Tango Time Travel
Privacy policy
Last revised: · Version 2026-09-24.1.
Who is responsible
Tango Time Travel is a project operated by Moving Art Studio ASBL, a Belgian non-profit association. Our contact address is 51 rue de l’Instruction, 1070 Brussels, Belgium; enterprise/VAT number BE0451807885. Contact: info@tangotimetravel.be. Moving Art Studio ASBL is responsible for the processing described in this notice.
This notice covers account, purchase, download and support data associated with TTT. Reading or using the website is not blanket consent to all processing.
Data, purposes and legal bases
Orders and accounts: identity, contact and billing details, purchases, account credentials and download entitlements are used to take steps at your request and perform the purchase contract. Fields needed to process an order or respond to a request are identified in the relevant form; without necessary information we may be unable to provide that service.
Contract records and withdrawal requests: we keep the version of the applicable terms and the choices you made at checkout, together with their date and order reference, to document and perform the purchase contract and meet our legal obligations. A withdrawal declaration includes the identity and contact details you provide, the purchase reference, the items concerned and the date of the declaration. We use this information to handle your request, send its acknowledgement, meet applicable obligations and establish or defend legal claims. It is not published.
Preferred audio format: if you choose to remember a format, we use that preference to help you select compatible music files. It is stored in the shopping session or, for a signed-in customer, in the account. You can use the format preference’s forget option without changing your purchases or download rights.
Accounting and tax: invoices, transaction records and relevant country/location evidence are processed to comply with applicable accounting and VAT obligations.
Support and security: messages, order references, IP addresses, access/download logs and technical device/browser information help us resolve delivery issues and protect accounts, files and payments. Depending on the request, the basis is contract performance or our legitimate interests in operating a reliable service, preventing abuse and establishing or defending legal claims. IP addresses and other online identifiers may be personal data.
Gift cards: the purchaser supplies recipient contact details and a message so that the gift can be delivered. If you receive a gift, those details came from the purchaser; we use them to deliver and administer that gift, not as automatic permission for marketing.
Marketing and optional technologies: a purchase is not blanket consent to advertising or tracking. Where consent is required, it must be obtained separately and can be withdrawn. You may object to direct marketing at any time.
Service providers and payment security
Authorised people handling the service and relevant hosting, email, payment, security and accounting providers may receive the information needed for their tasks. WordPress and WooCommerce operate the shop; installing software does not by itself mean that its publisher receives customer data.
Stripe processes payment-related information and may act in its own capacity for purposes such as fraud prevention and regulatory obligations. See the Stripe privacy policy. We receive transaction references and payment-status information needed to manage orders. Do not send us full payment-card details by email.
The contact form uses Google reCAPTCHA to assess possible automated abuse. Google processes relevant technical information on our behalf to provide reCAPTCHA for security, fraud and abuse prevention, under the Google Cloud Terms of Service and Cloud Data Processing Addendum. Moving Art Studio ASBL remains responsible for this processing as data controller. If the form fails, email us directly. Payment and security checks may automatically reject an attempt; contact us if you believe a legitimate request or payment has been blocked so that the issue can be reviewed.
Some providers may process data outside the European Economic Area. The applicable transfer arrangements depend on the provider and processing involved, including adequacy decisions or appropriate safeguards where required. Contact us for information on the recipients and safeguards relevant to your data; provider policies above also describe their international operations.
How long information is kept
Purchase and download history. We retain the transaction history, download records and entitlements needed to maintain your purchases and operate the shop. These records help us restore access where appropriate, identify previous purchases, prevent duplicate orders and resolve delivery issues. We do not set an automatic deletion date for these essential records while they remain necessary for those purposes. Inactivity alone does not trigger their deletion.
Customer support. We retain support correspondence and the relevant history of how requests were handled to provide continuity of customer service and understand earlier decisions or recurring issues. No automatic deletion date is currently set for this history. Access is restricted to authorised people. This does not mean that every attachment or incidental item of personal information must be retained indefinitely; information no longer needed may be removed following review or an applicable data-protection request.
Accounting, tax and contractual evidence. Invoices and accounting records are retained for the applicable statutory periods. Records required under the EU One Stop Shop (OSS) VAT scheme are retained for ten years from the end of the calendar year in which the transaction took place. Contract confirmations, checkout choices and withdrawal records are retained for as long as necessary to fulfil the associated obligations and establish, exercise or defend legal claims.
Technical logs and backups. Security and diagnostic logs follow their own retention and rotation rules and are distinct from the purchase and download history described above. Backup copies expire according to the applicable backup cycle.
Deletion requests. We assess requests individually. Deleting an account does not automatically erase records that must be retained for legal obligations or justified claims. Where a request would affect access to existing purchases, we explain the consequences and assess which information can be removed while preserving the records that remain necessary.
Your rights and how to exercise them
Contact info@tangotimetravel.be to request access, correction, erasure, restriction or portability where applicable, or to object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting processing already lawfully carried out. We may request information reasonably necessary to verify your identity.
Requests and the first copy under the right of access are normally free. Charges or refusal are permitted only in the limited circumstances allowed by law, not as a routine fee. We normally respond within one month; where the GDPR permits an extension, we explain the reason and notify you within that first month.
You may complain to the Belgian Data Protection Authority or another competent supervisory authority. You do not have to complete our internal complaint process before exercising that right.
If personal data relating to a child has been supplied inappropriately, contact us so that we can assess the circumstances and appropriate action. This notice does not set a universal minimum age for every type of processing.
Revision history and references
24 September 2026 — reCAPTCHA clarification. Updated Google’s role as processor and the applicable Cloud terms for security, fraud and abuse prevention.
24 September 2026 — retention clarification. Clarified the ongoing purposes of purchase, download and customer-support history, the ten-year OSS record-keeping period, and the distinction between business records, technical logs and rotating backups.
22 September 2026 — purchase rights and request records. Clarified retention of purchase history and download entitlements, checkout proof and withdrawal declarations, and the remembered audio-format preference. No automatic deletion of purchase rights is introduced by this revision.
21 September 2026 — GDPR accuracy and transparency revision. Removed implied consent through browsing, the routine access-fee statement and the categorical description of IP logs as non-personal. Added purpose/legal-basis distinctions, payment and reCAPTCHA information, gift recipients, retention criteria, rights and supervisory-authority contact.
These corrections concern obligations already established by the GDPR, applicable since 25 May 2018; they are not described as a new 2026 privacy law. The generic CCPA section was removed rather than presenting that law as automatically applicable to this Belgian non-profit association. English grammar and terminology were revised. GDPR Articles 12–22; APD: consent.