Privacy policy

Who is the data controller?

The controller of the data is UNISON RIGHTS OGI, S.L. (hereinafter “UNISON”), with its address at Carrer de Reina Cristina, 9, pral., CP 08003 – Barcelona (Spain), CIF: B-66840612, email: privacy@unisonrights.com, tel. +34 931 43 49 96.

UNISON is an independent management entity for rights in musical works, authorised by management contracts signed with authors and music publishers to manage their rights in accordance with art. 153 of the Spanish Intellectual Property Act and Directive 2014/26/EU.

Applicable legislation

UNISON undertakes to process your data in accordance with:

• REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (GDPR).

• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and the guarantee of digital rights (LOPD).

• Any applicable regulation in force concerning privacy, data protection, transparency and information security.

How we process your data

For what purpose is your data processed?

A – If you are an author, composer, publisher or other rights holder who is a UNISON client

Processing your registration with Unison.

• Contacting you in relation to our contractual relationship.
• Managing our contractual relationship.
• Administering, collecting and distributing your royalties.
• Processing claims.
• Identifying works.
• Verifying works in the process of being identified.
• Managing licences for the use of your works.
• Negotiating, within the objectives of our management and of the management contract signed with you, and in your interest, licences with third parties and agreements with other collective management organisations.
• Invoicing and accounting.
• Sending you information about changes to our security policies.
• Performing a contract, or taking steps connected with a contract.
• Processing and responding to your questions about exercising your rights under applicable data protection law.

B – If you are a user of our website

Processing your enquiries and sending you the information you request.

• Sending you information about changes to our policies.
• Performing a contract, or taking steps connected with a contract.
• Processing and responding to your questions about exercising your rights under applicable data protection law.

C – If you are a user of our repertoire

Processing your user registration with Unison.

• Contacting you in relation to our contractual relationship.
• Managing our contractual relationship.
• Administering, collecting and distributing the royalties from your licences to the rights holders represented by Unison, directly or indirectly.
• Processing claims.
• Identifying works.
• Verifying works in the process of being identified.
• Managing licences for the use of works.
• Managing agreements with other collective management organisations.
• Invoicing and accounting.

What is the legal basis for the processing?

A – If you are an author, composer, publisher or other rights holder who is a UNISON client

Consent.

• Performance of the contract you have signed for UNISON to manage your rights or the rights you represent.
• Entering into and/or performing contracts in your interest.
• UNISON’s legitimate interest.
• The collective management provisions of the Intellectual Property Act.
• Legal obligations.

B – If you are a user of our website

Consent.

• UNISON’s legitimate interest.
• Entering into and/or performing the contract you have signed with Unison.
• Provisions of the Intellectual Property Act.
• Legal obligations.

C – If you are a user of our repertoire

Consent.

• Entering into and performing a contract between the parties.
• UNISON’s legitimate interest.
• The collective management provisions of the Intellectual Property Act.
• Legal obligations.

Who may we share the data with?

A – If you are an author, composer, publisher or other rights holder who is a UNISON client

UNISON employees and collaborators.

• Administrative, political and public entities and authorities, under a legal obligation.
• Judicial entities and authorities, at the request of those authorities or where necessary to perform the contract between the parties.
• Other collective management organisations that work with UNISON.
• Users or potential users of the repertoire managed by UNISON.
• Banks and financial institutions, to manage collections and/or payments.

B – If you are a user of our website

UNISON employees and collaborators.

C – If you are a user of our repertoire

UNISON employees and collaborators.

• UNISON clients.
• Administrative, political and public entities and authorities, under a legal obligation.
• Judicial entities and authorities, at the request of those authorities or where necessary to perform the contract between the parties.
• Other collective management organisations that work with UNISON.
• Banks and financial institutions, to manage collections and/or payments.

How long do we keep your data?

A – If you are an author, composer, publisher or other rights holder who is a UNISON client

• For the duration of our contractual relationship with you and for up to 5 years afterwards (without prejudice to the sections below) for judicial purposes.
• For the periods set by applicable legislation (tax, criminal, and others).
• For the statutory periods to which UNISON is subject in the course of its business activities.
• In certain situations you may be asked to provide, voluntarily, supporting documentation to confirm your identity. Those documents are kept for a period of two years.

B – If you are a user of our website

For as long as is necessary to process your request.

• If you take part in a competition or prize draw we run, the information is kept until the prize has been awarded, up to a maximum period of one year.
• For the applicable statutory periods in the event of disputes.
• For the periods set by applicable legislation (tax, criminal, and others).
• For the statutory periods to which UNISON is subject in the course of its business activities.

C – If you are a user of our repertoire

• For the duration of our contractual relationship with you and for up to 5 years afterwards (without prejudice to the sections below) for judicial purposes.
• For the periods set by applicable legislation (tax, criminal, and others).
• For the statutory periods to which UNISON is subject in the course of its business activities.
• In certain situations you may be asked to provide, voluntarily, supporting documentation to confirm your identity. Those documents are kept for a period of two years.

What rights exist and how are they exercised?

