Effective Date: 01/12/2023
The Websites are owned and operated by, or on behalf of, Kobalt Music Group Limited (“we” or “us”). We are registered in England and Wales under company number 04018752 and our registered office is at 120 Moorgate, London EC2M 6UR. Our VAT registration number is GB774150334.
Information we collect from you
We collect certain personal information about you when you sign up for an account or otherwise use our Websites. We also automatically collect information regarding your use of our sites as you use them.
How we use your information
We use your personal information for various purposes connected with your interest in our Websites, products, and services, and to allow us to maintain and improve them.
Sharing of personal information
We may share your personal information with certain third parties, such as with our service providers and to provide you with opportunities that we believe may be of interest to you.
Our Websites are not directed towards children and we do not knowingly collect personal information from them.
Data security and retention
The security of your personal information is of utmost important to us and we maintain appropriate safeguards to protect it.
Your choices and rights
You have certain choices and rights over how we use your personal information.
California Privacy Notice
We provide additional disclosures and rights to residents of California.
European Privacy Notice
We provide additional disclosures and rights to individuals located in Europe.
Australia Privacy Notice
You may obtain further information about our Australian subsidiaries.
You may contact us for comments or questions in various ways.
1 - Information we collect from you
1.1 - Personal information you provide to us
We may collect the following personal information about you to you choose to provide us through our Websites:
Account information. When you apply for an account on our Websites, including the Portal, you may be asked to provide basic contact information such as your title/role, name, email address, and password, government-issued identification numbers, and additional information that you may specify such as personal marketing preferences. We may also collect certain additional information for authentication purposes, such as your phone number.
Correspondence information. When you report a problem with the Websites to us or otherwise contact us, you may provide us with certain of your contact information and other personal information.
Payment information. If you purchase products or services from us, you may be required to provide your payment card or bank account information, or your account information for one of our third party payment platforms, as well as your shipping and billing addresses.
1.2 - Information that we automatically collect
Browser and device data, such as IP address, device identifier, device type, operating system and Internet browser type, screen resolution, operating system name and version, device manufacturer and model, language, plug-ins, add-ons, and the language version of the Websites you are visiting; and
Usage data, such as geolocation data, browsing history, time spent on the Websites, pages visited, links clicked, language preferences, patterns of use, and the pages that led or referred you to our Websites.
2 - How we use your information
We may use any information about you:
to provide you with any products and services that we may offer, including through our Portal (our “Products and Services”)
to enable you to have full access to the Websites;
to contact you when you have requested us to do so, including where required to respond to any reported problems concerning the Websites or the Products and Services;
to produce anonymous reports, statistics and analysis of the types of users who access the Websites;
to create your Kobalt account and identify you when you sign-in to your account in accordance with your agreement with us;
for marketing purposes (see Marketing section below), consistent with your communication preferences;
to contact you for your opinions on the Websites;
to allow you to participate in interactive features of the Portal, when you choose to do so
to administer and, for our legitimate interests, to improve the Websites, our services, and your account with us;
for our internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;
to ensure that content on the Websites and Portal is presented in the most effective manner for you and your device;
to protect ourselves, you, and others; prevent fraud and other unlawful or unauthorized activity; and create and maintain a trusted, secure, and reliable online environment; and
to comply with our legal obligations; respond to subpoenas, court orders, or legal process; and to establish or exercise our legal rights or defense against legal claims.
3 - Sharing of personal information
We may share your personal information with the following categories of third parties:
Among our brands and affiliates. We may share personal information among our various brands and affiliates to provide our Websites, provide the Products and Services, and for internal administrative purposes.
Our service providers. We share personal information with our service providers to provide services on our behalf, such as payment processing, analytics, advertising (excluding targeted advertising), hosting, marketing, customer and technical support, and other services. These third parties have access to your personal information only to perform these tasks on our behalf and are obligated not to disclose or use the information for any other purpose.
Other business partners. We may share personal information with third-party business partners in connection with our Websites, Products and Services.
Compliance and harm prevention. We may share personal information as we believe necessary (i) to comply with applicable law, rules and regulations; (ii) to enforce our contractual rights; (iii) to investigate possible wrongdoing in connection with the Sites, Products, and Services; (iv) to protect and defend the rights, privacy, safety and property of us, you, and others; and (v) to respond to requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities.
4 - Children’s Privacy
Our Websites are not directed toward children (as defined by local law) nor does Kobalt knowingly collect information from children (as defined by local law).
If you are a parent or guardian and you are aware that a child has provided us with personal information without parental consent, please contact us using the information in the Contact Us section. If we become aware that we have collected personal information from children without verification of parental consent, we will take steps to remove that information from our servers.
5 - Data security and retention
We take reasonable steps, including physical, technical and organisational measures, to protect your personal information from unauthorised access and against unlawful processing, accidental loss, destruction and damage. Unfortunately, transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information submitted to us and any transmission is at your own risk.
