Privacy Policy & Cookie Policy

1. Data Controller

The data controller responsible for the processing of your personal data on this website is:

Throughout this document, "we", "us", "our", and "Yamazaki" refer to Quarium Kft.

2. Scope and Application

This Privacy Policy applies to all personal data processed through the website go.yamazaki.hu and its subpages, including all song landing pages, the bio page, newsletter archives, and any forms or interactive features hosted on the domain.

This policy has been prepared in accordance with:

• Regulation (EU) 2016/679 (General Data Protection Regulation, "GDPR");
• Act CXII of 2011 on Informational Self-Determination and Freedom of Information (Hungarian Data Protection Act, "Infotv.");
• Directive 2002/58/EC (ePrivacy Directive), as transposed into Hungarian law; and
• Act CVIII of 2001 on Certain Issues of Electronic Commerce Services and Information Society Services (Hungarian E-Commerce Act, "Eker. tv.").

By using our website, you acknowledge that you have read and understood this policy. Where processing is based on consent, we will request your affirmative, informed, and freely given consent before collecting any non-essential data.

3. Legal Bases for Processing

We process personal data under the following legal bases as defined in GDPR Article 6(1):

Where we rely on legitimate interest, we have carried out a balancing test to ensure that our interests do not override your rights and freedoms. You may request a copy of our legitimate interest assessments by contacting us.

4. Data We Collect

4.1 Data collected automatically from all visitors

When you visit any page on go.yamazaki.hu, we automatically collect the following data:

• IP address — used for geographic lookup (GeoIP) via a locally hosted MaxMind GeoLite2 database. Your IP address is processed on our server and is never transmitted to MaxMind or any other third party for this purpose.
• Geographic information — country, region, and city, derived from your IP address via the local MaxMind database.
• Browser user-agent string — used to determine your browser type and version.
• Device type — classified as mobile, tablet, or desktop based on the user-agent.
• Page views, click events, and session data — which pages you visit, what you click on, and how long you remain on a page.
• Referrer URL — the website or page that directed you to our site.
• UTM parameters — marketing campaign tracking parameters in the URL (utm_source, utm_medium, utm_campaign, utm_term, utm_content).
• Ad platform click identifiers — fbclid (from Meta/Facebook/Instagram) and ttclid (from TikTok), when present in the URL.

4.2 Cookies and identifiers set on your device

Subject to your consent (except for the essential consent-state cookie), we set the following identifiers:

• yz_consent — records your cookie consent choice. This is an essential cookie and does not require consent.
• yz_vid — a randomly generated visitor identification string. Duration: 1 year.
• yz_fp — a hashed browser fingerprint, generated from publicly available browser attributes (screen resolution, installed fonts, WebGL renderer, etc.) to create a probabilistic identifier. Duration: 1 year. This hash cannot be reversed to reconstruct the original browser attributes.

See Section 18 (Cookie Policy) for a complete cookie table.

4.3 Data collected upon user interaction (consent required)

When you actively interact with features on our site, we collect additional data. Each of these requires your explicit consent via our consent banner or an action-specific consent gate.

Email subscription

• Email address — provided when you subscribe to our mailing list via any form on the site.

Spotify OAuth connection

When you click a Spotify action button (e.g., "Save on Spotify", "Follow on Spotify", "Follow playlist"), you are redirected to Spotify's authorization page. If you grant permission, we receive:

• Spotify user ID
• Display name
• Email address
• Country
• Spotify subscription type (free or premium)
• OAuth tokens (access token and refresh token)

We store OAuth tokens securely in order to execute pre-save actions on your behalf (e.g., automatically saving a track to your library on release day). You can revoke this access at any time through your Spotify account settings at spotify.com/account/apps or by submitting a data request to us.

Discord OAuth connection

When you click "Join the Discord", you are redirected to Discord's authorization page. If you grant permission, we receive:

• Discord user ID
• Username
• Global display name
• Email address
• Avatar URL

This data is used to add you to the Yamazaki Discord server and to link your Discord identity to your fan profile. You can revoke access through your Discord account settings at any time.

