ABOUT CONCORD Privacy Policy | Terms © 2021 Concord SUBSCRIBE Concord - Privacy Policy Last updated: July 15, 2021 Concord cares about your privacy. To better protect your privacy, this privacy policy explains how Concord Music Group, Inc. and its affiliates (collectively, “Concord” or “we,” “us” and “our”) collect and use personal information we collect from you or you provide to us through our websites, emails, and other means described here (“Sites”). Personal information – or “personal data” in other jurisdictions like the EU – is information that identifies you as an individual, including, but not limited to, your name, address, email address, or telephone number. Information collected on the Sites may be used in the manner described below by Concord, our labels, our publishing companies, agents, subsidiaries and trusted partners acting on our behalf, including artists and artist management. This privacy policy does not address, and we are not responsible for, the privacy practices of any third party, including Facebook, Inc., Google LLC, our artists or their management, or financial partners. HOW WE PROCESS YOUR PERSONAL INFORMATION TRACKING TECHNOLOGIES / COOKIES HOW WE SHARE YOUR INFORMATION WHERE WE STORE YOUR PERSONAL INFORMATION LINKS TO THIRD PARTY WEBSITES AND THE INTERNET COMMUNITY FUNCTIONS CHILDREN YOUR RIGHTS YOUR CALIFORNIA PRIVACY RIGHTS YOUR NEVADA PRIVACY RIGHTS CHANGES TO OUR PRIVACY POLICY USERS OF SITES IN THE EUROPEAN UNION/EUROPEAN ECONOMIC AREA CONTACT US 1. HOW WE COLLECT AND PROCESS YOUR PERSONAL INFORMATION We collect and process your personal information for the following purposes. Please note that you are responsible for keeping your information current and up-to-date. You may update your information by contacting us as described in the CONTACT US section below. (a) Participation in special activities. We collect and process your personal information when you register with us as part of your participation in our promotions, contests or sweepstakes. As part of your registration for the promotion, we may request the following (as required from case to case): personal information (such as your name, address, email address, telephone number and birth date), demographic information (such as country and gender) and profile data (such as your music preferences and entertainment practices). (b) Newsletters. We collect and process your email address that you provide us with to receive updates on a particular artist or type of music. We then add that address to the email list for that artist or type of music. You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails, accessing the email preferences in your account settings page or you can contact us as described in the CONTACT US section below. (c) Product purchase. If retail opportunities, e.g. in online stores, are available and you choose to buy any of our products, we will collect and process your name, address, email address, telephone number, and order details, and may collect your birth date. Additionally, our financial partners involved in the processing of your banking or credit card data will collect and process the following additional personal information in order to complete your transaction: price, credit card number or other payment information and billing address as well as any further details on the purchase transaction. (d) Website registration. We collect and process your login details if you choose to register a website user name and/or password so that we can communicate with you, provide the services you have requested and to provide a more personalized experience on our website. You are not required to provide us with this information, but if you choose not to do so, you may not be able to participate in some of the activities on our website. In addition to this, we will process all information you provide to us when you use our services as a registered user and also your usage data (e.g. login times, length of stay). (e) Contact us. When you CONTACT US by phone, email or otherwise to submit information to us (such as when contacting us with a question or feedback), we collect and process the information you provide to us, e.g. your name, email address, telephone number and request, to respond to your inquiry. (f) Job application. We collect and process your personal information such as name, address, email address, birth date, work experience, education and other related information you submit to review, verify and evaluate your job application information if you have applied for a job at Concord. (g) Updates concerning us. If you are a registered user, we collect and process your email address in order to keep you informed about the operation of our services by sending emails and announcements that are needed for the proper functioning and administration of our Sites and services. 