Legal
Privacy policy
Last updated: 23 October 2026
This is a translation provided for convenience. In case of any discrepancy, the Spanish version prevails.
This policy explains how we process your personal data when you use soundacer.com, in accordance with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD).
1. Data controller
- Controller: Sound Strategy Group, S.L. (“Soundacer”)
- Tax ID (NIF): B70879580
- Registered address: Calle de Cadarso, 4, local izquierda, 28008 Madrid, Spain
- Privacy contact: [email]
2. What data we process
- Distribution access application: full name, ID card or passport number, artist name, email, country, link to your music, Instagram or TikTok username, current distributor, how you heard about us, any message you write, the plan you are interested in and whether you agree to receive communications.
- Contact form: name, email, reason and message.
- Technical data for each submission: date and time, IP address and browser, to protect the forms against abuse and to be able to prove that you gave your consent.
- Web analytics: only if you accept analytics cookies (see the cookie policy).
We ask for your identity document number (DNI, NIE, ID card or passport) because, if your application is accepted, the distribution contract is signed electronically and must clearly identify the person signing it. We do not ask for your address or bank details on the website: if your application is accepted, the data needed to pay royalties is collected at that point and the contract itself explains how it is processed.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Reviewing your distribution application, listening to your music and replying to you. | Steps taken at your request prior to entering into a contract (Art. 6(1)(b) GDPR). |
| If your application is accepted, preparing the distribution contract with your full name and identity document and sending it to you for electronic signature. | Pre-contractual steps and performance of the contract (Art. 6(1)(b) GDPR). |
| Answering your enquiry through the contact form or by email. | Your consent (Art. 6(1)(a) GDPR). |
| Sending you Soundacer news, tips and offers by email. | Your consent, which is optional and can be withdrawn at any time (Art. 6(1)(a) GDPR and Art. 21 of the Spanish Information Society Services Act, LSSI). |
| Protecting the forms against spam and abuse. | Legitimate interest in the security of the website (Art. 6(1)(f) GDPR). |
| Keeping proof of your consent. | Legal obligation to be able to demonstrate it (Arts. 6(1)(c) and 7(1) GDPR). |
| Measuring website visits. | Your consent to analytics cookies (Art. 6(1)(a) GDPR and Art. 22(2) LSSI). |
We do not make automated decisions or create profiles with legal effects: every application is reviewed by a person on our A&R team.
4. How long we keep it
- Applications not accepted and enquiries: for as long as needed to reply to you and up to 12 months afterwards, in case you write to us again.
- Accepted applications: they become part of the contractual relationship and are kept for its duration and for the legal periods that follow.
- Marketing communications: until you unsubscribe.
- Proof of consent: 3 years, the limitation period for infringements set out in the LOPDGDD.
5. Who we share it with
We do not sell or share your data with third parties, except where required by law. To provide the service we use providers that process data on our behalf (processors) under contract:
- Web hosting: ProfesionalHosting, with servers in Spain.
- Email: Google (Google Workspace), where we receive applications and reply to them.
- Electronic signature: Docusign, only to sign the contract if your application is accepted.
- Analytics: Google Analytics, only if you accept its cookies.
- Videos: YouTube, only if you click to play a video.
Google and Docusign may process data outside the European Economic Area. In Google’s case, these transfers are covered by the EU-U.S. Data Privacy Framework and the European Commission’s standard contractual clauses; in Docusign’s case, by its binding corporate rules approved by the European data protection authorities.
6. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability, and withdraw your consent at any time (without affecting processing already carried out), by writing to [email] and stating which right you wish to exercise. To unsubscribe from communications you can also use the link included in every email.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the data protection authority of your country.
7. Minors
If you are under 14, please do not send us your data: we need the consent of your parent or guardian. If you are under 18, you can write to us, but signing a distribution contract will require your legal representative.
8. Security
We apply technical and organisational measures to protect your data: encrypted connections (HTTPS), restricted access to applications, backups and protection of the forms against abuse.
9. Changes to this policy
We may update this policy to reflect legal or service changes. The date of the last update is shown above.