Privacy Policy

Who this covers

This policy applies to Canada Music Group (“CMG”, “we”, “us”) and covers our website, the Distribution Portal, and our three businesses: CMG Records, CMG Distribution and CMG Publishing. It applies to artists, songwriters, labels, managers, job applicants and anyone who visits or contacts us.

This policy does not cover other companies that handle your music, such as streaming platforms, or the way you use social media. Each of them has its own rules.

If you sign an agreement with us, that agreement may add details about how we handle your information. Where the two differ, the agreement applies to that relationship.

Key terms

To keep this policy readable, we use a few terms in a specific way:

Who is responsible for your information

Canada Music Group is the controller of the personal information described in this policy. This means we decide why and how it is used and we are responsible for handling it lawfully. CMG Records, CMG Distribution and CMG Publishing operate as part of the same group, so your information may be used across them where that is needed to provide the service you asked for.

If you have a question about who is responsible for a particular piece of information, or want to reach the people who handle privacy at CMG, use the details in the “Contact us” section at the end of this policy.

Information we collect

We collect only what we need to run our services. Most of it comes directly from you.

Where it comes from

We get personal information in four ways:

• From you. When you create an account, fill in a release, ask a question or apply for a job.
• From your use of our services. For example, which releases you upload, which reports you open and when you sign in.
• From platforms and stores. They send us streams, sales and royalty data about your music. This is reported to us as totals, such as countries and platforms, rather than as named listeners.
• From other people. A collaborator, manager or label may add you to a release or split, or give us your contact details so we can reach you.

How we use it

• Create and manage your account, and confirm it is really you.
• Deliver your music to streaming platforms and stores on the date you choose.
• Show you reports, calculate royalties and make payments.
• Review releases against technical and platform requirements.
• Answer your questions and give support.
• Register songs, collect royalties and pitch music for sync licensing.
• Keep our services secure, prevent fraud and fix problems.
• Meet legal, tax and accounting obligations.
• Send service messages, and news about CMG if you have asked for it. You can opt out of news at any time.

We use your information only for these purposes, or for another purpose we tell you about first. We do not make decisions about you that have legal or similarly significant effects by automated means alone. Our checks on releases, such as file quality and platform rules, are reviewed by our team.

Our reasons for using it

Data protection laws ask us to have a lawful reason for using your information. Ours are:

• To carry out our agreement with you. Delivering releases, reporting and paying royalties all depend on using your details.
• Our legitimate interests. Running a secure, reliable service, preventing fraud and improving what we offer, in ways that do not override your rights.
• Legal obligations. Tax, accounting, sanctions and other rules we must follow.
• Your consent. For optional things such as news emails. You can withdraw consent at any time and we will stop.

How we use your information, activity by activity

The table below sets out each main activity, the information it involves, what we do with it, and the reason the law allows us to do it. If you choose not to give us information we ask for, we may not be able to provide the related service.

Where we rely on legitimate interests, we have considered whether our use could be unfair to you, and we do not use your information in that way if our interest is outweighed by your rights. You can ask us how we reached that conclusion.

Our lawful reasons, explained

Many privacy laws require us to have a valid reason before we use your personal information. This section explains each reason we rely on in plain language, so you can see how it applies to you.

Carrying out our agreement with you

When you open a Distribution Portal account, sign a distribution, label or publishing agreement, or ask us to take steps before an agreement is made, we need to use your information to do what we promised. Delivering a release, producing a royalty statement and sending a payout are all examples. If we could not use your information for these tasks, we could not provide the service. This is the reason we rely on most often.

Our legitimate interests

We sometimes use information because it is genuinely useful to run CMG responsibly, and because we think the impact on you is small or expected. Examples include keeping our systems secure, spotting fraud, answering general questions, understanding which parts of the website are used, and improving our services. Before relying on this reason, we ask three questions: is our interest real and lawful, is using your information necessary for it, and do your rights and expectations outweigh it. If the answer to the third question is yes, we do not use your information that way. You can object to this kind of use at any time.

Legal obligations

Some laws require us to collect, keep or share information. These include tax and accounting rules, sanctions and anti-money-laundering checks, consumer rules, and orders from courts and regulators. Where a law requires it, we may not be able to delete the information even if you ask, but we will limit its use to what the law requires.

Your consent

For optional activities, such as news emails, we ask for your permission first. Consent must be your free choice, specific, informed and clear. We will not make it a condition of using our services unless it is genuinely needed. You can withdraw consent at any time by using the unsubscribe link, changing your settings, or contacting us. Withdrawing consent does not affect what we did before, and it will not affect any use that rests on a different reason.

Protecting someone’s vital interests, or the public interest

In rare cases, we may use information to protect someone’s life or physical safety, or where the law gives us a public interest task. We expect this to be very unusual.

Who we share it with

We do not sell personal information. We share it only in these cases:

• Streaming platforms and digital stores. We send the release content and details needed to put your music live.
• Payment and banking providers. They process payouts to you.
• Contributors on a release. People you list in the splits can see their own share and the release it belongs to.
• Service providers. Companies that host our systems, send email or help with support work for us under instructions to protect your information. This includes the tools you may use to contact us, such as Gmail, Google Forms and Tally, which store the messages you send.
• Authorities and advisers. When the law requires it, or to protect rights, safety or property, and to our legal and financial advisers.
• A future owner. If CMG merges with or is acquired by another company, your information may transfer with the business. We will tell you if that happens.

Other people’s information

Releases often involve more than one person. When you give us a collaborator’s name, email address or share of income, you confirm that you have the right to share it with us and that the person knows their details are used for the release.

If you are named on a release by someone else and want to know what we hold about you, or want something corrected, you can use the same contact route as everyone else in the section on your rights below.

Automated checks and decisions

We use automated tools to help check that audio files, artwork and metadata meet the technical and policy requirements of the platforms we deliver to, and to flag unusual sign-in or payout activity for security reasons. These checks help our team work faster, but they do not decide on their own anything that has a legal or similarly significant effect on you. A member of our team reviews any decision to reject a release, hold a payment or restrict an account.

If you disagree with an outcome, contact us and ask for a person to review it. We will look at it again and explain our decision.

Fraud prevention and security monitoring

Music distribution is a target for fraud, including stolen identities, fake accounts, artificial streaming and attempts to redirect payouts. To protect you, other artists and our platform partners, we may use account, payout, release and technical information to detect, investigate and prevent this kind of activity. We may also verify your identity, or ask for extra documents, before we change payout details or release a large payment.

We do this because it is necessary for our legitimate interests in running a safe service and, in some cases, because the law or our partners require it.

Legal claims, audits and business changes

We may use and keep any of the information described in this policy to bring or defend legal claims, respond to regulators and law enforcement, carry out internal and external audits, and check that we follow the law and our contracts. We may also share it with our lawyers, accountants and auditors for these purposes.

