Privacy Policy

2. How Does Symphonic Collect Your Personal Information?

Symphonic collects personal information in different ways depending on how you use and interact with us and our Services. We may collect the information discussed above through different methods, including, but not limited to, any of the following ways:

• Your interactions with us. We collect most of your personal information directly from you, for example when you register for an account, apply for Services, use our Services, make a purchase, participate in surveys, or contact us; when you submit a customer support request, fill out an inquiry form, initiate a data subject rights request, or sign up for a newsletter or an event; when you enter information within your SymphonicMS account; when you apply for our bona fide loyalty programs or financial incentive programs; when you apply for employment; when you submit a claim; when you perform a search using our search engine; or when you submit a comment or review of a product or service or provide feedback (Note: Forums, message boards, posts, blogs, news groups and/or other areas of public communication may be available to you through the Services. Any information you post in these areas may become public and known to third parties outside of Symphonic who are not subject of the terms of this Policy. If you post personal information online that is accessible to the public, you may receive unsolicited responses. You should exercise caution when deciding to disclose information in a public forum, including within our Services, as it may be misused or abused by third parties).
• Automated technologies. We may also collect personal information automatically through tracking tools such as beacons, pixels and Cookies.
• From third parties or publicly available sources, such as vendors, business partners and/or social media platforms.

We may also collect and/or generate anonymized and aggregated information when you use the Services. We may use or share such information with third parties for research, analytics and/or other commercial purposes.

3. How and Why Does Symphonic Use Your Personal Information?

The table below explains the purposes we use your personal information for and why. It sets out the ‘lawful basis’ (i.e., a proper reason) we rely on for processing that personal information which is a requirement under certain data protection laws, including in the UK/EU. Our processing basis is further explained in Sections 14-16 of this Policy.

4. Cookies

Please see our Cookie Policy for further details.

5. Opt-Out

Targeted Advertising, “Sharing,” and “Selling”

As described in our Cookie Policy, we have incorporated Cookies from certain third parties into our Services. These Cookies allow those third parties to receive information about your activity on our Services that is associated with your browser or device. Those third parties may use that data to serve you relevant ads on our Services or on other websites you visit. Under certain U.S. privacy laws, you may have the option to opt out from the sharing your data through third party Cookies for targeted advertising or cross-contextual behavioral advertising (“Sharing”) of your Personal information. In some states, such Sharing may also be deemed “selling.” Please note that we do not sell personal information for monetary consideration.

You have the right to opt-out of the Sharing of your personal information for the purposes of targeted advertising and the “sale” of your personal information. You can opt-out using the following methods:

• By implementing the Global Privacy Control or similar control that is legally recognized by a government agency or industry standard and that complies with the applicable law. The signal issued by the control must be initiated by your browser and applies to the specific device and browser you use at the time you cast the signal. Please note this does not include Do Not Track signals.
• By contacting us at privacy@symdistro.com.

Automated Decisions

We may  use various applications to present interview questions and prompts for further consideration and processing of your submission.  You have the right to opt-out from the processing of your personal information for the purposes of profiling in furtherance of decisions that produce legal or similarly significant effects to you, if applicable.

You may exercise these rights by contacting Symphonic via e-mail at privacy@symdistro.com or, to the extent applicable, by checking the appropriate box on the online form or clicking the unsubscribe link in the email. Please note, however, that the collection and use of certain information as set forth herein is required for Symphonic to provide access and/or use of the Symphonic Services.  Further note that Symphonic’s access to and/or use and processing of such information is necessary and required for Symphonic to provide access to and/or use of Services, including services for which you may have contracted with Symphonic to provide to you. Further note that we may also still need to send you certain communications regarding the operation and administration of the Services, and you will not be able to opt out of those communications, for example, communications regarding updates to this Policy and other information which Symphonic is required to provide to you by applicable law.

6. Links to Third-Party Websites

Symphonic may display links to third party websites, including social media sites that we do not own or operate. We provide links to these third-party sites as a convenience to you. They are not intended as an endorsement of or referral to the linked sites or services. The linked sites and services are subject to their separate and independent privacy statements, notices, and terms. Please read their privacy policies carefully to find out how they collect and process your personal information prior to submitting any personal information via such third-party websites. The collection, use, and disclosure of your personal information on third party sites will be subject to the privacy policies of the third party and not Symphonic’s Policy. We cannot control or be held responsible for the data collection, privacy, and information sharing policies and procedures or content of third parties.

