Privacy statement www.musisum.com

Which uses does this Privacy Statement cover?

This Privacy Statement applies to the processing of personal data in our services, including the use of the Website.

Which (personal) data do we process?

When using the Website, data are processed that we have obtained because you have used our services and/or because you have provided them yourself. In some cases, this data may also be personal data.

This includes personal data such as your name and email address, but also other personal data that you actively provide to us, for example in when registering on the Website, in correspondence or by phone.

We can also collect certain information automatically when you use the Website. For example, your IP address, the date and time you use our services, and information about the hardware and software of your computer or mobile device. This includes general information, such as the operating system, device ID and user ID of your mobile phone, the internet browser used, application versions and your language settings. For mobile devices, we may collect device-specific settings and features, application crashes and other system activity.

We can also use data (including emaildresses) that might contain personal data that we receive from artist/ or Bands to inform you on their behalf.

We also collect (anonymised) information on how you use the Website on the and which pages are displayed.

If you opt to connect social media accounts or other services like Spotify etc. we may get access to some of your (profile) data.

In addition, when you follow us on social media, we may get access to some of your (profile) data. The same applies when you "like" certain posts from us. We can also like social media channels ourselves and thus access data about you.

For what purposes do we process personal data?

Musisum may process (personal) data for the following purposes:

• to perform an agreement: This includes, for example, providing our services or providing certain information. That includes sending updates about artists ofr band you are following, answering requested by you and answering (helpdesk) questions. This may also include accounting purposes, such as payment processing, billing, auditing, payment card verification etc. We may also contact you by email from time to time for administrative or operational purposes, such as in the case of a service message;
• to keep you informed of our latest news and products and services, or suggest bands and artists you might be interested in: we may inform you of interesting news, send invitations to follow bands or artists and inform you about products and services of Musisum. This could be through a recommendation in our Website, or through a newsletter, email, etc. We give you the option to unsubscribe with every newsletter. For push notifications, you can switch them off in the mobile app and/or via your mobile phone's settings;
• to inform you about personalised offers: If you have given your consent, we can make personalised offers based on your interests and behaviour. You can withdraw this consent at any time;
• To improve our services: We may also use personal data for statistical or analytical purposes and to improve our services. Think of measuring visits to our website, or reach of certain posts via social media etc. We use this data for testing and troubleshooting, and to generate statistics about our services and reach. The main purpose is to understand how our services perform, how they are used, and ultimately to optimise, adjust and improve our services, making them easier and more meaningful to use. We aim to use anonymous or pseudonymous data as much as possible;
• to comply with legal obligations and to satisfy our legitimate interests: e.g. debt collection, fraud screening, mandatory checking of IP address ranges in connection with certain limited rights with respect to geo-restricitons, safety, security and legal purposes, such as handling disputes and complying with applicable laws and regulations).

We base these processing operations on the basis that the processing of personal data is necessary for the performance of an agreement, for instance if you apply as a "fan" and you want to stay updated on information of your favorite artist and bands, we can use your personal data to this end. If you sign up as an artist, we can use your personal data to fulfil the terms of our contract. This includes providing updates about your social media profile and updating your artist page.

In addition, we base ourselves on legitimate business interests to (be able to) offer news about artist and bands, analyze, improve our services and prevent fraud. When personal data are used for these legitimate interests, we will always balance the rights and interests relating to the protection of your personal data against ours.

For complying with legal obligations, we base such processing on the basis of complying with legal obligations (such as legal enforcement requests).

Finally, we use your consent as the basis for processing personal data, for example when processing data for the purpose of providing personalised offers. Here, it applies that this consent can be freely withdrawn again at any time. The withdrawal of consent does not affect the lawfulness of the processing of personal data prior to the withdrawal of consent.

Do we share your data with third parties?

Insofar as we share personal data with other parties, we have made agreements with them, for example in the form of a processing agreement. Our agreements include the manner in which the data is shared, and stipulate that these third parties are obliged to adequately protect the personal data.

For example, we may provide personal data to third parties because:

• we have engaged them to process certain data;
• it is necessary in order to perform the agreement with you;
• you have given your consent to this;
• we have a legitimate interest in doing so;
• we are required to do so by law (e.g. if the police demand it in case of suspected crime).

