Last updated: 24 October 2026
This English version is provided for convenience only. The French version (Politique de confidentialité et cookies) is the legally binding text.
This policy explains how Val-U-Music Studios collects and uses your personal data on https://val-u-music.com, in accordance with Regulation (EU) 2016/679 (“GDPR”), the amended French Data Protection Act of 6 January 1978 (“Loi Informatique et Libertés”) and the French data protection authority (CNIL) guidelines on cookies.
1. Data controller
Valery Shpolansky, sole trader (Entrepreneur individuel – EI), trading as Val-U-Music Studios – SIRET 952 183 184 00011 – Rue Henri Dunant, 37540 Saint-Cyr-sur-Loire, France – valumusicstudios@gmail.com – +33 (0)7 81 20 10 31.
Given the size of the business, no Data Protection Officer (DPO) has been appointed; any question can be sent to the address above.
2. Data collected, purposes and legal bases
| Purpose | Data | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Answering your requests (contact forms, email, phone, WhatsApp) and preparing quotes | Name, email, phone (optional), requested service, message, any files you send | Pre-contractual steps at your request (b) or legitimate interest in answering enquiries (f) |
| Performing services (mixing, mastering, recording, editing, sound design, custom audio, lessons) | Identity, contact details, audio files and project material, correspondence | Performance of a contract (b) |
| Selling and delivering Digital Products, customer account, download links | First and last name, email, billing address, order history, account credentials, IP address | Performance of a contract (b) |
| Online payment | Transaction data (card details are handled directly by the payment provider and never stored by Val-U-Music Studios) | Performance of a contract (b) |
| Invoicing and accounting | Identity, contact details, invoices, payments | Legal obligation (c) |
| Site security, spam and fraud prevention (reCAPTCHA, server logs, firewall) | IP address, browser technical data, connection logs | Legitimate interest in securing the Site (f) |
| Audience measurement (Google Analytics, Jetpack/WooCommerce statistics) | Pages viewed, technical data, cookie identifiers, traffic source | Consent (a) |
| Advertising performance measurement (Google Ads) | Cookie identifiers, interactions with the Site | Consent (a) |
| Embedded players and content (SoundCloud, YouTube, Google Maps, Google reviews) | IP address, cookies set by these platforms | Consent (a) |
| Managing customer reviews and the business relationship; establishing and defending legal claims | Identity, correspondence, order details | Legitimate interest (f) |
Fields marked with an asterisk in forms are mandatory; without them your request cannot be handled. No automated decision-making or profiling with legal effects is carried out.
3. Retention periods
- Contact requests and prospects: 3 years from your last contact.
- Customers (contract data): duration of the relationship, then 5 years (general limitation period, Art. 2224 French Civil Code).
- Invoices and accounting records: 10 years (Art. L123-22 French Commercial Code).
- Audio files and projects: 12 months after delivery, unless a different period is agreed in the quote or you ask for earlier deletion.
- Customer account: until deleted, or after 3 years of inactivity.
- Cookies and trackers: durations shown in the table in section 6; your cookie choice is kept for 12 months; Google Analytics statistics data: 14 months maximum.
- Security logs: 12 months maximum.
4. Recipients and processors
Your data is intended for Valery Shpolansky only and is never sold. It may be processed on his behalf by the following providers, strictly within the scope of their tasks:
| Provider | Role | Location |
|---|---|---|
| o2switch | Website and database hosting | France |
| Google (Gmail) | EU / USA | |
| WooPayments (Automattic) and Stripe | Card payment in the shop, security and fraud prevention (Stripe acts as a separate controller for its own legal obligations) | EU (Ireland) / USA |
| PayPal | Payment for a service, only if you choose this method (separate controller) | EU (Luxembourg) / USA |
| Google (reCAPTCHA, Analytics, Ads, Maps, YouTube) | Anti-spam, audience measurement, advertising, embedded maps and videos | EU / USA |
| Automattic (Jetpack, WooCommerce) | Statistics and shop features | USA |
| SoundCloud | Embedded audio players (after consent) | EU (Germany) / USA |
| Trustindex | Display of Google reviews | European Union (Hungary) |
| WhatsApp (Meta) | Messaging, only if you choose that channel | EU / USA |
If other providers are used in future (for example an accountant or invoicing tool), this list will be updated. Data may also be disclosed to administrative or judicial authorities where required by law.
5. Transfers outside the EU
Some providers (notably Google, Automattic and Meta) may process data in the United States. These transfers rely on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework for certified companies or, failing that, on the European Commission’s Standard Contractual Clauses (Arts. 45 and 46 GDPR). A copy of the safeguards is available on request.