If CMG, or part of it, is involved in a merger, sale, financing or reorganisation, we may share personal information with the other party and its advisers under a duty of confidentiality. We will tell you if the change means your information will be handled under a different policy.

Cookies and local storage

Our pages remember your light or dark mode choice by saving a small setting in your browser’s local storage. That setting stays on your device. Some pages also load fonts from Google Fonts, so your browser contacts Google’s servers and Google can see your IP address.

Our Cookie Policy explains the cookies and similar technologies we use and how to control them.

Information that becomes public

Music distribution is public by nature. Once we deliver a release, details such as your artist name, track titles, credits, artwork and release date appear on platforms and may be copied by third parties. We do not control those platforms. To remove a release, ask us to take it down; this may take time to reach every platform.

Emails and notifications

We send two kinds of messages. Service messages are about your account and releases, such as confirming your email address, telling you a release needs changes, or letting you know a statement is ready. You will receive these while you have an account.

News and updates about CMG are optional. Every one has an unsubscribe link, and you can also ask us to stop by writing to halo@canadamusicgroup.cc.

How long we keep it

We keep your information while your account is active and for as long as we need it to pay royalties, resolve disputes and meet tax, accounting and legal duties. After that, we delete it or remove anything that identifies you.

In practice this means account details stay while your account is open, payout and tax records stay for as long as the rules require, and messages to support or the contact page are kept only as long as we need them to deal with your question and handle any follow-up. Unsuccessful job applications are not kept longer than needed for hiring.

Keeping it safe

We protect access to accounts with login details, limit internal access to the people who need it, train our team to handle information with care, and use technical safeguards for stored and transmitted data. Payment details are handled only by people and providers that need them to pay you. No system is completely secure, so please choose a strong, unique password and keep it private. If you think your account has been accessed without your permission, contact us right away.

If something goes wrong

If we learn that your personal information has been lost, stolen or accessed without permission in a way that could harm you, we will investigate quickly, take steps to contain it, and tell you and the relevant authorities where the law requires. Our message will say what happened, what information was involved and what you can do to protect yourself.

International transfers

We deliver music worldwide, and our team and providers may be in different countries from you. Your information may therefore be processed outside the country where you live. When this happens, we take steps to protect it as this policy describes.

Your rights and choices

Depending on where you live, the law may give you rights over your personal information. You can ask us to:

• tell you what information we hold about you and give you a copy;
• correct anything that is wrong or out of date;
• delete your information, or limit how we use it;
• stop using your information where you object, or withdraw consent you gave earlier;
• stop sending you news and marketing messages.

We may need to confirm your identity before we act on a request, and we may keep information we are legally required to keep. Deleting your account does not remove music already live on platforms, so ask for a takedown first if you want it removed. You can also complain to your local data protection authority.

We will answer your request as soon as we reasonably can, and within any time limit the law sets. If we cannot do what you ask, we will explain why. We do not charge a fee for ordinary requests, but we may charge a reasonable fee or decline when a request is clearly unfounded or excessive.

You may also be able to update some of your information yourself by signing in to the Distribution Portal.

Sensitive information

Please do not send us sensitive personal information unless we have asked for it for a specific purpose. This includes government identity numbers, information about health, race or ethnic origin, religion or beliefs, political opinions, sexual orientation, trade union membership or criminal history. This also applies to emails, forms and files you attach.

The exception is tax and identity information we ask for in order to pay you or meet legal duties. We will tell you what is needed and why, and we limit who can see it.

Rights by region

The rights you have depend on where you live. We apply the rights below to everyone who asks, wherever they are, as far as the law allows. To use any of them, contact us as described in the “Contact us” section.

European Economic Area and United Kingdom

California

If you live in California, you can ask us what categories of personal information we collected about you, where it came from, why we use it and who we share it with, and you can ask for a copy of the specific information we hold. You can also ask us to delete or correct it. We do not sell personal information and we do not share it for cross-context behavioural advertising. We will not treat you unfairly for using these rights. You may use an authorised agent to make a request for you; we may ask for proof of their authority and may verify your identity directly.

Canada

If you live in Canada, you can ask for access to the personal information we hold about you, challenge its accuracy and ask us to correct it, and withdraw consent to uses that rely on it, subject to legal and contractual limits. You can complain to us first, and you may also contact the Office of the Privacy Commissioner of Canada or your provincial privacy regulator.

Everywhere else

If your country’s law gives you other privacy rights, such as under Indonesian data protection law, we will respect them in the same way. Tell us which country you live in and which right you want to use.

Browser signals

Some browsers send “Do Not Track” or similar signals. We do not use your browsing to build advertising profiles or to follow you across other sites, so these signals do not change how our pages work. If this changes, we will update this policy before we begin.

Questions and complaints

If you have a concern about how we handle your information, please tell us first so that we can try to put it right. We will acknowledge your message, look into it, and reply with what we found and what we will do. If you are not satisfied, you have the right to take the matter to your local data protection authority, whether or not you contacted us first.

How long we keep information, in detail

We do not keep a fixed number of years for everything. We decide how long to keep information using the questions below, and we review what we hold from time to time.

• Do we still have a relationship with you, for example an open account or releases still on sale?
• Do we still need the information to pay royalties, resolve a dispute or answer a question?
• Does a law require us to keep it, such as tax, accounting or anti-fraud rules?
• Is it sensible to keep it because of a possible legal claim, audit or investigation?
• Do guidelines from data protection authorities say how long it should be kept?

When we no longer need information, we delete it or remove anything that identifies you. Backups are overwritten on a regular cycle, so deleted information may remain in a backup for a short time before it is removed.

International transfers, in detail

CMG delivers music worldwide. The people who work with us, and the companies that provide our systems, may be in a different country from you, and the streaming platforms and stores that receive your music operate across many countries. As a result, your personal information may be stored or used in countries whose data protection rules differ from those where you live.

When we send personal information from the European Economic Area or the United Kingdom to a country that has not been recognised as providing an adequate level of protection, we rely on a safeguard approved by the relevant authority, such as standard contractual clauses, together with additional measures where needed. If you would like a copy of the safeguard we use, contact us.

Delivering a release to a platform necessarily means sending the release details to that platform, wherever it is. We send only the information needed to put the music live and pay for it.

Security measures, in detail

We take security seriously and use a layered approach. In practice this means:

• Passwords are stored in protected form and are never visible to our team.
• Information is encrypted while it travels between you and our services.
• Access inside CMG is limited to people who need it for their work, and is removed when their role changes.
• Payout details are handled only by the people and providers who need them to pay you.
• Our team is trained to handle personal information with care and to report problems quickly.
• We choose service providers carefully and require them to protect information and use it only on our instructions.
• We review and update our systems and processes regularly.