2. TRACKING TECHNOLOGIES / COOKIES Our Sites have features that automatically collect information from you to assist us in creating Sites that honor your preferences and serve your needs, allow us to improve our Sites and provide you with tailored advertising. In certain instances, our Sites use cookies, which are small data files containing information about you that are stored on your hard drive. Cookies are embedded in the HTTP information that travels back and forth between your computer and the servers. Cookies allow automated customer customization and personalization, and, for example, cookies may be utilized to assure that a sweepstake’s applicant enters any given sweepstakes only once or to store session preferences. (a) We use the following cookies on our Sites: Functionality cookies. These are used to recognize you when you return to our Sites in order to improve your experience on our Sites, allowing us to personalize our content for you. Examples of functionality cookies used may include, but not be limited to: • mid • mcd • vuid • csrftoken Strictly necessary cookies. These cookies are essential for the operation of our Sites and include, for example, cookies that enable you to browse our Sites and use its features and to maintain secure areas of our Sites. We use these cookies based on our legitimate interest to provide you with functioning and secure Sites. Examples of strictly necessary cookies used may include, but not be limited to: • __cfduid • cart_ts • secure_customer_sig • cart_sig • OptanonConsent • OptanonAlertBoxClosed • _dc_gtm_UA-100981624-1 • checkout_token • _orig_referrer Analytical/performance cookies. These cookies collect anonymous information about how you use our Sites, for example how you arrived at our Sites and which pages you visit most often. This helps us to improve the way our Sites work, for example, by ensuring that users are finding what they are looking for easily. These cookies are sometimes placed by third-party providers of web traffic analysis services, such as Google Analytics. We use these cookies only if you have consented via the cookie banner. Examples of analytical/performance cookies used may include, but not be limited to: • _gid • __utma • _gat_UA-nnnnnnn-nn • _shopify_y • _s • _shopify_s • _shopify_sa_p • _y • _ga • __utmz • _gat_UA-100981624-1 • __utmt • _shopify_fs • _shopify_sa_t • _landing_page • __utmc • __utmb • _ga_ga Targeting cookies. These cookies record your visit to our Sites, the pages you have visited and the links you have followed. These cookies are usually placed by third-party advertising networks. They remember the other websites you visit, and this information is shared with third-party organizations, for example advertisers (including Sumo, Facebook, Twitter, Google and Spotify). We use these cookies only if you have consented via the cookie banner. Examples of targeting cookies used may include, but not be limited to: • __smVID • _fbp • datr • sp_t • lu • fr • _gid • auth_token • APISID • SSID • sp_key • metrics_token • _ga • _gat_gtag_UA_5784146_31 • anj • wp_refresh_token • lu • lang • sp_dc • wp_expiration • sc_anonymous_id • sp_key • twll • UID • sp_landing • secure_session • sp_ab • guest_id • __utma • __smSessionId • uuid2 • IDE • personalization_id • SID • SAPISID • sp_landing • anj • remember_checked • fr • wp_expires_in • test_cookie • remember_checked_on • wp_sso_token • id • UIDR • wp_expiration • wp_sso_token • tfw_exp • IDE • HSID • wp_access_token • _ga • sp_ab • wp_access_token • _gid • uid (b) Social Media plugins: We use so-called social plugins, e.g. “like buttons,” on our Sites. These are services that are provided by social media organizations such as Facebook, Instagram, Twitter and others. If you access a page of the Site that contains such a plug-in, your browser establishes a direct connection to the social media provider’s servers. Via the plugins, the providers receive the information that you have visited our Sites even if you do not have a profile or are not currently logged in. This information (including your IP address) will be transferred from your browser directly to a server of the respective provider in the USA and stored there. If you are logged in to one of the social media services, the providers may allocate your visit of the Sites to your account with them. Interactions with plug-ins like the “like button” are sent directly to the providers’ servers and stored there. The information is also stored in the social network and published on your account. The purpose and scope of the data collection and the further processing of your data by the providers as well as your relevant rights and setting options for the protection of your privacy can be found in the privacy notices of the providers. Below, please find more details on the social plugins we use: Facebook is operated by Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA. An overview of Facebook plugins and their appearance can be found here: https://developers.facebook.com/docs/plugins Twitter is operated by Twitter Inc, 1355 Market St, Suite 900, San Francisco, CA 94103, USA. An overview of the Twitter buttons and their appearance can be found here: https://about.twitter.com/en_us/company/brand-resources.html Instagram is operated by Instagram LLC, 1601 Willow Road, Menlo Park, CA 94025, USA. An overview of the Instagram buttons and their appearance can be found here: https://help.instagram.com Tumblr is operated by Tumblr, Inc., 770 Broadway, New York, NY, 10003, USA. An overview of the Tumblr buttons and their appearance can be found here: