parcel’s Community website for registered users.

7.3 Legal basis

The processing is necessary for the conclusion and fulfillment of the user contract or the contractual relationship existing between you and us (Art. 6 para. 1 lit. b GDPR). Without providing your personal data during registration, we cannot provide our contractually owed services.

7.4 Storage period

The data will be automatically deleted by us upon termination of your user contract or the contractual relationship existing between you and us. You can terminate the user contract by notifing us by email to privacy (AT) parcelsmusic.com or by mail to [Parsells Merchandise GbR - Aufgang V - Pfuelstraße 5- 10997 Berlin]) that you no longer wish to be a registered user of our Parcel’s Community website. We will then delete your user account immediately. Furthermore, as a logged-in user, you can edit and remove your own details and information at any time.

Recipients and transfer to third countries In order to process your personal data regarding your registration and your profile on our Parcel’s Community website we use the external service provider Medallion Arts Inc. [https://medallion.fm/] within the framework of so-called data processing, in which we as the controller are authorized to issue instructions to our processor and Magic labs, Inc., 695 5TH ST, APT 10 SAN FRANCISCO CA 94107 United States. For more information about Magic labs’ privacy policy, please visit: https://magic.link/legal/privacy-policy.

8. PURCHASE

8.1 Description of the processing

As a registered user you can purchase goods and services on our Parcel’s Community website (records, merchandise products, NFTs etc.). As part of your ordering process, we process personal data from you. The mandatory fields marked with an asterisk "*" in our online store must be filled out by you. Otherwise, it is not possible for us to conclude a purchase contract with you and send you the desired goods or services. When shopping on our Parcel’s Community website, you can settle the purchase price via our payment provider, STRIPE (s. below). Upon completion of your order, the data required for payment (name, email address, payment card details) will be passed on to our respective payment service provider and for delivery to our shipping service provider, Tickettoaster (s. below). If you shop on our Parcel’s Community website as a registered user, you can store your billing and delivery addresses for faster and more convenient ordering with us in your user profile.

8.2 Purpose

The processing is carried out for the conclusion and execution of sales contracts.

8.3 Legal basis

The processing is necessary for the conclusion and fulfillment of the purchase contracts (Art. 6 para. 1 lit. b GDPR). This also applies to the transfer of data required for (a) the processing of payments respective payment service provider, STRIPE, and (b) for the delivery of goods shipments to the shipping service provider, Tickettoaster (s. below).

8.4 Storage period

We are obliged by commercial and tax law to store your address, payment and order data for a period of ten years. However, we restrict processing after six years. The Payment history is kept for 6 years after the transaction within our Parcel’s Community website. I.e. your data will then only be stored separately for compliance with the statutory retention periods and deleted immediately after their expiry.

8.5 Recipients and transfer to third countries

In order to process your personal data regarding your purchases on our Parcel’s Community website we use the external service provider Medallion Arts Inc. [https://medallion.fm/] within the framework of so-called data processing, in which we as the controller are authorized to issue instructions to our processor.

In order to process your payment, personal data (name, email address, payment card details) will be passed on to the external payment service provider: Stripe, Inc. (within this privacy policy “STRIPE”), 185 Berry Street, Suite 550, San Francisco, California 94107, USA. For more information about STRIPE's privacy policy, please visit https://stripe.com/de/privacy. In order to carry out and process the delivery of goods, we will pass on the data required for this to our shipping service provider: Tickettoaster GmbH (within this privacy policy “Tickettoaster”), Wolfhager Straße 39a, 34117 Kassel - Germany. For more information about Tickettoaster GmbH 's privacy policy, please visit: https://www.tickettoaster.de/datenschutz.

9. NOTIFICATION – E-MAILS

9.1 Description of the processing

We send a notification - e-mails at irregular intervals. With such e-mails we inform you about news on our Parcel’s Community website regarding our services and goods as well as other news about the music group “Parcels”. You will receive the notification - e-mails, if you are member of our Parcel’s Community and therefore you have concluded an agreement with us (s. General Terms and Conditions).. To receive such notification - e-mails only the specification of your e-mail address is required, which you provide via your initial sign-in to our Parcel’s Community website. All other information (such as your first name and last name) is voluntary and serves solely to personalize the e-mails.

9.2 Purpose

The processing takes place in order to be able to send notification - e-mails to subscribers and to provide you with all information about the functions of our Parcel’s Community website as well as as other news about the music group “Parcels”.

9.3 Legal basis

The processing is necessary for the fulfillment of the user contract or the contractual relationship existing between you and us (Art. 6 para. 1 lit. b GDPR). Without providing your personal data, we cannot provide our contractually owed services.

