Privacy Policy

We take the protection of your personal data very seriously. This page explains, in plain words first and in legal detail below, what happens with your personal data when you visit cajonbox.com, buy from the shop, take a course, or join the newsletter.

1. An overview of data protection

The following information provides an easy-to-navigate overview of what happens with your personal data when you visit this website. The term “personal data” comprises all data that can be used to personally identify you.

Who is responsible for the recording of data on this website?

The data on this website is processed by the operator of the website:

Cajonbox — Heidi Joubert
Harburger Straße 55
29614 Soltau, Germany
E-mail: heidi@cajonbox.com

How do we record your data?

We collect your data as a result of your sharing it with us — for instance information you enter into the contact form, a comment, the newsletter signup or the checkout. Other data is recorded automatically by our IT systems when you visit the website: primarily technical information such as your web browser, operating system, and the time the site was accessed.

What do we use your data for?

A portion of the information is generated to guarantee the error-free provision of the website. Other data is used to fulfil your orders, provide your course access, or send you the newsletter you asked for. We do not sell your data, and this website runs no third-party advertising or tracking network.

What rights do you have regarding your information?

You have the right to receive information about the source, recipients and purposes of your archived personal data at any time, free of charge. You also have the right to demand that your data is rectified or eradicated. If you have consented to data processing, you can revoke this consent at any time with effect for the future. You also have the right, under certain circumstances, to demand that the processing of your data be restricted, and the right to log a complaint with the competent supervisory agency. Please contact us at any time at the address above if you have questions about data protection.

2. Hosting

This website is hosted by an external service provider (host). Personal data collected on this website is stored on the servers of the host. This may include IP addresses, contact requests, metadata and communications, contract information, contact information, names, web page access, and other data generated through a website.

The host is used for the purpose of fulfilling the contract with our potential and existing customers (Art. 6 para. 1 lit. b GDPR) and in the interest of a secure, fast and efficient provision of our online services by a professional provider (Art. 6 para. 1 lit. f GDPR). Our host will only process your data to the extent necessary to fulfil its performance obligations and to follow our instructions with respect to such data.

3. General information & your rights

Data protection

The operators of this website take the protection of your personal data very seriously. We handle your personal data as confidential information, in compliance with the statutory data protection regulations and this privacy policy. We advise that the transmission of data via the internet (e.g. e-mail communications) may be prone to security gaps; it is not possible to completely protect data against third-party access.

Revocation of your consent to the processing of data

A wide range of data processing transactions are possible only subject to your express consent. You can revoke any consent you have already given us at any time — an informal e-mail is enough. This shall be without prejudice to the lawfulness of any data collection that occurred prior to your revocation.

Right to object to the collection of data in special cases; right to object to direct advertising (Art. 21 GDPR)

IN THE EVENT THAT DATA ARE PROCESSED ON THE BASIS OF ART. 6 SECT. 1 LIT. E OR F GDPR, YOU HAVE THE RIGHT TO AT ANY TIME OBJECT TO THE PROCESSING OF YOUR PERSONAL DATA BASED ON GROUNDS ARISING FROM YOUR UNIQUE SITUATION. THIS ALSO APPLIES TO ANY PROFILING BASED ON THESE PROVISIONS. IF YOU LOG AN OBJECTION, WE WILL NO LONGER PROCESS YOUR AFFECTED PERSONAL DATA, UNLESS WE ARE IN A POSITION TO PRESENT COMPELLING PROTECTION WORTHY GROUNDS FOR THE PROCESSING OF YOUR DATA THAT OUTWEIGH YOUR INTERESTS, RIGHTS AND FREEDOMS, OR IF THE PURPOSE OF THE PROCESSING IS THE CLAIMING, EXERCISING OR DEFENCE OF LEGAL ENTITLEMENTS (OBJECTION PURSUANT TO ART. 21 SECT. 1 GDPR).

IF YOUR PERSONAL DATA IS BEING PROCESSED IN ORDER TO ENGAGE IN DIRECT ADVERTISING, YOU HAVE THE RIGHT TO OBJECT AT ANY TIME TO THE PROCESSING OF YOUR AFFECTED PERSONAL DATA FOR THE PURPOSES OF SUCH ADVERTISING. THIS ALSO APPLIES TO PROFILING TO THE EXTENT THAT IT IS AFFILIATED WITH SUCH DIRECT ADVERTISING. IF YOU OBJECT, YOUR PERSONAL DATA WILL SUBSEQUENTLY NO LONGER BE USED FOR DIRECT ADVERTISING PURPOSES (OBJECTION PURSUANT TO ART. 21 SECT. 2 GDPR).

Right to log a complaint with the competent supervisory agency

In the event of violations of the GDPR, data subjects are entitled to log a complaint with a supervisory agency, in particular in the member state where they usually maintain their domicile or place of work, or at the place where the alleged violation occurred. The right to log a complaint is in effect regardless of any other administrative or court proceedings available as legal recourses.

