This Privacy Policy explains how Unfolded Vision ("Unfolded Vision", "we", "us" or "our") collects, uses and protects your personal data when you visit unfoldedvisionband.com (the "Website") or contact us.

For the purposes of the EU General Data Protection Regulation (GDPR) and the Portuguese data protection law, the data controller is Unfolded Vision [legal entity / address to be completed]. You can reach us about privacy matters at unfoldedvision@gmail.com.

We only collect data that we need, and we keep it to a minimum:

• Contact / booking data: when you use our contact form we collect your name, email address, subject and the content of your message.
• Technical data: when you visit the Website, our hosting provider automatically processes data such as your IP address, browser type, device information and the pages you view, primarily in server logs for security and reliability.
• Anti-abuse data: when you submit the contact form we store a salted, irreversible hash of your IP address (never the address itself) together with your browser user agent, so we can rate-limit abuse and filter spam.
• Cookie data: strictly necessary cookies and your cookie preference (see our Cookie Policy).
• Newsletter signup: if you leave your email address to be notified when the store opens, we store that address and which page you signed up from, until we send that one-off notice or you ask us to delete it.
• Future store data (Phase 2): if and when we launch online sales, we will collect order and delivery details and process payments through a payment provider. This will be covered by an updated policy.

We do not knowingly collect special categories of data, and we do not buy personal data from third parties.

We process your personal data for the following purposes and legal bases:

• To respond to your enquiries and manage booking requests — legal basis: our legitimate interest in communicating with you and, where applicable, taking steps prior to entering a contract.
• To operate, secure and improve the Website — legal basis: our legitimate interest in running a safe, functional website.
• To remember your language and cookie choices — legal basis: necessity to provide the service you requested (strictly necessary cookies).
• To comply with legal obligations — legal basis: compliance with a legal obligation.

The Website uses only strictly necessary cookies (for example, to store your language and your cookie choice). We do not use advertising or third-party analytics cookies. For full details, including how to manage cookies, please read our Cookie Policy.

We never sell your personal data. We share it only with trusted service providers ("processors") who help us run the Website, and only as needed:

• Hosting & infrastructure: Netlify, Inc., which hosts the Website and processes server logs.
• Email delivery: Resend, which delivers the emails generated by our contact form.
• Spam protection: Cloudflare, Inc. (Turnstile), which checks that the contact form is submitted by a person and not by an automated script. Cloudflare receives your IP address and basic browser signals for this purpose.
• Audience measurement: Cloudflare, Inc. (Web Analytics), which counts page views and visits. It uses no cookies, does not build a profile of you, and does not follow you across other websites.
• Content & media embeds: when a page shows an embedded player or post (Spotify, Apple Music, YouTube, Instagram, Facebook), that provider may receive data such as your IP address; their own privacy policies apply.
• Payments (Phase 2): if we launch online sales, a payment provider (e.g. Stripe) will process your payment data.

We may also disclose data if required by law, to protect our rights, or in connection with a reorganisation of the band’s activities.

Some of our providers are based outside the European Economic Area (EEA), including in the United States. Where data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision.

We keep personal data only for as long as necessary for the purposes described above:

• Contact / booking messages: typically up to 24 months after the last contact, unless a longer period is needed to manage a booking or comply with the law.
• Newsletter signups: until we send the store-opening notice they were collected for, or up to 12 months, whichever comes first, unless you ask us to delete your address sooner.
• Server logs: a short period for security and troubleshooting, in line with our provider’s defaults.
• Cookie preference: up to 12 months, after which we ask again.

Subject to applicable law, you have the right to: access your data; rectify inaccurate data; erase your data; restrict or object to processing; data portability; and, where processing is based on consent, withdraw that consent at any time.

To exercise any of these rights, contact us at unfoldedvision@gmail.com. You also have the right to lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD — www.cnpd.pt), or your local data protection authority.

We use appropriate technical and organisational measures to protect your data, including encryption in transit (HTTPS) and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to address any incident promptly.

The Website is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has provided us with personal data, please contact us and we will delete it.

The Website contains links to third-party sites and services (for example our social media and streaming profiles). We are not responsible for their content or privacy practices; please review their policies.

We may update this Privacy Policy from time to time. The "last updated" date below reflects the latest version, and material changes will be highlighted on the Website.

For any question about this policy or your personal data, contact us at unfoldedvision@gmail.com.