This includes use of multi-factor authentication to use the Portal. This is designed to ensure that the person accessing your account is, in fact, you. You may choose to provide us with a telephone number so that we can text you a one-time use code. You may alternatively use a third party authentication app ("Authentication App"). When you download the Authentication App, the applicable third party's privacy notice and/or the relevant app store privacy notice will apply to the collection and use of your information by the Authentication App and relevant app store (as applicable). The Authentication App is not provided by Kobalt and Kobalt is not responsible for the processing of your information by the Authentication App. In particular, you may use the Google Authenticator app. Please see more information here.
Your personal information will be retained by Kobalt for a period of time as necessary and relevant to our legitimate operations, our terms of agreement (if any) with you and in accordance with applicable legal obligations. This may include retention necessary to meet our tax reporting requirements as well as time required to enforce the relevant terms of agreement or to identify, issue or resolve legal proceedings.
Our determination of precise retention periods will be based on (i) the length of time we have an ongoing relationship with you; (ii) whether there is a legal obligation to which we are subject; and (iii) whether retention is advisable in light of our legal position, including regard to applicable statutes of limitations, litigation or regulatory investigations.
We may retain a record of you stated objection to the processing of your data, including in respect of an objection to receiving marketing communications, for the sole legitimate purpose of ensuring that we can continue to respect your wishes and not contact you further, during the term of your objection.
6 - Your choices and rights
You have options and choices over how we use your personal information. You may have the right under applicable laws to ask for details of the personal information we hold about you, or to amend, limit or delete your personal information. You may also have the right to object to further processing under certain circumstances.
We also respect the rights you may have under applicable laws to receive that information in a commonly used electronic format (or ask for this information to be provided in that format to a third party where feasible).
By email at: [email protected]
By writing to us, for the attention of our Data Protection Officer at: Kobalt Music Group, 1 Cousin Lane, London EC4R 3TE.
Please note that we may require you to verify your identity before allowing you to access your personal information.
In addition to the above, we may offer the following additional ways to exercise your privacy rights and preferences:
Your California privacy rights. California residents have certain rights with respect to our collection, use, and sharing of their personal information under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and other state laws. Please review our California Privacy Notice below for more information about those rights.
Your Nevada privacy rights. Nevada residents have the right to request to opt out of any “sale” of their personal information. Kobalt does not sell your personal information. However, you may nonetheless request to opt out of the future sale of your personal information. If you are a Nevada resident and would like to make such a request, please contact us using the information in the Contact Us section at the end of this Policy, and provide “Nevada Privacy Rights” in the subject line. You must include your full name, email address and postal address in your request so that we can verify your Nevada residence and respond. In the event we sell your personal information after the receipt of your request, we will make reasonable efforts to comply with such request.
Your European privacy rights. Individuals located in the European Economic Area, United Kingdom, and Switzerland have certain rights with respect to our collection, use, and sharing of their personal information. Please review our European Privacy Notice for more information about those rights.
7 - California Privacy Notice
The CCPA provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of personal information, as well as rights to access, delete, correct, limit, and opt-out of the sales of certain personal information we collect about them, as well as to opt-out of the selling of personal information and sharing of personal information for purposes of cross-context behavioral advertising (called “sharing” under California law). California residents also have the right not to receive discriminatory treatment by us for the exercise of your privacy rights under the CCPA. If you are a California resident, you may submit a request to exercise these rights by emailing us using the information provided in the Your Privacy Rights section below.
For the purposes of this California Privacy Notice, except where a different definition is noted, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been de-identified; or information that has been aggregated. For purposes of this section, “publicly available information” includes: information that is made available from federal, state, or local government records; information that a business has a reasonable basis to believe is lawfully available to the general public, either through widely distributed media, or by the consumer; and information that is made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.
7.1 - Personal information we collect
Kobalt may collect, or has collected, the following categories of personal information over the past twelve (12) months:
Identifiers, which includes first and last name; legal names, common names, and pseudonyms/personas; business entity names; email address; phone number; shipping address; billing address; account name; tax and other government-issued identification numbers (including Social Security Numbers, National Insurance Numbers, and passport numbers); proof of address (e.g., utility bills); online identifiers; and/or other similar identifiers.
Personal information described in California Civil Code § 1798.80(e), which includes first and last name; signatures; phone number; shipping address; billing address; tax and other government-issued identification number (including Social Security number, National Insurance number, and passport number); and/or payment card or bank account information or other financial information.
Characteristics protected under California or federal law, which includes your date of birth, age, or age range; gender or gender identity; marital status; and nationality or national origin.
Commercial information, which includes records of personal property; products or services purchased, obtained, or considered; or other purchasing histories or tendencies.
