Privacy Policy

NOTICE:

UMW RECORDINGS, INC. S.A.S., with Taxpayer Registry Number 0993391921001 and a registered address at Av. Francisco de Orellana, Guayaquil 090512, Ecuador, acts as the “Controller” with respect to the processing activities described in this Policy. The identified or identifiable natural person whose personal data is processed is referred to as the “Data Subject.” A provider that processes personal data on behalf of UMW and under UMW’s documented instructions is referred to as the “Processor.” This Policy primarily applies in accordance with Ecuador’s Organic Personal Data Protection Law and its secondary regulations. Territorial supplements apply only when a foreign law materially and territorially applies to a specific operation.

This Policy is organized as a regulatory framework covering:

• identification and scope;
• data inventory;
• lawfulness;
• recipients;
• data lifecycle;
• Data-Subject rights;
• transparency controls.

This Policy explains the processing of personal data through the public website, UMW Core, music distribution, royalties, support, UMW Song Assets, white-label Services, API access, and UMW tools.

‍FIRST.— CONTROLLER AND CONTACT INFORMATION.

UMW RECORDINGS, INC. S.A.S.
RUC 0993391921001
Av. Francisco de Orellana
Guayaquil 090512
Ecuador

‍SECOND.— PERSONS COVERED BY THIS POLICY.

This Policy covers personal data relating to:

• visitors;
• applicants;
• artists;
• labels;
• managers and team members;
• composers and lyricists;
• Clients and providers;
• payment beneficiaries;
• Claimants and persons submitting counter-notifications;
• Users of white-label Clients;
• API partners;
• persons identified in Metadata, agreements, or credits.

‍THIRD.— SYSTEMS AND ENTRY POINTS.

UMW may obtain personal data through:

• umwrecordingsinc.com;
• UMW Core;
• contact, demo, publishing, DMCA, and white-label forms;
• email and support channels;
• release uploads;
• UMW Scan;
• withdrawal requests;
• UMW Song Assets;
• tools such as UMW Protect, mastering, or cover artwork;
• API access and webhooks;
• campaigns and events;
• DSPs, Societies, banks, providers, or Claimants.

‍FOURTH.— ACCOUNT DATA.

UMW processes:

• name;
• email address;
• telephone number;
• country and address;
• language;
• hashed password or access-provider credential;
• company, label, and role;
• team Users;
• preferences;
• sessions, IP address, and device information;
• change history.

UMW cannot read a password stored through an appropriate hashing system.

‍FIFTH.— IDENTITY AND AUTHORITY.

When KYC or KYB is required, UMW may process:

• identification documents;
• date of birth;
• Selfie or liveness verification is required only when triggered by the applicable identity, security, payment, catalog, or risk-control process. Not every account or action requires biometric verification;
• RUC and corporate documents;
• legal representative information;
• authorizations;
• ultimate beneficial owner information;
• country of tax residence;
• verification results.

UMW does not request this information from every visitor. Verification must correspond to the risk associated with the Account, payment, agreement, or catalog.

‍SIXTH.— MUSIC DATA.

For distribution, UMW processes:

• audio;
• cover artwork;
• title;
• artist information and profiles;
• label information;
• composers, lyricists, producers, and performers;
• phonographic and composition copyright information;
• UPCs, ISRCs, and other identifiers;
• genre, language, and explicit-content status;
• dates and Territories;
• splits;
• agreements or licenses;
• review and delivery statuses;
• Platform links.

Names and credits intended for a DSP will be made public on that Platform as part of the delivery.

‍SEVENTH.— ROYALTIES AND PAYMENTS.

UMW processes:

• report files;
• DSP, period, country, currency, and amount;
• UPC and ISRC;
• Commission, adjustment, deduction, and reserve;
• Account balance;
• invoices;
• tax information;
• withdrawal method;
• beneficiary name;
• payment Account or payment identifier;
• status and receipt;
• payment communications.

When an external payment gateway directly receives payment card information, UMW receives:

• confirmation;
• transaction reference;
• amount;
• currency;
• status;
• information required for invoicing and support.

