Privacy Policy

Last updated: 18 October 2026

Privacy Policy

This policy explains what personal data we collect, why, and what your rights are. It follows the EU General Data Protection Regulation (GDPR) and Greek Law 4624/2019.

1. Who is responsible

The data controller is SHAMANIC GROOVE ΕΠΕ ΥΠΟΚΑΤΑΣΤΗΜΑ ΑΛΛΟΔΑΠΗΣ (Greek branch of a foreign company), trading as Nebula Music. ΑΦΜ 802927177, ΓΕΜΗ 185504906001, Υπολοχαγού Αγγελάκη 10, 56122 Μενεμένη, Thessaloniki, Greece.

For anything about your data, write to info@nebulamusic.org.

2. What we collect

  • Account: your email address, your name and your password (stored only as a secure hash).
  • Billing: billing address, country, VAT number if you give one, and the information needed to apply the right VAT.
  • Orders: what you bought, when, the price, the tax, and your invoices.
  • Licences and activations: your licences, and for each activated computer a hashed machine ID, the computer's name, the macOS version and the app version, with activation and deactivation dates.
  • Newsletter: your email address and a record of your consent, only if you sign up.
  • Support: the messages you send us.
  • Technical: server logs with IP addresses, kept for security.

We do not receive your card number. Stripe handles it.

The software does not upload your projects, audio or recordings to us.

3. Why we use it, and on what legal basis

  • To sell, deliver and support your licence, and run your account — to perform our contract with you (GDPR art. 6(1)(b)).
  • To check activations and limit a licence to 5 computers — to perform the contract, and our legitimate interest in preventing licence misuse (art. 6(1)(b) and (f)).
  • To issue invoices, apply VAT and keep accounting records — legal obligation under Greek tax and EU VAT law (art. 6(1)(c)).
  • To send our newsletter — your consent (art. 6(1)(a)). You can withdraw it at any time with the link in every email.
  • To email you about your order, your plan ending, or important product and security news — to perform the contract (art. 6(1)(b)). These are not marketing.
  • To keep our servers secure — our legitimate interest (art. 6(1)(f)).

We do not sell your data. We do not use it for advertising profiles. We make no automated decisions about you that have legal or similar effects.

4. Who we share it with

  • Stripe processes payments. Stripe receives your card and payment details directly. See stripe.com/privacy.
  • Hetzner Online GmbH provides the servers our website, accounts, licence system and email run on, in Germany and Finland (EU).
  • Our own mail server sends our emails. We do not use an outside email marketing service.
  • Our accountant and the tax authorities, as Greek law requires.
  • The EU VIES service, to check a VAT number you give us.

We may also disclose data if the law or a court requires it.

5. Transfers outside the EU

We keep your data in the EU. Stripe may process payment data outside the EU, including in the United States. Stripe relies on the EU–US Data Privacy Framework and on the European Commission's Standard Contractual Clauses for these transfers.

6. How long we keep it

  • Invoices and accounting records: 10 years, as Greek tax law requires.
  • Licence and activation records: for as long as the licence exists, so we can restore it and answer questions about it. A perpetual licence does not expire, so we keep its record while your account exists.
  • Account: until you ask us to close it. Invoices are then still kept for the 10 years above.
  • Newsletter: until you unsubscribe. We keep proof of your consent and of your unsubscribing.
  • Support messages: up to 3 years after the last message.
  • Server logs: a few weeks.

7. Your rights

You have the right to:

  • get a copy of your data (access);
  • correct wrong data;
  • have your data deleted, unless we must keep it by law (for example invoices);
  • restrict how we use it;
  • receive your data in a portable format;
  • object to use based on our legitimate interest;
  • withdraw your consent at any time, for example to the newsletter. This does not affect what we did before.

To use any of these rights, write to info@nebulamusic.org from the email address on your account. We reply within one month. We may ask you to confirm your identity.

8. Complaints

You may complain to the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Κηφισίας 1-3, 11523 Athens, www.dpa.gr, or to the authority in the EU country where you live. We would be glad if you contacted us first.

9. Security

We use encrypted connections (HTTPS), hashed passwords, restricted access and regular backups. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

10. Children

Our shop is not for children under 16. We do not knowingly collect their data.

11. Cookies

See our Cookie Policy.

12. Changes

We may update this policy. We will show the new date at the top, and tell you by email about important changes.