Privacy policy

This privacy policy explains which personal data we process when you visit our website, buy or claim our products, use our software or get in touch with us, why we do it and what rights you have.

Who we are

The controller responsible for processing your data is:

Playfair Audio – Dipl.-Ing. Christian Luther
Gellertstr. 12
30175 Hannover
Germany

Phone: +49 (0)511 12272506 (this is not a support hotline)
Email: support@playfair-audio.com

For any question about your data, or to exercise your rights, write to us at the address above.

Visiting our website

Hosting

Our website runs on a server rented from netcup GmbH (Daimlerstraße 25, 76185 Karlsruhe, Germany) in a data center in Nuremberg, Germany. netcup processes data on our behalf under a data processing agreement. To deliver a page, our server necessarily receives your IP address and the request your browser sends (the page, browser and operating system, referring page). We use this only to answer the request; our server does not keep access logs of your visits. Legal basis: our legitimate interest in operating the website (Art. 6(1)(f) GDPR).

The fonts on our website are served from our own server. Your browser does not connect to Google or any other font provider.

Cookies and browser storage

We only store information on your device, or read it from there, where it is strictly necessary to provide what you asked for (§ 25(2) no. 2 TDDDG), or with your consent (§ 25(1) TDDDG).

Strictly necessary, always on:

pf_consent (cookie): your choice in the cookie banner. Kept for 180 days if you accept and for one day if you decline, after which we ask again.
Your sign-in session (local storage): keeps you signed in to your account.
Your cart (local storage): the products in your cart and the reference to your open order.
Two short-lived entries in session storage: a summary of your order for the confirmation after checkout, and a marker that your cookie choice has been saved to your account (see below). Both are deleted when you close the tab.

Only with your consent:

_fbp and _fbc (cookies, 90 days): set by the Meta Pixel, see “Advertising with Meta” below.
pf_first_touch (365 days) and pf_last_touch (90 days, cookies): how you first and most recently came to our website, see “Campaign attribution” below.
Information YouTube stores in your browser when a video is loaded, see “Embedded videos” below.

Your cookie choice

When you first visit, we ask whether you accept these optional cookies and services. You can change your choice at any time with the “Cookie settings” link in the footer of every page; declining after accepting deletes the optional cookies. Legal basis for everything that depends on your consent: Art. 6(1)(a) GDPR. Withdrawing your consent does not affect the lawfulness of processing before the withdrawal.

If you are signed in to your account when you make a choice, we also save that choice and its date to your account. This lets us show that you consented (Art. 7(1) GDPR) and respect a “no” on other devices, see “Meta events from your customer account” below. Legal basis: Art. 6(1)(c) and (f) GDPR.

Website analytics

We use Plausible Analytics, which we host ourselves on our server at netcup in Nuremberg, to count visits and understand how our website is used, for example which pages are read, where visitors come from (referring website, campaign parameters in the link) and which actions are taken (such as sending the contact form, adding a product to the cart, signing up or downloading).

Plausible works without cookies and does not store anything on your device. It does not store your IP address: to tell visits apart it uses a one-way hash of your IP address and browser that changes every day, and it derives your country and region from the IP address. The results are aggregate statistics that don't identify you, and no data goes to third parties. Legal basis: our legitimate interest in improving our website (Art. 6(1)(f) GDPR). You can object at any time, see “Your rights” below.

Advertising with Meta

With your consent, we use the Meta Pixel and the Meta Conversions API of Meta Platforms Ireland Limited (Merrion Road, Dublin 4, D04 X2K5, Ireland) to measure how well our ads on Facebook and Instagram work and to show them to people likely to be interested.

When you consent, the Meta Pixel sends Meta information about your visit and your actions on our website: pages viewed, sending the contact form, adding to cart, starting checkout, completing a purchase and creating an account, with the products and amounts involved. Meta also receives your IP address, browser information, the page address and the _fbp/_fbc cookie values. Our server sends the same events to Meta as well, so they are counted even if the Pixel is blocked. If you are signed in, it also includes your email address, hashed so that Meta can only match it against addresses it already knows.

We and Meta are joint controllers for collecting this data and transmitting it to Meta (joint controller addendum). Meta is responsible for what it does with the data afterwards, as described in its privacy policy, which also explains how to exercise your rights against Meta. Meta may transfer data to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

Meta events from your customer account

Separately from the Pixel, our server tells Meta when someone completes a paid purchase, creates an account or confirms a newsletter subscription. These events are based on the information in your customer account, not on your browser. They contain the event, the products and amount (for purchases), your email address hashed as above and, if you came to us through a Meta ad and agreed to campaign attribution, the Meta click ID.

Legal basis: our legitimate interest in measuring the effectiveness of our advertising (Art. 6(1)(f) GDPR). We don't send these events if you declined cookies while signed in to your account. You can object at any time by writing to us; we then stop sending them for your account.

Campaign attribution

With your consent, we store in two cookies how you came to our website: the campaign parameters of the link you followed (utm_source, utm_medium, utm_campaign, utm_term, utm_content), a Meta click ID if present, the page you landed on and the referring website. One cookie keeps your first visit, the other your most recent one. When you are signed in, we copy both to your customer account, so we know which campaigns lead to customers. They stay there as long as your account exists. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG).

If you arrive through a link with campaign parameters, we also attach those parameters to your order, so our shop can tell which campaign it came from. Without your consent, this only uses the link of your current visit and stores nothing on your device. Legal basis: our legitimate interest in evaluating our campaigns (Art. 6(1)(f) GDPR).

Embedded videos

Some pages show videos from YouTube, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Until you play a video, we only show a preview image served from our own server, and your browser does not contact YouTube.