7. Data Retention

We retain your information in our server logs, our databases and our records for as long as necessary considering the purposes set out in this Policy, subject to any legal obligations to further retain such information. We may use third party service providers to store and maintain such data. We retain your verification-related information for a reasonable period, even if you do not complete all verification steps, to assist with future verifications and to prevent abuse of our verification processes and for other purposes as set forth herein. If you decide not to verify the account and would like us to delete the verification information you provided, please contact us via e-mail at privacy@symdistro.com. We may retain information that no longer identifies you indefinitely.

8. Data Transfer

Where we share your personal information with third parties we do so in line with this Policy and in compliance with data protection laws. We may share personal information that we collect with:

• Vendors and service providers, who perform services on our behalf, including our payment processing partner, Tipalti; identify verification partner, Idenfy; analytics providers such as Google; and advertising partners such as Google and Facebook.
• To third parties as part of a business transfer, to facilitate a merger, acquisition, or other conveyance of some or all the assets of Symphonic.
• Law enforcement agencies or regulatory bodies, to comply with the law and legal requirements.

Symphonic is headquartered in Tampa, Florida in the United States. The information we collect from you will be transferred to, stored, and processed in the United States. It may be transferred to and/or stored in other countries where our service providers maintain facilities as well. When Symphonic transfers your information from outside of the United States, we will strive to ensure that your information is processed as securely as feasible and that your rights continue to be protected. Please see a description of our safeguards or international transfers under Sections 14-16 below.

9. Data Security

The security of the information you provide to Symphonic is important to us. We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and after receipt, including against unauthorized or unlawful access and accidental loss, destruction or damage. Unfortunately, no data transmission over the Internet or storage of information can be guaranteed to be 100% secure. As a result, while we strive to protect your information, we cannot ensure or warrant the security of any information that you transmit to us, and you do so at your own risk.

10. Children’s Privacy

We do not knowingly collect or attempt to collect any personal information from children under the age of eighteen (18) years old. If you become aware that we have collected personal information from a child, please contact us immediately via email at privacy@symdistro.com. For more information on how to protect the privacy of children online, visit www.OnGuardOnline.gov.

11. Changes to this Policy

We may amend this Policy at any time and, as such, we encourage you to periodically review this page for the latest information on our privacy practices. If we make a material change to this Policy, we will send an email to users who have provided an email address or post a notice on our Service prior to the change becoming effective. We encourage you to review this Policy periodically to remain informed of how we use and protect your information, and to be aware of any Policy changes.

12.  Data Privacy Laws Vary by Territory

Please note that data privacy requirements vary within the United States from State to State, and broadly outside of the United States.  Consumer data privacy laws are being passed and revised both nationally and internationally on an ongoing basis.  We encourage you to consult the applicable data privacy laws in your location, and to contact privacy@symdistro.com should you have any questions or concerns as to our Policy compliance in your particular location.  Following are some additional comments and disclosures regarding certain States and international territories:

13. State Specific Privacy Rights

California, Virginia, Colorado, Connecticut, Texas and Nebraska have each adopted laws (respectively, CCPA (as amended by the CPRA), VCDPA, CPA, CTDPA, TDPSA, and NEDPA) that give consumers located in those States certain rights including:

• Access: You have the right to request confirmation of or access to the personal information that we process about you. You can also request access to a portable copy of your personal information.
• Deletion: You have the right to request that we delete the personal information that we have collected about you.
• Correction: You have the right to request that we correct any inaccurate personal information we have collected about you.
• Portability: You have the right to request a copy of your personal information in a machine-readable format, to the extent technically feasible.

For more information on your rights and how to exercise them concerning these State specific Privacy Acts, please refer to the following links: CCPA, VCDPA, CPA, CTDPA, TDPSA, NEDPA.

If you would like to exercise any of these rights, please contact us via email to privacy@symdistro.com . Please note that we may take steps to verify your identity to enable us to respond to your request.