VRChat username

• VRChat username — voluntarily self-reported through a text input on the bio page. We do not connect to VRChat's API or verify this information. It is stored solely to link your VRChat identity to your fan profile.

Actions and engagement data

• Song saves, artist follows, and playlist follows performed through Spotify OAuth.
• Pre-save registrations (we store your Spotify OAuth tokens to execute a library save on release day, then delete the tokens once the action is complete or after 90 days, whichever is sooner).

4.4 Data collected from Shopify purchases

When you purchase merchandise through our Shopify store, Shopify acts as both a joint controller and a processor. We receive the following data from Shopify via webhook:

• Email address
• Order details: line items, total price, currency
• Landing site URL (the page you arrived from, used for marketing attribution via UTM parameters)
• Financial status (paid, refunded, etc.)
• Fulfilment status (unfulfilled, shipped, delivered, etc.)

We do not receive or store your payment card details, billing address, or shipping address. Those are processed exclusively by Shopify. Please refer to Shopify's Privacy Policy for details on their data handling.

4.5 Consent records

For every consent interaction, we record:

• Consent state (granted, declined, or pending)
• Trigger method (whether consent was given via the cookie banner or via an action-specific gate)
• Timestamp of the consent action
• Visitor identifier at the time of consent

Consent records are retained for 5 years as required by GDPR Article 7(1), which obliges us to demonstrate that consent was validly obtained. These records are never deleted upon a standard erasure request, as their retention is a legal obligation.

5. Purposes of Processing

We process personal data for the following specific purposes:

6. Cookies and Tracking Technologies

We use cookies and similar technologies to identify visitors, measure engagement, and attribute marketing campaigns. Non-essential cookies are only set after you grant consent through our cookie banner.

6.1 What is a cookie?

A cookie is a small text file placed on your device by a website. Cookies allow the website to recognise your device on subsequent visits. Some cookies are essential for the website to function; others help us understand how you use the site or enable marketing features.

6.2 Browser fingerprinting

In addition to cookies, we generate a probabilistic browser fingerprint by hashing publicly available browser attributes (such as screen resolution, timezone, installed fonts, and WebGL renderer). The resulting hash (stored in the yz_fp cookie) is used alongside the visitor ID cookie to improve visitor identification accuracy. This technique is subject to the same consent requirements as non-essential cookies. The original browser attributes are not stored; only the one-way hash is retained.

For a complete list of all cookies we set, their purposes, durations, and classification, see Section 18 (Cookie Policy).

6.3 How to manage cookies

You can withdraw your cookie consent at any time by clearing your browser's cookies for go.yamazaki.hu, which will cause our consent banner to reappear on your next visit. You may also manage cookies through your browser settings. Note that blocking essential cookies may prevent the consent mechanism from functioning correctly.

7. Third-Party Data Sharing

We share personal data with the following third parties, only to the extent necessary for the stated purpose. We do not sell personal data.

Each third-party processor operates under its own privacy policy. We encourage you to review them:

• Meta: facebook.com/privacy/policy
• TikTok: tiktok.com/legal/privacy-policy
• Spotify: spotify.com/privacy
• Discord: discord.com/privacy
• Mailchimp: intuit.com/privacy/statement
• Shopify: shopify.com/legal/privacy
• IPQS: ipqualityscore.com/privacy-policy

8. Data Retention Periods

We retain personal data only for as long as necessary for the purposes stated in this policy or as required by law. The following table specifies our retention periods for each category of data:

When a retention period expires, data is either permanently deleted or irreversibly anonymised so that it can no longer be linked to an identifiable individual. Anonymised data may be retained indefinitely for statistical purposes.

9. Your Rights

Under the GDPR (Articles 15 through 22) and Hungarian data protection law (Infotv.), you have the following rights regarding your personal data:

9.1 Right of access (Art. 15)

You have the right to obtain confirmation as to whether we process your personal data, and if so, to receive a copy of that data along with information about the purposes, categories of data, recipients, retention periods, and the source of the data.

