Privacy Policy
BSI Merch & Artist Services · Official Artist Stores (UK & EU)
July 2026
Jump to Cookie Policy↓1.Who we are and who controls your data
In this policy "BSI", "we", "us" and "our" mean the BSI associated businesses. Backstreet International Merchandise Ltd and BSI Merch GmbH are separate legal entities that operate the official artist stores together. The data controller for your personal data is the entity that operates the store you use:
| Region | Data controller and details |
|---|---|
| United Kingdom |
Backstreet International Merchandise Ltd (trading as BSI Merch & Artist Services) Company no. 02597733, registered in England and Wales Registered office: 1a High Street, Epsom, Surrey, KT19 8DA VAT: GB 549 0485 22 |
| EU / EEA |
BSI Merch GmbH Amtsgericht Charlottenburg, HRB 232304B Registered office: Gottlieb-Dunkel-Str. 20/21, Haus 1, Bereich Blau, 12099 Berlin VAT: DE345828165 |
You can contact our Data Protection Officer for either entity at dpo@bsimerch.com. Our UK ICO registration number is 00012249518.
If you are in the EU/EEA, BSI Merch GmbH is established in Germany and is your controller; no separate EU representative is required. If you are in the UK, Backstreet International Merchandise Ltd is your controller.
2.The law we follow
UK store: the UK GDPR, the Data Protection Act 2018, PECR and the Data (Use and Access) Act 2025. EU store: the EU GDPR, the German Federal Data Protection Act (BDSG) and German law implementing the ePrivacy Directive (the TDDDG).
3.The personal data we collect
When you order from us or interact with us, we may collect:
- Identity and contact data: name, email, telephone, billing and shipping address.
- Order data: items purchased, order value and order history.
- Marketing preferences: the opt-ins you have given, including any consent to hear from the artist.
- Technical and usage data: IP address, device and browser type, approximate location, and how you use our site, via cookies and similar technologies (see our Cookie Policy).
Our stores run on Shopify and are fulfilled by Backstreet International Merchandise Ltd in the UK and BSI Merch GmbH in the EU. We do not store full payment card numbers; card payments are processed securely by Shopify Payments (powered by Stripe), and PayPal payments by PayPal. We do not generally collect special category data.
4.How we use your data, and our lawful basis
We rely on the following lawful bases under Article 6 of the UK GDPR and the EU GDPR (the bases are the same under both):
| Purpose | Data used | Lawful basis |
|---|---|---|
| Fulfilling your order: processing, payment, delivery, confirmations and support | Identity, contact, order | Performance of a contract, Art 6(1)(b) |
| Managing your account | Identity, contact, order | Performance of a contract, Art 6(1)(b) |
| Our own marketing and stock alerts you request | Contact, preferences | Consent, Art 6(1)(a) |
| Sharing with the artist and Artist Parties for artist marketing | Contact, preferences | Consent, Art 6(1)(a) |
| Site analytics and improving our service | Technical, usage | UK: consent or legitimate interests; EU: consent, Art 6(1)(a) |
| Targeted advertising | Technical, usage | Consent, Art 6(1)(a) |
| Fraud prevention and platform security | Identity, order, technical | Legitimate interests, Art 6(1)(f) |
| Keeping accounting and tax records | Identity, order | Legal obligation, Art 6(1)(c) |
5.Marketing and sharing with the artist
These are official stores for the artist. With your consent, we will share the personal data you have opted in (name, email, telephone and marketing preferences) with the artist and the artist's authorised representatives so that they can keep you updated about the artist.
"Artist Parties" means the artist and their authorised representatives, which may include their management company, record label(s), music publisher(s), licensors and rights holders, promoters, ticketing and live event partners, fan club and membership operators, merchandising partners, and other representatives authorised by the artist from time to time. Because an artist's business relationships change over time, this definition is intended to cover future authorised representatives as well.
