Privacy Policy

This Privacy Policy (the “Privacy Notice”) explains how UMW Recordings Inc. (doing business as UMW Core) (“UMW,” “we,” “us,” “our”) may access, collect, store, use, disclose, and otherwise process (“process”) personal information when you use our websites, apps, dashboards (including core.umwrecordingsinc.com), and related services (collectively, the “Services”).

If you do not agree with this Privacy Notice, do not use the Services.

‍

Questions or requests: privacy@umwrecordingsinc.com (subject line: “DPO”) or our contact page.

‍

IMPORTANT: THIS NOTICE IS ORGANIZED IN 3 PARTS

Because UMW can act in different roles depending on the product you use, this Privacy Notice is divided into:

1. Part I — UMW as Data Controller (website visitors, prospects, direct customers: Artist/Label/Company, and general business operations).
2. Part II — UMW as Data Processor (when a business customer uses UMW as infrastructure, including certain White Label/enterprise configurations and “Service Data”).
3. Part III — General Information (security, retention, international transfers, cookies, rights, updates).

If you are an end user of a White Label distributor powered by UMW, your primary privacy relationship may be with that distributor (the Controller). UMW processes “Service Data” on their instructions as described in Part II.

‍

PART I — INFORMATION UMW PROCESSES AS A DATA CONTROLLER‍

1) Who is the Data Controller?

UMW Recordings Inc. (UMW Core) is responsible for deciding how personal information is processed when UMW acts as a controller. We provide contact channels for privacy questions, complaints, and data subject requests.

‍

Privacy Contact (Privacy Lead)

• Email: privacy@umwrecordingsinc.com (subject: “DPO”)
• Requests portal / representative portal (where applicable): via the channels referenced in our notice.

UK / EU Representative (where applicable)

UMW has appointed a UK GDPR Article 27 representative and provides official portal links for EU/UK data subject requests.

‍

2) What personal information do we collect?

The exact categories depend on your interaction with the Services. We may collect:

‍

2.1 Information you provide directly

Examples include: names, phone numbers, email addresses, mailing/billing addresses, job titles, usernames, passwords, contact preferences, authentication data, and other information you choose to provide.

2.2 Payments and payout information (handled by processors)

If you pay for subscriptions or receive royalty payouts, we may collect data necessary to process payments and payouts. All payment data is handled and stored by our processors (including Stripe, Payoneer, and Dlocalgo) and UMW does not store full payment card data (processed via certified providers consistent with PCI standards).

2.3 Music distribution & platform identifiers

We may process distribution-related identifiers and account details such as stage name / project name, banking information for royalty payments, and platform identifiers (e.g., ISRC, Spotify ID, YouTube channel).

2.4 Automatically collected information (logs, device data, usage)

We may automatically collect technical and usage information such as IP address, device/browser identifiers, telemetry, logs, and similar analytics signals.

2.5 Social login data

If you register/log in using a social media account, we may receive certain profile information from that provider, depending on your settings.

2.6 App permissions (if you use our application)

If you use our app(s), we may request access to certain device features (e.g., calendar/contacts/bluetooth) if you grant permission, and we may collect mobile device data (device ID, model, OS, IP/proxy).

2.7 Sensitive information

We do not process sensitive personal information (as “sensitive” may be defined by law). Please do not send us sensitive information.

3) Where do we get information from?

We may collect personal information:

• From you (forms, account setup, uploads, support communications).
• Automatically (cookies, logs, device data).
• From third parties (e.g., social login providers; service providers; public sources where permitted).

‍

4) Why do we process personal information?

We process personal information to:

• Provide, improve, and administer the Services, including account creation and authentication.
• Process subscriptions, payments, and payouts, and maintain financial reconciliation.
• Communicate with you (support, service updates, essential transactional notices).
• Marketing & promotions where consistent with your preferences; you can opt out of marketing emails.
• Security and fraud prevention, monitoring, auditing, and enforcing policies.
• Comply with law and respond to lawful requests.

‍

5) Legal bases (EEA/UK and similar regions)

Where required, we rely on legal bases such as:

• Contract performance (to provide Services you request);
• Consent (e.g., certain cookies/marketing where required);
• Legitimate interests (security, analytics, improving Services);
• Legal obligations;
• Vital interests (rare safety-related cases).

‍

6) Who do we share personal information with?

We may disclose personal information to:

‍

6.1 Service providers (sub-processors)

We use vendors for hosting, analytics, customer support tools, communications, security, payments/payouts, and other infrastructure—under contracts requiring appropriate safeguards.

6.2 Payment processors

Payments and payout processing is performed via processors such as Stripe, Payoneer, and Dlocalgo.

6.3 Distribution / platform partners

To deliver Services, some information may be shared with distribution platforms and partners as operationally necessary (e.g., account identifiers, metadata, and reporting context).

6.4 AI service providers (when you use AI features)

We may provide AI-based features via third-party AI service providers (including references in our notice), and your input/output and associated personal information may be processed to enable those features.

6.5 Legal, compliance, and protection of rights

We may disclose information to comply with law, enforce our agreements, protect rights/safety, and respond to lawful requests.