9.2 Right to rectification (Art. 16)

You have the right to request that we correct any inaccurate personal data and complete any incomplete personal data concerning you.

9.3 Right to erasure ("right to be forgotten") (Art. 17)

You have the right to request that we delete your personal data when, among other circumstances, the data is no longer necessary for the purpose it was collected, you withdraw your consent, or you object to the processing. Please note that consent records are exempt from erasure requests due to our legal obligation under GDPR Article 7(1) to demonstrate that consent was obtained.

9.4 Right to restriction of processing (Art. 18)

You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data or when you have objected to processing pending verification of legitimate grounds.

9.5 Right to data portability (Art. 20)

You have the right to receive the personal data you provided to us in a structured, commonly used, and machine-readable format (JSON), and to transmit that data to another controller without hindrance.

9.6 Right to object (Art. 21)

You have the right to object at any time to processing of your personal data that is based on legitimate interest. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims.

9.7 Right to withdraw consent (Art. 7(3))

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal. You can withdraw cookie consent by clearing your cookies. For other consent-based processing, submit a request through our self-service portal or contact us directly.

9.8 Right to lodge a complaint

You have the right to lodge a complaint with the competent supervisory authority if you believe that our processing of your personal data violates applicable data protection law. See Section 16 for details on the Hungarian supervisory authority.

Response time

We will respond to all data subject requests without undue delay and in any event within one calendar month of receipt. If a request is particularly complex, this period may be extended by a further two months, in which case we will inform you of the extension and the reasons for the delay within the first month.

10. Self-Service Data Requests

We provide a dedicated self-service portal where you can exercise your data protection rights without needing to send an email:

Through this portal, you can request:

• A copy of all personal data we hold about you (access request)
• Correction of inaccurate data (rectification)
• Deletion of your personal data (erasure)
• Export of your data in machine-readable format (portability)
• Restriction or objection to processing
• Withdrawal of consent

Alternatively, you can submit requests by email to yamazaki@yamazaki.hu or by post to our registered address. We will verify your identity before processing any request to prevent unauthorised access to personal data.

11. International Data Transfers

Our servers and primary data storage are located within the European Union. However, some of the third-party services we use are operated by companies based in the United States or other countries outside the European Economic Area (EEA).

When personal data is transferred to a country outside the EEA that has not received an adequacy decision from the European Commission, we ensure appropriate safeguards are in place, including:

• EU-U.S. Data Privacy Framework — where the recipient is certified under the framework (applicable to Meta, Shopify, Intuit/Mailchimp, Discord, and others).
• Standard Contractual Clauses (SCCs) — as adopted by the European Commission under Commission Implementing Decision (EU) 2021/914, where the Data Privacy Framework does not apply or as an additional safeguard.

The following services may involve transfers outside the EEA:

• Meta Platforms, Inc. (United States)
• TikTok / ByteDance (Singapore / United States)
• Spotify AB (Sweden, with sub-processors in the U.S.)
• Discord Inc. (United States)
• Intuit / Mailchimp (United States)
• Shopify Inc. (Canada / United States)
• IPQualityScore (United States)
• Resend / SMTP provider (United States)

You may request a copy of the applicable safeguards by contacting us.

12. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include, but are not limited to:

• Encryption in transit — all data transmitted between your browser and our servers is encrypted using TLS (HTTPS).
• Encryption at rest — sensitive data such as OAuth tokens and email addresses is encrypted in our database.
• Hashing — email addresses and IP addresses sent to third-party marketing APIs (Meta, TikTok) are hashed using SHA-256 before transmission.
• Access controls — access to personal data is restricted to authorised personnel on a need-to-know basis.
• Server security — our infrastructure is protected by firewalls, regular security updates, and monitoring.
• Token security — Spotify and Discord OAuth tokens are stored in encrypted form and are automatically deleted after their intended use or upon expiry.
• Bot detection — we use IP-based bot detection (via IPQS) to prevent automated abuse and ensure the integrity of analytics data.
• Audit logging — all data access, modification, and deletion events are logged for accountability purposes.