6. Cookies and trackers
On your first visit, a banner lets you accept, reject or customise cookies, each as easily as the others. Audience-measurement and advertising cookies, as well as embedded videos, maps and players, are only activated after your consent. You can change or withdraw your choice at any time via the “Cookies” link at the bottom of every page. Rejecting these cookies does not prevent you from using the Site.
Embedded content, fonts and reviews: YouTube videos, the Google Maps map on the Contact page and SoundCloud players are shown as a click-to-load panel. They load, and their provider can set cookies, only if you click the panel (which counts as your consent for that item) or if you have accepted all cookies, or the “Advertisement” category, in the banner. YouTube videos then load from youtube-nocookie.com. Video thumbnails, the reviewers’ profile pictures and the icons of the reviews widget are copies stored on our own server, and our typefaces (Google Fonts: Playfair Display, Poppins, Abril Fatface) are hosted on our own server, so displaying them does not connect your browser to Google.
What still connects to a third party without consent, and why: (1) the script of the customer-reviews widget on the home page (Trustindex, a provider based in the EU), which sets no cookie and is needed to display the reviews; (2) Google reCAPTCHA, which protects our forms against spam (on the Contact page and when you open a booking or contact form); (3) on the checkout page only, our payment provider Stripe (WooPayments) and its fraud-prevention services (including hCaptcha), which are strictly necessary to process your payment securely. Your browser then shares, in particular, your IP address with these providers.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
| Strictly necessary (no consent needed) | |||
| cookielawinfo-checkbox-*, CookieLawInfoConsent, viewed_cookie_policy | val-u-music.com | Remember your cookie choices | 12 months |
| pll_language | val-u-music.com | Remember your language (FR/EN) | 1 year |
| woocommerce_*, wp_woocommerce_session_* | val-u-music.com | Cart and checkout | Session to 2 days |
| wordpress_*, wordpress_logged_in_* | val-u-music.com | Customer account login | Session / 14 days |
| _GRECAPTCHA | google.com | Form spam protection (reCAPTCHA) | 6 months |
| __stripe_mid, __stripe_sid, m, __ssid, hmt_id, __cf_bm | Stripe / WooPayments and their fraud-prevention services (Sift, hCaptcha) | Payment security and fraud prevention (checkout page only) | 30 minutes to 1 year |
| Audience measurement (with consent) | |||
| _ga, _ga_KGGWHBTQPF | Google Analytics (MonsterInsights) | Visit statistics | 13 months maximum |
| tk_ai, tk_or, tk_r3d, tk_lr, tk_qs | Jetpack / WooCommerce (Automattic) | Site and shop statistics | Session to 13 months |
| sbjs_* | WooCommerce (order attribution) | Know which visit source led to an order | Session |
| Advertising (with consent) | |||
| _gcl_au | Google Ads | Ad conversion measurement | 90 days |
| IDE | doubleclick.net (Google) | Ad measurement and targeting | 400 days maximum (set by Google) |
| Embedded content (only after your click or consent) | |||
| SoundCloud cookies | soundcloud.com | Play embedded tracks | Set by SoundCloud |
| YSC, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, __Secure-YNID, __Secure-ROLLOUT_TOKEN | youtube.com / youtube-nocookie.com | Play embedded videos | Session to 6 months |
| Google Maps cookies | google.com | Display the map (Contact page) | Set by Google |
More about these third parties: Google, SoundCloud, Automattic, Stripe, Trustindex. You can also set your browser to block cookies.
7. Your rights
You have the right of access, rectification, erasure, restriction, objection (including, at any time and without reason, to direct marketing) and portability, the right to withdraw consent at any time, and the right to give instructions on what happens to your data after your death (Arts. 15–22 GDPR; Art. 85 French Data Protection Act).
To exercise them: valumusicstudios@gmail.com or by post to the address in section 1. You will receive an answer within one month (extendable by two months for complex requests). Proof of identity may only be requested if there is reasonable doubt about your identity.
If you believe your rights have not been respected, you may lodge a complaint with the CNIL – 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France – www.cnil.fr/fr/plaintes – or with the supervisory authority of your EU country of residence.
8. Security
The Site is served over HTTPS; administration access is restricted and protected; payments are handled by a PCI-DSS certified provider; regular backups are made. No system is infallible: any data breach posing a risk will be notified to the CNIL and, where required, to the people concerned (Arts. 33 and 34 GDPR).
9. Minors
Purchases on the Site are reserved for adults or for minors authorised by their legal guardian. For music lessons for a minor, data is collected from the legal guardian. In France, a minor under 15 cannot consent alone to non-essential cookies (Art. 45 French Data Protection Act).
10. Changes
This policy may change, in particular when new tools are added. The update date appears at the top of the page. See also the Legal Notices and the Terms of Sale.