UMW must not receive or retain the complete payment card number or security code. UMW verifies this statement for each integration before displaying that integration during checkout.

‍EIGHTH.— PUBLISHING DATA.

UMW Song Assets may process:

• compositions;
• authors and publishers;
• IPI, CAE, ISWC, and affiliation information;
• performing rights or collective management Society;
• splits;
• Administered Interest;
• agreements;
• Territories;
• licenses;
• publishing statuses;
• tax and payment information;
• communications with BMI, ASCAP, SAYCE, SGAE, The MLC, HFA, or another route included in the Order.

‍NINTH.— SUPPORT AND CLAIMS.

An initial application is used for evaluation. It does not, by itself, authorize a registration.

UMW retains:

‍TENTH.— SECURITY AND ANTI-FRAUD.

• support tickets;
• Account information;
• messages;
• attachments;
• UPCs, ISRCs, or Transaction information;
• personnel who handled the matter;
• responses;
• resolution;
• DMCA notices;
• counter-notifications;
• rights disputes;
• appeals.

Do not submit sensitive personal data that is not necessary.

UMW may process:

‍ELEVENTH.— COOKIES AND MARKETING.

• logs;
• access activity;
• beneficiary changes;
• matches;
• duplicates;
• UMW Scan alerts;
• DSP notices;
• documentation;
• promotion campaign information;
• Account behavior;
• case classification;
• measures adopted;
• outcome.

An indicator is not publicly communicated as confirmed fraud.

UMW processes the User’s cookie choices and, when supported by a valid legal basis:

• webpage interactions;
• campaign source;
• conversion events;
• subscription to communications;
• email opens or clicks when enabled;
• withdrawal of consent.

‍TWELFTH.— REQUESTED TOOLS.

Optional marketing and Advertising Cookies require authorization when applicable.

Unsubscribing from marketing communications does not affect contractual communications.

When a person uses mastering, cover artwork, UMW Protect, an image resizer, or another tool, UMW processes the files, parameters, and output necessary to provide the function.

‍THIRTEENTH.— PURPOSES AND LEGAL BASES.

UMW does not use Client music, voices, documents, or cover artwork to train its own or third-party generative models unless UMW obtains separate, specific, and unambiguous authorization identifying:

• the purpose;
• the provider.

1. Registration and Access Phase (Onboarding)

• KYC/KYB : Verifies identity and ownership. Legal basis: Legal obligation, agreement, and legitimate interest.
• Account and Order : Create, invoice, and manage the service. Legal basis: Agreement and legal obligations. [1]

2. Operation and Content Management (Daily Use)

• Releases : Review, deliver, update, and delete content. Legal basis: Agreement.
• UMW Scan : Detects errors, duplicates, fraud, or conflicts. Legal basis: Contract execution, security, and legitimate interest.
• Publishing : Registers and manages the entrusted interest. Legal basis: Publishing order.
• Royalties : Imports, reconciles, accounts for, and pays royalties. Legal basis: Agreement, accounting obligations, and defense of rights.

3. Interaction, Support and Marketing

• Support : Handles requests and saves the resolution. Legal basis: Agreement and legitimate interest.
• Optional Cookies : Analytics, external functions, or advertising. Legal basis: Consent.
• Marketing : Sends offers and measures campaigns. Legal basis: Consent or other disclosed legal basis.

4. Security, Legal and Compliance (Control)

• Security : Prevents unauthorized access, loss, and misuse. Legal basis: Security obligation and legitimate interest.
• DMCA : Processes copyright notices and counter-notifications. Legal basis: Legal obligation and defense of rights.
• Compliance : Responds to requirements from authorities, taxes, or sanctions. Legal basis: Legal obligation.

When a purpose requires consent, UMW will not conceal that consent within general acceptance of the agreement.

Information marked as mandatory is necessary to:

• create an Account;
• enter into an agreement;
• deliver content;
• satisfy DSP requirements;
• verify rights;
• issue an invoice;
• make a payment.