Artist Parties may use your opted-in data to contact you about artist-related activities, including merchandise, touring and live events, ticketing, presales, fan clubs, memberships, promotions, competitions and other fan engagement. When we share your data with an Artist Party for their own marketing, that Artist Party is an independent controller and uses your data under its own privacy policy; we share under appropriate controller-to-controller terms. Giving this consent is optional and not a condition of buying. We ask for it separately at the point of collection (an unticked opt-in at checkout or sign-up), and you can withdraw it at any time.
6.Who else we share data with
- Service providers (processors): Shopify (e-commerce platform), Shopify Payments / Stripe and PayPal (payments), delivery partners, customer service tools, and Klaviyo (email and CRM).
- Analytics and performance providers: Google Analytics 4, Shopify analytics and Datadog.
- Advertising and affiliate partners, where you have consented to the relevant cookies: Meta, Google Ads, TikTok and Impact.
- Authorities and advisers where required by law, and any successor if our business is sold or reorganised (we will tell you if your controller changes).
7.International transfers
Some providers and Artist Parties are outside the UK and EU/EEA, including in the United States. Where we transfer your data internationally we rely on appropriate safeguards:
| United Kingdom | European Union / EEA |
|---|---|
| We rely on a UK adequacy decision, including the UK Extension to the EU-US Data Privacy Framework (the "UK-US Data Bridge") where the recipient is certified; otherwise the International Data Transfer Agreement (IDTA), or the EU SCCs with the UK Addendum. | We rely on an EU adequacy decision, including the EU-US Data Privacy Framework where the recipient is certified; otherwise the EU Standard Contractual Clauses, with a transfer impact assessment where required. |
You can ask us for a copy of the relevant safeguard using the contact details above.
8.How long we keep your data
| Category | Retention | Reason |
|---|---|---|
| Order and transaction records | 6 years after the end of the relevant financial year | Tax and accounting law |
| Account data | While your account is active, then 12 months | Service provision |
| Marketing consent and preferences | Until you withdraw consent or opt out | Consent |
| Customer service correspondence | 24 months | Handling queries and complaints |
| Cookie and analytics data | As set out in our Cookie Policy | Consent / legitimate interests |
9.Your rights
You have the right to access, rectification, erasure, restriction, data portability, to object to processing based on legitimate interests and to direct marketing at any time, and to withdraw consent where we rely on it. You also have the right not to be subject to solely automated decisions with legal or similarly significant effects; we do not make such decisions. To exercise any right, contact dpo@bsimerch.com.
Response times
| United Kingdom | European Union / EEA |
|---|---|
| We respond within one month. Under the Data (Use and Access) Act 2025 we may pause that period ("stop the clock") if we reasonably need more information, and may extend it by up to two further months for complex requests. | We respond within one month, extendable by up to two further months for complex or numerous requests, and will tell you if we extend. |
10.Complaints
Please contact us first and we will look into it. You also have the right to complain to a regulator:
| United Kingdom | European Union / EEA |
|---|---|
| The Information Commissioner's Office (ICO), ico.org.uk, 0303 123 1113. | Your local supervisory authority. Our lead authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). |
11.Cookies, security and children
We use cookies as described in our Cookie Policy. We use appropriate technical and organisational measures to protect your data, and in the event of a personal data breach we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours, and affected individuals without undue delay where the risk is high. Our stores are intended for adults; we do not knowingly collect data from children under 16 (we take children's needs into account in line with the ICO Age Appropriate Design Code in the UK and Article 8 EU GDPR in the EU).
12.Changes to this policy
We may update this policy and will post the updated version here with a new "last updated" date; where changes are significant we will take additional steps to tell you.
BSI Merch & Artist Services · Official Artist Stores (UK & EU)
July 2026
This Cookie Policy explains how the BSI group (Backstreet International Merchandise Ltd for our UK stores, and BSI Merch GmbH for our EU stores) uses cookies and similar technologies. Please read it with our Privacy Policy.