Right to data portability

You have the right to demand that we hand over any data we automatically process on the basis of your consent or in order to fulfil a contract to you or to a third party in a commonly used, machine-readable format. If you should demand the direct transfer of the data to another controller, this will be done only if it is technically feasible.

SSL/TLS encryption

For security reasons and to protect the transmission of confidential content — such as purchase orders or inquiries you submit to us — this website uses SSL/TLS encryption. You can recognise an encrypted connection by the “https://” in the address line of your browser and the lock icon. When encryption is active, data you transmit to us cannot be read by third parties. Payment transactions are processed exclusively via encrypted connections.

Information about, rectification and eradication of data

Within the scope of the applicable statutory provisions, you have the right to demand, at any time, information about your archived personal data, its source and recipients, and the purpose of its processing. You may also have the right to have your data rectified or eradicated. Please contact us at any time at the address above.

Right to demand processing restrictions

You have the right to demand the imposition of restrictions on the processing of your personal data. This applies: while we verify a disputed claim about the correctness of your data; if processing was conducted unlawfully and you prefer restriction over eradication; if we no longer need the data but you need it to exercise, defend or claim legal entitlements; or while an objection under Art. 21 Sect. 1 GDPR is being weighed. Restricted data may — apart from archiving — be processed only with your consent, to claim or defend legal entitlements, to protect the rights of others, or for important public-interest reasons.

4. Data recording on this website

Cookies

Our website uses “cookies” — small text files that do not cause any damage to your device, stored either temporarily for the duration of a session (session cookies) or permanently (permanent cookies) until you delete them or your browser does. Some cookies are technically essential: certain website functions such as the shopping cart, your login for course access, or your language choice would not work without them. Third-party cookies may be stored when you use certain services on our site (e.g. the processing of payment services or embedded video/music players — see sections 6 and 8).

Cookies that are required for electronic communication or for functions you have asked for (such as the cart) are stored on the basis of Art. 6 Sect. 1 lit. f GDPR — we have a legitimate interest in the technically error-free and optimised provision of our services. Where consent for cookies is requested, those cookies are stored exclusively on the basis of that consent (Art. 6 Sect. 1 lit. a GDPR), revocable at any time. You can set your browser to notify you about cookies, allow them case by case, exclude them, or delete them automatically — parts of this website may then work with limitations.

Server log files

The provider of this website automatically collects and stores information in server log files, which your browser communicates automatically: browser type and version, operating system, referrer URL, hostname of the accessing computer, time of the server inquiry, and IP address. This data is not merged with other data sources. It is recorded on the basis of Art. 6 Sect. 1 lit. f GDPR — the operator's legitimate interest in the technically error-free presentation and optimisation of the website.

Contact form, e-mail and phone requests

If you submit inquiries via the contact form, e-mail or phone, your request — including the contact details you provide — will be stored by us in order to handle your inquiry and possible follow-up questions. We do not share this information without your consent. Processing is based on Art. 6 para. 1 lit. b GDPR if your request relates to a contract, otherwise on our legitimate interest in handling inquiries effectively (Art. 6 para. 1 lit. f GDPR) or on your consent (Art. 6 para. 1 lit. a GDPR). The data remains with us until you ask us to delete it, revoke your consent, or the purpose lapses — mandatory retention periods remain unaffected.

Registration and customer accounts

When you buy from the shop or enrol in a course, an account is created for you. We use the data you enter only to provide the service you registered for — your orders, downloads, subscriptions and course access. Processing is based on the contract (Art. 6 Sect. 1 lit. b GDPR) and, where applicable, your consent (Art. 6 Sect. 1 lit. a GDPR). The data is stored for as long as you are registered; you can delete your account at any time from your account page. Mandatory statutory retention obligations (e.g. for invoices) remain unaffected.

Comments on this website

When you leave a comment, we store the comment, the time it was written, your e-mail address, and the name you chose — plus your IP address. We store the IP because we do not review comments before publishing and may need it to act against rights violations such as defamation. Comments are stored on the basis of your consent (Art. 6 Sect. 1 lit. a GDPR), revocable at any time, and remain until the commented content is deleted or the comment has to be removed for legal reasons.

5. Newsletter

AWeber

We send our newsletter with AWeber. The provider is AWeber Systems, Inc., 1100 Manor Drive, Chalfont, PA 18914, USA. When you sign up for the newsletter, the data you enter (your e-mail address and, where given, your name) is stored on AWeber's servers in the USA. Your signup uses double opt-in: you receive a confirmation e-mail, and only after clicking the confirmation link are you subscribed.

AWeber lets us analyse newsletter performance — for instance whether a message was opened and which links were clicked, along with technical information (time of access, IP address, browser and operating system). This is used for statistical analysis to make future newsletters more relevant. Your data is processed on the basis of your consent (Art. 6 Sect. 1 lit. a GDPR), which you can revoke at any time by clicking the unsubscribe link found in every single newsletter e-mail. After you unsubscribe, your e-mail address is removed from the distribution list; it may be kept in a suppression list solely to honour your opt-out. For details see AWeber's privacy policy: https://www.aweber.com/privacy.htm.