When the information is not provided, UMW may be unable to complete the applicable function. UMW does not require marketing consent to provide distribution Services.

‍FOURTEENTH.— MANDATORY DATA.

A Client may provide information concerning credits, co-authors, beneficiaries, or representatives.

The Client must:

• have the right or legal basis to provide the information;
• provide accurate data;
• limit the information to what is necessary;
• notify the person when applicable.

‍FIFTEENTH.— PERSONAL DATA OF OTHER PERSONS.

UMW will make this Policy available and address the rights of any person appearing in its records.

UMW will use biometric data only when it implements a verification process that genuinely requires it and has:

• explicit consent;
• or a documented legal exception.

Identity verification is processed using a specialized verification provider. Before you begin, UMW will display the applicable provider, data processed, purpose, retention period and available privacy rights.

‍SIXTEENTH.— BIOMETRIC DATA.

• the provider;
• the data involved;
• the purpose;
• the retention period;
• a reasonable alternative when applicable;
• the recipients;
• the method for withdrawing consent.

The biometric template will be deleted after the verification result is obtained. The underlying image will be deleted within the shortest technically feasible period and, as an internal rule, no later than thirty (30) days, unless a documented legal obligation or dispute requires retention. Biometric data will not be used to train models.

UMW Scan, security controls, and providers may generate an alert or score.

‍SEVENTEENTH.— AUTOMATED DECISIONS.

An alert may:

• require review;
• protect a payment;
• change a status to Documents Needed;
• block a session;
• temporarily stop a delivery.

A final termination, loss of funds, or serious classification will not be based exclusively on automated processing. When an automated assessment affects a person’s rights or interests, the person may:

• request clear information about the purpose and automated nature of the processing;
• object when applicable;
• submit evidence;
• request human review.

When UMW develops, implements, deploys, or uses an artificial intelligence system that processes personal data belonging to Ecuadorian Data Subjects, UMW must:

• identify the system’s function and provider;
• provide clear, specific, and transparent information;
• record the processing and relevant automated decisions in the Record of Processing Activities;
• conduct risk management and the applicable impact assessment before use;
• implement security measures;
• audit the system according to its level of risk;
• maintain effective human supervision.

A commercial name such as UMW Scan does not, by itself, establish that artificial intelligence is being used. These obligations apply according to the actual technology and processing activity.

‍EIGHTEENTH.— DISTRIBUTION RECIPIENTS.

UMW communicates audio, cover artwork, Metadata, and identifiers to:

• selected DSPs;
• authorized delivery infrastructure;
• technical processing providers;
• identification or control Services included in the applicable Service;
• Rights Holders or Claimants when required by a dispute.

Each DSP may determine its own purposes as an independent Controller.

‍NINETEENTH.— PAYMENT RECIPIENTS.

UMW communicates necessary personal data to:

• banks;
• PayPal;
• Payoneer;
• invoicing providers;
• tax or accounting advisers;
• tax authorities.

Available payment methods depend on the country and Account.

‍TWENTIETH.— WHITE-LABEL SERVICES.

In a white-label relationship, the Business Client ordinarily determines:

• which Users it accepts;
• what it charges;
• what personal data it requests;
• what support it provides;
• what catalog it submits.

For that personal data, the Business Client may act as Controller and UMW as Processor.

The B2B agreement must define:

• instructions;
• security;
• Subprocessors;
• assistance with Data-Subject rights;
• incident response;
• return of personal data;
• deletion.

UMW remains Controller for personal data it uses to satisfy its own:

• legal obligations;
• security requirements;
• invoicing obligations;
• legal defense requirements.

‍TWENTY-FIRST.— API.

The API uses:

• credentials;
• logs;
• Account information;
• endpoints;
• payloads;
• results;
• webhooks.

Partners may access only data belonging to authorized Accounts.

UMW applies:

• permissions;
• limits;
• separation between sandbox and production;
• credential rotation;
• auditing.

Complete identification documents must not be included in an ordinary payload when a dedicated channel exists.

‍TWENTY-SECOND.— PROVIDERS AND SUBPROCESSORS.

