Privacy

unheard. ("unheard.", "we", "us") is an independent record label with desks in Vilnius, Lithuania; Sittard, Netherlands; and Dallas, Texas, United States. We are the controller of the personal data described in this policy.

This policy explains what unheard.online collects, why it is held, how long it is kept, who it is shared with, and what rights you have over it.

It covers this site and the label activity carried out through it. It does not cover the streaming services this site links to, which act as independent controllers of any data they collect from you.

Privacy enquiries and rights requests: [email protected].

Through the submission form. The artist name, territory, discipline, the link you supply and any notes you enter. The contact address is taken from your account rather than entered separately. We also record the date of filing and the reference we issue.

Through account registration. Your name, contact address and a password. The password is never stored in readable form: it is hashed with scrypt and a per-account random salt, and the hash cannot be reversed.

Through signing in. One cookie holding an opaque session identifier. The identifier carries no personal data and is meaningless outside our server.

Automatically. Our web server and the infrastructure in front of it record technical information as part of ordinary operation — IP address, request time, the page requested, referrer, and the browser and device identifiers your browser reports.

In the course of business. Where a submission leads to a working relationship, we collect what that relationship requires: profile details, biography and photographs for publication, social handles, and the banking and tax details needed to account to you. That data is collected directly from you under separate agreement, not through this site.

What we do not collect. This site runs no advertising, no analytics, no tracking pixel, no session recorder and no fingerprinting. It builds no behavioural profile, records no listening history, and buys no data about you from anyone.

Where the EU or UK General Data Protection Regulation applies, we rely on the following bases:

• Submissions — to review material, to report its status back to the account that filed it, and to answer follow-up correspondence. Basis: performance of our agreement with you, since filing requires an account.
• Accounts — to authenticate you and to show you the submissions filed against your address. Basis: performance of our agreement with you.
• Sessions — to keep you signed in between requests. Basis: strictly necessary to provide a service you asked for.
• Server records — to keep the site available, diagnose faults, and detect and prevent abuse. Basis: our legitimate interest in the security and integrity of the service.
• Rate limiting — we check whether an address has filed a submission within the previous hour, to prevent flooding of the queue. Basis: our legitimate interest in a usable intake channel.
• Signed artists — to promote and distribute recordings, to account for royalties, and to meet tax and accounting obligations. Basis: performance of our agreement with you, and compliance with a legal obligation.

Where we rely on legitimate interests we have considered the effect on you and are satisfied the processing is proportionate. You may object at any time; see Your rights.

We do not use your data for automated decision-making that produces legal or similarly significant effects, and we do not profile you.

This site sets one cookie, and only after you sign in:

• unheard_session — an opaque session identifier. HttpOnly, SameSite=Lax, secure in production, and it expires thirty days after issue or when you sign out.

That cookie is strictly necessary to provide the sign-in you requested, so no consent banner is shown for it. There are no analytics, advertising or third-party cookies to consent to.

A small amount of information is kept in your browser's session storage to control interface behaviour within a single tab. It is not transmitted to us and is discarded when the tab closes.

You can control cookies through your browser settings. Blocking them will prevent you from signing in, but the rest of the site will work.

We do not sell personal data. We do not rent it, trade it, or disclose it to third parties for their own marketing.

We share it only where necessary, and only with:

• hosting and infrastructure providers, who process data on our instructions in order to run the site;
• our email provider, in order to reply to you;
• music distribution and delivery partners, where a release requires it;
• payment and accounting providers, in order to account to signed artists;
• professional advisers — lawyers, accountants, auditors — where they need it to advise us;
• a purchaser or successor, if the label or its assets are acquired, subject to this policy continuing to apply; and
• a public authority, court or regulator, where we are required by law to disclose it or where disclosure is necessary to establish, exercise or defend a legal claim.

Processors act under written terms that require them to keep the data secure and to process it only as we instruct.

The label operates desks in Lithuania, the Netherlands and the United States. Personal data may therefore be accessed from, and transferred to, the United States.

Where personal data is transferred out of the European Economic Area, we rely on the European Commission's Standard Contractual Clauses, together with any supplementary measure the transfer requires. A copy of the mechanism relied upon is available on request from [email protected].

Fonts are served in part by Google Fonts. Requesting a font sends your IP address and browser details to Google, which acts as a separate controller for that request. The brand typeface is served from our own infrastructure and involves no third party.

Submissions — retained while the queue is active and for twenty-four months after a decision is issued, so that we can answer correspondence and evidence what was reviewed and when.

Accounts — retained until you close the account. On closure the account and its credentials are deleted, and any submissions filed under it are detached from it and retained for the period above.

Sessions — expire thirty days after issue and are deleted on sign-out.

Server records — retained for twelve months, then deleted or aggregated so that they no longer identify anyone.

Signed artists — records relating to releases, royalties and accounting are retained for as long as the recordings are exploited and for the period that tax and accounting law requires afterwards.

We may retain data for longer where a law requires it or where it is needed for a legal claim, and we will delete it once that reason ends.

We implement appropriate technical and organisational measures, including:

• encryption in transit: the site is served over TLS;
• passwords hashed with scrypt and a per-account random salt;
• session identifiers generated from a cryptographically secure source, stored server-side, and set as HttpOnly cookies so that scripts in your browser cannot read them;
• access controls limiting production data to those who need it to operate the label; and
• periodic review of access and of the measures above.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within seventy-two hours of becoming aware of it, and will tell you directly where the risk to you is high.

You have the right to:

• be told what personal data we hold about you and obtain a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased, where we no longer have grounds to hold it;
• restrict how we process it while a dispute about it is resolved;
• receive the data you gave us in a structured, commonly used, machine-readable form, and have it sent to another controller where technically feasible;
• object to processing carried out on the basis of legitimate interests, and at any time to processing for direct marketing; and
• withdraw consent, where we relied on it, without affecting processing carried out before withdrawal.

To exercise any of these, write to [email protected] from the address concerned. We will respond within one month. That period may be extended by two further months for complex requests, and we will tell you if it is. There is no charge unless a request is manifestly unfounded or excessive.

We may need to verify your identity before acting, in order to avoid disclosing your data to someone else.

If you are in the European Economic Area you may complain to your national supervisory authority. For our EU desks these are the State Data Protection Inspectorate in Lithuania and the Autoriteit Persoonsgegevens in the Netherlands. You may also complain to the authority in your country of residence or workplace.

Depending on your state of residence you may have the right to know what personal data we collect, to obtain a copy of it, to have it corrected or deleted, and not to be discriminated against for exercising those rights.

We do not sell personal data and we do not share it for cross-context behavioural advertising, as those terms are defined under United States state privacy laws. We therefore offer no opt-out of sale or sharing, because neither occurs.

To exercise a right, write to [email protected]. You may use an authorised agent, in which case we will ask for proof of their authority.

Our services are not intended for users under 13 years of age, and we do not knowingly collect personal data from children under 13.

If you believe a child under 13 has provided personal data to us, write to [email protected] and we will delete it.

Listening links direct to Spotify, Apple Music, YouTube and Amazon Music. Once you follow one, that service's own privacy policy governs what it collects, and this policy no longer applies.

We have no control over those services and take no responsibility for their practices. Read their policies before using them.

We may update this policy periodically. The revision date is shown at the head of the document, and the version published here is always the current one.

We will notify you of material changes through the site or by email. Continued use of the site after a change constitutes acceptance of the updated policy.

All correspondence, including privacy enquiries, rights requests and complaints: [email protected].

Desks: Vilnius, Lithuania · Sittard, Netherlands · Dallas, Texas, United States.