Privacy Policy
This Privacy Policy explains what personal data Al Millennium collects when you visit almillennium.com, why we collect it, and the rights you have over it. It is written to comply with the EU General Data Protection Regulation (GDPR) and the Dutch Telecommunicatiewet (Dutch Telecommunications Act).
Who we are
Al Millennium is a creative project run under the trading name Vaurelion Entertainment, by Hakim Amir, based in Eindhoven, the Netherlands. Vaurelion Entertainment is the data controller for the personal data described below.
- Trading name: Vaurelion Entertainment
- KVK number: 72251476
- VAT number: NL002347618B51
- Registered address: Eindhoven, Netherlands
- Contact: legal@almillennium.com
What we collect, and why
Account & The Vault
If you register for a free account ("The Vault"), we collect your name, email address, and password (stored as an irreversible hash, never in plain text). This is used to create and secure your account, let you sign in, save favourites, and receive account-related emails — processed under contract performance (Art. 6(1)(b) GDPR): we need it to provide the account you asked for.
Shop orders
When you buy something from the shop, we collect your name, email address, phone number (optional), and — for physical items — your shipping address. This is used to process, fulfil, and communicate about your order, and is processed under contract performance (Art. 6(1)(b) GDPR). If online card payment is enabled, payment details are collected and processed directly by our payment processor, Stripe — we never see or store your full card number. See "Third parties" below.
Newsletter
If you sign up for the newsletter ("the Signal"), we collect your email address and use a double opt-in confirmation before sending anything. This is processed under your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by using the unsubscribe link in any email we send.
Cookieless analytics
We run a first-party, cookieless analytics beacon that records anonymous, aggregate page-view data: which page was viewed, an approximate device/screen category (mobile, tablet, laptop, desktop), and an approximate country derived from your IP address at the time of the request. Your IP address itself is used only for that momentary country lookup and is not stored. No cookie, browser fingerprint, or cross-site identifier is set or read by this beacon. This is processed under our legitimate interest (Art. 6(1)(f) GDPR) in understanding, in aggregate, how the site is used, weighed against your privacy — which is why no individually identifying data is kept.
Session & security cookies
The site sets a session cookie and a CSRF (cross-site request forgery) protection cookie. These are strictly necessary for the site to function — they keep you signed in and protect forms from being submitted by other sites on your behalf — and under the ePrivacy rules implemented in the Dutch Telecommunicatiewet, strictly necessary cookies do not require consent. See the Cookie Policy for the full list.
Third parties
- Stripe — if online card payment is enabled, Stripe processes your payment details directly under its own privacy policy and PCI-compliant safeguards. We never store full card numbers.
- YouTube (privacy-enhanced / "nocookie" embeds) — trailers and videos on the site are embedded via YouTube's privacy-enhanced mode, which limits cookies until you interact with the player. Once you play a video, Google/YouTube may set their own cookies and process data under their own privacy policy.
- Google Fonts — some pages load typefaces from Google Fonts, which may set cookies or log requests under Google's own privacy policy when your browser fetches them.
We do not sell your personal data, and we do not use advertising trackers, analytics cookies, or social media pixels of any kind.
International transfers
Data we collect directly is stored and processed within the EU. If Stripe is enabled, payment data may be processed by Stripe under its own EU-standard-contractual-clause and other GDPR-recognised safeguards for any transfer outside the EU. Google Fonts and YouTube may involve requests to Google's global infrastructure, covered by Google's own transfer safeguards.
Retention
We keep account data for as long as your account is active, order data for as long as required by Dutch tax and consumer law (generally 7 years for financial records), and newsletter data until you unsubscribe. Analytics beacon data is kept in aggregate form only and is not linked back to an individual.
Your rights
Under the GDPR, and as a resident of the EU, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("the right to be forgotten")
- Port your data to another service in a structured format
- Object to processing based on legitimate interest, including analytics
- Withdraw consent at any time, where processing is based on consent (e.g. the newsletter)
To exercise any of these rights, contact us at legal@almillennium.com. You also have the right to lodge a complaint with the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Changes to this policy
We may update this Privacy Policy as the site evolves. Material changes will be reflected in the "Last updated" date above.