Last updated: 28 September 2026
Below you will find how personal information is handled whenever you visit www.spotsound.ca, create an account, buy something or contact us, together with the choices you have over it. The text is drawn up in line with Regulation (EU) 2016/679 (GDPR) and with the French Data Protection Act (Loi Informatique et Libertés).
1. Identity of the data controller
Decisions about your data are taken by:
BLUECHOU EI, the publisher of www.spotsound.ca
113 avenue de Saint-Ouen, 75017 Paris, France
SIRET: 510 397 623 00032 - EU VAT number: FR60510397623
Any privacy enquiry can be sent to contact@spotsound.ca
2. Categories of data collected
- Account data: your civility, surname and forename, email, a password stored only in encrypted form, a birth date that you may leave out, and, for professional buyers, the company name and VAT number.
- Order and delivery data: invoicing and delivery addresses, telephone number, the items bought and the customization choices attached to them, plus your order history, invoices and returns.
- Payment data: payments are processed by our payment providers themselves. A full card number never reaches us or sits in our systems; we hold the transaction reference, amount and status only.
- Customer support data: whatever you write to us via the contact form, live chat, email or a quote request, and any attachment you add.
- Newsletter data: your email address and your subscription status, when you subscribe.
- Review data: the text and rating of your review and the name or pseudonym under which you publish it.
- Affiliate data: if you take part in the affiliate programme, the identity and payment details required to pay out your commissions.
- Technical data: your IP address, the type of browser and device, the pages you view, an approximate country (so that language and currency fit), and the information gathered by cookies and comparable technologies (section 8).
Fields marked as mandatory must be completed for us to process your request or order. Without them, we are unable to proceed.
3. Purposes and legal bases
- Managing accounts, orders, payments, deliveries, returns and after-sales service falls under performance of the contract (Art. 6(1)(b) GDPR).
- Issuing invoices, keeping accounts and meeting tax duties stems from a legal obligation (Art. 6(1)(c) GDPR).
- Answering your questions and quote requests relies on pre-contractual measures or on our legitimate interest in responding.
- Fraud prevention and website security, spam filtering of forms included, rests on our legitimate interest in protecting customers and the business.
- Newsletters and marketing emails need your consent; the unsubscribe link lets you withdraw it at any time.
- Audience measurement and website improvement, as well as advertising performance measurement, rest on our legitimate interest or, where legislation requires, on your consent.
- TikTok features (section 5) depend on your consent, given when you approve the link on TikTok.
4. Recipients of your data
Access is limited to our staff and to the providers whose services keep the shop running. They act on our instructions and are bound by confidentiality and security obligations. Your personal information is never sold.
- Payment: Revolut, Stripe, and our bank where you pay by transfer.
- Delivery: the carrier you choose (for example Chronopost, FedEx, UPS, USPS or Canada Post) is given your name, delivery address, telephone number and email so that it can follow the parcel.
- Hosting and security: Namecheap, Inc. (web hosting, United States) and Cloudflare, Inc. (content delivery network and protection against attacks).
- Customer service: tawk.to (live chat).
- Statistics and advertising: Google (Google Tag Manager, Google Analytics, Google reCAPTCHA) and Meta Platforms (Meta Pixel).
- Internal software: the IT tools, including artificial intelligence services, used by our team to process orders and support requests.
- Authorities: the courts, the police or tax administrations when a legal duty compels disclosure.
5. The TikTok integration
Our site is built on TikTok Login Kit and the TikTok Content Posting API, which let users connect their TikTok account and send videos to it.
- Data obtained after your approval (scope user.info.basic): the TikTok open_id, an identifier that is specific to our application, along with your display name and profile picture.
- Video transfer (scope video.upload): videos reach your TikTok account solely as drafts, and only following your explicit request. We never publish anything for you; reviewing and posting the drafts is up to you in the TikTok app.
- Use made of the data: it serves these two features exclusively, namely identifying the account you linked and transferring the videos you request. It is not sold, is shared with TikTok alone, and plays no part in advertising or profiling.