You may also be able to modify, correct, change, or update your personal record or cause your personal record to be removed from Symphonic’s database by clicking on “Edit Profile” located within your control panel in SymphonicMS. Provided, however, we may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. If we deny your request, we will explain why your request was denied and how to appeal our decision, as required by applicable law. After receiving our explanation, if you would like to appeal our decision, you may do so as further detailed in our communication back to you. An example would be where you request deletion of data for which Symphonic is required by law to retain records to comply with applicable law. We may also decline requests if accepting such request would compromise Symphonic’s legitimate use of the data for fraud prevention and/or other security purposes, such as if you request the deletion of an account that is being investigated for security issues.  Other reasons why your privacy request may be denied include if it jeopardizes the privacy of others, if it is frivolous or onerous, or is extremely impractical.

Anti-Discrimination
We will not discriminate against you for exercising your rights under applicable privacy laws. We will not deny you our goods or services, charge you different prices or rates, or provide you a lower quality of goods and services if you exercise your rights under applicable privacy laws. However, we may offer different tiers of our Services as allowed by applicable data privacy laws with varying prices, rates or levels of quality of the goods or services you receive related to the value of Personal information that we receive from you.

Appeal

If we refuse to take action on a request within a reasonable period of time after receiving your request in accordance with this section, you may appeal our decision. In such appeal, you must (1) provide sufficient information to allow us to verify that you are the person about whom the original request pertains and to identify the original request, and (2) provide a description of the basis of your appeal.

You may appeal a decision by contacting us at: privacy@symdistro.com (title must include “Privacy Rights Appeal”)

Please note that your appeal will be subject to your rights and obligations afforded to you under the applicable privacy law. We will respond to your appeal within the timer period required by applicable privacy law.

As permitted by law or to provide our Services, we do not delete data we use to: (i) complete transactions requiring data such as billing information or transaction histories; (ii) respond to customer support inquiries; (iii) detect and prevent security incidents, identify, and repair errors that impair functionality of our Services (e.g., log files, error diagnostics); and (iv) comply with legal obligations.

In the event that you consider our processing of data related to your use of the Services not to be compliant with the applicable data protection laws, you can contact us at privacy@symdistro.com or lodge a complaint with the relevant data protection authority.

Additional California Resident Rights

California consumers have the right to request that we limit the use or sharing disclosure of their sensitive personal information. However, since we only process your sensitive personal information for the permitted purposes under Section 7027(m) of the CCPA Regulations and we do not infer characteristics from your sensitive personal information, we do not offer a way for you to submit such a request.

Please also see the California Notice at Collection here.

14. General Data Protection Regulation (GDPR) Notice

Regulation (EU) 2016/679 (“GDPR”) applies to the processing of data of citizens in the UK, European Union (EU)and European Economic Area (EEA).

Please note that for the purposes of the GDPR the data controller is Symphonic Distribution, Inc., who can be contacted at privacy@symdistro.com.

International Transfer: Where we transfer your personal information outside of the UK/EU/EEA, we will always ensure it is protected by reasonable safeguards, including (but not limited to) only transferring personal data to countries that have been deemed by the Information Commissioner or European Commission to provide an adequate level of protection, or by using specific contractual protections. The appropriate cross-border transfer method governing personal information included in such transfers is the EU Standard Contractual Clauses agreement pursuant to EC Decision 2010/87/EU (and as applied by the UK by way of the International Data Transfer Addendum to such clauses).

Processing Basis: The law requires us to have a lawful basis for collecting and using your personal information. Our processing of your personal information in order to provide you with the Services will typically be based on one of the following processing bases: (i) because you have provided us with your specific, informed, freely-given, and unambiguous consent, which you can remove at any time by contacting us at privacy@symdistro.com; (ii) performance of a contract, because we need to process it in order to provide you with the Services or a particular feature of the Services;; (iii) because the processing is necessary for the purposes of the legitimate interests pursued either by us or by a third party and such legitimate interests are not overridden by your privacy and related rights as an individual. Our legitimate interests include the provision of digital music distribution services, including the Services; or (iv) we may use your personal information where it is necessary for compliance with a legal obligation that we are subject to. Please see the table above in Section 3 which explains what we use your personal information for and why.

Questions/Concerns: Should you wish to raise a concern about our use of your information (and without prejudice to any other rights you may have), you have the right to do so with your local data protection authority.  Additionally, you may contact us regarding such concerns via email at privacy@symdistro.com.

