Last updated 19 November 2026
Privacy
This notice explains what personal information IOTA collects through iotaofficial.com, why, and what you can do about it.
Who we are
iotaofficial.com is run by IOTA. Our postal address is available on request at [email protected]. We are the "controller" of your information. Contact us any time at [email protected].
What we collect and why
| When | What | Why (legal basis) | How long we keep it |
|---|---|---|---|
| You join the mailing list | Email address, first name (optional), city (optional), and whether you opened or clicked our emails | To send you news about music, shows, tickets and merch, and to tell you when we play near you. Basis: your consent, confirmed by the email you click to sign up. | Until you unsubscribe (every email has a link), then removed from our list |
| You buy merch | Name, email, shipping and billing address, what you ordered. Card details go directly to Stripe; we never see or store them. | To take payment, send your order and handle returns. Basis: contract. We keep records for tax. Basis: legal obligation. | Order records: 6 years (UK tax rules) |
| You email us | Whatever you send us | To reply. Basis: legitimate interests. | As long as the conversation needs, then deleted |
| You visit the site | Anonymous visit statistics (pages viewed, rough location, where you came from, device type) | To see what's working on the site. Basis: legitimate interests. Our analytics don't use cookies or identify you. | Kept only as anonymous totals that can't be linked to you |
Your bag is saved only in your own browser so it's still there when you come back. It isn't sent to us until you check out.
Who we share it with
We don't sell your information. We use these services to run the site, and they handle your data on our behalf:
- Kit (kit.com): our mailing list. Based in the US.
- Stripe (stripe.com): payments and order details.
- Cloudflare (cloudflare.com): hosts the site and provides visit statistics.
- Royal Mail: receives your name and address to deliver orders.
Some of these are outside the UK. Where that happens, they protect your data with the safeguards UK law requires, such as the UK International Data Transfer Addendum or the UK-US data bridge.
Embedded content
The site includes players and widgets from Spotify, Apple Music, Bandcamp, YouTube and Bandsintown, and fonts from Google Fonts. When these load, your browser connects to those companies, and they may collect data or set cookies under their own privacy policies. Music players only load after you tap "Load player" (we remember that choice on your device; clear this site's data in your browser to undo it). YouTube videos only load when you press play, and use YouTube's privacy-enhanced mode.
Your rights
You can ask us to see, correct or delete the information we hold about you, to stop using it, or to send it to you in a portable format. You can withdraw consent to emails at any time by unsubscribing. Email [email protected] and we'll respond within one month.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If we change this notice we'll update the date at the top.