9.4 Storage period and revocation of consent

The data will be automatically deleted by us upon termination of your user contract or the contractual relationship existing between you and us. You may withdraw from the receipt of the notification e-Mails by notifing us by email to privacy (AT) parcelsmusic.com or by mail to [Parsells Merchandise GbR - Aufgang V - Pfuelstraße 5- 10997 Berlin]) that you no longer wish receive the notification e-Mails. Upon withdrawal, no more notification e-Mails will be sent to you and your personal data will be removed from our active distribution list.

9.5 Recipients and transfer to third countries

We use the services of the notification – e-Mail provider Twilio Inc. to manage our distribution list and to send the notification – e-Mail to you. This is done within the framework of data processing. Further information on data protection regarding Twilio Inc. can be found at [https://www.twilio.com/en-us/legal/privacy].

10. CONTACT BY EMAIL

10.1 Description of the processing

You can also contact us via the e-mail addresses provided on our Parcel’s Community website. In this case, the personal data transmitted with the e-mail will be processed by us or our service providers.

10.2 Purpose

The data transmitted with and in your e-mail will be used exclusively for the purpose of processing and responding to your request.

10.3 Legal basis

The processing is necessary to protect the overriding legitimate interests of the controller (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the purpose named in section 10.2. If the e-mail contact is aimed at the conclusion or fulfillment of a contract, the data processing is carried out for the fulfillment of the contract (Art. 6 para. 1 lit. b GDPR).

10.4 Storage period

The data is deleted by us as soon as it is no longer required to achieve the purpose for which it was collected. This is usually the case when the respective communication with you has ended. The communication is terminated when it can be inferred from the circumstances that your concern has been conclusively clarified. If legal retention periods prevent deletion, the data will be deleted immediately after the expiry of the legal retention period.

V. Security measures

SECURITY MEASURES

To protect your personal data from unauthorized access, we have provided our Parcel’s Community website with an SSL certificate. SSL stands for "Secure Sockets Layer" and encrypts the communication of data between our server and our Parcel’s Community website on the user's end device.

VI. Your rights

12. DATA SUBJECTS‘ RIGHTS

With regard to the data processing by Parcels described above, you are entitled to the following data subject rights:

12.1 Right of access (Art. 15 GDPR)

You have the right to request confirmation from us as to whether we are processing personal data relating to you. If this is the case, you have a right to information about this personal data and to the information listed in detail in Art. 15 GDPR under the conditions set out in Art. 15 GDPR.

12.2 Rectification (Art. 16 GDPR)

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you and, where applicable, to have incomplete personal data completed, including by means of providing a supplementary statement.

12.3 Erasure (Art. 17 GDPR)

You have the right to obtain from us the erasure of your personal data without undue delay, and we shall have the obligation to erase your personal data without undue delay where one of the grounds under Art. 17 of the GDPR applies (e.g. if your data is no longer required for the purpose for which we was using it).

12.4 Restriction of processing (Art. 18 GDPR)

You have the right to demand that we restrict the processing of your personal data, provided that one of the criteria specified under Art. 18 of the GDPR is met (e.g. if you dispute the accuracy of your personal data, its processing will be restricted for the period necessary for us to check its accuracy).

12.5 Data portability (Art. 20 GDPR)

Subject to the criteria specified under Art. 20 of the GDPR, you have the right to be given your data in a structured, commonly used and machine-readable format.

12.6 Withdrawal of consent (Art. 7 (3) GDPR)

You have the right to withdraw your previously provided consent for data processing. The withdrawal will take effect from the time you request it (i.e. it will have future effect but no retrospective affect).

12.7 Complaint (Art. 77 GDPR)

If you believe that the processing of your personal data is in breach of the GDPR, you can complain to a supervisory authority. You can submit your complaint to a supervisory authority in the EU member state where you are habitually resident or work, or where the alleged breach took place.

In the UK, the supervisory authority is the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF (www.ico.org.uk). In Switzerland, the supervisory authority is the Federal Data Protection and Information Commissioner, 1 Feldeggweg, Berne CH3003 (www.edoeb.admin.ch). In California, the privacy regulator is the California Privacy Protection Agency, 2101 Arena Blvd, Sacramento, California 95834 (https://cppa.ca.gov/)

Other countries, states and territories may have their own privacy regulators, who may also be contacted in respect of that country, state or territory.

12.8 Restraint on automated decision-making/profiling (Art. 22 GDPR)

Decisions that have legal consequences for you or that could have a significant detrimental affect on you must not be based solely on the automated processing of personal data, including profiling. We do not apply any such processing or profiling to your personal data.

12. 9 Right of objection (Art. 21 GDPR)

Where we process your personal data on the basis of Art. 6 Par. 1 f of the GDPR in pursuit of our overriding legitimate interests, you have the right subject to Art. 21 of the GDPR to object, provided your objection is based on grounds relating to your specific situation. Once you have objected, we will no longer process your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims. Regardless of the aforementioned restrictions, and regardless of whether any special circumstances apply, you have the right to object at any time to the processing of your personal data for direct marketing purposes.

October 2023