Internet or other electronic network activity information, which includes cookie identifiers; tracking pixels containing an ID number; online tracking technology; browser software; your computer’s operating system; the website that referred you to our site and/or the search terms you entered into a search engine to reach our site; internet service provider (“ISP”); date/time stamp; clickstream data; keylogging and computer mouse movement tracking; and device platform, version, and other device characteristics which may include settings such as Wi-Fi, Bluetooth, and Global Positioning System (“GPS”).
Geolocation data, which includes Global Positioning System (“GPS”) data based on your IP address.
Audio, electronic, visual, thermal, olfactory, or similar information, which includes photographic images; and audio recordings.
Professional or employment-related information, which includes employer name; employment history; job title or role; manager/supervisor; and office location.
Inferences drawn from the personal information listed above.
Please note that because of the overlapping nature of certain of the categories of personal information identified above, which are required by state law, some of the personal information we collect may be reasonably classified under multiple categories.
Sensitive personal information. Certain of the personal information that we collect, as described above, may constitute “sensitive personal information” under California law, including:
Social security, driver’s license, state identification card, or passport number; and
Account log-in combined with any required security or access codes, passwords, or other credentials allowing access to an account;
Kobalt will not retain any information we collect form you for longer than is reasonably necessary for the disclosed purpose of using such information. Our determination of precise retention periods will be based on (i) the length of time we have an ongoing relationship with you; (ii) whether there is a legal obligation to which we are subject; and (iii) whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation or regulatory investigations).
7.2 - Sources of personal information
We may collect personal information about you from the following categories of sources:
From you, including through our Websites, in-person, or via email, telephone, electronic messaging, postal mail, social media, or other means.
From other individuals and partners, including creators you may be associated with, other creators, our partners and their employees and representatives.
From and through our service providers, including communications and analytics providers; internet service providers; and operating systems and platforms.
We may supplement the information described above with information we obtain from other sources, including from both online and offline data providers.
7.3 - How we use your personal information
The sensitive personal information that we collect as described in Section 7(a) above may be used for any of these purposes.
7.4 - Who we disclose your personal information to
We may disclose your personal information to the categories of service providers and third parties identified in Section 3 as detailed in the chart below. This includes disclosure of your personal information to service providers for one or more business purposes. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not to use it for any purpose except performing the contract. In the preceding twelve (12) months, we have disclosed each categories of personal information listed in Section 7(a), including the listed sensitive personal information, for a business purpose. Kobalt does not “sell”/”share” personal information, including for purposes of cross-context behavioral advertising, as those terms are defined by the CCPA.
7.5 - Your privacy rights
If you are a California resident, you have the right to make the following requests under applicable California law in relation to your personal information, subject to certain exceptions:
Right to Know. You have the right to, up to twice in a 12-month period, request what personal information we collect, use, disclose, and/or sell, and to whom, as applicable.
Right to Delete. You have the right to request, under certain circumstances, the deletion of your personal information that we collect.
Right to Opt-Out of Sale or Sharing. You have the right to opt-out of the sale or sharing of your personal information as those terms are defined under California law. However, as noted above, we do not sell/share your personal information.
Right to Limit Use and Disclosure. You have the right to limit the use or disclosure of your sensitive personal information to only the uses necessary for us to provide our products and services to you, or for certain other purposes authorized by California law.
Right to Correct. You have the right to request the correction of your inaccurate personal information.
Right to Non-Discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.
How to submit a request. You may exercise any of the rights described in this section by emailing us at [email protected] or mailing us at Data Protection Officer, Kobalt Music Group, 1 Cousin Lane, London EC4R 3TE.
Any request you submit to us is subject to an identification and residency verification process (“Verifiable Consumer Request”) as permitted by the CCPA. We will not fulfill your request unless you have provided sufficient information that enables us to reasonably verify that you are the consumer about whom we collected the personal information on. To verify you, you must provide us with your first name, last name, and email address. We may request additional information for verification purposes, such as your royalty statement. These rights are also subject to various exclusions and exceptions under applicable laws.
You may also designate an authorized agent, in writing or through a power of attorney, to request to exercise the above rights on your behalf. If you should use an authorized agent to exercise your various rights under the CCPA, we may require that you provide your authorized agent with written permission to exercise your various rights and to verify your own identity with us. If your authorized agent does not submit proof that they have been authorized by you to submit verified requests for disclosure and deletion, we reserve the right to deny such a request that we have received and will explain to your authorized agent why we have denied such request. The authorized agent may submit a request to exercise these rights by emailing the letter of authorization or power of attorney to [email protected].
We currently do not collect household data. If we receive a request submitted by all members of a household, we will individually respond to each request. We will not be able to comply with any request by a member of a household under the age of 13, as we do not collect personal information from any person under the age of 13.
