Legal
Privacy policy.
What we collect when you shop with us, why we collect it, who else sees it, and how to get it removed.
Who is responsible
Nirvana Musicals is the data controller for the personal information described here. That means we decide what is collected and what it is used for, and we are accountable for it.
Questions about anything on this page, including requests to see or delete your information, can go to the contact address in the footer.
What we collect
When you place an order we collect the name, email address, phone number and delivery address you give us, along with what you bought and what you paid. If you contact us or subscribe to the newsletter we keep that message and your email address.
We also record basic technical information about visits to the site — pages viewed, referring site, approximate location from your IP address — so we can tell which parts of the shop are working.
Guest baskets and how we recognise you
There are no customer accounts on this site. When you add something to a basket we create an anonymous session and store a long random token in a cookie on your device; the server keeps only a hash of that token.
That token is what links a basket, and later an order, to you. It contains no personal details, it is not used to build an advertising profile, and clearing your browser cookies ends the session.
Why we use it
We use your details to take payment, deliver your order, handle returns and answer your questions — in other words, to perform the contract you entered into with us.
We use order history and site analytics for our own legitimate interest in running the shop: understanding what sells, spotting fraud and improving the site. Marketing email is only sent where you asked for it, and every message includes an unsubscribe link.
Who we share it with
Couriers receive the name, address and phone number needed to deliver your parcel. Payment providers receive what they need to authorise a payment. Email is sent through a transactional email provider, and the site is hosted on servers operated by our hosting partner.
We do not sell your personal information, and we do not share it for anyone else's marketing.
How long we keep it
Order records are kept for as long as we need them for warranty, accounting and tax purposes, which in practice means several years after your last purchase.
Newsletter subscriptions are kept until you unsubscribe. Contact messages and abandoned baskets are deleted once they are no longer useful, and analytics data is aggregated so that it stops identifying anyone.
Your rights
You can ask for a copy of the information we hold about you, ask us to correct it, or ask us to delete it where we have no continuing reason to keep it. You can object to processing based on our legitimate interests, and you can withdraw consent to marketing at any time.
We answer requests within one month. If you are unhappy with how we have handled your information you can complain to your national data protection authority.
Keeping it secure
Traffic to the site is encrypted, staff access is password-protected and limited by role, and passwords are stored only as one-way hashes. We keep the amount of personal information we hold to the minimum needed to run the shop.