You can help by choosing a strong, unique password, not sharing it, signing out on shared devices and keeping your email account secure. Be careful about messages that claim to be from us and ask for your password or bank details; we will never ask for your password. If you think someone has accessed your account, contact us immediately.

How we handle your requests

When you contact us to use a right, please say which right you want to use, what you want us to do and which information it relates to. This helps us deal with it faster.

To protect you, we may only act on requests sent from the email address linked to your account, or we may ask for further proof of identity first. We will only ask for what we need. We may need to refuse or limit a request where it would reveal information about someone else, where we are legally required to keep the information, or where the request is clearly unfounded or excessive. If we do, we will tell you why.

If someone makes a request for you, such as a manager or lawyer, we will ask for written proof that you have authorised them, and we may confirm it with you directly.

We aim to reply as soon as reasonably possible and within the time limit that applies where you live. If a request is complex, we may need more time, and we will tell you if so.

Other companies and their policies

When we deliver your music, the streaming platforms and digital stores that receive it become responsible for the information they collect about their own listeners and users, and for what they do with the release information we send. We do not control them, and this policy does not cover them. Please read their privacy policies to learn how they use information about you.

The same applies to tools you may use to contact us, such as Gmail, Google Forms and Tally, and to social media sites linked from our pages. They keep and use your information under their own terms.

California privacy notice

This notice supplements the rest of this policy for people who live in California, and explains how we handle personal information under the California Consumer Privacy Act as amended (the “CCPA”). It covers the previous 12 months and the way we plan to handle information going forward.

Categories we collect

The categories below follow the CCPA’s list. The examples show what each category means for CMG.

We do not intentionally collect most categories of sensitive personal information. The exceptions are account log-in credentials, and tax or government identity information we need to pay you, which we use only for that purpose and for legal duties.

Where it comes from

We collect information directly from you, from your use of our services, from streaming platforms and stores that report royalties to us, and from collaborators, managers and labels who add you to a release.

Why we collect it

We use information for the business purposes described elsewhere in this policy: to run accounts, deliver music, report and pay royalties, provide support, keep our services secure, prevent fraud, meet legal duties, and improve what we offer. We do not use or disclose sensitive personal information to infer characteristics about you.

Who we disclose it to

Sale and sharing

In the previous 12 months, we have not sold personal information, and we have not shared it for cross-context behavioural advertising. We do not knowingly sell or share the information of anyone under 16.

Your California rights

• The right to know the categories and specific pieces of information we collected about you, where it came from, why we collected it and who we disclosed it to.
• The right to delete information we collected from you, subject to legal exceptions.
• The right to correct inaccurate information.
• The right to opt out of sale or sharing. We do neither, so there is nothing to opt out of.
• The right to limit the use of sensitive personal information. We use it only for limited, permitted purposes.
• The right not to be treated unfairly for using your rights.

To make a request, email us using the details in the “Contact us” section. We will confirm your identity by matching what you give us to the information we hold. We will reply within 45 days, and if we need more time, we will tell you why and may take up to a further 45 days. You may also use an authorised agent, who must give us written proof of your permission. You may ask for the information once in any 12-month period for the “right to know” request, and we will not charge a fee unless a request is clearly excessive.

If you think we have denied a request wrongly, you may appeal by replying to our message and asking for a review. We will respond in writing.

Canadian privacy notice

If you live in Canada, or we handle your information in Canada, we follow the principles in Canadian privacy law. In practice these mean:

• Accountability. We are responsible for the information we hold, including information given to service providers, and we have people responsible for privacy at CMG.
• Purpose. We tell you why we collect your information before or when we collect it.
• Consent. We ask for your consent where the law requires it, and you may withdraw it, subject to legal or contract limits. We will explain what that means for you.
• Limiting collection and use. We collect only what we need, and use it only for the purposes described.
• Accuracy. We keep information accurate and up to date as needed.
• Safeguards. We protect information with safeguards that suit how sensitive it is.
• Openness and access. We explain our practices in this policy and you may ask to see, and correct, your information.
• Challenging compliance. You may raise a concern with us, and we will investigate and respond.

Some of the companies that help us operate are outside Canada, so information may be processed there and may be available to courts or authorities in those countries under their laws. If you would like more information about our service providers outside Canada, contact us.

Closing your account and removing music

You can ask us to close your account at any time. Closing it ends your access to the Distribution Portal. It does not automatically remove music that is already live, because releases are delivered to platforms and stores that we do not control. To remove a release, ask us for a takedown first. We will send the instruction to each platform, but each one acts on it in its own time, so it can take days or weeks to reach every service, and copies, playlists and third-party listings may remain beyond our control.

After closure, we keep only what we need to pay any final royalties, answer questions, resolve disputes and meet legal duties, as explained in the retention section. If you want us to delete more, tell us which information and why, and we will consider your request under the law that applies to you.

Your communication choices

You are always in control of the news we send. Every news email includes an unsubscribe link, and you can also write to us at the contact address. We usually act on a request within a few days, although you may receive a message that was already being sent. If you opt out of news, we will continue to send the service messages you need, such as security alerts, notices that a release needs changes, statements and changes to our terms. These messages contain no marketing.

We do not send marketing by text message, and we do not pass your email address to other companies for their marketing.

Cookies and similar technologies, in detail

Cookies are small files that a website places on your device. Similar technologies, such as local storage, do the same job in different ways. This section explains what our pages use today. It is meant to be read with our Cookie Policy.

What we use

What we do not use

We do not use advertising cookies, we do not follow you across other websites, and we do not use social media tracking pixels on our pages. If we add analytics or advertising tools in future, we will update this policy and our Cookie Policy first, and where the law requires it, ask for your consent before they run.

How to control them

Most browsers let you see, block or delete cookies and local storage in their settings. In Chrome, Edge, Firefox and Safari, look under Privacy or Privacy and Security. Blocking essential items may stop the Distribution Portal from working properly. Deleting local storage will reset your light or dark mode choice. You can also use private browsing, which clears this information when you close the window.

The kinds of companies that help us

We use outside companies for tasks we cannot reasonably do ourselves. We choose them carefully, give them only what they need, and require them to protect it. The table describes the types of provider, rather than naming each company, because providers change over time. If you want to know which providers handle your information, ask us.

Providers act on our instructions and may not use your information for their own purposes, with one exception: services such as Google and Tally keep information you enter into their forms under their own terms too, as described under “Other companies and their policies”.

If you are named on a release

Many releases involve more than one person. You may be named as a writer, producer, featured artist, label or manager by someone who has a CMG account, even though you have never used our services yourself. This section explains how we handle your information in that case.

