Privacy Policy

Publicly Available Data

We may collect publicly available information (e.g., from social media profiles, public artist pages, or press releases) for the purposes of analytics and prospecting, always in accordance with applicable law.

Sharing of Personal Data with Third Parties

ANDR shall not disclose your personal data to third parties, unless it is necessary to enable one of the aforementioned purposes. In this respect, your personal data may be processed by accountants, consultants, payment providers, software providers, data enrichment partners and cloud partners.

Processing by the third-party shall be governed by a contract or other legal act under Union or Member State law, that obligates the third-party to handle or process your personal data at least as restrictive as ANDR itself and that sets out (i) the subject-matter and duration of the processing, (ii) the nature and purpose of the processing, (iii) the type of personal data, (iv) categories of data subjects and (v) the obligations and rights of the third party and ANDR.

Notwithstanding the foregoing, it is, however, possible that ANDR discloses your personal data:

• To the competent authorities (i) if ANDR is obliged to do so under the law or under legal or future legal proceedings, and (ii) to safeguard and defend our rights.
• To the party taking over ANDR, if ANDR, or the majority of its assets, is taken over by said third party, in which case your personal data – which ANDR has collected – shall be one of the transferred assets.

If ANDR does not need to transfer your personal data for the purposes listed in this Privacy Policy, it will not sell, hire out or pass on your personal data to third parties, except when it (i) has obtained your permission to this end and (ii) has completed a data processing agreement with the third party in question, which contains the necessary guarantees regarding confidentiality and privacy compliance of your personal data.

Transfers of Personal Data to Third Countries

Any transfer of personal data to a third country or international organization shall be subject to an adequacy decision by the Commission or the following safeguards:

• A data transfer agreement, which shall contain (i) the standard contractual clauses, as referred to in the ‘European Commission decision of 5 February 2010 (Decision 2010/87/EC)’, or (ii) any other mechanism pursuant to privacy legislation, or any other regulations pertaining to the processing of personal data. Before the transfer takes place, the recipient of personal data/processor of ANDR in the third country has to guarantee ANDR that an adequate level of privacy compliance is ensured in this third party country;
• Binding corporate rules. As it is the case for standard contractual clauses, the recipient of personal data/processor of ANDR in the third country has to guarantee ANDR that an adequate level of privacy compliance is ensured in the third party country; or
• Standard Contractual Clauses (SCCs) 2021/914.

Most data is stored in the EU (AWS Frankfurt).

Storage of Personal Data

Unless a longer storage period is required or justified (i) by law or (ii) through compliance with another legal obligation, ANDR shall retain personal data only as long as necessary for the purposes described in this Privacy Policy or as required by law:

• Account & analytics data: retained while you have an active account and deleted or anonymized after termination.
• Prospecting & marketing data: retained for 12 months unless you unsubscribe earlier.
• Anonymized, aggregated data may be stored longer for product improvement

Your Privacy Rights

In light of the processing of your personal data, you enjoy the following privacy rights:

• Right to withdraw consent: you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before the withdrawal.
• Right of access by the data subject: you can ask for confirmation of whether or not personal data that relates to you is being processed, as well as more clarifications about the information referred to in this information notice. You have the right to request a copy of the personal data undergoing processing.
• Right to rectification: you can request to correct or supplement the data provided to us, if (no longer) inaccurate
• Right to erasure (‘right to be forgotten’): please be aware that in this context certain services will no longer be accessible (e.g. access to the ANDR platform) and/or can no longer be provided if you delete resp. request deletion of certain required personal data
• Right to restriction of processing: you can object to the processing of your data at any time, unless there are legitimate reasons for proceeding with the processing that prevail over yours, for example for the exercise of a right or our defence in court. The aforementioned limitations do not apply where personal data are processed for direct marketing purposes.
• Right to data portability: you can request to receive the data you provided, or to send it to another entity indicated by you, in a commonly used structured format readable by automatic device.
• Right to lodge a complaint: in case you are not satisfied with the way ANDR handled your requests, questions and/or remarks or have any complaints about the way ANDR collects, uses and and/or processes your personal data, note that you have the right to submit a complaint to or appeal on the Belgian Data Protection Authority.

At any time you can exercise your privacy rights towards ANDR by contacting us via email legal@andrmusic.co.

In principle, you can exercise these rights free of charge. In addition, you can always, via your personal account, update, modify and/or verify your personal data, which you were required to submit when creating and/or accessing your account for the first time.

Where and as permitted under applicable law, ANDR may process your contact information for marketing purposes. If you no longer wish to receive newsletters or information about the services and/or products of ANDR, you can unsubscribe at any time by replying to the email containing the newsletter of ANDR.

Security of Personal Data

The security and safety of your personal data is ANDR’s top priority. ANDR implements technical, administrative and physical security measures designed to protect your personal data from (i) unauthorized access or disclosure and (ii) loss, abuse or alteration, including:

• Encryption (TLS 1.2+, AES-256);
• Role-based access control (RBAC) & multi-factor authentication (MFA);
• Regular security audits, backups, and disaster recovery testing.

Updates to This Privacy Policy

ANDR is entitled to update this Privacy Policy by posting a new version on the Website whereby ANDR will indicate the revision date at the top of the first page of this Privacy Policy. As such, it is strongly recommended to regularly consult the Website and the page displaying the Privacy Policy, to make sure that you are aware of any changes. Significant changes will be communicated via email.

Other Websites

The Website may potentially contain hyperlinks to other websites. When you click on one of these links, you may be redirected to another website or internet source that could collect information about you through cookies or other technologies. ANDR does not bear any responsibility, liability or control authority over these other websites or internet resources, nor about their collection, use and disclosure of your personal data. You must check the privacy statements of these other websites and internet sources in order to be able to judge whether they act in accordance with the Privacy Legislation.

Contact ANDR

If you have questions and/or remarks about this Privacy Policy or the manner in which ANDR collects, uses and/or processes your personal data, please contact us:

Via email: legal@andrmusic.co

In case you are not satisfied with the way ANDR handled your questions and/or remarks, you can lodge a complaint with the Belgian Data Protection Authority.