UMW publishes the following information concerning material providers in the Provider Registry:

• legal entity;
• function;
• country;
• category of personal data;
• role.

Before publishing that table, UMW verifies the applicable agreement, invoice, or provider dashboard. UMW does not identify the legal contracting party solely from a trade name observed in a script. When the provider acts under UMW’s instructions, the agreement must address:

‍TWENTY-THIRD.— INTERNATIONAL TRANSFERS.

• subject matter;
• duration;
• purpose;
• personal data;
• Data Subjects;
• instructions;
• confidentiality;
• security;
• Subprocessors;
• international transfers;
• assistance;
• incidents;
• audits;
• return or deletion.

A provider’s contractual DPA means Data Processing Agreement. It must not be confused with geographic DPA codes 0901 and 090150.

Some DSPs, Societies, and providers operate outside Ecuador.

UMW:

• identifies the country and recipient;
• determines the recipient’s role;
• applies an authorized transfer mechanism;
• limits the personal data transferred;
• documents security;
• communicates material changes.

International processing is governed by:

• the LOPDP;
• its Regulations;
• current SPDP regulations;
• any applicable territorial rules.

‍TWENTY-FOURTH.— RETENTION.

UMW documents:

• the applicable transfer circumstance;
• recipient;
• purpose;
• categories;
• country;
• safeguards;
• measures;
• traceability.

Acceptance of cookies does not replace an international transfer safeguard.

UMW uses a retention schedule organized by system and category of personal data:

1. Immediate or Short-Term Retention (Days to Months)

• Biometric data : The template is deleted after the result; the image is stored for a maximum of 30 days.
• Account : Up to 90 days after technical closure, except for mandatory registrations.
• Unconfirmed alert : It is removed or anonymized as soon as it is no longer needed.
• Tool file : It is deleted immediately after the period shown in the function.

2. Medium-Term Retention (Up to 2 Years)

• Ordinary logs : Up to 12 months, except if they are linked to an incident.
• Ordinary support ticket : Up to 24 months after the case is closed.

3. Withholding Related to the Commercial Relationship (Active)

• Release and delivery : During distribution, disposal, late reports and claims period.
• Marketing : Until the user withdraws their consent (suppression list is maintained).
• Consent : For the period necessary to demonstrate the user's choice.

4. Long-Term Retention / Legal Obligation (Years or Statute of Limitations)

• KYC/KYB : During the relationship and the legal claims period; full copies are deleted beforehand.
• Acceptance and Order : During the business relationship and the applicable legal claims period.
• Royalties, invoices, and payments : Throughout the applicable fiscal, accounting, and contractual period.
• DMCA and disputes : During the case and throughout the applicable legal defense period.

UMW applies blocking when it must retain a record without using it for ordinary operations.

When an Account is closed, UMW:

• revokes access;
• processes the catalog;
• retains pending statements and payments;
• blocks contractual evidence;
• deletes personal data that no longer has a purpose;
• explains what cannot yet be deleted.

Deleting an Account does not remove credits already published by a DSP or files controlled exclusively by a third party.

‍TWENTY-FIFTH.— DELETION AND ACCOUNT CLOSURE.

UMW transmits corrections or removals when applicable.

UMW implements proportionate measures, including:

• access controls;
• roles;
• authentication;
• credential protection;
• encryption in transit;
• backups;
• logs;
• environment separation;
• provider review;
• vulnerability management;
• incident response;
• business continuity.

The Security Program Statement describes the actual status of the program and does not claim certification.

‍TWENTY-SIXTH.— SECURITY.

UMW records:

1. detection;
2. affected systems and personal data;
3. affected persons;
4. containment;
5. risk;
6. communications;
7. recovery;
8. corrective action.

When UMW acts as Controller, it will notify authorities and Data Subjects within the applicable legal periods when the relevant requirements are satisfied. When UMW acts as Processor, it will notify the Client acting as Controller without undue delay and within the applicable contractual or legal period.

‍TWENTY-SEVENTH.— INCIDENTS.

‍