Privacy Policy

1. Who we are

Beyond Floor Musics ("we", "us", "our") provides royalty-free instrumental music for gymnastics floor routines through this website. We are the data controller for the personal data described in this policy. You can reach us at musicrequest@beyondfloormusic.co.uk, and we will provide our postal address on request.

2. What we collect

• Account details: your email address, display name and password (passwords are stored in hashed form by our authentication provider; we never see them).
• Purchase and download records: which tracks you bought or downloaded, your token balance, order references and amounts paid.
• Guest checkout details: the name and email address you give when buying a track without an account, so we can deliver your download link.
• Bespoke request details: the information you enter on the bespoke request form (name, club, gymnast age range and level, deadline, musical preferences and any notes or reference links you add).
• Contact form messages: your name, email, topic and message.
• Newsletter preference: whether you opted in or out of our newsletter, and your email address if you opted in.
• Payment information: card payments are taken by Stripe. We never receive or store your full card details; we only see a payment reference, the amount and whether it succeeded.
• Technical data: basic information our hosting and backend providers log to keep the site secure and working, such as IP address, browser type and error reports.

We do not knowingly collect personal data directly from children. If a club or parent is choosing music on behalf of a young gymnast, please use an adult's contact details on our forms.

3. Why we use it, and our legal basis

• To provide the service you asked for: creating your account, taking payment, delivering downloads, answering messages and producing bespoke tracks. Legal basis: performance of a contract.
• To keep records we are required to keep: sales, tax and accounting records. Legal basis: legal obligation.
• To keep the site secure and prevent misuse: including expiring download links and limiting how often a link can be used. Legal basis: legitimate interests.
• To send our newsletter: only if you ticked the newsletter box. Legal basis: consent. You can withdraw at any time by emailing us.

4. Cookies and similar technologies

We use only the storage that is strictly necessary to run the site: keeping you signed in, remembering that you have already seen our update pop-up for this browsing session, and completing a payment. We do not use advertising or third-party tracking cookies, so no cookie consent banner is required for non-essential tracking. If we ever add analytics or marketing cookies, we will ask for your consent first and update this policy.

5. Who we share it with

We do not sell your personal data. We share it only with the service providers we need to run the site, who act on our instructions:

• Stripe: payment processing and fraud prevention.
• Our hosting, database and email providers: running the website, storing account, order and message records, and sending transactional emails such as your download link.

We may also disclose information where we are legally required to do so. Some of these providers may process data outside the UK; where that happens, transfers are protected by the UK International Data Transfer Agreement or Addendum, or by an adequacy decision.

6. How long we keep it

• Account, purchase and download records: for as long as your account is open, then up to 6 years after your last transaction to meet UK tax and accounting requirements.
• Guest download links: active for 7 days after payment; the order record is kept for the accounting period above.
• Bespoke requests and contact messages: up to 24 months after the enquiry is closed.
• Newsletter preferences: until you unsubscribe, plus a record of the opt-out so we do not contact you again.

7. How we protect it

Data is stored on managed, access-controlled infrastructure with encryption in transit. Access to database records is restricted by row-level security so that you can only see your own account, orders and downloads. Music files are served through short-lived, signed links rather than public URLs, and purchase links expire after 7 days.

8. Your rights

Under UK data protection law you have the right to be informed, to access a copy of your data, to have inaccurate data corrected, to have data erased, to restrict or object to processing, to data portability, and to withdraw consent where we rely on it. Please see our GDPR policy for how to exercise each right.

To make a request, email musicrequest@beyondfloormusic.co.uk. We will respond within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Changes to this policy

If we change how we handle personal data we will update this page and change the date at the top. Significant changes will be highlighted on the site.