- Retention: access tokens and the TikTok data listed above remain with us as long as your TikTok account is linked. Within 90 days after you unlink the account, revoke access or ask for erasure, they are deleted. Videos already transferred are not kept by us for TikTok purposes.
- Revoking access: at any moment, open the TikTok app and go to Settings and privacy → Security → Manage app permissions, then delete our application.
- Erasure request: write to contact@spotsound.ca whenever you want your TikTok data deleted.
- TikTok's own processing of your data is described in the TikTok Privacy Policy.
6. How long data is kept
- Customer account: until you close it, or at most 3 years once you stop using it.
- Orders and invoices: 10 years, in line with accounting and tax rules.
- Support requests and quotes: 3 years counted from the last contact between us.
- Newsletter: until you unsubscribe, or at most 3 years after your last interaction.
- Reviews: as long as the review is online, unless you ask for its removal.
- Technical logs: 12 months.
- Cookies: a maximum of 13 months.
- TikTok data and tokens: while the account stays linked, then deleted within 90 days (section 5).
Once a period has run out, data is either erased or made anonymous, so that no one can link it to you.
7. Transfers beyond the European Union
Several of our providers, in particular Namecheap, Cloudflare, Google, Meta, tawk.to and some carriers, are established outside the European Economic Area (mostly in the United States) or process data from there. Transfers of this kind are covered either by a European Commission adequacy decision, such as the EU-US Data Privacy Framework for certified organizations, or, failing that, by the European Commission's Standard Contractual Clauses. A copy of these safeguards can be requested from us.
8. Cookies and comparable tools
A cookie is a small file stored on your device by a website. We use the following kinds:
- Strictly necessary cookies: without them the website cannot work (basket, login, language and currency, security), and we have no means of turning them off.
- Preference and service cookies: they remember what you chose and make the live chat run.
- Measurement and advertising cookies: set by Google (Google Tag Manager, Google Analytics) and Meta (Meta Pixel) to count visits and assess our advertisements, and by Google reCAPTCHA to stop spam on our forms.
Managing cookies: through your browser, you may allow, block or delete cookies at any time (in Chrome, Firefox, Safari or Edge, see Settings → Privacy → Cookies), and third-party cookies can be blocked on their own. Blocking essential cookies may disable certain features, such as the cart. Cookies last 13 months at most.
9. Rights you can exercise
Under the GDPR, you are entitled to:
- consult your data and obtain a copy;
- have inaccurate or incomplete data corrected;
- ask for erasure where the law allows it;
- request a restriction of processing;
- oppose processing founded on our legitimate interest, and oppose direct marketing whenever you like;
- receive your data in a structured, commonly used format (portability);
- withdraw consent at any time, without affecting processing already carried out;
- give instructions about the fate of your data after your death.
Send your request to contact@spotsound.ca or to the postal address given in section 1. If you hold an account, most of your data can also be viewed and changed under My account. Our answer comes within one month; where there is a reasonable doubt about your identity, we may require proof of it.
10. Data security
Appropriate technical and organizational measures protect your data: HTTPS encryption, encrypted passwords, payments handled by certified providers (PCI-DSS), restricted access, regular backups and protection against attacks. Since no system offers absolute security, a breach likely to put your rights at risk would be reported to you and to the competent authority, as required by law.
11. Children
The website is aimed at adults. Data from children below 15 is not knowingly collected without the consent of a parent or guardian. Should you believe that a child has supplied us with personal data, tell us and the data will be deleted.
12. Lodging a complaint
When you consider that your rights were disregarded, we invite you to contact us first at contact@spotsound.ca. A complaint may also go to the French authority, the CNIL (Commission nationale de l'informatique et des libertés, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 - www.cnil.fr), or to the supervisory authority of the EU country in which you live.
13. Changes to this policy
Whenever our services or the legislation evolve, this policy may be amended. The top of the page shows the date of the most recent version. Where an amendment is substantial, you will be informed by a notice on the website or by email.