Privacy Policy
Last updated: October 5, 2026
This notice explains how personal data is processed when you visit www.mathamemusic.com (the “Site”), in accordance with Articles 13 and 14 of Regulation (EU) 2016/679 (the “GDPR”) and Italian Legislative Decree 196/2003 as amended.
1. Data Controller
The Data Controller is MHA SRL, with registered office at Via Manzu 25, 24122, Bergamo, Italy, VAT number IT 04704070160 (the “Controller”).
For any privacy request you can write to merch.mathame@h2049.com.
The Controller has not appointed a Data Protection Officer, as this is not required for its activities.
2. Personal data we process
- Browsing data. IP address, browser and device type, operating system, pages visited, referring page, date and time of the request. These are collected automatically by the hosting provider to deliver the Site and keep it secure.
- Newsletter data. First name and email address you enter in the newsletter form, the date and time of sign-up, and whether you open our emails and click their links (measured through Mailchimp tracking).
- Data collected through cookies and similar technologies. Technical cookies are always active. Analytics and marketing cookies are used only with your consent. Embedded YouTube videos use privacy-enhanced mode and set cookies only when you play a video. Details are in the Cookie Policy.
- Advertising events (Meta Conversions API). With your consent to marketing cookies, our server sends Meta information about actions you take on the Site, such as page views and newsletter sign-ups. This may include the page address, IP address, browser information, Meta cookie identifiers and, for a sign-up, your email address in hashed form (converted into a code that cannot be read).
- Data you send us by email. Your email address and anything you choose to include in your message.
We do not ask for special categories of data (such as health data). Please do not send them to us.
3. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Delivering the Site, keeping it secure and measuring its technical performance | Browsing data | Legitimate interest in running a secure and working website (Art. 6(1)(f) GDPR) |
| Sending the newsletter with news, releases and tour dates, and measuring opens and clicks | First name, email, sign-up date, email interactions | Consent (Art. 6(1)(a) GDPR) |
| Audience statistics (Google Analytics) | Cookie identifiers, browsing data | Consent (Art. 6(1)(a) GDPR) |
| Measuring the results of our advertising on Facebook and Instagram and showing our ads to people who visited the Site (Meta Pixel and Conversions API) | Cookie identifiers, browsing events, hashed email | Consent (Art. 6(1)(a) GDPR) |
| Showing embedded videos of the artist’s work (YouTube, privacy-enhanced mode) | Browsing data; cookie identifiers once you play a video | Legitimate interest in presenting the artist’s work (Art. 6(1)(f) GDPR) |
| Replying to your messages | Contact details, message content | Steps taken at your request (Art. 6(1)(b) GDPR) or legitimate interest (Art. 6(1)(f) GDPR) |
| Complying with legal obligations and establishing or defending legal claims | Data needed for the purpose | Legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR) |
You can withdraw your consent at any time, as easily as you gave it: through the “Cookie settings” link at the bottom of every page, or through the unsubscribe link in every newsletter. Withdrawing consent does not affect processing carried out before it.
4. Is providing data mandatory?
No. Browsing data is needed to deliver the Site. Everything else is optional: if you do not give your email address you will not receive the newsletter, and if you refuse cookies you can still use the whole Site.
5. Who receives the data
Data is processed by authorised staff of the Controller and by the following providers. Providers acting as processors are bound by a data processing agreement under Article 28 GDPR.
| Provider | Role | Service |
|---|---|---|
| ATIO Studio, Via Borgo Palazzo 31, 24125 Bergamo, Italy | Processor | Development and technical maintenance of the Site |
| Vercel Inc. | Processor | Hosting, content delivery, technical performance measurement |
| Storyblok GmbH | Processor | Content management and image delivery |
| The Rocket Science Group LLC (Mailchimp) | Processor | Newsletter management and sending |
| Google Ireland Limited (Google Analytics) | Processor | Audience statistics |
| Google Ireland Limited (YouTube) | Independent controller | Embedded videos |
| Meta Platforms Ireland Limited | Joint controller for collection and transmission; independent controller afterwards | Advertising measurement and optimisation |
For the Meta Pixel and Conversions API, the Controller and Meta are joint controllers for the collection and transmission of the data, under the Meta Controller Addendum. Meta is responsible for any later processing, described in the Meta Privacy Policy. Under this arrangement the Controller is responsible for informing you and for collecting your consent, while Meta handles requests about the data it stores. You can exercise your rights with either of us.
Data may also be disclosed to public authorities when required by law. We do not sell personal data and we do not disclose it to anyone else.
6. Transfers outside the European Economic Area
Some providers (Vercel, Mailchimp, Google and Meta) may process data in the United States or other countries outside the EEA. These transfers rely on the European Commission adequacy decision for the EU–US Data Privacy Framework, for providers certified under it, or on the Standard Contractual Clauses approved by the European Commission. You can request a copy of the safeguards by writing to the contact address above.
7. How long we keep data
| Data | Retention period |
|---|---|
| Browsing data in server logs | 1 day, unless needed to investigate a security incident |
| Newsletter data | Until you unsubscribe |
| Google Analytics data | Event data 2 months; user-level data 14 months from your last visit |
| Emails and correspondence | As long as needed to handle the request, then up to 24 months |
| Cookies | See the durations in the Cookie Policy |
Data needed to comply with legal obligations or to defend legal claims is kept for the time those require.
8. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- access your data and receive a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data deleted;
- restrict processing;
- receive the data you provided in a structured, machine-readable format and have it sent to another controller (portability);
- object at any time to processing based on legitimate interest;
- withdraw your consent at any time.
To exercise these rights write to merch.mathame@h2049.com. We will reply within one month, which may be extended by two further months for complex requests.
If you believe your data is processed unlawfully, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the supervisory authority of the EU country where you live, work or where the alleged breach took place.
9. Security
We use technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access restricted to authorised people and providers that offer recognised security guarantees.
10. Automated decisions
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. With your consent, Meta may use data from the Site to select which of our ads to show you; this does not have such effects.
11. Minors
The Site and the newsletter are not intended for children under 14. If you are under 14, please do not sign up to the newsletter or accept non-technical cookies. If we learn that we hold data of a child under 14 without a parent’s consent, we will delete it.
12. Links to other websites
The Site links to ticketing sites, the merchandise shop and social networks. These are run by third parties with their own privacy policies, which we encourage you to read.
13. Changes to this notice
We may update this notice. The date at the top shows the current version. Significant changes will be shown on the Site.