Personal Data Protection Policy (LOPDP)

NOTICE:

UMW RECORDINGS, INC. S.A.S., acting as the Data Controller, provides this first-layer notice so that each person understands, before providing personal data:

• who uses the data;
• the purposes for which it is used;
• the person’s rights;
• where those rights may be exercised.

This notice is supplemented by the Privacy Policy and the Cookie Policy.

Brief Privacy Notice. This is the quick-reference layer. The complete Privacy Policy is available through the Privacy Policy page.

In less than one (1) minute:

• UMW uses the data necessary to operate Accounts, releases, royalties, support, and requested Services;
• You may request access, correction, deletion, objection, and portability when applicable;
• Non-essential cookies may be rejected without losing basic access;
• The DPO maintains a direct and independent communication channel.

This notice briefly explains what happens to the personal data of a person who:

• visits UMW;
• opens an Account;
• submits a release;
• requests a payment;
• files a complaint or claim;
• purchases UMW Song Assets Services.

The Privacy Policy contains the complete data inventory.

‍FIRST.— DATA CONTROLLER.

UMW RECORDINGS, INC. S.A.S.
RUC 0993391921001
Av. Francisco de Orellana
Guayaquil 090512
Ecuador

Cantonal DPA 0901 · Parish DPA 090150

Privacy Inquiries and Data-Subject Rights: Privacy of personal data under international laws
Personal Data Protection Officer: Verónica Gabriela Salazar Castro
DPO: Data Protection Officer

The DPO independently supervises compliance.

The operational team processes the request. The DPO may:

• review the procedure;
• provide advice;
• receive complaints.

In this identification, DPA means Political-Administrative Division. It does not mean a data processing agreement.

‍SECOND.— PERSONAL DATA UMW USES.

Depending on the relationship, UMW may process:

• name, email address, telephone number, country, and Account information;
• company information, representative information, and RUC;
• documents used to verify identity or rights;
• audio, cover artwork, credits, UPCs, ISRCs, and Metadata;
• agreements, splits, and publishing data;
• reports, balances, invoices, payment methods, and payment-beneficiary information;
• support tickets, DMCA matters, and anti-fraud Case Files;
• IP address, sessions, device information, and security logs;
• cookie and marketing preferences;
• information submitted to requested tools.

UMW does not need you to send passwords, complete payment card information, or documents through an unsecured email channel.

‍THIRD.— PURPOSES FOR WHICH PERSONAL DATA IS USED.

UMW uses personal data to:

• create and protect UMW Core Accounts;
• review and deliver releases;
• match reports with UPCs, ISRCs, and Accounts;
• calculate statements and process withdrawals;
• verify identity, authority, and rights;
• investigate fraud or claims;
• administer compositions through UMW Song Assets;
• provide support;
• comply with legal obligations;
• perform measurement or advertising only when an applicable legal basis or consent exists.

‍FOURTH.— WHO RECEIVES INFORMATION.

When necessary, UMW communicates personal data to:

• selected Platforms and stores;
• delivery providers;
• Societies and publishing Agencies identified in an Order;
• banks and payment processors;
• infrastructure, authentication, support, and security providers;
• professional advisers, auditors, or authorities;
• white-label Clients when they act as Controllers of their own Users.

Not every recipient is a Subprocessor.

A DSP or Society may act as an independent Data Controller.

‍FIFTH.— YOUR RIGHTS.

You may request:

• information and access;
• rectification and updating;
• deletion;
• objection;
• suspension;
• data portability when applicable;
• withdrawal of consent;
• an explanation and human review of a relevant automated decision;
• the filing of a complaint with the DPO or the SPDP.

LOPDP Request

Include:

• your name;
• your Account or relationship with UMW;
• the right you wish to exercise;
• your preferred response method.

UMW will verify identity proportionately and will not request more personal data than necessary.

‍SIXTH.— RESPONSE PERIOD.

UMW acknowledges receipt, registers the case, and responds within the applicable legal period. As an operational reference, UMW endeavors to resolve applicable Data-Subject rights requests within fifteen (15) days. When clarification is required, the period will be calculated in accordance with applicable law.

A complete or partial denial will identify:

• the reason;
• the available complaint or appeal procedure.