If you are a user residing in the UK/EU/EEA, you may exercise any of the rights described in this section by contacting us at privacy@symdistro.com. Some of these rights apply generally, while others will only apply in certain circumstances. Please note that we may ask you to verify your identity before taking further action on your request. For all rights, we usually act on requests and provide information free of charge, but, where allowed under the law, we may charge a reasonable fee to cover our administrative costs of providing the information for baseless or excessive/repeated requests, or further copies of the same information. Alternatively, we may be entitled to refuse to act on the request in some circumstances. We’ll try to respond as soon as we can.

• Information – You have the right to be provided with clear, transparent, and easily understandable information about how we use your information and your rights, which is why we are providing you with this Policy.
• Data Access – You may be entitled to request copies of your personal information held by us and to check that we are lawfully processing it (this is commonly known as a “data subject access request”).
• Data Portability –You may also be entitled to request copies of personal information you have provided to us in a structured, commonly used, machine-readable format so that you can reuse it for your own purposes across different services.
• Change or Correct Data (Rectification) – You have the right to correct, change, update, complete or rectify your personal information.
• Data Deletion (Erasure) – This is also known as the ‘right to be forgotten’ and you have the right to ask us to delete all or some of the personal information we hold about you where there is no compelling reason for us to keep using it. If you have an account, you can also delete your account through the Settings at any time as described below. We may need to retain some of your personal information even after you have closed your account if reasonably necessary to comply with our legal obligations.
• Objection to Processing – You have the right to object to processing your personal information on grounds relating to your particular situation at any time (in particular, where we don’t have to process the personal information to meet a contractual or other legal requirement, or where we are using the personal information on the basis of our legitimate interests). If you object to such processing, Symphonic will no longer process your personal information for these purposes unless we can demonstrate compelling legitimate grounds for such processing or such processing is required for the establishment, exercise or defense of legal claims or obligations. Where your personal information is processed for direct marketing purposes, you have the right to object to such processing of your personal information at any time and ask Symphonic to cease processing your data for these direct marketing purposes. However, please be aware that any objection to processing will not necessarily have an impact on the personal information processing before such objection was made, thus such processing will generally be deemed as permissible and will be subject to the usual retention and deletion periods.
• Restriction of Processing – You have the right to ‘block’ or suppress further use  of your personal information where one of the following applies: your personal information is not accurate anymore; the processing is unlawful and instead of erasing the personal information you request the restriction of use; the personal information is no longer needed by us but required by you for the establishment, exercise or defense of legal claims; you have objected to the use and the decision on the legitimate grounds for objection is pending. When processing is restricted, we can still store your information, but may not use it further.
• Withdrawing Consent – Where you provide consent to the processing of your personal information by Symphonic, you may withdraw your consent at any time by sending a communication to Symphonic specifying the specific consent you are withdrawing. Please note that the withdrawal of your consent does not affect the lawfulness of any processing activities based on such consent before its withdrawal.
• Lodging Complaints – You have the right to lodge complaints about the data processing activities carried out by Symphonic before a competent data protection authority. A list of EU data protection authorities is available here.

15. Lei Geral de Proteção de Dados Pessoais (LGPD) Notice

LGPD applies to the data processing of individuals located in Brazil.

For the purposes of LGPD the data controller is Symphonic Distribution, Inc., which may be contacted at privacy@symdistro.com.

Disclosures:  The LGPD requires certain disclosures that are already covered in this Policy including the purposes of the processing of your personal information, the type and duration of the processing, information regarding the shared use of the data by the controller and the purpose, responsibilities of the agents that will carry out the processing, and an explanation of the data subject rights.  You may inquire with Symphonic (the data controller) should you need further clarification of any such disclosures contained herein.

Requests: The LGPD allows you to make certain requests concerning your personal information such as confirming the existence of processing; correcting incomplete, inaccurate, or out-of-date data; anonymization, blocking, or deletion of unnecessary or excessive data or data processed in non-compliance with the provisions of LPGD; data portability; deletion of personal information (subject to certain exceptions); information about public and private entities with which the controller has shared data; information about the possibility of denying consent and the consequences of such denial; and revocation of consent. You can make such requests, subject to the provisions hereof, by contacting us at privacy@symdistro.com.

