Nex Artist Privacy Policy

Introduction

The Site is operated by Nex Artist Limited trading as Nex Artist ("Nex", "we", "us", "our"). We are a limited company registered in the United Kingdom. Our registered company number is 13093536.

Nex Artist is a web application and a mobile application music platform. The web application enables music artists to upload their tracks ("Artists"), and the mobile application enables users to listen to tracks via their devices by streaming ("Listeners"). Both Artists and Listeners register an account. Registered accounts can be used for accessing both the web application (as an Artist) and the mobile application (as a Listener). In addition to creating an account with an email address and password, Google and Apple accounts may be used to authenticate on the platform. Authenticating via Google or Apple removes the requirement for email address verification.

Artists on the web application and Listeners on the mobile application use the platform with a limited qualified licence set out in the Terms and Conditions (together referred to as "Users").

This privacy policy, together with our Terms and Conditions and any other policies referred to within, explains what information we gather about you, what we use it for, the lawful basis on which it is used, and who we share it with. It also sets out your rights and our obligations in relation to your information and who you can contact for more information or queries.

We are the controller of personal data obtained via our Site, meaning we are the organisation legally responsible for deciding how and for what purposes it is used.

We take your privacy very seriously. Please read this privacy policy carefully as it contains important information on who we are and how and why we collect, store, use, and share any information relating to you (your "personal data") in connection with your use of our Site. It also explains your rights in relation to your personal data and how to contact us or the relevant regulator in the event you have a complaint.

We collect, use and are responsible for certain personal data about you. When we do so we are subject to the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where we process the personal data of individuals located in the European Economic Area (EEA), we are also subject to the EU General Data Protection Regulation (EU GDPR) in respect of that processing. UK GDPR and EU GDPR are separate legal regimes and references in this policy to "Data Protection Law" mean whichever regime applies to the processing in question.

Please retain a copy of this privacy policy for your records.

Children

Our Service is available to users aged 13 and over. Users aged 13 to 17 must have the consent of a parent or legal guardian to register and use the Service. We do not knowingly collect personal data from children under the age of 13. If you are aware that personal data of a child under 13 has been submitted to our Site, please contact us immediately at [email protected] so that we can delete that data. Where a user provides false information about their age to circumvent this restriction, they do so in breach of our Terms and Conditions; Nex Artist will take steps to delete the account and associated data upon becoming aware of such circumstances.

1. What This Policy Applies To

This privacy policy relates to your use of our Site only.

Throughout our Site, we may link to other websites owned and operated by certain trusted third parties. Those third-party websites may also gather information about you in accordance with their own separate privacy policies. For privacy information relating to those third-party websites, please consult their privacy policies as appropriate.

2. Personal Data We Collect About You

The personal data we collect about you depends on the particular activities carried out through our Site. We may collect and use the following personal data about you:

• Your name, address, and contact information, including email address and telephone number and company details;
• Information to check and verify your identity, e.g. date of birth;
• Your gender, if you choose to give this to us;
• Location data, if you choose to give this to us;
• Your billing information, transaction information, and payment details (processed by our payment provider Stripe; Nex Artist does not store full card details);
• Details of any information, feedback, or other matters you give to us by phone, email, post, or via social media;
• Your account details, such as username and login details;
• Your activities on, and use of, our Site;
• Your personal or professional interests;
• Information about the services we provide to you;
• Information about how you use our Site and technology systems - certain statistical data is recorded from Listener interactions on the mobile application. The purpose of this is so that the data can be presented in a reporting format to Artists on the web application, enabling them to understand the level of engagement they are receiving. Statistical data is stored securely and is only visible to the relevant Artist within the web application. Statistical data is not processed or sold in any way. Examples of statistical data include track streams (total number of seconds), streaming link clicks, social media link clicks, and profile views. We reserve the right to remove, add, or amend the statistical information recorded at any time;
• Your responses to surveys, competitions, and promotions.

You may be requested to provide personal data including your name, date of birth, gender, email address, home address, and country of residence, unless we tell you that a particular item is optional. Where you can choose whether to give us personal data, we will tell you and give you the choice before you provide it. We will also tell you whether declining to share that personal data will have any effect on your use of our Site.

3. How Your Personal Data Is Collected

We collect personal data from you directly when you enter or send us information, such as when you provide information to us by filling in forms on our Site. This includes information provided at the time of registering, subscribing to any of our services, posting material, making or receiving payments through your User account, or requesting further services.

