Legal
This privacy policy explains how CATUZIO processes personal data of visitors, fans, artists and buyers under the EU General Data Protection Regulation (GDPR). Placeholders in double braces are filled by the operator before public release.
Draft, not final
This page is a working draft. It still contains placeholders ({{...}}), the list of processors and storage periods is provisional, and a lawyer has not yet reviewed it. A final GDPR review is required before public release.
The controller within the meaning of the GDPR is:
{{ANBIETER_NAME}}, {{ANSCHRIFT}}
Email: {{KONTAKT_EMAIL}}. Data protection contact: {{DATENSCHUTZ_KONTAKT}}.
We use carefully selected service providers as processors under Art. 28 GDPR. Where a transfer to a third country takes place, it is based on an adequacy decision or on EU standard contractual clauses. The operator confirms the final list and the transfer safeguards before public release.
When you sign up for the launch notification, join the founding-act waitlist or subscribe to the newsletter, we process your email address (for the act waitlist additionally the free-text details you provide, for example artist name and a link) on the basis of your consent (Art. 6 (1) (a) GDPR). You confirm the consent in a double opt-in via a link in the confirmation email.
Purpose: to notify you once when CATUZIO opens (launch notification), to contact you about founding-act admission (waitlist), or to send you the editorial newsletter. No use beyond that takes place. No tracking pixel, no open or click tracking, no profiling.
Recipients: the email dispatch runs through our service provider {{E-MAIL-DIENSTLEISTER, z.B. Resend}} as a processor (Art. 28 GDPR). {{Drittland-/Transferhinweis, falls zutreffend}}.
Storage period: until you withdraw your consent; the launch notification list is deleted after the launch {{vom Betreiber zu bestaetigen}}.
Withdrawal: at any time via the unsubscribe link in the email or at {{Kontakt, z.B. privacy@...}}, without giving reasons, with effect for the future (Art. 7 (3) GDPR). The lawfulness of the processing carried out until the withdrawal remains unaffected.
Controller: {{Verantwortlicher, siehe Abschnitt oben}}.
[Entwurf, vor oeffentlicher Freigabe von einem zugelassenen Anwalt gegenzulesen.]
Payments run through Stripe and, for direct artist sales, through Stripe Connect. CATUZIO stores payment references but no full card data; card data is processed by Stripe as an independent provider.
For direct sales between an act and a fan the respective role (merchant of record, controller and processor split between Stripe, artist and platform) is described in the final version after legal review.
We store personal data only for as long as it is needed for the platform operation, the contract, security, statutory obligations or legitimate evidence. Order and invoice data is kept for the statutory retention periods (regularly up to ten years under tax and commercial law).
After the purpose ceases and once no retention obligation applies any more, the data is deleted or anonymised. The operator confirms the concrete periods before public release.
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future (Art. 7 (3) GDPR).
To exercise your rights contact {{KONTAKT_EMAIL}} or {{DATENSCHUTZ_KONTAKT}}.
You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR).
Competent supervisory authority: {{AUFSICHTSBEHOERDE}}.
We use necessary storage to operate login, account, guest checkout and abuse protection, and to keep your language and theme. Optional features are only activated after explicit consent and can be withdrawn in the settings. Details are on the Cookies page.