Last updated: August 26, 2026
This Privacy Policy explains how Gonzalo Bustos (“we”, “us”) collects, uses, and protects personal data when you visit gonzalobustos.com or purchase scores or audio licenses through it. It is written to comply with the EU General Data Protection Regulation (GDPR).
1. Data Controller
The data controller for this website is:
Gonzalo Bustos
Email: contact@gonzalobustos.com
For any question about your personal data, or to exercise your rights (see Section 7), please contact us at this address.
2. What Personal Data We Collect, and Why
| When | Data collected | Purpose | Legal basis |
|---|---|---|---|
| You use the Contact form | Name, email address, message content, IP address (via reCAPTCHA) | To respond to your inquiry | Legitimate interest / consent |
| You subscribe to the newsletter | Email address | To send occasional updates about new works, concerts, or releases | Consent (you can withdraw it at any time) |
| You purchase a score or an audio license | Name, email, billing address, order details, payment confirmation (card details are processed directly by Stripe — we never see or store your full card number) | To process and deliver your order, issue invoices, and provide customer support | Performance of a contract |
| You browse the website | Pages visited, approximate location, device/browser type, aggregated statistics (via Jetpack Stats) | To understand how the site is used and improve it | Legitimate interest |
| You play an embedded audio player | Interaction data collected by SoundCloud | Playback of the audio sample you chose to play | Legitimate interest / third-party embed |
We do not collect more personal data than is necessary for these purposes, and we do not sell personal data to third parties.
3. Cookies
This website uses the following categories of cookies:
- Strictly necessary cookies — required for the shopping cart and checkout (WooCommerce) to function.
- Analytics cookies — Jetpack Stats (Automattic), used to measure site traffic in an aggregated way.
- Form security cookies — Google reCAPTCHA, used on the contact form to prevent spam.
- Third-party content cookies — set by SoundCloud when you interact with an embedded audio player.
You can control or disable cookies through your browser settings at any time; please note that doing so may affect some site functionality (for example, the shopping cart).
(At the time of writing, this site does not yet display a cookie consent banner. Adding one is recommended so visitors can accept or decline non-essential cookies before they are set — see the accompanying recommendation for next steps.)
4. Who We Share Data With
We share personal data only with the service providers (“processors”) that are strictly necessary to operate this website and process your orders:
- Hostinger — our hosting provider, which stores the website and its data.
- Stripe — our payment processor, which handles payment card data directly; we do not store your card details.
- Automattic (WordPress.com / Jetpack / WooCommerce) — providers of the software and analytics tools used to run this site.
- Google (reCAPTCHA) — used to protect our contact form from spam.
- SoundCloud — used to embed audio players for music samples.
We do not share your data with third parties for their own marketing purposes.
5. International Data Transfers
Some of the providers listed above (notably Stripe, Automattic, and Google) are based in, or transfer data to, the United States. Where this occurs, it is carried out under an approved legal safeguard — typically the European Commission’s Standard Contractual Clauses — as implemented by each provider’s own data processing terms.
6. Data Retention
- Contact form messages are kept for as long as reasonably necessary to handle your inquiry, then deleted.
- Newsletter email addresses are kept until you unsubscribe.
- Order and invoicing data is kept for the period required by French commercial and tax law (currently up to 10 years for accounting records).
- Analytics data is retained in aggregated/anonymized form by Jetpack according to Automattic’s own retention rules.
7. Your Rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you;
- Request correction of inaccurate data;
- Request deletion of your data (“right to be forgotten”), subject to our legal obligations (e.g. invoices we must keep);
- Object to, or request restriction of, certain processing;
- Request a portable copy of your data;
- Withdraw your consent at any time (for example, unsubscribe from the newsletter), without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at contact@gonzalobustos.com. You also have the right to lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), if you believe your rights have not been respected.
8. Security
We take reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or misuse. No online transmission or storage system can be guaranteed 100% secure.
9. Children
This website is not directed at children, and we do not knowingly collect personal data from children.
10. Changes to This Policy
We may update this Privacy Policy from time to time, for example when we add a new tool or service to the site. The “Last updated” date at the top of this page will reflect the most recent revision.
11. Contact
Questions about this Privacy Policy can be sent to: contact@gonzalobustos.com. See also our Legal Notices for information about the site publisher and hosting provider.