Follow
Follow HSHQ
Privacy policy
PRIVACY POLICY
This store is operated by BSI Merch GmbH on behalf of Sony Music. For information about how Sony Music handles your personal data, please refer to the Sony Music Global Privacy Policy.
BSI Merch & Artist Services · Official Artist Stores (EU)
July 2026
Jump to Cookie Policy ↓1. Who we are and who controls your data
In this policy "BSI", "we", "us" and "our" mean BSI Merch GmbH, the EU operating entity for these stores. BSI Merch GmbH is the data controller for your personal data:
BSI Merch GmbH
Amtsgericht Charlottenburg, HRB 232304B
Registered office: Gottlieb-Dunkel-Str. 20/21, Haus 1, Bereich Blau, 12099 Berlin
VAT: DE345828165
You can contact our Data Protection Officer at dpo@bsimerch.com.
BSI Merch GmbH is established in Germany and is your controller; no separate EU representative is required.
2. The law we follow
We follow the EU GDPR, the German Federal Data Protection Act (BDSG) and German law implementing the ePrivacy Directive (the TDDDG).
3. The personal data we collect
When you order from us or interact with us, we may collect:
- Identity and contact data: name, email, telephone, billing and shipping address.
- Order data: items purchased, order value and order history.
- Marketing preferences: the opt-ins you have given, including any consent to hear from the artist.
- Technical and usage data: IP address, device and browser type, approximate location, and how you use our site, via cookies and similar technologies (see our Cookie Policy).
Our stores run on Shopify and are fulfilled by BSI Merch GmbH in the EU. We do not store full payment card numbers; card payments are processed securely by Shopify Payments (powered by Stripe), and PayPal payments by PayPal. We do not generally collect special category data.
4. How we use your data, and our lawful basis
We rely on the following lawful bases under Article 6 of the EU GDPR:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Fulfilling your order: processing, payment, delivery, confirmations and support | Identity, contact, order | Performance of a contract, Art 6(1)(b) |
| Managing your account | Identity, contact, order | Performance of a contract, Art 6(1)(b) |
| Our own marketing and stock alerts you request | Contact, preferences | Consent, Art 6(1)(a) |
| Sharing with the artist and Artist Parties for artist marketing | Contact, preferences | Consent, Art 6(1)(a) |
| Site analytics and improving our service | Technical, usage | Consent, Art 6(1)(a) |
| Targeted advertising | Technical, usage | Consent, Art 6(1)(a) |
| Fraud prevention and platform security | Identity, order, technical | Legitimate interests, Art 6(1)(f) |
| Keeping accounting and tax records | Identity, order | Legal obligation, Art 6(1)(c) |
5. Marketing and sharing with the artist
These are official stores for the artist. With your consent, we will share the personal data you have opted in (name, email, telephone and marketing preferences) with the artist and the artist's authorised representatives so that they can keep you updated about the artist.
"Artist Parties" means the artist and their authorised representatives, which may include their management company, record label(s), music publisher(s), licensors and rights holders, promoters, ticketing and live event partners, fan club and membership operators, merchandising partners, and other representatives authorised by the artist from time to time. Because an artist's business relationships change over time, this definition is intended to cover future authorised representatives as well.
Artist Parties may use your opted-in data to contact you about artist-related activities, including merchandise, touring and live events, ticketing, presales, fan clubs, memberships, promotions, competitions and other fan engagement. When we share your data with an Artist Party for their own marketing, that Artist Party is an independent controller and uses your data under its own privacy policy; we share under appropriate controller-to-controller terms. Giving this consent is optional and not a condition of buying. We ask for it separately at the point of collection (an unticked opt-in at checkout or sign-up), and you can withdraw it at any time.
6. Who else we share data with
- Service providers (processors): Shopify (e-commerce platform), Shopify Payments / Stripe and PayPal (payments), delivery partners, customer service tools, and Klaviyo (email and CRM).
- Analytics and performance providers: Google Analytics 4, Shopify analytics and Datadog.
- Advertising and affiliate partners, where you have consented to the relevant cookies: Meta, Google Ads, TikTok and Impact.
- Authorities and advisers where required by law, and any successor if our business is sold or reorganised (we will tell you if your controller changes).