What we hold

We may hold your name, role, share of income and contact details, as given to us by the person who set up the release. We may also hold payment and tax information if you choose to be paid through us.

Why we hold it

We use it to credit you correctly, divide royalties as agreed, and reach you about your share. Our reason is our legitimate interest in running distribution accurately and fairly, and our agreement with the account holder.

What you can do

• Ask us what we hold about you and where it came from.
• Ask us to correct your name, role or share if it is wrong.
• Ask us to stop using your contact details, although we may still need to keep your name and share on the release record.
• Raise a concern if you did not expect to be named or were named without permission.

We will deal with these requests as we would for any account holder. We may need to check with the account holder to resolve a disagreement, and we will only tell them what is necessary. If a dispute is about money or credits rather than privacy, we will tell you how it will be handled.

Collecting only what we need

We try to design our services so they use as little personal information as possible. In practice we follow these habits:

• We ask for tax and bank details only when payment is due, not when you first sign up.
• We receive royalty and listener data as totals, such as countries and platforms, rather than as information about named listeners.
• We limit who inside CMG can see payout and identity information.
• We remove or anonymise information when we no longer need it to identify you.
• We review new features and tools for privacy before using them with your information.
• We do not ask for information we do not need, and we say so if a field is optional.

If you think we are asking for more than we need, tell us and we will explain why, or stop asking.

If something goes wrong, step by step

Despite our efforts, an incident could still occur. If we suspect that personal information has been lost, stolen or accessed without permission, we follow these steps.

• Contain. We act immediately to stop the problem, for example by changing access or shutting down a system.
• Assess. We work out what happened, which information and which people are affected, and whether there is a risk of harm.
• Fix. We repair the cause and add protection to stop a repeat.
• Notify. Where the law requires or where there is a real risk of harm, we tell the people affected and the relevant authorities, without undue delay.
• Learn. We record what happened and review our practices.

Our message to you will say what happened, what information was involved, what we have done and what you can do, such as changing your password or watching for suspicious messages.

Job applicants

If you apply to work with CMG, we use the information you send, such as your contact details, CV, portfolio and links, to assess your application and to contact you about it. We may also keep notes of any conversations. We only collect information about you from other sources, such as a referee, if you tell us we may.

Only the people involved in hiring can see your application. We do not use automated tools to reject candidates without a person reviewing the application. If your application is unsuccessful, we delete it after a reasonable period unless you ask us to keep it so that we can consider you for future roles. You may ask us to delete it sooner at any time.

Common questions

The questions below summarise points made elsewhere in this policy. If an answer here differs from the longer section, the longer section applies.

Do you sell my information?

No. We do not sell personal information, and we do not share it with advertisers.

Who can see my royalty statements?

You can, and people on our team who need to help you. Contributors you list in a split can see their own share and the release it belongs to, not your whole account.

Why do you need my tax and bank details?

To pay you, and to meet tax and financial rules. We cannot pay royalties without them.

Can I see everything you hold about me?

Yes, subject to the law. Email us and we will send you a copy, after confirming it is you.

Can you delete my information?

Often, yes. We will delete what we are not required to keep. We must keep some records, such as tax and payment history, for as long as the law requires.

If I delete my account, will my music disappear?

Not automatically. Ask for a takedown first, then close the account. Each platform removes the music in its own time.

Is my information safe?

We use protections suited to how sensitive it is, but no system is completely secure. Use a strong password and tell us quickly if anything looks wrong.

Where is my information stored?

It may be processed in several countries, because we and our providers work globally. We put safeguards in place when we send information abroad.

Do you use cookies to track me?

We do not use advertising or cross-site tracking cookies. See the cookies section for what we do use.

How do I stop your emails?

Use the unsubscribe link in any news email, or write to us. We will still send essential service messages.

What if I disagree with how you handled my request?

Reply to our message and ask for a review. You may also complain to your data protection authority.

Will you tell me when this policy changes?

We change the date at the top and tell account holders about significant changes by email or in the Distribution Portal.

Translations and how to read this policy

We may provide translations of this policy to help you. If a translation and the English version differ, the English version applies, unless the law where you live says otherwise. Headings are there to help you find your way and do not change the meaning of the text. Examples are illustrations, not complete lists. If something in this policy is unclear, please ask us. We would rather explain it than leave you unsure.

Using your rights, one by one

Earlier we listed your rights. This section explains how each one works in practice at CMG, so you know what to expect when you ask.

Access

You can ask for a copy of your personal information. We will send it in a clear, commonly used format, together with a description of why we use it, who we share it with and how long we keep it. We will not give you information that would reveal details about another person, or that is protected by law, but we will tell you if we hold back anything and why.

Correction

If something is wrong or out of date, tell us what should change. For many details, such as your name, email address and release information, you can make the change yourself in the Distribution Portal. For details that affect payment, such as bank or tax information, we may ask for extra proof before changing them, to protect you from fraud.

Deletion

You can ask us to delete your information. We will do so where we no longer need it, where you withdraw consent we relied on, or where the law says we must. We cannot delete information we must keep by law, such as payment and tax records, or information we need to defend a legal claim. In those cases, we will tell you what we are keeping and why, and we will restrict its use.

Restriction

You can ask us to pause using your information while we check whether it is accurate, or while we consider an objection. During that time, we will store it but not otherwise use it, except for legal reasons or with your permission.

Portability

Where we use information you gave us on the basis of an agreement or your consent, and we do so by automated means, you can ask for it in a structured, machine-readable form, or ask us to send it to another provider if that is technically possible. This helps if you want to move your catalogue to another service.

Objection

You can object to uses based on our legitimate interests, and to direct marketing at any time. For marketing, we stop as soon as we receive your request. For other uses, we will stop unless we can show strong reasons that outweigh your interests, or we need the information to deal with a legal claim.

Withdrawing consent

Where we rely on consent, such as for news emails, you can withdraw it as easily as you gave it. Withdrawal applies from that moment on.

Review of automated decisions

You can ask for a person to review any decision that was made with the help of automated checks and that affects you significantly. We will explain the outcome and consider your view.

Team, label and management accounts

Some accounts are used by more than one person, for example a label with several staff, or a manager acting for several artists. When this happens, the people who use the account may see information about each other, such as names, email addresses and activity in the Distribution Portal.

• The account holder decides who may use the account and what they can see, and is responsible for adding only people who have agreed.
• If you give someone access, you confirm that you have the right to share their details with us.
• If you act for an artist or writer, you confirm that you are authorised and that you have told them their details will be used for the release.
• We may contact the account holder about anything involving the account, and we may need to check with an artist or writer if we doubt that a manager is authorised.
• If you leave a team, ask the account holder to remove your access. You may also contact us if you cannot reach them.