‍SEVENTH.— AUTOMATION.

UMW Scan and other controls may flag:

• duplicate content;
• Metadata issues;
• access activity;
• risk indicators.

An alert may temporarily change a status to review. UMW will not issue a final termination, cause a loss of funds, or make an accusation of fraud based solely on an automated alert.

You may:

• submit supporting documents;
• request human review.

When a feature uses artificial intelligence to process personal data, UMW will:

• explain its purpose;
• disclose the automated nature of the processing;
• assess risks;
• implement security measures;
• maintain human supervision in accordance with current Ecuadorian law.

‍EIGHTH.— COOKIES.

Necessary Technologies may operate for security and essential functionality. Analytics, advertising, embedded content, and other optional Technologies require the applicable choice. You may use Cookie Settings in the website footer. Closing the banner does not constitute acceptance. The rejection button is labeled:

‍NINTH.— INCIDENTS.

Reject Non-Essential Cookies

Rejecting non-essential cookies does not block essential functions.

When an incident occurs, UMW will:

• contain it;
• document it;
• assess it;
• notify Controllers, Data Subjects, and authorities when applicable.

Report unrecognized access or exposure to:

‍TENTH.— ADDITIONAL INFORMATION.

Privacy of personal data under international laws

Do not include credentials in the message.

‍ELEVENTH.— YOUR PRIVACY CONTROLS.

Review the Privacy Policy for information concerning:

• legal bases;
• retention;
• recipients;
• international transfers;
• minors;
• biometric data;
• marketing;
• white-label Services;
• UMW Song Assets.

UMW brings together its principal privacy controls under:

Account → Privacy and Security

‍TWELFTH.— VERIFIABLE PRIVACY PREFERENCES.

From that section, you may:

• review preferences;
• review prior acceptances;
• download information;
• request portability;
• withdraw consent;
• submit a complaint;
• contact the DPO.

Necessary Technologies keep the website secure and enable the functions you request. Analytics, advertising, external content, and personalization remain disabled until you choose to activate them.

UMW tests:

• first visit;
• closing the banner without accepting;
• rejection;
• selection by category;
• acceptance;
• preference changes;
• withdrawal.

After production testing has passed, the website may display:

‍THIRTEENTH.— PRIVACY AND ACCEPTANCE HISTORY.

Verified Consent Controls

This message does not mean that the SPDP has certified or approved the controls.

Last technical test: [actual date] · Scope: [pages tested].

Review the decisions you have made at UMW, including accepted documents, privacy preferences, changes, and specific authorizations. Each record displays its date, version, and action.

View History · Download Record · Change Preferences

The history does not limit your rights. When you change a decision, UMW retains both the previous event and the new event so that it can demonstrate what occurred.

‍FOURTEENTH.— SECURE CHECKOUT.

Before payment, UMW displays:

• legal company name;
• RUC;
• Order;
• Service;
• period;
• currency;
• price;
• taxes;
• charges;
• total;
• renewal terms;
• processor;
• cancellation terms;
• refund terms.

The payment button must state:

Confirm and Pay [currency] [total]

The personal data necessary to authorize payment is processed by the payment gateway identified on the screen.

UMW retains:

• the transaction reference;
• amount;
• status;
• invoice;
• information required for support and compliance.

‍FIFTEENTH.— PAYMENT HISTORY.

The complete Privacy Policy explains the processing of financial information.

The information is available under:

Billing → Payment History

The User may review:

• Orders;
• approved charges;
• pending payments;
• declined payments;
• invoices;
• refunds;
• references;
• related support.

‍SIXTEENTH.— DOWNLOAD AND PORTABILITY.

Each Transaction retains its own details even when the price of a plan changes later.

Request and Download My Data

You may request:

• profile information;
• Account information;
• catalog information;
• Metadata;
• royalties;
• payments;
• publishing information;
• support tickets;
• preferences;
• acceptance records.

When the right to data portability applies, UMW provides structured formats such as JSON or CSV within a ZIP archive. UMW may transmit personal data directly to another Data Controller when technically possible.

Before a direct transfer, UMW explains:

• the information that will be transmitted;
• the effect on the Account;
• the records UMW must retain under an applicable legal basis.

‍