Privacy Policy

1. Introduction: Our commitment to your privacy

Welcome to Catalog. This Privacy Policy explains how Catalog Music Holding Limited, doing business as Catalog, and its operating subsidiaries Catalog Music France SARL (France), Catalog Music S.L. (Spain), and Catalog Music North America Inc. (USA) (collectively “Catalog,” “we,” “us,” or “our”) collect, use, disclose, and safeguard your personal data when you access our website, use our platform (the “Platform”), or interact with our services (collectively, the “Services”).

We are committed to protecting your privacy and ensuring the security of your personal data. During the account creation process, you actively confirmed that you have read, understood, and agree to the terms outlined in this Privacy Policy. Your continued use of our Services signifies your ongoing acceptance of this Policy. Please note that your agreement to this Privacy Policy is distinct from any consent you may provide for receiving marketing communications.

2. What personal data we collect

We collect personal data to provide and improve our Services. The types of data we collect include:

2.1. Data you provide directly to us:

Contact Information: Your name, email address, phone number (if provided), country of residence, and mailing/billing addresses (if applicable for invoicing or services).

Professional information: Company name, job title, areas of professional expertise (e.g., film, advertising, gaming, genre specializations), professional affiliations, and links to your professional profiles (e.g., IMDb, LinkedIn, personal portfolio website) if you choose to provide them.

Account & profile information: Information you provide when you create or update your account, which may include a biography, portfolio samples, and links to your work if you choose to include them in any user profile features.

Communications data: Information you provide when you contact us with questions, feedback, participate in surveys, or engage in other communications with our team.

Payment information (handled by processors): When you pay for a music license, this is currently done via bank transfer from you to Catalog, using the specific bank details we provide on your invoice. In this standard process, Catalog does not directly collect or store the bank account details you use to initiate the transfer; your bank manages this. We receive the payment along with necessary transaction identifiers and your billing information for our records. In the future, we may offer the option to use third-party payment processors (such as Stripe or PayPal) for certain transactions. Should you choose such a method when available, the payment processor would collect your financial information (like payment card numbers or direct debit details) according to their own privacy policies and security standards. In that event, Catalog would typically only receive limited data from the processor, such as a transaction ID and your billing address, and we would not store your full payment card details on our servers.

2.2. Data we collect automatically when you use our services:

Log data: Information your browser or device automatically sends when you access our Platform. This includes your Internet Protocol (IP) address, browser type and settings, device information (name of the device, operating system), dates and times of your requests, and how you interacted with our Platform.

Usage data: We collect information about how you use our Services. This includes:

Music interaction data: Tracks you play, search for, download (if applicable for previews), add to playlists, or otherwise interact with.

Platform interaction data: Pages you visit, features you use, actions you take (e.g., creating productions, making offers), similarity searches you perform, and the time, frequency, and duration of your activities. This helps us understand user needs and improve the platform.

Productions & billing data: When you create "Productions" (projects) on our Platform, we collect information about the project scope and the tracks you add or consider for licensing. This is essential for the licensing workflow, accurate billing, invoicing, and fraud prevention.

Cookie data: We use cookies and similar technologies to collect information about your Browse activities. (See Section 8: Cookies and Similar Technologies for more details).

Location data (Approximate): We may derive a rough estimate of your geographical location (e.g., country or city) from your IP address.

Email interaction data: If you subscribe to our email communications, we may use technologies (like pixels) to collect information such as your IP address and when you open an email or click on links within it. This helps us gauge the effectiveness of our communications.

2.3. Data we may receive from third parties:

Payment processors: As mentioned, we receive limited transaction details from our payment providers.

Analytics & advertising partners: We may use third-party analytics tools (e.g., Google Analytics) and advertising platforms (e.g., Meta Pixel, LinkedIn Insight Tag) to help us understand user interaction with our Platform, measure the effectiveness of our advertising, and improve our services. These tools may collect their own data subject to their privacy policies.

3. How we use your personal data (our purposes and legal bases)

We use your personal data for the following purposes, relying on specific legal bases as required by laws like GDPR:

To provide and manage our services (Legal basis: contract performance):

Process your membership application and manage your account.

Enable you to create productions, search for music, create playlists, and engage with platform features.

Facilitate the music licensing process, including processing your offers and payments.

Provide you with customer support and respond to your inquiries.

For our legitimate business interests (Legal basis: legitimate interests):

Communicate with you: Send administrative information, such as updates to the Services, changes to our terms, conditions, and policies, and respond to your comments or questions.

Enhance and personalize your experience: Analyze how you interact with our Services (e.g., links clicked, pages visited, music interactions) to maintain and improve the content, functionality, and user experience. We may combine information to create insights and user segments to suggest relevant tracks, artists, or potential licensing scopes based on your past activity and similarity searches.

Audio similarity recommendations: Our AI-driven audio similarity technology analyzes audio characteristics of reference tracks you provide to recommend other tracks. This involves analyzing audio data to generate accurate recommendations for you.

Service improvement & development: Develop new products and services and inform our operational strategy.

Security and fraud prevention: Prevent fraud, criminal activity, or misuses of our Service, and ensure the security of our IT systems, architecture, and networks.

