Privacy policy
We collect only what is needed: your e-mail address if you subscribe or download a free plugin, and your name, e-mail and message if you contact us. No advertising, no tracking cookies, no selling of data. Visitor statistics are anonymous. You can unsubscribe and ask us to delete your data at any time.
1. Controller and contact
The controller of your personal data is BIGZUN, the owner of the bigzun.com website and the BIGZUN brand of Eurorack modules and audio plugins (“we”). For anything related to your data — questions, access, correction, deletion or objections — contact us through the contact form or by e-mail at contact@bigzun.com. We do not have a data protection officer, as we are not required to appoint one.
2. What we collect, why and on what legal basis
Contact form and e-mails to contact@bigzun.com. Your name, e-mail address, the topic and the content of your message and of our conversation. Purpose: to answer you and handle your request. Legal basis: steps you ask for and our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR).
Newsletter. Your e-mail address, the exact wording of the consent you gave, the date and time, and a one-way hash of your IP address (as proof of consent), plus the date you unsubscribe. We send a confirmation e-mail first — you are subscribed only after you click it (double opt-in). We use the address to send news about new modules, videos, plugins and offers. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with the “Unsubscribe” link in every e-mail; this does not affect what was sent before.
Free plugin downloads. Free plugins are available to newsletter subscribers. To deliver them we create personal download links (valid for 7 days, limited number of uses) and log the time of each download with a one-way hash of the IP address, to prevent abuse. Legal basis: your consent to the newsletter and our legitimate interest in protecting the downloads (Art. 6(1)(a) and (f) GDPR).
Visitor statistics. We count visits on our own server, without cookies and without any third-party analytics service: the page viewed, the referring website, the device type (desktop, phone or tablet), the country (derived from a shortened IP address, which is not stored), clicks on the shop buttons, plays of videos, manual downloads and the words typed into the site search. Visitors are counted with an identifier that changes every day and cannot be linked to a person. Legal basis: our legitimate interest in understanding and improving the website (Art. 6(1)(f) GDPR).
Security. To protect the forms and the website from spam and attacks we use rate limits and short-lived security logs based on a one-way hash of the IP address. Legal basis: our legitimate interest in keeping the website secure (Art. 6(1)(f) GDPR).
3. Is providing data required?
No. Browsing the website does not require any personal data. Giving your e-mail address is voluntary, but without it we cannot answer your message, send the newsletter or deliver a free plugin.
4. Cookies and similar technologies
The public website does not use cookies. Your browser may store the website files in its normal cache. YouTube videos are loaded from the privacy-enhanced youtube-nocookie.com domain only after you click “play”; from that moment YouTube (Google) processes data under its own privacy policy.
5. Who receives the data
We do not sell or share your data with anyone for their own marketing. Data is processed on our behalf only by the company that hosts the website, the database and the e-mail service, under a data processing agreement. Links to Etsy, eBay, Reverb, Tindie and YouTube take you to those services, which act as separate controllers under their own privacy policies — what you do there (for example buying a module) is governed by their rules.
6. Where the data is stored
On our hosting server in the European Union. We do not transfer your data outside the European Economic Area. Only if you choose to play a YouTube video or visit one of the marketplaces may those services process data outside the EEA under their own safeguards.
7. How long we keep data
Contact messages: as long as needed to handle your request, at most 2 years. Newsletter: until you unsubscribe; the record of your consent and of unsubscribing is kept for up to 3 years as proof. Unconfirmed newsletter sign-ups: 30 days. Copies of e-mails we send: up to 90 days. Download records: up to 13 months. Visitor statistics (anonymous): up to 13 months. Security logs: up to 30 days. Deleted data is removed from regular backups within 30 days.
8. Automated decisions
We do not make automated decisions about you and we do not create profiles.
9. Your rights
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability, to object to processing based on our legitimate interest, and to withdraw your consent at any time. To use these rights, contact us as described in section 1 — we will answer within one month. You also have the right to lodge a complaint with the data protection supervisory authority in your country of residence, place of work or where you believe the infringement took place.
10. Security
The website uses an encrypted connection (HTTPS). Data is kept in a protected database, access to the administration is secured with a password and two-factor authentication, and we store only what is necessary.
11. Changes
We may update this policy when the website changes (for example when our own shop opens). The current version is always on this page, with the date below.
Last updated: 31 October 2026