Information about an artist or writer who is paid through a manager or label is handled under this policy as well. That person keeps the rights described here, and can contact us directly.

Content you upload

Releases can include personal information that you add on purpose or by accident. Examples are a voice on a recording, a photograph of a person in artwork, a name in a credit or a message in lyrics. When you upload content, you confirm that you have the right to provide it and that anyone identifiable in it has agreed to its use where the law requires.

Please do not include sensitive information, such as home addresses, identity documents or health details, in audio, artwork, titles or credits, because releases are delivered to public platforms. If you notice that something personal has been published by mistake, contact us straight away and ask for an urgent takedown. We will act quickly, although each platform controls how fast it removes content.

About royalty and listener data

Royalty reports can look personal, so we want to be clear about what they contain. The reports we receive from streaming platforms and stores generally show how often a track was played or sold, the country or region, the platform or store, the period and the amount earned. They do not usually show the names or contact details of individual listeners. We do not try to identify listeners from this data, and we do not combine it with other sources to do so.

We use these reports to calculate and pay royalties, to give you statements and, in summary form, to understand which music is performing so we can support artists and writers. Where we share summaries with others, such as in an industry report or with a contributor on a release, we show totals, not details of individual people.

Extra information for the EEA and the United Kingdom

If you live in the European Economic Area or the United Kingdom, the following applies in addition to the rest of this policy.

• We use your information only where we have one of the lawful reasons set out above, and we tell you which one applies to each activity in the activity table.
• Where we rely on legitimate interests, you have a right to object, as explained in the section on your rights.
• Where we send information outside your region, we use approved safeguards, such as standard contractual clauses, and you may ask for a copy.
• You may lodge a complaint with your local supervisory authority, which in the United Kingdom is the Information Commissioner’s Office, and in the EEA is the authority in the country where you live, work or believe a problem occurred.
• If you have a question about our approach, ask us first. We would like the chance to explain or fix it.

Children, in more detail

Our services are meant for adults and for young creators who can lawfully enter into an agreement or who act with a parent or guardian. We do not knowingly collect information from a child under 16 without the involvement of a parent or guardian. Where a young artist releases music with us, we ask for a parent or guardian to be involved in the account and in any agreement, and we may ask for proof of that.

If you are a parent or guardian and believe a child has given us information without your consent, contact us. We will confirm who you are, and then delete the information or give you access to it, as the law requires and as you choose.

Getting this policy in another form

We want everyone to be able to read this policy. If you have difficulty reading it, for example because you use assistive technology or need a different format, contact us and tell us what would help. We will do our best to provide it, such as by email in plain text or in a larger print or audio format, within a reasonable time.

What we do not collect

It can help to know what we do not do. We do not collect the following, unless a particular service clearly tells you otherwise before we do:

• Precise location from your phone or device.
• Contacts, photos or files on your device.
• Biometric information such as fingerprints or face scans.
• Health information, or information about your religion, politics or sex life.
• Complete payment card numbers through our website.
• Information about you from data brokers or from your social media accounts.
• Recordings of your calls, unless you are told first.

If a feature ever needs one of these, we will explain it clearly and ask for your permission first.

Publishing and sync, in more detail

CMG Publishing handles the rights in songs, which means it works with songwriters, composers and other rights holders, and with organisations that collect money for them. Doing this work involves more sharing than distribution alone, so we explain it here.

Registering works

To register a song, we send the title, the names of the writers, their shares and the identifiers needed to match it to income. We send this to collecting societies, rights databases and partners, who may be in other countries. Writers may also have their own membership in a society, and what that society does with their information is governed by its own policies.

Collecting income

When royalties are paid, societies and partners send us statements. We use the information in them to match income to the right works and writers, and then to pay you.

Pitching for sync

When we pitch a song for use in film, television, games or advertising, we share the song, its credits and the contact details of the people who can approve it. We share these with music supervisors and partners who are considering the song. If a licence is agreed, we share the information needed to complete it and to report use.

Anonymising and aggregating information

Sometimes we turn personal information into information that no longer identifies anyone. We do this by removing names, contact details and other identifiers, and by combining information about many people into totals. For example, we may count how many artists use the Distribution Portal each month, or which countries produce the most streams in a quarter.

We use this information to plan, to improve our services, to understand how our promotion work performs, and to produce reports for ourselves and for partners. We do not try to re-identify anyone from it, and we require anyone who receives it from us not to do so either. Once information has been truly anonymised, privacy law no longer applies to it, but we still treat it with care.

Requests from authorities and legal process

Sometimes a court, regulator or law enforcement agency asks us for information. We deal with these requests carefully:

• We check that the request is valid, comes from a body entitled to make it, and applies to us.
• We share only what is required, and we try to limit it to the narrowest set of information that satisfies the request.
• Where the law allows, we tell you before we share your information, so you can respond.
• We may be unable to tell you if the law or the authority forbids it, or if telling you could put someone at risk or interfere with an investigation.
• We keep a record of requests and challenge ones we believe are unlawful or too broad.

We may also have to share information for sanctions and financial compliance checks, for example to confirm that a payment is lawful.

How we choose and manage providers

Before we use a provider that will handle personal information, we consider what information it would see, how it protects it, where it works and how it treats information after our contract ends. We use a written agreement that says it must use the information only for us, keep it confidential, protect it, help us respond to your requests, tell us promptly about an incident and delete or return it when we ask.

We review providers from time to time and stop using one if it no longer meets our standard. If a provider changes in a way that matters to your privacy, we will update this policy.

If an artist or writer dies, or cannot manage an account

Music outlives its makers, and so do royalties. If an artist or writer dies, or becomes unable to manage their own account, we may need to deal with a family member, estate representative or someone with legal authority. We will ask for proof of that authority, such as a will, grant of probate or power of attorney, and for proof of the person’s identity.

Once satisfied, we will share only what is needed to administer the account, pay royalties and settle the affairs, and we will treat the information with respect. Privacy rights may work differently for people who have died, depending on the law, but we will try to act fairly and with care.

Protecting yourself from scams

Because we pay royalties, people may pretend to be CMG to trick artists and writers. To stay safe:

• We will never ask for your password, by email, message or phone.
• Check that messages come from our official domain, and be wary of urgent demands or unexpected attachments.
• Do not click links in a message you did not expect. Go to our website directly instead.
• Do not give bank details to anyone who contacts you out of the blue. If we need to change payment details, we will ask you to do so through the Distribution Portal.
• If you are unsure, contact us through the details on our contact page before replying.

If you receive a suspicious message that appears to be from us, please forward it to us so we can investigate.

Examples of how requests work

These examples show how we might handle common requests. They are illustrations only, and the details depend on your case and on the law.

Example: you want a copy of your information

You email us from the address on your account. We confirm it is you, collect your information from our systems and send it to you in a readable file, with a short explanation of what it covers, within the time the law requires.