While we take reasonable precautions, no method of transmission or storage is 100% secure. If you become aware of any security issue, please contact us immediately at yamazaki@yamazaki.hu.

13. Automated Decision-Making

We use automated processing in one limited context:

Bot detection and filtering

We send visitor IP addresses to IPQualityScore (IPQS) to obtain a fraud/bot risk score. This score is used to filter out automated bot traffic from our analytics data so that we can accurately measure real fan engagement.

This automated process:

• Is used solely for security and data integrity purposes, not for profiling individuals;
• Does not produce legal effects or similarly significantly affect you;
• Does not result in any content being hidden from or shown to you;
• Does not affect your ability to use any feature of the website; and
• Processes only your IP address — no other personal data is sent to IPQS.

We do not engage in automated decision-making or profiling that produces legal effects or similarly significant effects concerning you, as described in GDPR Article 22.

14. Children's Privacy

Our website and services are not directed at children under the age of 16. We do not knowingly collect or solicit personal data from anyone under 16 years of age. In accordance with GDPR Article 8 and the Hungarian implementation thereof, the processing of personal data of a child below the age of 16 based on consent is only lawful if and to the extent that consent is given or authorised by the holder of parental responsibility.

If we become aware that we have collected personal data from a child under 16 without verification of parental consent, we will take steps to delete that information as quickly as possible. If you believe we have collected data from a child under 16, please contact us immediately at yamazaki@yamazaki.hu.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will:

• Update the "Last updated" date at the top of this page;
• Where feasible and where we hold your email address, send a notification about the change; and
• Where changes affect consent-based processing, request renewed consent where required.

We encourage you to review this page periodically. Continued use of the website after changes are posted constitutes your acknowledgement of the updated policy, except where renewed consent is required.

16. Supervisory Authority

If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with the competent supervisory authority. For Hungary, the competent authority is:

You also have the right to lodge a complaint with the supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement.

Before filing a complaint, we encourage you to contact us first so that we can attempt to resolve your concern directly.

17. Contact

For any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, you can reach us through any of the following channels:

We aim to respond to all enquiries within 5 business days, and to all formal data subject requests within 30 calendar days in accordance with GDPR Article 12(3).

18. Cookie Policy

This section constitutes our Cookie Policy, which forms part of our Privacy Policy. It describes the specific cookies and similar technologies used on go.yamazaki.hu.

18.1 Cookie classifications

We classify cookies into the following categories:

• Essential — required for the basic functioning of the website. These cookies do not require consent under the ePrivacy Directive.
• Functional — enhance the functionality of the website by enabling visitor identification and session tracking. Require consent.
• Marketing — used for advertising attribution and campaign measurement. Require consent.

18.2 Complete cookie table

18.3 Consent mechanism

When you first visit go.yamazaki.hu, a cookie consent banner is displayed at the bottom of the page. You may:

• Accept all cookies — by clicking "OK", which grants consent for functional and marketing cookies;
• Decline non-essential cookies — by clicking "No", which sets only the essential yz_consent cookie to record your refusal.

Certain interactive actions (such as connecting Spotify or Discord) also include an action-specific consent gate. If you have not yet consented via the banner, performing one of these actions will prompt you to provide consent before proceeding.

18.4 Withdrawing cookie consent

You can withdraw your cookie consent at any time using any of the following methods:

• Clear your cookies for go.yamazaki.hu in your browser settings. On your next visit, the consent banner will reappear.
• Use your browser's built-in cookie management or privacy settings to block cookies from our domain.
• Submit a consent withdrawal through our data request portal.

Withdrawing consent does not affect the lawfulness of data processing that occurred before the withdrawal.

18.5 Third-party cookies

We do not load any third-party cookie scripts (such as the Meta Pixel or TikTok Pixel) in the browser. All marketing data is sent from our server via server-side APIs (Meta Conversions API, TikTok Events API). The marketing cookies listed above (_fbc, _fbp, _ttclid) are set by our own first-party JavaScript code, not by third-party scripts.