How we collect, use, and protect your personal data. In compliance with the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).
At Lenz Music Lab we take your privacy seriously. This document explains, in plain language, what personal data we collect when you interact with our website and services, why we collect it, who has access to it, how long we keep it, and what rights you have over it.
The entity responsible for the processing of your personal data is:
Lenz Music Lab (commercial name)
Legal name: [Pending — to be updated upon SL incorporation]
Tax ID (NIF/CIF): [Pending]
Registered address: Barcelona, Spain
Contact email: hello@lenzmusiclab.com
Website: lenzmusiclab.com
For matters specifically related to data protection, you can also reach us directly at privacy@lenzmusiclab.com.
We only collect data that is necessary for the purposes described below. Specifically:
When you submit our contact form (/contact), we collect:
If you are an existing client and complete the data form we send you, we collect:
When you contract our mastering, mixing, or production services, we additionally process:
When you browse the site, our servers automatically receive standard technical information (IP address, browser type, pages visited, timestamps) for security, troubleshooting, and basic analytics purposes.
Under GDPR, we must have a valid legal basis to process your personal data. We use the following:
Legal basis: your consent (Article 6.1.a GDPR), expressed when you submit the contact form.
Legal basis: execution of a contract (Article 6.1.b GDPR). This includes processing your audio, communicating about the project, delivering the final files, and invoicing.
Legal basis: compliance with legal obligations (Article 6.1.c GDPR). This includes keeping invoicing records as required by Spanish tax law (Ley General Tributaria, Royal Decree 439/2007).
Legal basis: your explicit consent (Article 6.1.a GDPR). We only send marketing emails (updates about new services, releases, educational content) if you actively opt in. You can withdraw consent at any time.
Legal basis: our legitimate interest (Article 6.1.f GDPR) in understanding how the site is used and improving the quality of our services, without compromising your rights and freedoms.
Legal basis: your consent (Article 6.1.a GDPR), given through the cookie banner. Without it, no analytics or advertising cookies are set. You can withdraw it at any time from the "Cookie preferences" link at the bottom of every page (see Cookies).
We keep your data only as long as necessary for the purposes for which it was collected:
We never sell your personal data. We share it only with the following categories of recipients, and only when strictly necessary:
We work with carefully selected providers who process data on our behalf under data processing agreements (DPA):
Only if you accept cookies, the following providers receive data about your visit (pages viewed, device and browser information, and the actions described in Cookies):
We may share data with public authorities (tax authority, judicial bodies) when required by law.
Our primary data processing happens within the European Union, where GDPR applies directly. In specific cases, some processors may transfer data outside the EU (for example, certain cloud services). In all such cases, we ensure that adequate safeguards are in place, such as:
Google and Meta may process the data they receive through our analytics and advertising cookies in the United States. Both companies are certified under the EU-U.S. Data Privacy Framework and also rely on Standard Contractual Clauses.
Our website uses cookies that are strictly necessary for it to work and, only if you accept them in the cookie banner, analytics and advertising cookies. Until you decide, only the necessary ones are used.
These cookies do not require consent as they are essential for the site to work. Your cookie decision itself is stored in your browser's local storage.
Google Analytics (Google Ireland Ltd.) helps us understand how the site is used: pages visited, time on site, approximate location and device type. Cookies: _ga and _ga_*, up to 2 years.
Meta Pixel (Meta Platforms Ireland Ltd.) lets us measure the effectiveness of our ads on Instagram and Facebook: visits, contact requests, items added to the cart, sign-ups and purchases coming from those ads, and lets us show our ads to people who have visited the site. Cookies: _fbp and _fbc, up to 90 days.
If you submit a form or make a purchase, your email address and phone number may be sent to Meta in hashed (encrypted, non-readable) form to match the conversion with the ad. For the collection and transmission of this data, Meta and Lenz Music Lab act as joint controllers; Meta then processes it under its own privacy policy.
The pixel is never loaded on the private order pages (briefing and feedback links).
You can accept or reject analytics and advertising cookies at any time from the Cookie preferences link at the bottom of every page. If you withdraw your consent, those cookies are deleted and no further data is sent.
You can control or delete cookies through your browser settings. Disabling essential cookies may affect site functionality.
We implement appropriate technical and organizational measures to protect your data:
Despite these measures, no system is 100% secure. In the unlikely event of a data breach affecting your personal data, we will notify the Spanish Data Protection Agency (AEPD) within 72 hours and inform you directly if there is a high risk to your rights.
Under GDPR you have the following rights regarding your personal data:
To exercise any of these rights, send a request to privacy@lenzmusiclab.com with:
We will respond within 30 days of receiving your request. In complex cases this period may be extended by an additional 60 days, in which case we will inform you of the extension and its reasons.
Exercising your rights is free of charge. We may only charge a reasonable fee for manifestly unfounded or excessive requests.
Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from minors. If you are under 18, please do not submit any personal information to us. If we become aware that we have inadvertently collected data from a minor, we will delete it as soon as possible.
Parents or guardians who believe a minor has provided us with personal data can contact us at privacy@lenzmusiclab.com and we will promptly delete it.
We may update this privacy policy from time to time to reflect changes in our practices or for legal reasons. The "Last updated" date at the top of this document indicates when it was last revised.
For significant changes that affect how we process your personal data, we will notify you directly (by email if you have given us your contact details) or through a prominent notice on the website. We encourage you to review this policy periodically.
For any question, concern, or request related to this privacy policy or your personal data:
Email (privacy matters): privacy@lenzmusiclab.com
Email (general): hello@lenzmusiclab.com
Postal address: Lenz Music Lab — Barcelona, Spain
Website: lenzmusiclab.com
If you believe your data protection rights have been violated and we have not addressed your complaint satisfactorily, you can lodge a complaint with the Spanish supervisory authority:
Agencia Española de Protección de Datos (AEPD)
C/ Jorge Juan, 6 · 28001 Madrid · Spain
Phone: +34 901 100 099
Web: www.aepd.es