Privacy & Cookie Policy
Last updated: 3 November 2026
1. Who we are
1.1. The controller of personal data processed through make.8merch.com is 8MERCH Sp. z o.o. (limited liability company), Królewska 57, 30-081 Kraków, Poland; entered in the Register of Entrepreneurs of the National Court Register under KRS 0000404155 (District Court for Kraków-Śródmieście in Kraków, XII Commercial Department); NIP (tax ID) 6772365762; REGON 122461979; share capital PLN 5,000.00 paid in full ("8Merch", "we", "us").
1.2. Contact for anything in this policy, including exercising your rights: [email protected], or by post to the address above, marked "Personal data".
1.3. We have not appointed a data protection officer, as the GDPR does not require one for our processing.
1.4. We process personal data in accordance with Regulation (EU) 2016/679 (the "GDPR"), the Polish Personal Data Protection Act of 10 May 2018, the Polish Electronic Communications Law of 12 July 2024 (as regards cookies and similar technologies) and, for visitors in the United Kingdom, the UK GDPR and the Data Protection Act 2018.
2. Scope of this policy
2.1. This policy explains how we process personal data when you use make.8merch.com (the "Platform"), a business-to-business service for configuring, quoting, ordering and paying for vinyl pressing and printed packaging. It covers:
- the landing page and the launch list;
- the private-access gate (email and one-time code);
- the configurator at make.8merch.com/vinyl, including uploads of audio and artwork;
- the client portal at make.8merch.com/account (account, company details, team members, addresses, orders, approvals, payments);
- the payment step run through Stripe;
- emails we send in connection with the above.
2.2. The Platform is a professional tool used by record labels, artists, managers, distributors and mastering studios and their staff, ordering for their business or professional activity ("Clients"). Where you act on behalf of a company, some of your data is processed because of your role there; where you order as an individual, for example as an independent artist, you are our contracting party yourself.
2.3. The use of the Platform, including ordering, is governed by the make.8merch.com Terms of Use. Capitalised terms not defined here have the meaning given in those Terms.
2.4. This policy covers only make.8merch.com, which is a separate service. Our other services, such as the 8merch.com website and store, the pre-order store at preorder.8merch.com and Shopify stores we run for our clients, have their own privacy policies.
3. What data we process, why, and on what legal basis
3.1. We process the data below only for the purposes stated next to it. Legal bases refer to Article 6(1) GDPR: (a) consent, (b) contract or steps taken at your request before a contract, (c) legal obligation, (f) legitimate interests. How long we keep each item is in section 8.
| Purpose | Data | Source | Legal basis |
|---|---|---|---|
| Giving you private access to the configurator (sending and checking the one-time code) | Email address; time of access | You, at the access gate | Art. 6(1)(b) — steps at your request before a contract |
| Telling you when the Platform opens publicly (launch list) | Email address | You, on the landing page | Art. 6(1)(a) — consent |
| Sending marketing emails about our services | Email address; record of your opt-in | You, if you tick the marketing box at the access gate | Art. 6(1)(a) — consent; prior consent to commercial email is also required by Art. 398 of the Polish Electronic Communications Law |
| Running your client account and preparing quotes | Name, email, phone number, billing address; company name and VAT number where the Client has them; account password (stored only as a hash) | You or a colleague, in the portal and order form | Art. 6(1)(b) — contract; where you act for a Client, Art. 6(1)(f) — our legitimate interest in serving the Client you represent |
| Giving your colleagues access to the Client account | Team member's name, email, role | A colleague who adds you | Art. 6(1)(f) — the Client's and our legitimate interest in letting the Client's staff work on its orders |
| Producing and delivering your order | Order specification; release information (artist, title, barcode, tracklist); uploaded audio masters and artwork; delivery addresses and how the order is split between delivery addresses; contact details printed on the specification sheet | You, in the configurator and portal | Art. 6(1)(b) — contract |
| Recording approvals (artwork, audio, test pressings) and account activity | Who approved or changed what, and when | Generated by the Platform | Art. 6(1)(b) — contract; Art. 6(1)(f) — our legitimate interest in being able to show what was approved, in case of a dispute |
| Taking payment, setting up card or SEPA mandates, refunds | Name, email, payment method (held by Stripe), amounts, payment status and dates | You, through Stripe; Stripe | Art. 6(1)(b) — contract |
| Invoicing, accounting and tax (including VAT reverse charge for VAT-registered Clients and destination-country VAT for other Clients in the EU) | Client name or company data, invoice data, VAT number and the result of its check in the EU VIES system | You; VIES | Art. 6(1)(c) — legal obligations under Polish tax and accounting law |
| Keeping the Platform secure and preventing abuse (rate limiting) | IP address; request counters | Your browser | Art. 6(1)(f) — our legitimate interest in the security of the Platform |
| Measuring which Google ads lead to paid orders | Google ad click ID; your cookie choice; order value, currency, payment time and a random order reference | Your browser, only after you click Accept; our order records | Art. 6(1)(a) — consent (see sections 4 and 5) |
| Establishing, pursuing or defending claims | Data listed above that is relevant to the claim | As above | Art. 6(1)(f) — our legitimate interest in protecting our rights |
| Answering your messages | Email address, name and what you write to us | You | Art. 6(1)(f) — our legitimate interest in answering enquiries; Art. 6(1)(b) where the message concerns an order |
3.2. Is providing data required? Data needed to give access, quote, produce, deliver and invoice an order is a condition of the contract: without it we cannot accept the order. Data needed for invoices and tax records is also required by law. Marketing and ad-measurement consents are entirely optional, and refusing them changes nothing else on the Platform.