https://www.tumblr.com/buttons Google+ is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. An overview of Google’s logos including the Google+ logo can be found here: https://www.google.com/permissions/trademark/logos-list.html You can find more information under the following link: http://www.google.com/intl/en/privacypolicy.html (c) Web Beacons Based on your consent, we, or our third party partners, may employ a software technology called web beacons (also known as web bugs, clear gifs or pixels) which helps us understand what content is effective, for example by counting the number of users who have visited these pages, and to understand usage patterns. Web beacons are tiny graphics with a unique identifier, similar in function to cookies, and are used to let us know when content is viewed. In contrast to cookies, which are stored on a user’s computer hard drive, web beacons are embedded on web pages, ads, and e-mail. We, or our third-party partners, may tie the information gathered by web beacons to the other information we collect about you. 3. HOW WE SHARE YOUR INFORMATION Other than as set forth below in this privacy policy, we do not share your personal information with other organizations. Specifically, we share your personal information as follows: • With organizations acting as our agents in providing services to you and which agree to use it only for that purpose and to keep the information secure and confidential. These service providers and third parties can be classified in the following categories: • Delivery partners, to deliver our products to the right location; • Financial partners involved in the processing of your banking or credit card data on our website; • Marketing partners, which we use to send you promotional communications, for instance; • Promotional vendors, who help us to administer contests and promotions, including by maintaining separate contest and promotion microsites; • Applicant Tracking System vendor, to process and manage your job application as applicable; • IT service providers, such as our data hosting provider; and • Other service providers that we may engage to provide services to us or on our behalf. • With third parties which may send you marketing communications consistent with your choices, including artists and artist management (for example, if you register to join an artist’s mailing list). • We may share information in the event of a corporate change (such as a merger, acquisition or sale of assets) in which case we will inform you separately before any transfer of your personal information. • We will also disclose information we maintain (i) when required to do so by law (for example, in response to a court order or a subpoena or other legal obligation); (ii) in response to a law enforcement agency’s request; or (iii) in special cases when we have reason to believe that disclosing this information is necessary to identify, contact or bring legal action against someone who may be causing injury to or interference with our rights or property. If you are a user from the EU/EEA, please also see additional information on international data transfers in section 11 of this privacy policy. 4. WHERE WE STORE YOUR PERSONAL INFORMATION All the information you provide may be processed and stored, transferred or accessed by entities around the world as described in this privacy policy. We will take commercially reasonable steps to ensure that your data is treated securely and in accordance with this privacy policy. 5. LINKS TO THIRD PARTY WEBSITES AND THE INTERNET Our Sites may contain links to third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and we do not accept any responsibility or liability for these policies. Please check the policies before you submit any personal information to these websites. The transmission of information over the internet is not completely secure. If you provide us with information over the internet, any transmission is at your own risk. However, once we receive your information, we use commercially reasonable procedures and security to prevent unauthorized access to personal information about you. 6. COMMUNITY FUNCTIONS Our Sites may make available to you chat rooms, forums, message boards and/or other community functions. Remember that any information you disclose in these areas becomes public information and you should exercise caution when deciding to disclose your personal, financial or other information. Your use of such community functions is at your own risk. 7. CHILDREN (a) COPPA We strive to comply with the Children’s Online Privacy Protection Act. We do not knowingly collect any personal information from those under the age of 13. If you are under 13 years of age, please do not provide any personal information to us. If you feel that we have unknowingly collected personal information from someone under the age of 13, please contact us immediately as described in the CONTACT US section below and this information will be removed. For more information on how to protect your children online: Visit www.OnGuardOnline.gov for social networking safety tips for parents and youth. (b) GDPR We also strive to comply with the EU General Data Protection Regulation (“GDPR”). The Sites are not intended for children and we do not knowingly collect data relating to anyone under the age of 16 in cases where GDPR is applicable. 