🇩🇪
Listen to the Single
Legal

Privacy Policy

Privacy policy under the GDPR · As of October 2026

1. Data controller

Nhu Lai Dinh · Bodhi Cita Records
Zugspitzstraße 4 · 85591 Vaterstetten · Germany
Phone: +49 176 58873676 (Mon–Fri 10 am–6 pm CET)
Email: info@bodhicitarecords.com

2. Principles

We process personal data only insofar as necessary to provide this website, to process orders, to fulfil legal obligations or on the basis of your consent (Art. 6 (1) a, b, c and f GDPR). Data is processed for the stated purpose only, minimised, and stored only as long as required for that purpose or by statutory retention periods (8 years for invoices and accounting records under § 147 AO / § 14b UStG, 10 years for books and financial statements).

3. Hosting & server logs (Cloudflare)

This website is delivered via Cloudflare Pages (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA, with European data centres). When you visit, technically necessary connection data is processed (IP address, date and time, page requested, browser and operating-system identifiers, referrer) to deliver the site and protect it against attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6 (1) f GDPR). Cloudflare is certified under the EU-US Data Privacy Framework; standard contractual clauses additionally apply. More: cloudflare.com/privacypolicy.

4. Cookies & local storage

This website does not use tracking or advertising cookies. Only technically necessary settings are kept in your browser's local storage: your chosen theme (light/dark) and the identifier of your cart so it is retained on your next visit. During checkout, Shopify sets technically necessary cookies to process the purchase; details are in the shop's privacy policy linked in the checkout.

5. Online shop & order processing (Shopify)

Our shop (product data, cart and checkout) runs on the Shopify platform (Shopify International Limited, Victoria Buildings, 1–2 Haddington Road, Dublin 4, D04 XN32, Ireland; parent company Shopify Inc., Ottawa, Canada). When you order, we process the data required to perform the contract: name, delivery and billing address, email address, phone number if provided, items ordered, payment method and order history (Art. 6 (1) b GDPR). Payment data (e.g. card numbers) is processed exclusively by the respective payment provider and is not transmitted to us. Shopify may process data in Canada and the USA; an EU adequacy decision exists for Canada, and Shopify is certified under the EU-US Data Privacy Framework for the USA. We retain order and invoice data for 8 years under German commercial and tax law (§ 147 AO, § 14b UStG). More: shopify.com/legal/privacy.

6. Payment providers

Depending on the chosen payment method, the data required for payment (name, amount, currency, order number, and where applicable address and email) is transmitted to the respective provider (Art. 6 (1) b GDPR):

  • Shopify Payments (credit card, Apple Pay, Google Pay, Shop Pay) – processed by Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland.
  • PayPal – PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg.
  • Klarna – Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden. For pay-later or instalment options Klarna performs an identity and credit check; details in Klarna's privacy notice.

7. Production partners & shipping

Our items are made to order by production partners and shipped directly to you. For this we transmit the data necessary for production and delivery (name, delivery address, email address and phone number for delivery notifications where provided, items ordered) to:

  • Gelato (Gelato ASA, Oslo, Norway) with local print partners in Germany or the destination country – wall art and cards.
  • Printful (Printful Latvia SIA, Riga, Latvia / Printful, Inc., Charlotte, USA) with production sites in Latvia and Spain – apparel, phone cases, mugs, bags and further merch items.

Carriers (DHL, Deutsche Post, DPD, GLS, UPS) receive the delivery data. The legal basis is performance of the contract (Art. 6 (1) b GDPR).

8. Withdrawal function (“Withdraw from contract”)

If you declare a withdrawal via our online form, we process the data entered there (name, email address, order number, order date, items concerned and message where provided) together with the date and time of receipt in order to handle the withdrawal and send you the legally required confirmation of receipt (Art. 6 (1) b and c GDPR, § 356a BGB). The confirmation email is sent via the email service Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany; parent company Sendinblue SAS, Paris) from the sender address widerruf@mahasamadhi.de, with info@bodhicitarecords.com set as the reply address. For technical purposes Brevo records whether a message was delivered and opened (counting pixel). We have set this counting to anonymous in Brevo: opens are not linked to individual recipients. The data is retained for evidence purposes for the duration of the statutory limitation periods.

9. Newsletter (Brevo)

For the newsletter we use Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany; parent company Sendinblue SAS, Paris). Sign-up uses the double-opt-in procedure; we store your email address, the time of sign-up and confirmation, and the IP address as proof of consent (Art. 6 (1) a GDPR). You may withdraw your consent at any time via the unsubscribe link in every email or by message to us; the lawfulness of processing before withdrawal remains unaffected.

10. Contact by email or phone

If you contact us by email or phone, we process your details to handle the enquiry (Art. 6 (1) b or f GDPR). The data is deleted once the enquiry has been dealt with and no statutory retention obligations apply.

11. Embedded videos (YouTube)

On some pages we embed YouTube videos in privacy-enhanced mode (youtube-nocookie.com) (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When you open a page with an embedded video, your browser connects to Google to load the preview image and your IP address is transmitted (legal basis: our legitimate interest in presenting our music, Art. 6 (1) f GDPR). In privacy-enhanced mode Google sets no tracking cookies before playback; only when you start a video does Google process further data, which may be stored in the USA (Art. 6 (1) a GDPR by starting the video). Google is certified under the EU-US Data Privacy Framework. More: policies.google.com/privacy.

12. Fonts & external links

The fonts used are served locally from our server; no connection to Google servers is made for this. Links to streaming services and social networks (Spotify, Apple Music, YouTube, Instagram, TikTok, Pinterest, Facebook, Bandcamp and others) are plain links – only when you click do you leave our site, and the respective provider's privacy policy applies.

13. Your rights

You have the right at any time to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent at any time (Art. 7 (3)).

Right to object: Where we process data on the basis of a legitimate interest (Art. 6 (1) f GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You also have the right to lodge a complaint with a data-protection supervisory authority – the authority responsible for us is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany. Please send requests concerning your rights to: info@bodhicitarecords.com.

14. Data security

All data is transmitted encrypted via TLS (https). We take technical and organisational measures to protect your data against loss, misuse and unauthorised access.