01Data controller

The controller of your personal data is the Seller operating the WATCHFOREST store:

• Controller: WatchForest Serafin Skowroński
• Address: ul. Jurowiecka 56 lok. 4, 15-101 Białystok, Poland
• NIP: 9662221578
• Data-protection contact: (available shortly)

This Policy explains how we process personal data in connection with the use of our Store and Services, in accordance with Regulation (EU) 2016/679 (GDPR).

02What data we collect

• Account data — e-mail address, name/display name and authentication identifiers, provided via our identity provider when you sign up or sign in.
• Profile data — optional artist/band/label name and social links you choose to add.
• Order & billing data — services ordered, order history, billing name, address, country and (optionally) tax/VAT identifier.
• Payment data — processed by our payment providers; we receive the payment status and a transaction reference, but not full card numbers.
• Project content — audio files (stems, mixes) and notes you upload for the Service.
• Technical & usage data — IP address, device/browser information, log data and cookie identifiers (see Cookie Policy).

03Purposes and legal bases

• Providing the Services and account — performance of a contract, Art. 6(1)(b) GDPR.
• Invoicing, accounting and tax obligations — compliance with a legal obligation, Art. 6(1)(c) GDPR.
• Security, fraud prevention, handling complaints and claims — our legitimate interests, Art. 6(1)(f) GDPR.
• Optional analytics and marketing communications — your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time.

04Recipients and processors

We share data only with trusted processors acting on our behalf and under data-processing agreements, including:

• Identity provider (Auth0 / Okta) — authentication and account security.
• Payment provider (Stripe) — payment processing.
• Cloud hosting & storage (Amazon Web Services) — running the application and storing files.
• Communication tools — transactional e-mail delivery.

We may also disclose data to competent authorities where required by law.

05International transfers

Some processors may process data outside the European Economic Area (e.g. in the United States). In such cases, transfers are safeguarded by appropriate mechanisms under the GDPR, in particular the European Commission's Standard Contractual Clauses and/or adequacy decisions.

06Retention

• Account & profile — for as long as you keep an account; after deletion, residual backups expire on a rolling basis.
• Orders & invoices — retained for the period required by tax and accounting law (generally 5 years from the end of the relevant year).
• Project files — retained for a limited period after delivery, then deleted unless you ask us to keep them.
• Logs — kept for a short period for security and diagnostics.

07Your rights

You have the right to:

• access your data and obtain a copy;
• rectify inaccurate or incomplete data;
• erase data ("right to be forgotten");
• restrict processing;
• data portability;
• object to processing based on our legitimate interests;
• withdraw consent at any time, without affecting prior processing.

To exercise these rights, contact us at (available shortly). You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (UODO).

08Cookies and similar technologies

We use cookies and local storage to keep you signed in, remember your cart and currency, secure forms and — with your consent — to measure usage. Details and your choices are described in our Cookie Policy.

09Security and children

We apply appropriate technical and organisational measures to protect personal data, including encrypted connections, access controls and secure, time-limited file links.

The Store is not directed to children under 16, and we do not knowingly collect their data.

10Changes and contact

We may update this Policy; the current version and its effective date are shown above. For any privacy question or request, contact us at (available shortly) or write to our business address.