8. YOUR RIGHTS You may be entitled, to object to or request the restriction of processing of your personal information, and to request access to, rectification, erasure, and portability of your own personal information by contacting us as described in the CONTACT US section below. We may require you to prove your identity with approved identification if you request this information. You may exercise your rights by contacting us as described in the CONTACT US section below. 9. YOUR CALIFORNIA PRIVACY RIGHTS If you are a California resident, California Civil Code 1798.83 provides you the right to receive (a) information identifying any third party to whom we may have disclosed, within the preceding calendar year, your personal information for that third party’s direct marketing purposes and (b) a description of the categories of personal information disclosed. To obtain such information free of charge, by contacting us as described in the CONTACT US section below. Do-Not-Track Signals and Similar Mechanisms. Some web browsers may transmit “do-not-track” signals to the websites and other online services with which a user communicates. There is no industry standard that governs what, if anything, websites should do when they receive these signals. Concord currently does not act in response to these signals. In furtherance of Section 8 above and in accordance with the California Consumer Privacy Act of 2018 (“CCPA”), California consumers have the right to request: • the specific pieces of Personal Data we have about them; • additional information about whether and how we have collected, used, disclosed, and sold Personal Data about them; and • the deletion of the Personal Data we have about them. California consumers also have the right not to receive discriminatory treatment if they exercise the rights listed above. When you make a request, we may require that you provide information and follow procedures so that we can verify the request and your jurisdiction before responding to it. The verification steps we take may differ depending on the request you make. We will match the information that you provide in your request to information we already have on file to verify your request. We may ask for additional information to help us verify your request. If we are able to verify your request, we will process it. If we cannot verify your request, we may ultimately be unable to process your request. Consumers will be required to submit their first and last name and email address and may also be asked to provide additional information so that we can verify the request. We will only use the information received in a request, or in connection with a request, for the purposes of responding to the request. California law permits California consumers to use an authorized agent to make privacy rights requests. We require the authorized agent to provide us with proof of the California consumer’s written permission (for example, a power of attorney) that shows the authorized agent has the authority to submit a request for the California consumer. An authorized agent must follow the process described below to make a request. The authorized agent must also verify his/her own identity. We will confirm the agent’s authority with the California consumer about whom the request was made. You may submit a CCPA privacy rights request to us by: • Visiting CCPA Form. • Calling us at 1-866-904-1461. • Emailing us at privacy@concord.com. We are not currently selling your Personal Data and have not sold Personal Data since January 1, 2020, the date the California Consumer Privacy Act went into effect. 10. YOUR NEVADA PRIVACY RIGHTS Nevada residents have the right to submit a verified request directing us not to sell their Personal Data. If you are a Nevada resident, and would like to submit such a request, please send your request to privacy@concord.com. 11. CHANGES TO OUR PRIVACY POLICY We reserve the right to modify, alter or otherwise update this privacy policy at any time. We encourage you to review this privacy policy from time to time to be informed about how we protect your personal information. When we post changes to this policy, you will see the words “Last Updated” with the date of the last update at the top of this page. In case of substantial changes to this privacy policy, we will inform you about these in advance via email. 