6.6 Business transfers

If UMW undergoes a merger, acquisition, financing, or asset transfer, information may be transferred as part of that transaction (with appropriate safeguards where required).

‍

7) Cookies, tracking, and analytics (Controller context)

We use cookies and similar technologies (pixels/tags) for security, core site functionality, preferences, analytics, and (where enabled) marketing.

Cookie controls

You can manage cookies using our Cookie Consent Manager, and essential cookies cannot be rejected because they are strictly necessary to provide the Services.
Details (including cookie categories and examples) are described in our Cookies Policy.

Google Analytics opt-out

We describe available Google Analytics opt-out mechanisms (including Google’s opt-out tools and ad settings).

‍

8) AI features and AI Opt-Out

UMW may offer AI-based products such as AI bots, and we explain how AI data is processed. You may opt out of the automated assistant by emailing hello@umwrecordingsinc.com with subject “AI Opt-Out.”

‍

9) International transfers (Controller context)

Our servers are located in France and Germany, and data may be processed in those countries and other countries where our providers operate.
For transfers from the EEA/UK/Switzerland, we use safeguards such as the European Commission’s Standard Contractual Clauses (SCCs).

‍

PART II — INFORMATION UMW PROCESSES AS A DATA PROCESSOR (SERVICE DATA)

This Part applies when a business customer (for example, a distributor using a White Label/enterprise setup) uploads or controls personal data within the Services (“Service Data”) and that customer is the Controller.

‍

10) Processor role and instructions

UMW will process Service Data only on documented instructions from the Controller, including to provide, maintain, secure, and support the Services, unless processing is required by law (in which case we will inform the Controller where legally permitted).

‍

11) Confidentiality and access control

Access to Service Data is limited to authorized personnel who need access to provide support, troubleshoot, maintain security, or ensure proper operation. Personnel are subject to confidentiality obligations and appropriate training.

‍

12) Sub-processors and transparency

UMW may use sub-processors to provide infrastructure, security, communications, analytics, and support services. We maintain a sub-processor approach described in our privacy materials (including notice and change practices for B2B customers where applicable).

‍

13) Customer-enabled third-party integrations

If the Controller enables third-party integrations (e.g., DSP connections, analytics tools, CRM tools), data may be transferred to those third parties under the Controller’s responsibility. Controllers should review third-party privacy policies and configure integrations carefully.

‍

14) Data subject requests (DSRs)

If UMW is acting as a Processor, data subjects must direct requests to the Controller. UMW will provide reasonable assistance to the Controller to help fulfill DSRs, where required by applicable law and contract.

‍

15) Security incidents and breach notification (Processor context)

If UMW becomes aware of a personal data breach affecting Service Data, we will notify the Controller without undue delay and provide information reasonably necessary for the Controller’s compliance obligations (nature of incident, likely impact, mitigation steps), subject to ongoing investigation and legal constraints.

‍

16) Return and deletion (Processor context)

Upon termination of the applicable Service contract, and at the Controller’s choice (and as contractually agreed), UMW will return or make available Service Data and then delete Service Data from active systems within a commercially reasonable period, except where retention is required by law or necessary for security/fraud prevention, dispute resolution, or enforcement.

If there is a conflict between this Part II and a signed Data Processing Addendum (DPA) or enterprise agreement, the DPA/enterprise agreement controls for Service Data.

‍

PART III — GENERAL INFORMATION (APPLIES TO ALL USERS)

‍17) Data retention

We retain personal information only as long as necessary for the purposes described (service delivery, legal compliance, security, fraud prevention, dispute resolution, and enforcement). We may retain certain logs and investigation records for up to 36 months after a case is closed (or longer where required by law or to establish/defend legal claims).

‍

18) Account deletion

Users can delete their account from the dashboard by entering a confirmation code; deletion can be undone within 15 days. After deletion, we may retain limited information to prevent fraud, troubleshoot, comply with law, and enforce policies.

‍

19) Security measures

We maintain technical and organizational safeguards, including encryption in transit/at rest, MFA, role-based access control, audit logging/monitoring, encrypted backups, periodic penetration testing, and vulnerability management. No system is 100% secure.

‍

20) Minors

The Services are not intended for minors, and we do not knowingly collect personal information from children in ways prohibited by law.

‍

21) Do Not Track (DNT) and Global Privacy Control (GPC)

• DNT: we do not currently respond to DNT signals due to lack of a uniform standard.
• GPC: we will honor opt-out preferences signaled through Global Privacy Control where applicable.

‍

22) U.S. state privacy rights

Depending on your U.S. state of residence, you may have rights to access, delete, correct, obtain a copy, and opt out of targeted advertising/sharing/profiling (subject to legal limits and verification).

‍

23) reCAPTCHA Enterprise

Where implemented, the site may be protected by reCAPTCHA Enterprise and Google’s terms/privacy apply.

‍

24) Updates to this Privacy Notice

We may update this Privacy Notice from time to time. The updated version will be indicated by a revised “Last Updated” date and, where required, we may provide additional notice.

‍

25) Contact

For privacy questions, complaints, or requests:

• privacy@umwrecordingsinc.com (subject: “DPO”), or use our contact page.
• Where applicable, you may also submit requests through the representative portal links referenced in our notice.

‍