When you play a video, or on every page if you have accepted cookies, the video is loaded from YouTube in its privacy-enhanced mode (youtube-nocookie.com). Your browser then transmits your IP address and the page you are on to YouTube, YouTube may store information in your browser, and Google receives information about how you use the video. Google may transfer data to the USA; Google LLC is certified under the EU-US Data Privacy Framework. See Google’s privacy policy. Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), given by playing a video or by accepting cookies.

Customer account, licenses and downloads

Your customer account, your licenses and our downloads are run for us by Moonbase AS (Utsikten 6, 3718 Skien, Norway), which processes this data on our behalf under a data processing agreement. Moonbase stores the data mainly with Amazon Web Services in Ireland.

Your account holds your name and email address, your password (stored only in hashed form), your licenses, the devices they are activated on, your downloads and redeemed vouchers, your orders, your email preferences and, where applicable, your cookie choice and campaign attribution (see above). Emails Moonbase sends on our behalf, such as account confirmations and order emails, may record whether they are opened and which links are clicked.

We use this data to provide your account, licenses, downloads and support. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR). We keep it as long as your account exists. You can ask us to delete your account at any time.

Purchases

Our products are sold by our reseller Moonbase AS (or, for some orders from the USA, Moonbase LLC), which is named on your order confirmation. Moonbase is the seller and processes the data of your purchase (such as your name, billing address, payment and tax details) as an independent controller, together with the payment providers it uses. See Moonbase’s privacy policy for buyers.

Moonbase passes the details of your order to us (your name, email address, billing address, the products and price), so we can provide your licenses and support. Legal basis: Art. 6(1)(b) GDPR.

Free products

Some products, such as Body, are free in exchange for subscribing to our newsletter. You claim them through the same checkout as a purchase, and the claim includes the newsletter subscription. You can unsubscribe at any time and keep the product. Legal basis: your consent (Art. 6(1)(a) GDPR).

You can subscribe to our newsletter on our website, when you claim a free product, or in your account settings. When you subscribe on the website, we send you an email to confirm your address; you are only subscribed once you confirm (double opt-in). We record the time of your subscription and confirmation, so we can show that you consented. In your account settings, you can also choose to receive emails about updates to products you own.

Our newsletter includes product news, offers and, if you claimed a free product, a short series of emails about getting started with it. We send it with Sendy, newsletter software we host ourselves on our server at netcup in Nuremberg; the emails are delivered through Amazon Simple Email Service by Amazon Web Services EMEA SARL (38 Avenue John F. Kennedy, 1855 Luxembourg), from its data center in Frankfurt, Germany, under a data processing agreement. Our newsletter records whether you open an email and which links you click, so we can tell what our readers find useful.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time with the link in every email or in your account settings; that also ends the getting-started emails. After you unsubscribe, we keep your email address on file as unsubscribed, so we don’t email you again (Art. 6(1)(f) GDPR).

Contacting us

When you send us the contact form or an email, we process the information you give us (your name, email address, the product, subject and message) to answer your request. If you are signed in, your request carries your account’s name, email address and customer number instead of the name and email fields. The form is delivered as an email through our mail server at netcup, and you receive a short confirmation. To protect the form against abuse, we briefly keep a count of requests per IP address in our server’s memory; it is not stored anywhere.

Legal basis: performance of our contract with you where your request concerns it (Art. 6(1)(b) GDPR), otherwise our legitimate interest in answering your request (Art. 6(1)(f) GDPR). We keep this correspondence as long as it may be relevant to your request or to your use of our products, and delete it on request unless we are legally required to keep it.

Using our software

License activation

When you activate our software or it checks its license, it sends the license service run for us by Moonbase the name of your device, an identifier derived from the device, the operating system, the version of the software and, for each check, your IP address and approximate location. This information is shown with your licenses in your account, so you can see and manage your devices. With offline activation, this information is transferred once, in the file you upload. We keep it as long as the license exists. Legal basis: Art. 6(1)(b) GDPR.

Update checks

Our software regularly checks our server for updates and important notices. It sends the type of operating system (macOS or Windows), the version of the software and the plugin format (AU, VST or AAX). Like any request on the internet, this reveals your IP address, which we use only to answer the request. Legal basis: our legitimate interest in informing you about updates (Art. 6(1)(f) GDPR).

Recipients and transfers outside the EU

Besides the service providers named above (netcup, Moonbase, Amazon Web Services), your data is only passed on as described in this policy: to Meta and Google where stated, to Moonbase as the seller of your purchase, and to authorities where we are legally obliged to. We don’t sell personal data.

Moonbase is based in Norway, which is part of the European Economic Area. Where data reaches the USA (through Meta, Google or service providers of Moonbase), the transfer is covered by the EU-US Data Privacy Framework or the EU standard contractual clauses.

How long we keep data

Unless stated above, we delete personal data once it is no longer needed for the purpose we collected it for, and we keep it longer only where the law requires it, for example invoices and other accounting records for up to ten years under German commercial and tax law.

Your rights

You have the right to:

access the personal data we hold about you (Art. 15 GDPR)
have incorrect data corrected (Art. 16 GDPR)
have your data deleted (Art. 17 GDPR), unless we are legally required to keep it
have the processing restricted (Art. 18 GDPR)
receive the data you gave us in a common, machine-readable format (Art. 20 GDPR)
withdraw your consent at any time with effect for the future (Art. 7(3) GDPR)

Right to object (Art. 21 GDPR): where we process your data based on our legitimate interests, you can object at any time for reasons arising from your particular situation. Where we use your data for direct marketing, including measuring our advertising, you can object at any time without giving reasons, and we will stop.

To exercise these rights, write to us at support@playfair-audio.com. You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany (lfd.niedersachsen.de).

We don’t use automated decision-making, including profiling, that has legal or similarly significant effects on you.

Last updated: 15 October 2026