Privacy Notice
Version 2026-07-20.v1 · Last updated: 20 July 2026
This notice is issued by Music ("Platform", "we", "us") in accordance with the Digital Personal Data Protection Act 2023 ("DPDP Act") of India and the rules made thereunder. It describes what personal data we collect, why we collect it, how long we retain it, and the rights you may exercise as a Data Principal.
1. Who we are
We operate a licensed-music platform that connects rights-holding vendors with creators. For the purposes of the DPDP Act we are a Data Fiduciary. Our Grievance Officer is reachable at:
Grievance OfficerGrievance Officer
grievances@example.test
Registered office address, India
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email address, phone | Account creation, communication, identity verification | DPDP s.4(1)(a) — consent |
| PAN, GSTIN, bank details | Tax compliance, royalty payments (Income-tax Act s.194J; GST Act) | DPDP s.4(1)(b) — legal obligation |
| Date of birth | Age verification (DPDP s.9 age gate for children under 18) | DPDP s.4(1)(a) — consent |
| Uploaded audio files and associated metadata | Music processing, distribution, rights management | DPDP s.4(1)(a) — consent |
| IP address, user-agent string, session data | Security, fraud prevention, audit trail required by DPDP s.8(5) | DPDP s.4(1)(b) — legal obligation |
3. How long we keep your data
We retain personal data only for as long as the purpose for which it was collected subsists, after which it is erased or anonymised in accordance with DPDP s.8(7). Financial records (PAN, GSTIN, payment history) are retained for the periods mandated by the Income-tax Act 1961 and Companies Act 2013, which may exceed the duration of your active account.
4. Your rights as a Data Principal
- Access (s.11): Request a summary of the personal data we hold about you.
- Correction (s.12): Ask us to correct inaccurate or incomplete data.
- Erasure (s.12 / s.8(7)): Request deletion of your personal data. We will cascade the erasure to our data processors.
- Withdraw consent (s.6(6)): You may withdraw consent at any time. Withdrawal does not affect processing carried out before the withdrawal.
- Grievance redressal (s.13 / s.8(10)): Lodge a complaint with our Grievance Officer. If unsatisfied, you may approach the Data Protection Board of India.
- Nominee (s.14): You may register a nominee to exercise these rights on your behalf in the event of your death or incapacity.
To exercise any of these rights, sign in and visit Account → Privacy requests, or contact the Grievance Officer directly.
5. Children
A "child" under the DPDP Act (s.2(f)) is any individual who has not completed eighteen years of age. Before processing the personal data of a child we will seek verifiable consent from the child's parent or lawful guardian (s.9(1)). We do not carry out behavioural tracking of children (s.9(3)).
6. Security
We implement appropriate technical and organisational safeguards (DPDP s.8(5)). In the event of a personal data breach we will notify the Data Protection Board and each affected Data Principal without undue delay (s.8(6)).
7. Changes to this notice
If we materially change this notice, we will ask for your consent again before continuing to process your data under the new version. The version number above identifies the exact text you accepted.
यह गोपनीयता सूचना हिंदी में भी उपलब्ध है। हिंदी में पढ़ें