6. Plug-ins & embedded tools

YouTube

This website embeds videos from YouTube, operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit a page with an embedded YouTube video, a connection to YouTube's servers is established and YouTube is notified which of our pages you visited; YouTube may place cookies on your device. If you are logged into your YouTube account, YouTube can allocate your browsing directly to your profile — you can prevent this by logging out. The use of YouTube is based on our legitimate interest in presenting our content in an appealing manner (Art. 6 Sect. 1 lit. f GDPR). See Google's privacy policy: https://policies.google.com/privacy.

Spotify

Our music pages embed players from Spotify, operated by Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden. When you visit a page with an embedded Spotify player, a connection to Spotify's servers is established, and Spotify may place cookies; if you are logged into Spotify, your visit can be associated with your Spotify account. This is based on our legitimate interest in presenting our music in an appealing manner (Art. 6 Sect. 1 lit. f GDPR). See Spotify's privacy policy: https://www.spotify.com/legal/privacy-policy/.

Website translation (GTranslate / Google Translate)

Our site offers an optional translation feature (the globe icon). If — and only if — you choose a language, the text of the pages you view is sent to the Google Translate service (Google Ireland Limited) to be translated on the fly, and translation cookies may be set. No translation data is transmitted unless you use the feature. This is based on your consent expressed by using the feature (Art. 6 Sect. 1 lit. a GDPR).

Links to social networks

This website links to our profiles on social networks (e.g. YouTube, Instagram, Facebook, Spotify). These are plain links, not embedded tracking plug-ins: no data is transferred to those platforms by merely visiting our site. Once you follow a link, the privacy policy of the respective platform applies.

7. Security & anti-spam

Wordfence

To protect this website against attacks, malware and unauthorised access, we use the security service Wordfence, provided by Defiant Inc., 800 5th Ave., Suite 4100, Seattle, WA 98104, USA. Wordfence processes the IP addresses and request data of visitors to detect and block malicious traffic. This is based on our legitimate interest in protecting our website against cyber attacks (Art. 6 Sect. 1 lit. f GDPR). See https://www.wordfence.com/privacy-policy/.

CleanTalk anti-spam

To keep comments and forms free of spam, we use CleanTalk, provided by CleanTalk Inc., 711 S. Carson Street, Suite 4, Carson City, NV 89701, USA. When you submit a comment or form, technical data of the submission (e.g. IP address, e-mail address, message content) may be checked against CleanTalk's spam database. This is based on our legitimate interest in protecting the website against spam and abuse (Art. 6 Sect. 1 lit. f GDPR). See https://cleantalk.org/publicoffer#privacy.

8. eCommerce & payment providers

Processing of data (customer and contract data)

We collect, process and use personal data only to the extent necessary for the establishment, organisation or change of the legal relationship (data inventory), on the basis of Art. 6 Sect. 1 lit. b GDPR, which permits processing for the fulfilment of a contract or pre-contractual actions. We collect, process and use usage data about this website only to the extent necessary to enable you to use the services and to bill for them. Collected customer data is eradicated upon completion of the order or termination of the business relationship, without prejudice to statutory retention mandates (e.g. tax law).

Data transfer for shipping and contract fulfilment

We share personal data with third parties only where necessary for handling your order — for instance your name and delivery address with the shipping and logistics companies that deliver your cajon (e.g. our couriers and the Packlink shipping platform), or payment data with the payment provider you chose. Any further transfer only occurs with your express consent; your data is never shared with third parties for advertising purposes. Basis: Art. 6 Sect. 1 lit. b GDPR.

Stripe

We offer card payments via Stripe. The provider for customers within the EU is Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland. When you pay with Stripe, your payment data is forwarded to Stripe to process the payment. Basis: Art. 6 Sect. 1 lit. b GDPR (contract) and our legitimate interest in dependable, secure payment processes (Art. 6 Sect. 1 lit. f GDPR). Details: https://stripe.com/privacy.

PayPal

We offer payment via PayPal, provided by PayPal (Europe) S.à.r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg. If you choose PayPal, the payment information you enter is shared with PayPal on the basis of Art. 6 Sect. 1 lit. a GDPR (consent) and Art. 6 Sect. 1 lit. b GDPR (contract fulfilment). You can revoke your consent at any time with effect for future transactions. Details: https://www.paypal.com/privacy.

Amazon Pay

We offer payment via Amazon Pay, provided by Amazon Payments Europe S.C.A., 38 avenue J.F. Kennedy, L-1855 Luxembourg. If you choose Amazon Pay, your payment is processed using the payment and address data stored in your Amazon account, which Amazon shares with us to the extent needed to fulfil the order. Basis: Art. 6 Sect. 1 lit. b GDPR (contract fulfilment). Details: https://pay.amazon.eu (privacy notice).