3.3. Data about colleagues. If you add a team member, or give someone else's details as a contact or delivery recipient, please tell them about this policy.
3.4. What we do not collect. We do not ask for or knowingly process special categories of data (Article 9 GDPR). Card numbers and bank details for mandates go directly to Stripe and never reach our servers.
3.5. Uploaded content. Audio and artwork you upload may themselves contain personal data, such as names and photographs of artists in credits or artwork. We process them only to produce your order, as described in the Terms of Use, and you are responsible for having the right to provide them.
4. Cookies and browser storage
4.1. The Platform stores small pieces of information on your device. Most are entries in your browser's local storage; a few are cookies. The law treats both the same way: we may store or read them without your consent only when they are strictly necessary for a service you asked for. Everything else needs your consent first.
4.2. Your choice. When you first visit, a cookie bar offers Accept and Decline, shown with equal weight. Until you choose Accept, only the essential items below are used. You can change your mind at any time through the Cookie settings link at the foot of every page; withdrawing consent does not affect processing that took place before you withdrew it.
4.3. Essential items (no consent needed).
| Name | Type | Purpose | How long |
|---|---|---|---|
| 8merch_client_token, 8merch_client_info | Local storage | Keeps you signed in to the client portal | Until you sign out; the session expires after 24 hours |
| 8merch_auth_v1, 8merch_preview_email | Local storage | Remembers that you passed the email-code check | Until you clear it |
| 8merch_config_draft | Local storage | Saves your unfinished project so a reload does not lose it | Until you submit or reset the project |
| Theme key | Local storage | Remembers light or dark mode | Until you clear it |
| 8merch_variant_prompt_v1 | Local storage | Makes sure a one-time hint is shown only once | Until you clear it |
| 8merch.measurement.consent.v1 | Local storage | Records your cookie choice so we can respect it | 180 days |
| __stripe_mid, __stripe_sid | Cookies set by Stripe, on the payment step only | Fraud prevention for payments | Set by Stripe, up to about 1 year (see Stripe's cookie policy) |
4.4. Optional items (only after you click Accept).
| Name | Type | Purpose | How long |
|---|---|---|---|
| 8merch.measurement.click.v1 | Local storage | Stores the Google ad click ID (gclid, gbraid or wbraid) if you arrived from a Google ad | 90 days, or until you withdraw consent |
| Google tag cookies (Google Ads, tag AW-18551871018), e.g. _gcl_au | Cookies set by Google | Measuring ad conversions | Set by Google, up to 90 days |
4.5. Third-party resources without our cookies. Our pages load fonts from Google Fonts (fonts.googleapis.com, Google Ireland Ltd / Google LLC) and code libraries from cdnjs (Cloudflare, Inc.). Your browser sends your IP address to these providers when the page loads, as is necessary to deliver the files. We do this on the basis of our legitimate interest in displaying the Platform correctly and quickly (Art. 6(1)(f) GDPR).
4.6. Browser settings. You can also delete or block cookies and local storage in your browser. If you block essential items, you will not be able to sign in or keep a draft project.
5. Google Ads conversion measurement
5.1. With your consent, we tell Google Ads which ad clicks led to a paid order, so we can see which ads work. Nothing is stored or sent for this purpose before you click Accept, and declining changes nothing else on the Platform.