7. International transfers
Some providers and Artist Parties are outside the EU/EEA, including in the United States. Where we transfer your data internationally we rely on appropriate safeguards:
We rely on an EU adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified; otherwise the EU Standard Contractual Clauses, with a transfer impact assessment where required.
You can ask us for a copy of the relevant safeguard using the contact details above.
8. How long we keep your data
| Category | Retention | Reason |
|---|---|---|
| Order and transaction records | 6 years after the end of the relevant financial year | Tax and accounting law |
| Account data | While your account is active, then 12 months | Service provision |
| Marketing consent and preferences | Until you withdraw consent or opt out | Consent |
| Customer service correspondence | 24 months | Handling queries and complaints |
| Cookie and analytics data | As set out in our Cookie Policy | Consent / legitimate interests |
9. Your rights
You have the right to access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests and to direct marketing at any time, and to withdraw consent where we rely on it. You also have the right not to be subject to solely automated decisions with legal or similarly significant effects; we do not make such decisions. To exercise any right, contact dpo@bsimerch.com.
Response times
We respond within one month, extendable by up to two further months for complex or numerous requests, and will tell you if we extend.
10. Complaints
Please contact us first and we will look into it. You also have the right to complain to a regulator:
Your local supervisory authority. Our lead authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
11. Cookies, security and children
We use cookies as described in our Cookie Policy. We use appropriate technical and organisational measures to protect your data, and in the event of a personal data breach we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours, and affected individuals without undue delay where the risk is high. Our stores are intended for adults; we do not knowingly collect data from children under 16 (we take children's needs into account in line with Article 8 EU GDPR).
12. Changes to this policy
We may update this policy and will post the updated version here with a new "last updated" date; where changes are significant we will take additional steps to tell you.
Cookie Policy
BSI Merch & Artist Services · Official Artist Stores (EU)
July 2026
This Cookie Policy explains how BSI Merch GmbH uses cookies and similar technologies. Please read it with our Privacy Policy.
1. What are cookies
A cookie is a small file stored on your device. We also use similar technologies such as pixels, tags, scripts and SDKs (together, "cookies"), set by us or by third parties. Session cookies last until you close your browser; persistent cookies stay until they expire or you delete them.
2. The law and your consent
We use cookies under the EU GDPR and German law implementing the ePrivacy Directive (the TDDDG). Only strictly necessary cookies are used without consent. All other cookies, including analytics, advertising and targeting, are used only with your prior consent. There is no analytics exemption under EU law.
3. Categories of cookies
- Strictly necessary: required for the site, basket and checkout, security and fraud prevention. Always on; cannot be switched off.
- Performance / analytics: help us count visits and improve the store (Google Analytics 4, Shopify analytics, Datadog). Consent required.
- Functional: remember preferences such as country and language.
- Advertising / targeting: used by us and partners (Meta, Google Ads, TikTok, Impact) to show and measure ads and track affiliate referrals. Set only with your consent.
4. The cookies on our stores
Our cookies include, but are not limited to, those set out below, and the durations shown are indicative.
| Cookie(s) | Provider | Category | Purpose | Duration* |
|---|---|---|---|---|
| cart, cart_currency, cartinfo, localization | Shopify | Strictly necessary | Basket, currency, localisation | Session to 2 weeks |
| shopify_client_id, _shopify_y, _shopify_s | Shopify | Analytics | Visitor / session analytics | 1 year / 30 mins |
| _ga, _ga_* (store-specific) | Google Analytics 4 | Analytics | Site usage | Up to 2 years |
| _gcl_au | Google Ads | Advertising | Conversion linking | ~90 days |
| _fbp | Meta | Advertising | Ad targeting and measurement | ~90 days |
| __kla_id | Klaviyo | Advertising / marketing | Email identity | ~2 years |
| IR_PI | Impact | Advertising | Affiliate attribution | 60 days |
*Indicative durations, as shown. Strictly necessary HttpOnly session cookies (for example _secure_session_id, _shopify_essential, keep_alive) are also set but require no consent.
5. Managing your choices
Our consent banner lets you Accept all, Reject all, or choose by category, and you can change your choices any time via the "Manage cookies" link in the footer. Rejecting non-essential cookies will not stop you browsing or buying. You can also control cookies in your browser.
6. International transfers and changes
Some cookie providers are outside the EU/EEA, including in the US; we apply the transfer safeguards in our Privacy Policy. We may update this policy and will post changes here with a new date.