We also collect personal data in the following circumstances:

• Details of transactions you carry out via our Site;
• We may ask you for information when you report an issue or concern, or where we have or receive a complaint or query about you (whether or not a formal dispute is raised);
• We keep records of reports of illegal activity or Terms and Conditions violations made by Users or third parties regarding use of the Site. This Report Data will consist of the reporting user, the reported artist or user, the report reason, and the date and time of the report;
• We may keep a record of correspondence between you and us;
• We may ask you to complete surveys that we use for research purposes, although you do not have to respond to them;
• We may collect or obtain personal data about you because we observe or infer that data from the activities you undertake, or the way you interact with us or others. For example, to improve your experience when you use our Site and ensure that it is functioning effectively, we (or our service providers) may use cookies (small text files stored in a user's browser) and web beacons which may collect personal data. Additional information on how we use cookies and other tracking technologies, and how you can control these, can be found in our Cookie Policy.

4. How and Why We Use Your Personal Data

Under Data Protection Law, we can only use your personal data if we have a proper lawful basis, which includes:

• Where you have given consent;
• To comply with our legal and regulatory obligations;
• For the performance of a contract with you or to take steps at your request before entering into a contract; or
• For our legitimate interests or those of a third party.

The purposes for which we process your personal data include:

• Creating and managing your account with us;
• Providing the Site and associated services;
• To enforce legal rights or defend or undertake legal proceedings;
• Retaining and evaluating information on your recent visits to our Site, and how you move around different sections of it, for analytics purposes - to understand how people use our Site so that we can make it more intuitive or to check our Site is working as intended;
• Communications with you not related to marketing, including about changes to our terms or policies, or important notices relating to your account;
• Protecting the security of systems and data used to provide the services;
• Analysis of statistical data to help Users understand the level of engagement via the Site;
• Updating and enhancing user records;
• Disclosures and other activities necessary to comply with legal and regulatory obligations that apply to our business, e.g. to record and demonstrate evidence of your consents where relevant; and
• Marketing our services to existing and former Users (see section 6 below).

We will only process your personal data for the above purposes on the following bases:

• Our legitimate interests in the performance of activities that form part of the operation of our business, provided that such interests are not outweighed by your interests or fundamental rights and freedoms;
• Our legal and regulatory obligations, such as keeping records for tax purposes or providing information to a public body or law enforcement agency; or
• Because the information is required in order to carry out activities that form part of the operation of our business (e.g. the processing is necessary to perform our contractual obligations towards you).

Where we rely on legitimate interests, we carry out an assessment to balance our interests against your own. You can obtain details of this assessment by contacting us (see section 15 below). Examples of the legitimate interests referred to above include:

• To benefit from cost-effective services (e.g. use of certain IT platforms offered by suppliers);
• To verify the accuracy of information provided by a third party;
• To prevent fraud or criminal activity; and
• To safeguard the security of our IT systems, architecture, and networks.

To the extent that we process any sensitive personal data relating to you for any of the purposes outlined above, we will do so because: (i) we are required by law to process that data in order to meet our legal obligations; (ii) the processing is necessary to carry out our obligations under employment, social security, or social protection law; (iii) the processing is necessary for the establishment, exercise, or defence of legal claims; or (iv) you have made the data manifestly public.

5. Marketing

We may use your personal data to send you updates (by email or other means) about our services, promotions, and new features that we think may be of interest to you. We have a legitimate interest in processing your personal data for promotional purposes and to grow our business. You can ask us to stop sending you marketing messages at any time by:

• Following the unsubscribe link in any marketing email you receive from us; or
• Contacting us directly at [email protected].

Where you opt out of receiving marketing messages, this will not apply to personal data provided to us as a result of a product or service purchase or other transaction.

6. Who We Share Your Personal Data With

We routinely share personal data with:

• Third parties we use to help deliver the Site and its services, including cloud hosting providers, payment processors (Stripe), push notification providers, and analytics providers;
• Other third parties we use to help us run our business, such as email service providers and marketing agencies;
• Our professional advisors (such as lawyers and accountants), in which case the recipient of the information will be bound by confidentiality obligations; and
• Law enforcement agencies, courts, tribunals, and regulatory bodies to comply with our legal and regulatory obligations.

We only allow those organisations to handle your personal data where we are satisfied that they take appropriate measures to protect it. We require all third-party service providers to process your personal data only for specified, lawful purposes and in accordance with our instructions.

We do not sell your personal data to any third party.