Parties that may process personal data are:

• Cookie suppliers (see further information on cookies below);
• IT suppliers and service providers;
• (customer) service providers (for other information see below).

We additionally disclose personal data to law enforcement authorities to the extent required by law or strictly necessary for the prevention, detection or prosecution of crimes and fraud, or if we are otherwise required to do so by law. It may be necessary to further disclose personal data to competent authorities to protect and safeguard our rights or property or the rights and properties of our business partners.

Which party do we work with to process payments?

We use the services of payment provider Stripe for processing payments. If you use the services of Stripe, it may process (personal) data, such as your name, your bank account number and the name of your bank. More information on the processing of personal data by Stripe can be found at https://stripe.com/nl/privacy. Here you can find information on retention periods, and your rights as a data subject as well as how to exercise those rights.

How do we handle data when you contact customer service?

We use the services of LYRO AI Agent (http://www.tidio.com/) to register, resolve and analyze questions, comments and complaints about our Website.

What cookies or similar techniques do we use?

The Website uses so-called cookies and similar techniques. You can opt out of cookies by setting your internet browser so that it no longer stores cookies. You can also delete all previously stored information via your browser settings.

More information, including an overview of which cookies we use, can be found in our cookie statement https://musisum.com/cookie-policy

Transfer of personal data outside the European Economic Area

Your personal data may be transferred to a country outside the European Economic Area (EEA) that provides a lower level of protection for personal data than the legislation in the EEA. For example, a provider of online services located outside the EEA, or a party using servers located outside the EEA (e.g. in the United States of America) may be used. If such a situation arises and personal data is transferred to a country outside the EEA that provides less legal protection to personal data, we will provide appropriate safeguards to ensure that the transfer takes place in accordance with applicable privacy laws This means, for example, that we use a model agreement from the European Commission or make arrangements for handling personal data.

How do we secure personal data?

Musisum takes the protection of your data seriously and takes appropriate measures to counter abuse, loss, unauthorised access, unwanted disclosure and unauthorised modification. If you have the impression that your data is not properly secured or there are indications of misuse, please contact us at privacy@musisum.com. If we detect a data breach, we will report it to the Dutch Personal Data Authority. In addition, if necessary, we will contact the data subject(s) within the statutory time limits.

How long do we keep your data?

Musisum retains your personal data for as long as necessary for the above processing purposes or to comply with its legal obligations.

For example, if you have placed an order, we will retain the information until the order is completed and seven years thereafter (the statutory retention period). When we receive contact information from parties other than you, such as emails from artists or bands to contact you with offers on their behalf, we delete the contact information when it is no longer needed. For example, in the case of invitations to follow a band or artist, we delete all contact information after the invitations have been sent.

Data you have entered on the Website, we keep it for as long as we need it to provide the requested service.

Changes to the Privacy Statement

This Privacy Statement may be amended. In that case, we will publish the amended statement on our website, after which this Privacy Statement will be effective immediately. The latest update is listed at the bottom of this statement.

What about your rights regarding your personal data?

You have a number of rights to keep control over your personal data, for example:

• The right to ask whether or not personal data relating to you is processed and, if so, to access it;
• The right to request rectification and/or deletion of such data;
• The right to object to processing or request restriction of processing;
• The right to withdraw consent to processing, if the processing is based on consent;
• The right to receive or have your data transferred in the context of so-called data portability.

A full overview of your rights can be found on a dedicated page on the website of the

Should you wish to make such a request, you can always contact us at privacy@musisum.com.

Questions or complaints

If you have a question about how we handle personal data, please contact us by sending an email to privacy@musisum.com.

On the basis of the GDPR, you also have the right to lodge a complaint with the Dutch Data Protection Authority (AP) about how we handle your personal data. More information can be found on the website of the Dutch Data authority at https://www.autoriteitpersoonsgegevens.nl/en.

Contact details

With questions or complaints regarding the use of your personal data, you can send an email to privacy@musisum.com or reach us in writing at the following address:

Musisum B.V.
Energiestraat 11B
1411AP Naarden
The Netherlands