Legal compliance & protection: Comply with legal obligations and legal processes, and protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.

Client relationship management (CRM): To manage client relationships efficiently, we may use CRM tools (e.g., Pipedrive) to store and process client contact details, communication history, and business interactions. This data is used exclusively for our internal business operations to provide you with better service and is not sold or shared for external marketing purposes.

With your consent (Legal basis: consent):

Marketing communications: We will only send you marketing communications (e.g., newsletters, special offers, information about products or services we think might interest you) if you have actively and separately opted in to receive them. You can withdraw your consent at any time by clicking “unsubscribe” in our emails, adjusting your account notification preferences, or contacting us directly. Withdrawing consent for marketing will not affect service-related communications.

Specific cookies & tracking: We will seek your consent for non-essential cookies and similar tracking technologies as required by applicable law (see Section 8).

Other purposes: We ask for your consent for any other purpose.

Aggregated and anonymized information: We may aggregate or anonymize personal data and use this information to analyze the effectiveness of our Service, understand usage trends, improve and add features, and for other similar research and business intelligence purposes. We may share such aggregated/anonymized information (which does not identify you personally) with prospective business partners or our partner rights holders.

4. How we share and disclose personal data

We do not sell or disclose in your personal data. We may share your personal data in the following circumstances:

Vendors and service providers: We share personal data with trusted third-party vendors and service providers who assist us in our business operations and help us perform services and functions. This includes providers of hosting services (e.g., Amazon Web Services, with data centers in Ireland, cloud services, IT infrastructure, email communication software, newsletter services, advertising and marketing services (acting on our behalf), payment processing, CRM and customer support services, and analytics services (e.g., Google Analytics). These service providers are contractually obligated to protect your information and are authorized to process it only according to our instructions.

Partner rights holders (limited data): We may share anonymized and aggregated usage data with our partner rights holders (labels, publishers, artists) for their analytical and reporting purposes. When you make a licensing offer for a specific track, necessary details about your production and your identity as the licensee will be shared with the relevant rights holders for that track to enable them to evaluate and respond to your offer.

Business transfers: If Catalog is involved in a Transaction (merger, acquisition, financing, reorganization, bankruptcy, sale of assets, etc.), your personal data may be shared during due diligence and transferred to a successor or affiliate as part of that Transaction.

Legal requirements: We may disclose your personal data if required by law or in good faith belief that such action is necessary to comply with a legal obligation, protect our rights or property, prevent fraud, act in urgent circumstances to protect safety, or protect against legal liability.

International data transfers: Catalog operates globally. Your personal data may be transferred to, stored, and processed in countries other than your own (including the UK, EEA, and USA). When we transfer your personal information from the EEA or UK to countries outside these regions not deemed to provide adequate protection, we ensure appropriate safeguards are in place (e.g., Standard Contractual Clauses).

5. Data Security

We implement commercially high technical, administrative, and organizational measures designed to protect your personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. These include encryption, firewalls, access controls, and regular security audits. Our primary data for European users is stored in AWS data centers in Ireland, and we may use Google Workspace with data on European servers.

However, no internet transmission or electronic storage is 100% secure. While we strive to protect your personal data, we cannot guarantee its absolute security. Any transmission is at your own risk. Please take care when sending information, especially via email. We are not responsible for circumvention of privacy settings or security measures on the Service or third-party sites.

6. Data Retention

We retain your personal data only as long as necessary to fulfil the purposes outlined in this Privacy Policy, unless a longer period is required or permitted by law.

Account information: Typically for as long as your account is active and for four (4) years after your last interaction (with restricted access during the latter period).

Financial transaction data: For seven (7) years to comply with tax and accounting regulations.

Usage data & communications: Anonymized/aggregated usage data may be kept indefinitely. Communication records typically for 3 years.

Content you upload: Generally, as long as your account is active or as needed for related services. We may also retain data longer if required by legal obligations or for dispute resolution. Once retention periods expire, data is securely deleted or anonymized.

7. Your choices and data protection rights

Catalog is committed to ensuring you can exercise your data protection rights. Depending on your location (particularly GDPR for individuals in Europe), your rights may include:

The right to access: Request copies of your personal data. (A small fee may apply for excessive/repetitive requests).

The right to rectification: Request correction of inaccurate data or completion of incomplete data. (Much can be updated in your account settings).

The right to erasure ("Right to be forgotten"): Request deletion of your personal data, under certain conditions.

The right to restrict processing: Request restriction of processing, under certain conditions.

The right to object to processing: Object to our processing based on legitimate interests, under certain conditions.

The right to data portability: Request transfer of your data to another organization or to you, in a machine-readable format, under certain conditions.

The right to withdraw consent: If processing is based on consent (e.g., marketing), you can withdraw it anytime.

Marketing communications opt-out: Unsubscribe via email links, account settings, or by contacting us. Service-related emails will continue.

Managing cookies & online tracking: See Section 8 for details.

How to exercise your rights: Email us at support@catalog.ac. We will respond within one month. We reserve the right to confirm your identity and assess whether rights apply or are limited by law.