Example: you want everything deleted

You tell us. We check whether any music is live and ask whether you want a takedown first. We then delete what we do not need to keep, and tell you in writing what we are keeping and why, for example, payment records needed for tax.

Example: you are a writer on someone else’s release

You write to us with your name and the release. We check what we hold about you, explain it and correct what is wrong. If you want your contact details removed, we remove them but may keep your name and share on the release record.

Example: you object to a use

You tell us which use you object to and why. We consider whether our reasons outweigh your interests, stop if they do not, and reply to explain the result.

Identity, sanctions and compliance checks

Because we pay money to people around the world, the law may require us to confirm who you are and to check whether payments are allowed. We may ask for identity documents or business registration details, and we may screen names and countries against official sanctions and watch lists. We use the information only for these checks and to meet our legal duties, and we limit who can see it.

If a check raises a concern, a person on our team reviews it. We may delay or refuse a payment, or close an account, where the law requires it or where a check cannot be completed. We will tell you what we can and ask you for what is needed to resolve it, but the law may stop us from explaining everything.

Your part in keeping information accurate and safe

We can only protect and use your information properly if you help. We ask you to:

• Give us accurate and current details, and update them when they change.
• Keep your password private and your email account secure.
• Tell us quickly if you suspect someone has accessed your account.
• Only give us information about other people if you have the right to do so.
• Check release, split and payout details carefully before you confirm them.
• Be alert to emails or messages that pretend to be from us.

How we keep records of our own use

We keep internal records that describe what personal information we handle, why, who has access, which providers are involved, where it is stored and when we plan to delete it. We review these records from time to time and when we start a new activity or change a provider. For higher-risk changes, we carry out a review of the privacy impact before we begin, and we change our plans if it shows a problem.

Our team is told that personal information must be used only for work purposes, that it must be reported if it is lost, and that misuse can lead to disciplinary action. Access is removed when people leave or change roles.

If CMG changes hands

If CMG, or any part of it, is sold, merged, financed or restructured, your information may be part of what moves. Before that happens we will share information only with people who need to review it, under a duty of confidentiality, and only as much as the review requires.

If the business changes hands, the new owner must continue to protect your information in line with this policy, or tell you of any change and give you a chance to use your rights, such as asking us to delete your information. We will let account holders know by email or in the Distribution Portal.

How changes to this policy work

We will update this policy when our services, our providers or the law change. The date at the top of the page shows when it was last revised. Minor changes, such as fixing a typo or clarifying wording, take effect when we post them. If we make a significant change, such as using your information for a new purpose, sharing it with a new type of recipient or changing how long we keep it, we will tell account holders in advance by email or in the Distribution Portal, and where the law requires consent, we will ask for it.

We keep previous versions of this policy and can give you a copy of an earlier version if you ask. Please check this page from time to time to stay informed.

Music terms used in this policy

Some words in this policy come from the music business. In case they are new to you:

• Release: a single, EP or album, with its audio, artwork and details, that we deliver to platforms.
• Metadata: information about a release, such as titles, artists, credits, genres and dates.
• Split: the share of income that each contributor receives from a release or song.
• Takedown: a request to remove a release from platforms and stores.
• Royalty statement: a report that shows what a release earned and how it is divided.
• Collecting society: an organisation that collects money for songwriters, publishers or performers when music is used.
• Sync licence: permission to use a song or recording with a film, show, advertisement or game.
• Streaming platform and digital store: a service that plays or sells music to listeners.

What this means for different people

Different people deal with CMG in different ways. This table shows, for each group, the information we most often hold and the main reasons we hold it. The detail in the other sections still applies.

Your information through the life of a release

It can help to see where your information goes at each stage of a release. This is a simplified walk-through of a typical release.

• Signing up. You give us account and contact details. We create your account and verify your email address.
• Preparing the release. You upload audio, artwork and metadata, and list contributors and splits. We check the files and details against platform requirements.
• Delivery. We send the release content and details to the streaming platforms and stores you selected, on the date you chose.
• Going live. The release, with your artist name and credits, becomes public on platforms we do not control.
• Earning. Platforms report plays and sales to us. We calculate earnings and prepare statements, and contributors can see their share.
• Getting paid. We use your payout and tax details to pay you and to keep the financial records the law requires.
• Changing or removing. You can edit details or ask for a takedown. Platforms act on changes in their own time.
• Afterwards. We keep only what we need for royalties, disputes and legal duties, then delete or anonymise it.

Payment and tax details

Payout information is among the most sensitive we hold, so we treat it with extra care.

• We ask for it only when we need to pay you.
• Only the people and providers who need it to make payments or meet tax rules can see it.
• We may ask for proof before we change it, and may delay a payment while we check an unexpected change.
• We never ask for your full card number or PIN, and we never ask for your account password.
• If you give us details that belong to someone else, such as a company or a family member, you confirm that you have the right to do so.
• Payments may be made through banks and payment services in other countries, which can add fees and checks that are outside our control.

If a payment goes to the wrong place because of details you gave us, we will try to help, but we may not be able to recover the money. Please check your details carefully before you confirm them.

Contact forms and messages

When you use a contact form, send an email or fill in a form, we receive the details you enter, such as your name, your email address, the topic you choose and your message. Some forms may be provided by outside services, such as Google Forms or Tally Form, which also receive what you enter and keep it under their own terms.

Please include only what we need to help you. Do not send passwords, full card numbers, identity documents or other sensitive information in a message unless we ask for it through a secure route. We use your message to reply, to resolve your issue and to keep a reasonable record of what was said, so that we can follow up and improve our service.

Keeping information accurate, including elsewhere

We try to keep the information we hold accurate and up to date, and we rely on you to tell us about changes. Once information has been sent to platforms, societies or other partners, it becomes part of their records. If you ask us to correct something, we will update our own records and tell the partners we sent it to, so that they can update theirs. We cannot force them to act, or to act quickly, and old copies may remain visible for a time.

If a correction affects who gets paid, such as a change to a split, we may need agreement from the people involved, or proof of the change, before we make it. We will explain what we need.

Disputes about credits, shares or ownership

Sometimes people disagree about who wrote a song, who should be credited or how income should be divided. These disputes are usually about contracts and copyright rather than privacy, but they can involve personal information.

• We may share a limited amount of information with the people involved, such as names, roles and claimed shares, so they can respond.
• We may ask for evidence, such as agreements, messages or drafts, and may keep them for as long as the dispute and any related claim continues.
• We may pause payments, or hold a release, where there is a genuine dispute that we cannot resolve.
• We do not decide ownership. We follow the agreements we have, the instructions of the people entitled to give them and any order from a court or authority.