1.What are cookies
A cookie is a small file stored on your device. We also use similar technologies such as pixels, tags, scripts and SDKs (together, "cookies"), set by us or by third parties. Session cookies last until you close your browser; persistent cookies stay until they expire or you delete them.
2.The law and your consent
| United Kingdom | European Union / EEA |
|---|---|
| We use cookies under PECR and the UK GDPR, as amended by the Data (Use and Access) Act 2025. Strictly necessary cookies, and low-risk cookies used only for aggregate analytics to improve our service, can be used without consent, but we tell you clearly and offer a simple way to object. All other non-essential cookies, including advertising, are used only with your consent. | We use cookies under the EU GDPR and German law implementing the ePrivacy Directive (the TDDDG). Only strictly necessary cookies are used without consent. All other cookies, including analytics, advertising and targeting, are used only with your prior consent. There is no analytics exemption under EU law. |
3.Categories of cookies
- Strictly necessary: required for the site, basket and checkout, security and fraud prevention. Always on; cannot be switched off.
- Performance / analytics: help us count visits and improve the store (Google Analytics 4, Shopify analytics, Datadog). UK: aggregate-only with a simple objection; EU: consent required.
- Functional: remember preferences such as country and language.
- Advertising / targeting: used by us and partners (Meta, Google Ads, TikTok, Impact) to show and measure ads and track affiliate referrals. Set only with your consent.
4.The cookies on our stores
Our cookies include, but are not limited to, those set out below, and the durations shown are indicative.
UK stores
| Cookie(s) | Provider | Category | Purpose | Duration* |
|---|---|---|---|---|
| cart, cart_currency, cartinfo, localization | Shopify | Strictly necessary | Basket, currency, localisation | Session to 2 weeks |
| _shopify_y, _shopify_s | Shopify | Analytics | Visitor / session analytics | 1 year / 30 mins |
| _ga, _ga_* (store-specific) | Google Analytics 4 | Analytics | Site usage | Up to 2 years |
| _dd_s | Datadog | Analytics | Performance monitoring | Session |
| _fbp | Meta | Advertising | Ad targeting and measurement | ~90 days |
| _gcl_au | Google Ads | Advertising | Conversion linking | ~90 days |
| _ttp, ttcsid, ttcsid_* | TikTok | Advertising | Ad targeting and measurement | ~13 months |
| __kla_id, __kla_session | Klaviyo | Advertising / marketing | Email identity and session | ~2 years / session |
| IR_PI | Impact | Advertising | Affiliate attribution | 60 days |
EU stores
| Cookie(s) | Provider | Category | Purpose | Duration* |
|---|---|---|---|---|
| cart, cart_currency, cartinfo, localization | Shopify | Strictly necessary | Basket, currency, localisation | Session to 2 weeks |
| shopify_client_id, _shopify_y, _shopify_s | Shopify | Analytics | Visitor / session analytics | 1 year / 30 mins |
| _ga, _ga_* (store-specific) | Google Analytics 4 | Analytics | Site usage | Up to 2 years |
| _gcl_au | Google Ads | Advertising | Conversion linking | ~90 days |
| _fbp | Meta | Advertising | Ad targeting and measurement | ~90 days |
| __kla_id | Klaviyo | Advertising / marketing | Email identity | ~2 years |
| IR_PI | Impact | Advertising | Affiliate attribution | 60 days |
*Indicative durations, as shown. Strictly necessary HttpOnly session cookies (for example _secure_session_id, _shopify_essential, keep_alive) are also set but require no consent.
5.Managing your choices
Our consent banner lets you Accept all, Reject all, or choose by category, and you can change your choices any time via the "Manage cookies" link in the footer. Rejecting non-essential cookies will not stop you browsing or buying. You can also control cookies in your browser.
6.International transfers and changes
Some cookie providers are outside the UK and EU/EEA, including in the US; we apply the transfer safeguards in our Privacy Policy. We may update this policy and will post changes here with a new date.