7. How Long Your Personal Data Will Be Kept

We will hold your personal data on our systems for the longest of the following periods:

• As long as is necessary for the relevant activity - typically 7 years from the date your account is closed or the relevant relationship ends;
• Any retention period that is required or permitted by applicable law or regulation (for example, statutory limitation periods for bringing legal claims); or
• The end of the period in which litigation or regulatory investigations might arise in respect of our activities.

Where you close your account, your personal data will be deleted from our active systems in accordance with our account closure process. Deletion from backup and disaster recovery systems may take up to 90 days from the date of account closure. We may retain certain data for longer where required by law or to resolve any outstanding legal claim or dispute. We may also retain anonymised or aggregated data derived from your use of the Service indefinitely for analytical purposes; this data cannot be used to identify you.

8. Transferring Your Personal Data Out of the UK and EEA

Some of the third parties we use to deliver the Service are based outside the United Kingdom and/or the European Economic Area. Where we transfer personal data to a country or territory outside the UK, we ensure that an appropriate safeguard is in place to protect it, such as:

• A transfer to a country deemed by the UK Secretary of State (or the European Commission for EEA data) to provide an adequate level of data protection (an "adequacy decision");
• Standard contractual clauses approved by the Information Commissioner's Office (ICO) or the European Commission; or
• Another lawful transfer mechanism permitted by applicable Data Protection Law.

Our primary third-party service providers that may involve international data transfers include:

You can request further information about the safeguards we have in place for international transfers by contacting us at [email protected].

9. Your Rights

Under Data Protection Law you generally have the following rights, which you can usually exercise free of charge. The circumstances in which they apply vary; if in doubt, please contact us:

To exercise any of these rights, please write to us at [email protected], providing enough information to identify yourself (e.g. your full name and registered email address) and specifying which right(s) you wish to exercise. We may ask you for additional identity information before processing your request.

For further information on each of those rights, including the circumstances in which they do and do not apply, you may also find it helpful to refer to the guidance from the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Keeping Your Personal Data Secure

We have appropriate technical and organisational security measures in place to prevent personal data from being accidentally lost, used, accessed, altered, or disclosed unlawfully or without authorisation. We limit access to your personal data to those who have a genuine business need to access it. Those processing your personal data will do so only in an authorised manner and are subject to a duty of confidentiality.

We also have procedures in place to deal with any suspected personal data security breach. We will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Despite the measures above, the transmission of personal data via the internet is never completely secure. We cannot guarantee the security of personal data transmitted to our Site; any such transmission is at your own risk. You are responsible for maintaining the security of your account login credentials. If you believe your account has been accessed without your authorisation, please contact us at [email protected] immediately.

11. Requesting Your Account and Associated Data to Be Removed

You can request the deletion of your account and associated personal data at any time. To submit a deletion request, follow these steps in the Nex Artist mobile application:

1. Log in to the Nex Artist mobile application.
2. Navigate to the settings page by tapping the settings cog icon.
3. Tap on User Settings.
4. Under the Delete Account heading, tap the Delete user account button.

We will delete your account and associated personal data from our active systems within 5–7 working days of receiving your request. Deletion from backup and disaster recovery systems may take up to 90 days from the date of account closure. We may retain certain data for longer where required by applicable law or to resolve any outstanding legal claim or dispute.

Artists may also close their account via the account settings page on the web application. Upon account closure, all Tracks and Events associated with the account will be removed from public view on the platform and deleted from our active systems.

If you are unable to access the mobile application to submit a deletion request, you may contact us directly at [email protected] to request deletion. Please include your registered email address and full name so we can locate your account.

12. How to Complain

Please contact us if you have any queries or concerns about our use of your personal data (see section 15 below). We hope we will be able to resolve any issues you have.

If you are located in the United Kingdom, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO). The ICO may be contacted at:

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

If you are located in the European Economic Area, you have the right to lodge a complaint with your local data protection supervisory authority. Contact details for EEA supervisory authorities are available from the European Data Protection Board at edpb.europa.eu.

13. Changes to This Privacy Policy

We may change this privacy policy from time to time. Where a change is minor (for example, to correct a typographical error or to reflect a change in applicable law), we will update the date at the top of this page. Where a change is material and significantly alters your rights or our obligations, we will take steps to notify you directly, for example by email to your registered address, before the change takes effect. We recommend that you check this page periodically for updates.

14. How to Contact Us

You can contact us by email if you have any questions about this privacy policy, the personal data we hold about you, to exercise a right under Data Protection Law, or to make a complaint.