8. Cookies and Similar Technologies

Cookies are small text files placed on your computer or mobile device when you visit websites. They are designed to collect standard Internet log information and visitor behavior information. When you visit our Platform, we may collect information from you automatically through cookies or similar technologies (like web beacons or pixels). For further general information on cookies, visit allaboutcookies.org.

8.1. How We Use Cookies: Catalog uses cookies in a range of ways to improve your experience on our Platform, including:

Keeping you signed in: To maintain your session and keep you logged in as you navigate the Platform.

Understanding how you use our platform: To gather analytics on user behaviour, popular features, and areas for improvement.

Tracking and analyzing platform performance: Using tools like Google Analytics to monitor site traffic, performance metrics, and optimize our Services.

Managing preferences: Remembering your previously selected preferences, such as language settings, saved searches, or display options.

Facilitating transactions and licensing workflows: Ensuring seamless checkout processes, project management, and other core functionalities.

8.2. What types of cookies do we use? Our Platform uses various types of cookies:

Strictly necessary cookies: Essential for you to browse the Platform and use its features, such as accessing secure areas. Services like user login and shopping carts cannot be provided without these cookies.

Functionality cookies: Catalog uses these cookies so that we recognize you on our Platform and remember your previously selected preferences. These could include your preferred language or the region you are in. A mix of first-party (set by us) and third-party cookies (set by our partners) may be used.

Performance/analytical cookies: These cookies collect information about how you use our Platform, like which pages you visit most often, and if you get error messages. This data is aggregated and anonymous, which helps us improve how our platform works (e.g., using Google Analytics).

8.3. How to manage cookies: You have the right to decide whether to accept or reject cookies (other than strictly necessary cookies).

Browser settings: Most web browsers allow you to set your cookie preferences. You can usually find these settings in your browser’s "options" or "preferences" menu. You can set your browser not to accept cookies, and websites like allaboutcookies.org tell you how to remove cookies from your browser.

Cookie consent banner/tool: When you first visit our Platform, you may be presented with a cookie consent banner or tool that allows you to customize your cookie preferences for non-essential cookies. However, please note that if you choose to disable or refuse cookies, some parts of our Platform features may become inaccessible or not function properly.

9. Children’s privacy

Our Services are not directed to children under the age of 18. Catalog does not knowingly collect personal data from individuals under the age of 18. If you have reason to believe that a child under the age of 18 has provided personal data to Catalog through the Services, please contact us immediately at support@catalog.ac, and we will endeavor to delete that information from our databases.

10. EU AI Act Considerations

Catalog is committed to using Artificial Intelligence (AI) responsibly and in compliance with evolving applicable regulations, including the principles underlying the EU AI Act. Currently, our Platform utilizes AI primarily for features such as music similarity searches (to help you find relevant music based on reference tracks you provide), Smart Pricing estimates and potentially for suggesting relevant content based on your interactions.

We are dedicated to transparency regarding our use of AI. Where AI is employed in a manner that may significantly affect your experience or rights, we will strive to provide clear information about the AI system and its purpose. We continuously monitor the development and implementation of the EU AI Act and will update our practices and this Privacy Policy as necessary to ensure ongoing compliance.

11. Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, our Services, or applicable laws. When we make changes, we will post an updated version on this page and revise the "Last Updated" date at the top. For significant changes, we may also notify you by sending an email to the address associated with your account or by displaying a prominent notice within the Platform prior to the change becoming effective. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your information.

12. Contact Us, EU representative, and your right to lodge a complaint

Questions about this policy or your data: If you have any questions about our Privacy Policy, our information practices, or if you would like to exercise one of your data protection rights, please feel free to contact us.

Email: support@catalog.ac

Mailing address (data controller): Too Young Music Limited 86-90 Paul Street London, EC2A 4NE United Kingdom

EU representative (pursuant to article 27 GDPR): As an individual in the European Union, including Spain, you have rights under the General Data Protection Regulation (GDPR). You can contact our representative in the EU:

EDPO (European Data Protection Office)

Headquarters: Brussels

Other EU offices: Amsterdam, Berlin, Dublin, Madrid, Paris, Sofia, Stockholm

VAT: BE0689.629.220

Email: info@edpo.com

Spain: https://edpo.com/madrid-office/

France: https://edpo.com/paris-office/

UK: https://edpo.com/london-office/

Your Right to Lodge a Complaint with a Supervisory Authority: We are committed to resolving any concerns you may have regarding your privacy and our data practices. If you have such a concern, we encourage you to first contact us directly using the details provided above (e.g., by emailing support@catalog.ac) so that we have the opportunity to address your concerns and find a resolution with you.

However, you always have the right to lodge a complaint with a data protection supervisory authority if you believe that we have infringed upon your data protection rights.

For matters particularly related to our Spanish operations or if you are in Spain, you may contact the Spanish Data Protection Authority (Agencia Española de Protección de Datos - AEPD). You can find their contact details on their website: https://www.aepd.es/.

Individuals in other EU countries may also lodge a complaint with the supervisory authority in their country of residence, their place of work, or the place where an alleged infringement took place.