Privacy Policy

Controller

Who runs this site

This website (“StitchieEU”, stitchieeu.party) is run by DJ Andy. StitchieEU is the data controller for the processing described in this policy. For any data-protection question, contact us directly:

• Email: dj@stitchieeu.party
• Data Protection Officer: not required — StitchieEU is an individual controller; all requests are handled directly by the owner.

What we process

What we collect and why

• Contact & booking messages — your name, email address and the content of your message, so we can reply and arrange bookings.
• Song orders — your name, email, and the story/style details you provide, used solely to create and deliver your song and handle payment.
• Payment — processed entirely by PayPal. We never see or store card details; we receive only the payment confirmation PayPal returns (e.g. payer email, amount, order reference).
• Basic visit statistics — a file-based page counter. Only with your consent do we store a random identifier in a cookie (“stitchieeu_visitor”) to tell unique visitors apart, and keep a short, anonymous list of those identifiers with their first-visit time in a local server-side file (pruned automatically as the list grows). This is anonymous — no name, no IP, no profile, no cross-site tracking — and it is never shared with third parties. The same statistics are shared by the full site and the mobile version (/mobil/); the mobile version shows the same numbers but never adds to them.
• Mobile layout detection — to give phones a lightweight, mobile-friendly version of the site, the server notes the type of device your browser reports (phone, tablet or computer). This is used only to decide which layout to send and is not stored by us or combined with any other data.
• Accessibility preferences (on your device) — the “Accessibility” menu in the header saves your chosen text size, high-contrast, underline and reduced-motion settings directly in your browser’s local storage, where they stay on your own device. They are never transmitted to us or used for tracking.
• Admin Portal — if you are an authorised admin, a session cookie keeps you signed in.
• Anti-spam & rate limiting — when you send a form (contact, booking or song order), we temporarily keep a one-way hash of your IP address plus a timestamp, used only to stop spam and abuse. No readable IP address is stored, and the markers are removed automatically as the short limit window expires (within a few hours).
• Server & email logs — our hosting provider logs standard technical data (e.g. IP address, time, requested page) to keep the site secure and available, and messages sent to us produce email logs.

Legal bases

Why we are allowed to process it

• Consent (GDPR Art. 6(1)(a)) — the visitor-counting cookie is only used after you actively accept cookies. Consent is freely given, specific and recorded with a timestamp (no IP). You can withdraw it at any time via the “Cookie settings” link in the footer — this deletes the tracking cookie and stops tracking.
• Contract (GDPR Art. 6(1)(b)) — processing your song order or event booking is necessary to fulfil the agreement you enter into with us.
• Legitimate interest (GDPR Art. 6(1)(f)) — replying to your contact messages, maintaining visit statistics without personal profiling, keeping basic server/email logs for security and availability, and preventing spam/abuse through our rate-limiting (which stores only a hashed, time-limited marker and never a readable IP). This also covers detecting the type of device you use so we can serve the right version of the site (mobile or full) — it stores no device data. We weighed our interest against your privacy; none of these uses profiles you or monitors you beyond what is described here.
• Legal obligation (GDPR Art. 6(1)(c)) — keeping payment records for the retention periods required by Danish accounting/tax law.

We do not use your data for marketing, advertising, or sale to third parties. The consent you give on our contact/order forms is for that specific request only.

Cookies & storage

Cookies and similar technologies

No advertising, social-media or marketing cookies are used. Payment (PayPal) runs on PayPal's own pages and may set cookies there under their policy. The Twitch video player on our Watch page is click-to-load: it only contacts Twitch after you press “Load Twitch player”, so no Twitch cookie or request is made on normal page loads. All other content (fonts, images, audio) is served directly from this site — no external analytics or widgets load by themselves.

Consent & withdrawal

Making and changing your choices

• The cookie banner appears before any non-essential cookie is set. Choosing “Only necessary” sets no tracking cookie.
• If you visit from a phone you are automatically served the mobile version (/mobil/). Choosing “Full site” in the mobile footer keeps the full site for 30 days (a small exempt cookie, stitchieeu_desktop); you can switch back anytime via the “Mobile site” link in the full site’s footer, which clears that cookie.
• You can change your choice at any time using the “Cookie settings” link in the footer. Choosing “Only necessary” there deletes the tracking cookie and stops further tracking immediately.
• For compliance documentation we keep an anonymous log of when you made your choice (timestamp + choice only; no IP address, no other data).
• Withdrawing consent does not affect the lawfulness of processing that already happened before the withdrawal (GDPR Art. 7(3)).