We will only share what is necessary, and we will not give one party your bank details, tax details or contact details unless the law requires it or you agree.

Who inside CMG can see your information

Not everyone at CMG can see everything. Access depends on a person’s job.

People who work with us as contractors are held to the same rules. Access is reviewed from time to time and removed when it is no longer needed.

Where and how information is stored

We store information in systems provided by trusted hosting and software companies. Their data centres may be in different countries. Information is kept separate from the public parts of our website, and access is limited as described above. We keep backups so that we can recover from a failure. Backups are protected in the same way as live systems, and, as the retention section explains, information deleted from live systems may remain in backups for a short time until they are overwritten.

If you think your account has been compromised

Act quickly if you notice anything unusual, such as a release you did not make, a change to your payout details or an email about a sign-in you do not recognise.

• Change your password straight away, and change it anywhere else you used the same one.
• Check your payout details, email address and the releases in your account.
• Contact us with what you noticed and when, so that we can investigate and protect your account.
• Be careful of follow-up messages. Scammers sometimes pretend to be support staff after a breach.
• Secure your email account too, because anyone who controls it can try to reset your password.

We may temporarily suspend an account, or hold payments, while we investigate. We will explain what we can and help you recover access once we are sure it is safe.

What you can control, at a glance

Information for people in Indonesia

If you live in Indonesia, Indonesian data protection law, including Law No. 27 of 2022 on Personal Data Protection, may give you rights over your personal data. In summary, these generally include the right to be informed about how your data is used, to see and obtain a copy of it, to correct it, to ask for it to be deleted or for its use to stop, to withdraw consent, to object to certain automated decisions, to delay or limit processing, and to seek a remedy where your rights are breached.

We will respect these rights in the same way as the other rights in this policy, subject to any limits in the law. Because our services are delivered across borders, your information may be processed outside Indonesia, and we take steps to protect it when this happens. To use a right, contact us as described in the contact section, and tell us that you are in Indonesia. We will reply within the time the law sets. This summary does not replace the law itself, and you may also contact the relevant Indonesian authority.

Information for people in other places

If you live somewhere not named in this policy, your country may still give you privacy rights. We will respect the rights that apply to you, to the extent the law requires. Tell us where you live and which right you wish to use, and we will explain how we can help. Where the law where you live gives you greater protection than this policy, that law applies.

Our commitments in plain words

The sections above are detailed because the law and our partners ask for detail. This section sets out, in a few plain sentences, what we promise. If anything here seems to differ from a longer section, the longer section applies, but we want you to be able to see the spirit of the policy at a glance.

• We use your information to run the service you asked for, and for the other purposes listed in this policy, and not for anything we have not told you about.
• We do not sell your personal information, and we do not hand it to advertisers.
• We ask for what we need and explain why. If a field is optional, we say so.
• We keep your information only as long as there is a good reason to, then delete it or remove what identifies you.
• We protect it with measures that suit how sensitive it is, and we tell you if something goes wrong that could affect you.
• We answer your questions and requests honestly, and we explain our reasons when we cannot do what you ask.
• We treat information about other people, such as collaborators named on a release, with the same care as information about account holders.

These commitments describe how we aim to behave every day. They do not replace the rights the law gives you or the terms of any agreement you sign with us.

When you act for other people

Many people who use our services do so on behalf of someone else. A manager may run an account for several artists, a label may upload releases for its roster, and a songwriter may share details of co-writers. In these cases more than one party may decide how personal information is used, so it helps to be clear about who is responsible for what.

Where we decide

For the information described in this policy, such as account details, payout details and release records, CMG decides why and how it is used, as explained in the section on who is responsible for your information. This is the usual position.

Where you decide

When you collect information about other people yourself, for example by building a mailing list of your fans or by gathering the contact details of session musicians, you decide how that information is used, and you are responsible for following the law that applies to you. If you give us a copy so that we can deliver a release or pay a contributor, we use it only for that purpose and as this policy describes.

What we ask of you

• Make sure you are allowed to give us other people’s information.
• Tell those people, where the law requires it, that their details will be shared with us and with the platforms that carry the release.
• Give us only what is needed. A name, a role and a share of income are usually enough.
• Tell us promptly if someone asks you to correct or remove their details, so that we can update our records too.

If you are unsure about your own responsibilities, you may wish to ask a lawyer in your country. We cannot give you legal advice about your own obligations.

Metadata, credits and public records

The details attached to a release, often called metadata, are the backbone of how music is found, credited and paid. They are also the part of your information most likely to become public and hardest to withdraw, so they deserve a little extra thought before you submit them.

• Names. Use the name you want the public to see. Once a release is live, your artist name and credits may be copied by platforms, databases, playlists and fans.
• Credits. Only list people who agreed to be credited, and use the spelling they prefer. A mistaken or unwanted credit can be difficult to remove everywhere.
• Identifiers. Codes that identify recordings and songs are shared widely so that income can be matched. Do not use a code that belongs to someone else.
• Free-text fields. Descriptions, lyrics and notes are often published as written. Avoid including addresses, phone numbers or private details about anyone.
• Dates. Release dates and territories you choose are sent to partners and may be shown to listeners.

If you spot an error after delivery, tell us as soon as you can. We will update our records and send the correction to the platforms and stores that received the release. Each of them applies changes in its own time, and we cannot promise that an old version will disappear everywhere at once.

Using the Distribution Portal safely

The Distribution Portal is where most of your information lives, so a few habits make a real difference to its safety.

• Use a password that you do not use anywhere else. A long phrase is stronger than a short, complicated one.
• Sign out when you use a shared or public computer, and do not let a browser save your password on a device that others use.
• Keep your email account secure, because anyone who controls your email can try to reset your portal password.
• Check the address of the page before you sign in. Our pages are on our own domain, and we will not send you to a different website to enter your password.
• Review your payout details after any change, and look at your releases and statements from time to time for anything you do not recognise.
• If you share an account with colleagues, agree who may change payout details and who may only view reports.
• Keep the software on your device up to date, and be cautious about browser extensions you do not need.

If you notice anything unusual, follow the steps in the section on what to do if you think your account has been compromised, and contact us without delay.

Before you share information about someone else

It is easy to type a collaborator’s name into a form without thinking about it. A short pause can prevent problems later. Before you add another person’s details to a release, a split or a message to us, you may find it useful to ask yourself these questions.

• Does this person know that I am giving their name or contact details to CMG?
• Do I need all of the details I am about to enter, or would a name and role be enough?
• Would this person be comfortable seeing their name and share of income on a statement that other contributors can see?
• Have I spelled their name and written their email address correctly?
• Am I sure they want to be credited publicly, and in the way I have described?
• Do I have a written record, even a simple message, showing that we agreed on the split?