We will respond to your request within forty-five (45) days after receipt of a Verifiable Consumer Request for a period covering twelve (12) months and for no more than twice in a twelve-month period. We reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days.
Direct marketing by third parties. Kobalt does not disclose personal information to third parties for their own direct marketing purposes. However, California residents additionally have the right to request information regarding such practices under California’s “Shine the Light” law. If you are a California resident and would like to inquire further, please email [email protected].
We will continue to update our business practices as direct regulatory guidance becomes available.
8 - European Privacy Notice
European law provides individuals located in Europe with rights to receive certain disclosures regarding the collection, use, and sharing of personal data, as well as rights to be informed, access, rectification, erasure, restrict processing, data portability and to object with respect to collected personal data. For the purposes of this European Privacy Notice, “personal data” means any information relating to an identified or identifiable natural person.
8.1 - Basis for processing your personal data
We will retain your personal data for as long as required for the purpose for which we originally processed your information, or as long as the law permits.
Legitimate business interests. We may collect, process, and maintain personal data to pursue the legitimate business interests outlined below. To determine these legitimate interests, we balance our legitimate interests against the legitimate interests and rights of you and others and only process personal data in accordance with those interests where they are not overridden by your data-protection interests or fundamental rights and freedoms.
Provide, improve, and develop our Websites, Products, and Services, including to deliver the Websites including our Portal, send you messages and provide user support, customize the Websites to better fit your needs as a user, develop new Products and Services, and perform internal analytics and research and development. This also includes sharing personal data with our trusted service providers that provide services on our behalf.
Protect you and others and to create and maintain a trusted environment, such as to comply with our legal obligations, to ensure compliance our agreements with you and other third parties, to ensure safe, secure, and reliable Websites, Products, and Services, and to detect and prevent wrongdoing and crime, assure compliance with our policies, and protect and defend our rights, interests, and property. In connection with the activities above, we may conduct internal research and profiling based on your interactions on various Websites, content you submit to the Websites, and information obtained from third parties.
Provide, personalize, measure and improve our marketing, including to send you promotional messages and other information that may be of interest to you with your consent. We may also use personal data to understand our user base and the effectiveness of our marketing. This processing is done pursuant to our legitimate interest in undertaking marketing activities to offer products or services that may be of interest to you.
8.2 - Data sharing and transfers to third countries
Where we transfer personal information data we will seek to take account of any applicable statutory obligations relevant to personal information data transfers. In the case of transfers out of the EEA, we will, in the absence of an EC adequacy decision relevant to the destination country, seek to rely on appropriate safeguards such as a valid Privacy Shield certified US recipient or enter into appropriate EC approved standard contractual clauses (see http://ec.europa.eu/justice/data-protection/international-transfers/transfer/index_en.htm).
This may include the transfer of your personal data to one or more countries outside the UK and the EEA, where we (or other companies within the Kobalt Group), or our service providers maintain operations. You understand and accept that if your personal data is disclosed to third parties outside the UK and EEA those parties may be based in territories that may not have data protection provisions in law. In the case of transfers out of the UK and EEA, we will, in the absence of an EC adequacy decision relevant to the destination country, seek to rely on appropriate safeguards provided under law.
8.3 - Your privacy rights
In certain circumstances, individuals located within the EEA, UK, and Switzerland are entitled to the following data protection rights regarding their personal data:
Right to access. You have the right to request confirmation of whether Kobalt processes personal data relating to you, and if so, to request a copy of that personal data.
Right to rectification. You have the right to request that Kobalt correct or update your personal data that is inaccurate, incomplete or outdated.
Right to erasure. You have the right to request that Kobalt erase your personal data in certain circumstances provided by law.
Right to restrict processing. You have the right to request that Kobalt restrict the use of your personal data in certain circumstances.
Right to object to processing. You have the right to object to Kobalt’s processing of your personal data, under certain conditions.
Right to data portability. You have the right to request that Kobalt export the data that we have collected to you or another company, under certain conditions.
Where the processing of your personal data is based on your previously provided consent, you have the right to withdraw your consent at any time. If you would like to exercise any of these rights, please submit a written request using the information in the Contact Us section below. We will respond to these requests in accordance with applicable data protection laws. We may ask you to verify your identity in order to help us respond efficiently to your request.
You may also have the right to lodge a complaint about our data collection and processing actions with the appropriate supervisory authority. In the UK, the appropriate authority is the Information Commissioner’s Office (ICO), accessible here. In the EEA, you can view the contact information for your data protection authority here.
9 - Australia Privacy Notice
10 - Cookies
“Cookies” are small pieces of information which are issued to your computer or mobile device when you visit a website and which store and sometimes track information about your use of the website. When you visit our website, our web server sends a cookie to your device which allows us to recognise your device.
12 - Contact Us
Data Protection Officer
Kobalt Music Group
120 Moorgate, London EC2M 6UR