Access

The right to find out what personal data UNISON processes, the purpose for which it is processed, any disclosures made to third parties (where applicable), and the right to obtain a copy of your data or to know the intended retention period.

Rectification

The right to have inaccurate personal data processed by UNISON corrected.

Objection

The right, on certain grounds relating to your particular situation, to have processing of your data stopped to a degree or extent that could cause you harm.

Erasure

The right to request that your personal data be deleted.

Restriction

The right to have processing of your data stopped, with it kept only for the exercise or defence of claims.

Data portability

The right to receive the personal data you have provided to UNISON in a structured, commonly used, machine-readable format, and to transmit it to another controller.

Not to be subject to a decision based on automated processing

The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

How to exercise your rights

The rights of access, rectification, erasure, restriction, portability and objection are strictly personal and must therefore be exercised by the data subject, who must prove their identity. They may nonetheless be exercised through a legal or voluntary representative.

Data subjects may exercise their rights of access, rectification, erasure, portability and objection or restriction of processing by means of a signed letter addressed to UNISON RIGHTS OGI, S.L., Carrer de Reina Cristina, 9, pral., CP 08003 – Barcelona (Spain), or by sending it by email to privacy@unisonrights.com, in either case attaching a copy of the data subject’s identity document.

If a satisfactory response is not obtained, a complaint may be lodged with the Spanish Data Protection Agency, through the forms or other channels available on its website (www.aepd.es).

How do we protect your personal data?

UNISON has implemented appropriate technical and organisational measures to ensure a level of protection appropriate to the risk for the personal data processed, in accordance with data protection law. Measures are in place to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, and the ability to restore the availability of and access to personal data promptly in the event of a physical or technical incident; we have also implemented a process for regularly testing, assessing and evaluating the effectiveness of the technical and organisational measures for ensuring the security of processing.

These measures make it possible to ensure that the technical and organisational means are in place to prevent the loss, misuse, alteration, unauthorised access or copying of the data provided.

They include, among others, segregation of duties through access profiles, network threat monitoring controls, backups, storage in two separate locations, access control mechanisms, network segmentation, procedures and channels for exercising rights, information clauses and a legitimate basis for the processing of data, monitoring of the use of personal data, as well as the use of firewalls and antivirus software and working with companies that offer adequate levels of security.

In the event of a security breach we will notify you and any relevant regulatory body of any suspected breach, as appropriate, in accordance with our legal obligations.

Despite all these measures, it is clear that no security system can guarantee absolute protection.

Special categories of personal data

We will not collect or process any particularly sensitive personal data, or data falling within the special categories of personal data, unless it has been explicitly provided to us. Special categories of personal data refer to information relating to racial or ethnic origin, political opinions, religious or philosophical beliefs or other beliefs of a similar nature, trade union membership, genetic data, biometric data for the sole purpose of identifying a natural person, health data, sex life or sexual orientation.

International transfers

The protection offered by the General Data Protection Regulation travels with the data, which means that the rules protecting personal data continue to apply regardless of where the data ends up.

International data transfers involve a flow of personal data from Spanish territory to recipients established in countries outside the European Economic Area (the countries of the European Union plus Liechtenstein, Iceland and Norway). Controllers and processors may carry out international data transfers without authorisation from the Spanish Data Protection Agency provided that the processing complies with the GDPR.

Given the global nature of our operations, we may transfer your personal data to the United States and to other countries where data protection laws may not be as extensive as those in force in the EU.

Where Unison transfers your personal data outside the European Economic Area, it will only do so where one of the following circumstances applies:

• to a country which, according to the European Commission, has adequate data protection laws; or
• to a company holding a valid and current EU–US “Privacy Shield” certification providing certain standards for the protection of personal data in relation to the category of personal data being transferred; or
• where we have implemented an appropriate mechanism for the transfer of data, for example the EU Standard Contractual Clauses, to ensure that your personal data is adequately protected.

If none of the above criteria is met, Unison will still be entitled to transfer personal data outside the European Economic Area under the situations set out in Article 49 GDPR.

Access to your personal data will be limited to those people who need to know it for one of the purposes described in this Privacy Policy.

Links to other websites

UNISON’s website contains links to other websites that we consider potentially useful and informative for you. Please bear in mind, however, that we do not endorse or recommend the content or services of those websites, nor are we responsible for their privacy policies. We recommend that you take account of and read the privacy policies of every site you visit. Remember that what is set out in this Privacy Policy governs only the data collected and/or processed by UNISON.

Changes to and integrity of our Privacy Policy

We will only use your personal data as set out in the Privacy Policy in force at the time we collect your personal data. UNISON reserves the right to amend this Privacy Policy at any time, publishing such amendments on our website, so we recommend that you visit it each time you access the Privacy Policy. If at any point we decide to use personal data in a way different from that stated at the time it was obtained, we will notify you by email, provided we have one. At that point you will be given the option to authorise other uses or disclosures of the personal data you had provided to us before the amendment to our Privacy Policy.

Should any clause of this Privacy Policy be annulled or considered void, the remaining conditions will not be affected and will retain full validity and effect, in accordance with the applicable regulations in force at any given time.

Date of last update: September 2022.