Privacy Policy

This Privacy Policy explains how personal data is processed when you visit the official Odd Bazaar website, contact the Artist, or follow links to music and third-party platforms.

1. Data controller

Odd Bazaar - Xolo Go OÜ
Registry code: 14717109 · EU VAT number / Local tax number: EE102156920
Paju tn 1a, 50603 Tartu, Tartu Maakond, Estonia
Official artist website: Odd Bazaar
Privacy contact: contact@oddbazaar.space

2. Scope

This Policy covers personal data processed through this website, including first-party audience measurement, technical security data and information submitted through the contact form. It does not govern the independent processing activities of Apple Music, Spotify, YouTube or other third-party services linked from the site.

3. Personal data processed

• Contact data: name, email address and message content that you submit voluntarily.
• Audience and technical data: date and time, page visited, referrer, country, IP address, browser, device category and user-agent string.
• Bot classification: whether a request appears to come from a human visitor, a recognised crawler or an unclassified client, including the crawler name where identifiable.
• Professional correspondence: information contained in soundtrack composition, synchronisation, licensing or other moving-image project enquiries.

Please do not send sensitive personal data unless it is genuinely necessary for your request.

4. Purposes and legal bases

• Operating, securing and troubleshooting the website: legitimate interests in providing a safe, reliable service.
• Private first-party audience measurement: legitimate interests in understanding aggregate readership, popular pages, countries, referrers and crawler activity so the site can be improved and maintained.
• Answering enquiries: steps taken at your request before a contract, performance of a contract where applicable, or legitimate interests in managing correspondence.
• Legal, licensing and accounting administration: contractual necessity, legal obligations and legitimate interests in establishing or defending claims.

Contact details are not used for newsletters or promotional email unless you separately and expressly agree.

5. Private website statistics

Audience statistics are collected directly by this website and stored in a private MySQL database. They are not sent to Google Analytics or another analytics provider. The dashboard is restricted to the site operator by password, time-based verification code, secure session controls and rate limiting.

Recognised search engines and crawlers are counted separately from likely human visitors. Unknown or unusual user agents are kept in an “unclassified” category rather than automatically treated as human. A pseudonymous visitor value derived from IP address and user agent is used only to estimate unique visitors within the private dashboard; it is not used for advertising, profiling across websites or automated decisions.

Country detection uses local server geolocation where that facility is installed. Otherwise, a country header provided by the hosting or content-delivery infrastructure may be used. The site does not send visitor IP addresses to a separate geolocation API.

6. Contact form and email

Submitting the form sends your name, email address and message to contact@oddbazaar.space. For spam prevention and troubleshooting, the message also includes the IP address and browser user-agent associated with the submission. The form uses a CSRF token, a hidden anti-spam field and connection-based rate limiting.

7. Apple Music, artwork and audio excerpts

Release information and artwork are obtained from Apple services. Artwork may be loaded from Apple-operated content-delivery domains, which can receive ordinary request data such as IP address, browser information and the referring page.

When a visitor requests an audio excerpt, or when optional autoplay is enabled, the excerpt is streamed directly from an Apple-operated domain. Modern browsers may require a click or touch before audible playback begins.

Some Apple Music links contain an affiliate or campaign identifier. Apple and its partners may attribute a visit or transaction to this website. This does not change the price paid by the visitor. Apple handles data under its own privacy terms.

8. Cookies and local storage

The public catalogue does not use advertising or behavioural-tracking cookies. A strictly necessary session cookie is created when you open the contact page so the form can be protected against cross-site request forgery. Your optional sound preference is stored locally in your browser. The private dashboard uses a separate, strictly necessary secure authentication session.

If the site operator explicitly selects “Trust this device” during sign-in, a secure, HttpOnly, SameSite cookie may remain on that browser for up to 365 days. The server stores only a keyed hash of the random device token and a reduced browser signature in protected private storage. It can be revoked and is never used for advertising or cross-site tracking.

9. Recipients and international transfers

Data may be processed by providers used for hosting, content delivery, security, email, backups and technical maintenance, only as needed to provide those services. Data may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.

Some providers or external platforms may process data outside the European Economic Area. Where the controller is responsible for a transfer, an appropriate GDPR mechanism is used when required, such as an adequacy decision or Standard Contractual Clauses with supplementary safeguards.

10. Retention

• Private audience statistics: normally 180 days, configurable by the site operator between 7 days and five years.
• Contact messages: normally up to 24 months after the last meaningful interaction, unless an active project, contract, dispute or legal duty requires longer.
• Contracts, invoices, licensing and accounting records: for the period required by applicable tax, accounting and commercial law.
• Security rate-limit records: short-lived and automatically removed after they are no longer needed.
• Trusted-device records: until their selected expiry, for no longer than 365 days, or earlier when revoked.

11. Your rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing based on legitimate interests. Where processing relies on consent, consent may be withdrawn without affecting earlier lawful processing. You may also complain to a competent supervisory authority; in Estonia this is the Andmekaitse Inspektsioon.

12. Security, children and automated decisions

Technical and organisational safeguards include encrypted transport where available, restricted administration, hashed credentials, two-step verification, secure session cookies, access controls and database query parameterisation. No internet service can be guaranteed completely secure.

The site is intended for a general audience and is not designed to knowingly collect data from children. Collected information is not used for solely automated decisions that produce legal or similarly significant effects.

13. Requests and changes

For a privacy request, email contact@oddbazaar.space. Use the subject “Privacy Request”. Reasonable identity verification may be required. This Policy may be updated when the website, providers, practices or legal requirements change; the date above identifies the current version.