Third parties

Who we share data with

• PayPal — processes payments. Their servers are partly outside the EU/EEA (United States); PayPal is covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
• Ko-fi — processes donations ("Buy me a coffee"). If you donate, Ko-fi receives the payment details you provide; their privacy policy applies to that service.
• Web & email host (chosting.dk) — stores site files, order records, contact/consent logs and emails on servers within the EU.
• Email account (Google / Gmail) — a site contact account (bandeckko@gmail.com) is used to read messages. Google is also covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.
• Radio host (AzuraCast server) — the separate StitchieEU radio station (radio.stitchieeu.party) exists independently of this website; the site no longer plays it on any public page. Accessible only via a direct link from the admin Portal; it does not receive personal data from this site.
• Twitch (Amazon) — only if you choose to load the Twitch player or click a Twitch link. Twitch then receives your IP and may set its own cookies on Twitch's domain. Its servers are partly outside the EU/EEA (United States); Amazon is covered by the EU-US Data Privacy Framework and Standard Contractual Clauses.

Footer and menu links go to external services — Twitch, Mixcloud, Discord, Ko-fi, RaidPal (Connextions & TwitchDJs team pages) and the Games pages (“Guild Wars 2” and “Dune Awakening”). These are plain links — we transfer no data to them; their own privacy policies apply only once you visit.

Where data is transferred outside the EEA on your request (e.g. when you use PayPal), we rely on the EU's adequacy decisions and Standard Contractual Clauses described above.

Retention

How long we keep data

• Contact messages: up to 12 months after our last reply.
• Song orders (name, email, details, delivered MP3): kept so you can re-download or update; deleted on request at any time.
• Payment records: only as long as required by Danish accounting/tax law.
• Consent log: up to 24 months, after which old entries are removed.
• Full-site preference cookie (stitchieeu_desktop): 30 days.
• Accessibility settings (stitchieeu_a11y): stored only on your own device until you clear your browser’s site data — we never receive them.
• Visitor-count file: anonymous random identifiers with first-visit time, pruned automatically as the list grows (only the most recent entries are kept); never linked to identity.
• Anti-spam markers (hashed IP + timestamp): removed automatically as the rate-limiting window expires — within a few hours, never stored longer than 24 hours.
• Server logs: managed by our hosting provider and retained only for security and availability purposes.

Security

How we protect it

• The whole site runs over HTTPS (encrypted in transit) and forces secure connections (HSTS, including subdomains).
• Strict technical protections are active site-wide: a Content-Security-Policy (CSP) that only allows our own scripts, styles and media — no third-party scripts, tracking or embedded content can run; forms may only be sent to our own site and to PayPal; the site cannot be embedded (framed) by other websites; and browsers only report their origin to this domain.
• Order records and delivered files are stored outside the public web folder, and the Portal is password-protected. The audio catalog is served from a dedicated media folder and streamed; the admin area blocks direct access to its internal code.
• Session and consent cookies use Secure + SameSite flags; visitor identifiers are random, single-use and IP-free.
• Form submissions are rate-limited using only a hashed, time-limited marker stored outside the web root — no readable IP address is ever recorded by us.

Accessibility

Using this site with a disability

This website is built to be usable by everyone, including visitors who use a keyboard, a screen reader, voice control, or who prefer larger text or less motion. We aim to meet the WCAG 2.1 level AA guidelines and have added the following:

• A “Skip to main content” link as the first focusable element on every page, plus clear landmarks and headings for screen-reader navigation.
• An accessible menu “Accessibility” in the header lets you enlarge the text in four steps, switch to higher-contrast colours, underline every link and turn off animations — your choice is saved on your device for your next visit. The mobile version of the site (/mobil/) offers the same Accessibility menu with the same options.
• A visible keyboard focus outline on all links, buttons, form fields and menu items, so you can always see where you are.
• Keyboard-operable menus and controls — the navigation, dropdowns, cookie banner, players and the song-order steps can all be used without a mouse, and the Esc key closes open menus.
• Labels and announcements for forms and errors (including aria-invalid and live error messages), and descriptive text alternatives for images and audio players.
• Reduced-motion support — if your device requests less motion, animations, smooth scrolling and the animated visualiser are switched off automatically.
• Resizable text and responsive layout so content reflows and remains usable on small screens and at increased zoom.

If any part of this site is difficult for you to use, or you need information in another format, email dj@stitchieeu.party and we will help and fix it. Accessibility does not require any additional personal data from you and is not used for tracking.

Your rights

Your GDPR rights

Under the GDPR you have the right to:

• Access a copy of the personal data we hold about you
• Rectification of inaccurate or incomplete data
• Erasure (“right to be forgotten”)
• Restriction of processing while a request is reviewed
• Portability — receive your data in a machine-readable format
• Object to processing based on legitimate interest
• Withdraw consent at any time (via the footer's “Cookie settings”)
• Not be subject to automated decision-making — we make no automated decisions about you, and no profiling of your data takes place

To exercise any of these rights, email dj@stitchieeu.party. We will respond within one month as required by GDPR Art. 12.

If you are not satisfied with our response, you can complain to the Danish Data Protection Agency (Datatilsynet, www.datatilsynet.dk).