Taking a few minutes to confirm these points protects the other person’s privacy, reduces the chance of a dispute, and helps us pay the right people on time.

Payments, currencies and banks in other countries

Because we pay artists, writers and rights holders in many places, a payment may pass through banks and payment services in more than one country. This has some privacy consequences that are worth knowing.

• The banks and payment services involved may receive your name, your account details and the amount, and they use that information under their own legal duties and policies.
• Some countries require banks to check payments against official lists. A payment may therefore be delayed or returned even when you have done nothing wrong.
• Fees and exchange rates are set by the banks and services involved, and are outside our control. Where a fee is shown in your statement, it is there to explain the difference between what was earned and what arrived.
• Tax rules differ from country to country. We may ask for details to apply the right treatment, and we may report payments to the authorities where the law requires us to do so.
• If you change country or bank, tell us before the next payment is due, so that we do not send money to a closed account.

We limit the information we send to what a payment needs. We do not send your release content, your statements or your messages to banks.

When we disagree, and how we try to put it right

We hope you will never need this section, but it is better to explain what happens before a problem arises than afterwards.

Start with a conversation

If you are unhappy about how we have used your information, write to us first. Tell us what happened, when it happened and what you would like us to do. We would like the chance to understand and to fix it.

What you can expect from us

• We will confirm that we received your message.
• We will look into what happened, including speaking to the people on our team who dealt with it.
• We will tell you what we found, what we will change and, where we cannot do what you ask, why not.
• If we made a mistake, we will say so and correct it.

If you are still not satisfied

You can ask for a more senior member of our team to look at the matter again, and you can take it to your local data protection authority at any time. Using one route does not stop you using another.

Keeping a record

We keep a short record of complaints about personal information, what we decided and what we changed, so that we can spot patterns and improve. The record is kept only as long as it is needed and is seen only by those who deal with the complaint or oversee privacy at CMG.

Keeping this policy useful

A policy that no one can understand does not protect anyone. We try to keep this one accurate, easy to navigate and honest about what we do.

• We review it from time to time, and whenever we add a new service, change a type of provider or learn that the law has changed.
• We use plain words where we can, and explain the legal terms we cannot avoid.
• We tell you the date of the latest update at the top of the page, and we keep earlier versions so that you can ask to see them.
• We welcome suggestions. If something is confusing, missing or wrong, tell us, and we will consider changing it.

If you think a section does not match what we actually do, please let us know. We would rather correct the policy, or correct our practice, than leave a gap between the two.

Where to find what you need

The policy is long. This table points you to the sections that answer the most common needs, so that you do not have to read everything.

Small habits that protect everyone

Good privacy is shared work. Our team does its part, and the habits below help you do yours. None of them takes long, and together they prevent most of the problems we see.

• Keep one record of your agreements and splits, so that everyone can check what was decided.
• Update your contact and payout details as soon as they change, and tell us before your next payment is due.
• Read messages that claim to come from us with care, and use the contact details on our website when you are unsure.
• Send us only the documents we ask for, and use the route we suggest for sending them.
• Tell your collaborators how their details will be used, so that nobody is surprised by a statement or a credit.
• Ask us a question whenever something is unclear. A short email now is easier than a correction later.

It also helps to keep your own copies of important messages with us, such as confirmations of changes to payout details or takedown requests. If a question comes up later, a saved message lets both sides see exactly what was asked and what was done. We keep our own records too, and having both makes any correction quicker.

If you ever feel unsure about a request for your information, whether it comes from us or from someone who says they represent us, pause and check with us before you reply. We would always rather answer a careful question than repair a mistake.

Choosing the language you want to use

You may write to us in plain English, and we will do our best to reply in the same way. If you prefer another language, tell us, and we will try to help. Where we cannot reply in your language, we will say so and look for a practical alternative, so that you can still understand your options and use your rights.

Shared and public devices

If you use a shared computer, phone or tablet, someone else may be able to see what you view or what your browser has saved. Sign out when you finish, avoid saving passwords on devices you do not own, and clear your browsing data afterwards. These small steps help keep your account and your release information private.

Older records and archived releases

Some releases stay in our records long after they were first delivered. We keep only what we need to answer questions, pay royalties and meet legal duties, as explained in the retention sections. If you want us to review an old record, tell us which release you mean, and we will look at what we hold and whether it can be removed.

Requests from people who are not account holders

Sometimes a person who has no account asks us about information that relates to them or to a release. We treat these requests with care, check who is asking, and share only what the law allows. We will not give out details about an account holder, such as bank or contact information, unless the law requires it or the account holder agrees.

Keeping a history of corrections

When we correct information at your request, we may keep a short note of what changed and when. This helps us explain our actions later, deal with disputes and show that we followed the law. The note is kept only as long as needed and is seen only by the people who need it to do their work.

Testing and improving our services

When we change how the website or the Distribution Portal works, we try to test the change first. We use sample information where we can, rather than real account details. If real information must be used to fix a fault, we limit who can see it and for how long, and we remove it when the work is finished.

What happens in a support conversation

When you ask us for help, a member of our team may need to look at your account, your releases and your earlier messages. We only look at what is relevant to your question. We may ask you to confirm your identity first, and we will never ask for your password. Notes of the conversation are kept as described in the retention sections.

If you find a security problem

If you notice a weakness in our website or portal, please tell us through the contact details at the end of this policy. Give us a few details so that we can find the problem, and please do not look at other people’s information or share the problem publicly until we have had a chance to fix it. We appreciate careful reports and will take them seriously.

What this policy cannot do

This policy explains how we handle personal information. It does not change the law, it does not replace an agreement you have signed with us, and it cannot promise that nothing will ever go wrong. Where the law gives you more protection than this policy, the law applies. Where an agreement adds detail for a specific relationship, that detail applies as well.

A final note before you contact us

Thank you for reading this far. If you still have a question, or if anything here is unclear, please write to us. Tell us what you are trying to do, and which part of the policy you read. A clear message helps us answer you faster, and it helps us make this policy easier to understand for the next person.

Children

Our services are not directed at children under 16, and we do not knowingly collect their personal information without the involvement of a parent or guardian. If you believe a child has given us information, contact us and we will delete it.

Links to other sites

Our pages link to other sites, including Instagram, YouTube and the streaming platforms that carry your music. They have their own privacy policies, and we are not responsible for how they handle your information.

Changes to this policy

We may update this policy as our services or the law change. We will change the date at the top of this page, and for significant changes we will also tell account holders by email or in the Distribution Portal.

Contact us

For privacy questions or to make a request, email halo@canadamusicgroup.cc and start your subject line with “Privacy request”. Please include the email address of your Distribution Portal account so that we can find your records. You can also reach us through the contact page. We read every message and reply as soon as possible.

For job applications, use the contact page and choose “Careers” as the topic.