5.2. What happens after you click Accept:
- If you arrived from a Google ad, the ad's click ID is stored in your browser for up to 90 days and the Google tag loads.
- The first time you pass the email-code check, the Google tag records a "verified access" conversion. Your email address and the code are not sent to Google.
- When you submit an order, the click ID is saved with the order on our server.
- Only once the order is paid, our server sends Google Ads the click ID, the paid amount and currency, the payment time and a random order reference (Google's "offline conversion import"). We do not send your name, email, address, files or VAT number.
- If the order is later refunded, we send Google a correction or retraction.
5.3. Settings. Ad personalisation is switched off for this data: we do not build remarketing lists, we do not use enhanced conversions, and we do not use Google Analytics. Your consent choice is passed to Google with each event (Google Consent Mode). Orders that our staff place on a Client's behalf are never reported to Google.
5.4. Google's role. For this measurement Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms. Google may transfer data to Google LLC in the United States (see section 7). How Google uses data is described at policies.google.com/privacy and policies.google.com/technologies/partner-sites.
5.5. Withdrawing consent. Open Cookie settings and choose Decline. This deletes the click ID from your browser and tells our server to stop reporting any order linked to that browser's consent. A conversion already sent to Google before you withdrew stays in Google Ads; we clear the click ID on our server after 90 days in any case (section 8).
6. Who receives the data
6.1. We share data only where needed for a purpose in section 3, and only to the extent needed. Most recipients are processors acting on our instructions under a data processing agreement (Article 28 GDPR). Some act as independent controllers for their own purposes; their own privacy policies then apply.
| Recipient | What they receive | Why | Role | Location |
|---|---|---|---|---|
| Cloudflare, Inc. | Everything the Platform stores: accounts, orders, uploaded files, IP addresses | Hosting, database, file storage, code libraries (cdnjs) | Processor | USA; global network |
| Backblaze, Inc. | Copies of the database and uploaded files | Off-site backup | Processor | EU data centre (eu-central) |
| Brevo (Sendinblue SAS) | Email address and message content | Sending access codes and order emails | Processor | France |
| Shopify International Ltd | Contact name, email, phone, billing address, order lines | Draft orders and invoices | Processor | Ireland; Canada and USA |
| Stripe Payments Europe, Ltd. | Name, email, payment method, amounts | Payments, SEPA mandates, refunds | Processor for payment processing; independent controller for fraud prevention and its legal obligations | Ireland; USA |
| Comarch ERP Optima, maintained by ELTE-S | Client company and invoice data | Accounting and invoicing | Processor | Poland |
| Pressing plants and printers we work with | Order specification, audio, artwork, contact details on the specification sheet | Manufacturing the order | Processor | Mainly the EEA; elsewhere only with the safeguards in section 7 |
| DHL and other carriers | Weights, sizes and destination countries for quotes; recipient name, address and phone when shipping | Shipping rates and delivery | Independent controller | Germany; worldwide |
| Google Ireland Ltd | Ad click ID, conversion value, currency, time — only with your consent | Ad measurement (section 5) | Independent controller | Ireland; USA |
| Google (Google Fonts) | IP address when a page loads | Delivering web fonts | Independent controller | USA |
| European Commission (VIES) and national tax authorities | VAT number | VAT number validation | Independent controller | EU |
| Accounting, legal and debt-collection advisers | Data relevant to the matter | Accounting, legal advice, claims | Processor or independent controller, depending on the service | Mainly Poland |
6.2. We may also disclose data to courts, law-enforcement or tax authorities where the law requires it.
6.3. We do not sell personal data and do not share it with third parties for their own advertising.
7. Transfers outside the European Economic Area
7.1. Some recipients in section 6 are based in, or may access data from, countries outside the EEA, mainly the United States and Canada. We transfer data only where one of the following safeguards applies:
- Adequacy decision of the European Commission: for recipients certified under the EU-US Data Privacy Framework (Commission decision of 10 July 2023), for Canada (commercial organisations), and for the United Kingdom;
- Standard contractual clauses adopted by the European Commission (decision 2021/914), where no adequacy decision applies, together with additional measures where needed.
7.2. You can ask us for a copy of the safeguards that apply to a given transfer using the contact details in section 1.
7.3. Transfers from the United Kingdom are made on the basis of the UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum, as applicable.