International Transfers: If you are located where LGPD applies, information we collect (including through cookies) will be processed and stored in the United States. The appropriate cross-border transfer method governing personal information included in such transfers is the EU Standard Contractual Clauses agreement pursuant to EC Decision 2010/87/EU.

Processing Basis: Our processing of your personal information to provide you with the Services will typically be based on one of the following processing bases (pursuant to Article 7 LGPD):

• Because you have provided us with your specific, informed, freely given, and unambiguous consent; or
• Because the processing is necessary for the purposes of the legitimate interests pursued either by us or by a third party and such legitimate interests are not overridden by your privacy and related rights as an individual. Our legitimate interests include the provision of digital music distribution services, including the Services.

Exemptions:  LGPD exempts the processing of personal information in some instances such as for journalistic and artistic purposes or processing that is done exclusively for public safety, national defense, state security, or activities of investigation and prosecution of criminal offenses (which processing is subject to separate obligations).

16. Korean Personal Information Protection Act (Korean PIPA) Notice

Korean PIPA applies to data processing of individuals located in Korea.

For the purposes of Korean PIPA, the data controller is Symphonic Distribution, Inc., which may be contacted at privacy@symdistro.com for questions, clarification, and any disputes or claims concerning your data privacy and personal information. Symphonic has designated Trust & Safety team members as well as designated Data Privacy response team members who may be reached at the e-mail addressed provided.

Disclosures:  Korean PIPA requires certain disclosures that are already covered in this Policy including the purpose for which the personal information is collected and processed; the period for processing and retaining the information; the scope of provision of personal information to third parties; outsourcing of personal information processing; the rights of the individuals for whom such personal information is collected and processed; and installation and operation of automatic collection tools.  You may inquire with Symphonic (the data controller) at the e-mail address provided should you need further clarification or additional information as to any such disclosures already contained herein.

Rights/Requests:  Pursuant to Korean PIPA, you have the right to be informed of the processing of your personal information, the right to determine whether or not to content and the scope of such consent, the right to confirm whether or not personal information is being processed (including requesting copies of same); the right to suspend processing of your personal information; the right to request correction, deletion and destruction of such personal information; and the right to appropriate redress through timely and fair procedures.  You can make such inquires and requests, subject to the provisions hereof and /applicable law, by contacting us at privacy@symdistro.com and/or as outlined in the Korean PIPA Enforcement Decree.

Processing Basis:  Symphonic collects, retains and uses personal information as necessary to provide the Services; by consent; to comply with legal responsibilities; to resolve disputes; in the interests of the individual from whom such information is collected; as a matter of public interest; in the legitimate business purposes of Symphonic; and to perform contracts, among other things, in accordance with applicable law.

Data Retention:  Symphonic adheres to the data retention processes as described herein.  Symphonic will not store your personal information for a reasonable amount of time from the date of your last interaction with the Services, unless otherwise required by applicable law. We may retain information that no longer identifies you indefinitely.

International Transfers:  If you are located where Korean PIPA and related laws and regulations apply, information we collect (including through cookies) will be processed and stored in the United States. The appropriate cross-border transfer method governing personal information included in such transfers is the EU Standard Contractual Clauses agreement pursuant to EC Decision 2010/87/EU.

Symphonic may share data with third-party service providers and partners outside of Korea as described and for the purposes stated herein.  Additional information concerning such third-party service providers and partners in our Cookie Policy. Any additional questions or concerns regarding such third-party service providers may be directed to privacy@symdistro.com.

17. US Users Only: Notice of Bona Fide Loyalty Program

Based on your commercial activity, use of our Services, and other factors, we may offer you various bona fide loyalty program benefits (as defined by Colorado law) such as discounts, comped services, and other special offers in connection with the collection or use of personal information.  You can join (opt-in to) loyalty programs and find program details, and terms and conditions at the time you sign up and register.  You may withdraw (opt-out) from receiving such financial incentives at any time by contacting us at privacy@symdistro.com or otherwise by following the instructions provided to you at the time you sign up. Such loyalty program benefits offered are reasonably related to the value of a consumer’s data including your commercial activities. We calculate the value of a member’s data based on various factors, including the member’s commercial activities and the expenses related to the offer, provision, or imposition of the program benefits to such member.

We will not discriminate against you because you made any of these requests.

18. Questions or Comments

If you have any questions or comments regarding this Policy, please email us at privacy@symdistro.com.