8. How long we keep data
8.1. We keep data only as long as needed for the purpose it was collected for, or as long as the law requires. Where a period runs "to the end of a year", it ends on 31 December.
| Data | How long |
|---|---|
| One-time access and login codes | A few minutes, until used or expired; never included in backups |
| IP address counters for rate limiting | Up to about 1 hour |
| Private-access email (no account created) | 12 months after the public launch, or after your last access, whichever is later |
| Launch-list email | Until we tell you the Platform is open, then deleted within 30 days; earlier if you withdraw consent |
| Marketing consent and the email it covers | Until you withdraw consent; the record that you consented or withdrew is kept for 3 years afterwards as evidence |
| Client account data, team members, addresses | While the account is active; after it is closed or 24 months without activity, for the limitation period of claims under Art. 118 of the Polish Civil Code (3 years for Clients running a business and 6 years for other Clients, to the end of the calendar year) |
| Orders, approvals and activity history | To the end of the limitation period counted from completion of the order: 3 years for Clients running a business, 6 years for other Clients |
| Invoices, accounting and tax records (incl. VIES result) | 5 years from the end of the calendar year in which the tax payment deadline fell (Art. 70 of the Polish Tax Ordinance; Art. 74 of the Polish Accounting Act) |
| Uploaded audio masters and artwork | At least 12 months, as stated in the Terms, so that you can re-order; then deleted 24 months after the last order that used them |
| Unsubmitted drafts in your browser | Until you submit or reset the project, or clear your browser |
| Ad click ID in your browser | 90 days, or until you withdraw consent |
| Ad click ID on our server | 90 days; the order's reporting record (amount, time, status) is kept with the order records above |
| Cookie choice in your browser | 180 days, after which we ask again |
| Daily database backups and point-in-time restore (Cloudflare) | 30 days, rolling |
| Off-site backups (Backblaze) | Locked against deletion for 30 days, then deleted after 90 days |
8.2. If a claim, complaint or official proceeding is pending, we may keep the relevant data until it is finally resolved.
9. Your rights
9.1. Under Articles 15–22 GDPR you have the right to:
- access your data and receive a copy;
- rectify inaccurate or incomplete data — most account and company details can be edited in the portal;
- erase your data ("right to be forgotten"), unless we must keep it, for example for tax records or to defend a claim;
- restrict processing, for example while we check a complaint about accuracy;
- data portability: receive data you gave us under a contract or consent in a structured, machine-readable format, or have it sent to another controller;
- object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 6(1)(f)); we will stop unless we have compelling legitimate grounds that override your interests, or need the data for legal claims;
- withdraw consent at any time (marketing emails: the unsubscribe link or an email to us; launch list: an email to us; ad measurement: Cookie settings). Withdrawal does not affect the lawfulness of processing before it.
9.2. To exercise a right, write to [email protected]. We will reply within one month, which may be extended by two further months for complex requests; we will tell you if so. We may ask you to confirm your identity, for example by replying from the email address on the account. Requests are free unless they are manifestly unfounded or excessive.
9.3. Complaints. You may lodge a complaint with a supervisory authority, in particular in the EU country where you live, work or where the alleged infringement took place. Our lead authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. In the United Kingdom, you may complain to the Information Commissioner's Office, ico.org.uk. We would appreciate the chance to resolve your concern first.
9.4. Residents of the United States. We do not sell or share personal data for cross-context behavioural advertising as defined in US state privacy laws. You may make the requests in this section regardless of where you live.
10. Other information
10.1. Automated decisions. We do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects for you (Article 22 GDPR). Prices in the configurator are calculated automatically from the specification you choose, and the VIES check confirms whether reverse-charge VAT applies to a company; neither profiles you.
10.2. Security. All traffic to the Platform is encrypted (HTTPS). Access to the client portal requires a password and an email code; passwords are stored only as hashes. Card and bank details are held by Stripe, not by us. Access to the admin panel is limited to authorised 8Merch staff. Backups are stored separately. We review these measures regularly and will notify the supervisory authority and affected persons of a personal data breach where the GDPR requires it.
10.3. Children. The Platform is not directed at children. Accounts and Orders may be created only by adults (18 or over). We do not knowingly collect data of persons under 16; if we learn that we have, we delete it.
10.4. Links to other sites. The Platform links to other services, such as Stripe's payment pages and 8merch.com. Their own privacy policies apply there.
10.5. Changes to this policy. We may update this policy when the Platform or the law changes. We will publish the new version on this page with its date and, for material changes, tell account holders by email or in the portal before the change takes effect. Earlier versions are available on request.