12. USERS OF SITES IN THE EUROPEAN UNION/EUROPEAN ECONOMIC AREA This section of this privacy policy applies only if you use the Sites from a country that is a Member State of the European Union (“EU”) /European Economic Area (“EEA”) and supplements the information in this privacy policy. (a) Legal bases for processing your personal data • Participation in special activities: We process the listed information to administer promotions, contests and sweepstakes, so for contract performance. • Newsletters: We send you newsletters based on your consent. If you are already a customer who has purchased goods from us, we also process your email address to offer our own similar products, programs or services to you that may be of interest to you. Such processing is based on our legitimate interest to conduct direct marketing. You may always object to such processing. • Product purchase: We process the listed information to transact and administer your purchase, so for contract performance. • Website registration: We process the listed information to provide you with the requested services and administer your registration, so for contract performance. We also process your information in this context for IT security reasons, so for our legitimate interest to provide secure services. • Contact us: We process the listed information to respond to your inquiry, so to perform a (quasi)contract with you. • Job application: We process the listed information in preparation of a potential employment agreement between you and Concord. • Updates concerning us: We send you accordant updates based on our legitimate interests to provide you with working Sites and satisfying services. If informing you about updates is required by law, we send you accordant updates to comply with our legal obligations. (b) Retention of your personal data • Participation in special activities: We retain your personal information up to three months after the promotion, contest or sweepstake is completed, unless we are required by law to retain them for a longer period (for example for archiving purposes). • Newsletters: We will retain your personal information concerning marketing and newsletters for as long as you do not withdraw consent or opt-out from such marketing, unless we are required or permitted by law to retain it for a longer period (for example for archiving purposes). • Product purchase: We retain your personal information as long as you continue purchasing our products. We will delete your personal information if you have not purchased anything for three years, unless we are required or permitted by law to retain it for a longer period (for example for archiving purposes). • Website registration: We retain your personal information as long as you use our services for registered users. We will delete your personal information if you have not logged in for three years, unless we are required or permitted by law to retain it for a longer period (for example for archiving purposes). • Contact us: We retain this personal information for the time required to respond to your request and, where applicable, as required or permitted by statutory law (for example for financial statements or legal claims or archiving purposes). • Job application: If your application is successful, we retain the personal information for the duration of your employment with us, and beyond based on requirements or permissions by statutory retention requirements. If we do not employ you we will retain your personal information for the time required to respond to your request and, where applicable, as required or permitted by statutory law (for financial statements or legal claims or archiving purposes). • Updates concerning us: We retain your personal information as long as you use our services for registered users or purchase our goods. We will delete your personal information if you have not logged in for three years, unless we are required or permitted by law to retain it for a longer period. (c) Automated decision-making We may use automated decision-making technologies, including profiling, to support our data processing activities. Our automated decision-making capabilities include logic that attempts to identify artists, music, communications, products, or offers that we believe may interest you. By using this logic, it helps us personalize your interactions with us and our artists. For you, this means that you may see online advertisements, direct marketing communications (if you have subscribed), or other advertising or marketing messages or special offers based on your activity on our Sites or interactions with us or our third-party partners. (d) International transfers Our sharing of your personal information, in accordance with this privacy policy, may involve transferring your information outside the EU/EEA. Whenever we transfer your personal data out of the EU/EEA, we ensure a similar degree of protection is afforded to it by ensuring, where required by law, at least one of the following safeguards is implemented: • transferring personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission; • using specific contracts approved by the European Commission which give personal data the same protection it has in Europe; or • transferring personal data to the United States to an entity if they are part of the Privacy Shield which requires them to provide similar protection to personal data shared between the Europe and the US. You may be entitled, in accordance with applicable law, to request a copy of the concrete safeguards by contacting Concord as described in the CONTACT US section. (e) Your rights In furtherance of section 8 above and in accordance with GDPR you may have the following rights in relation to the personal information we hold about you, if the accordant preconditions are fulfilled: • Right of access: You may ask us to confirm whether we are processing your personal information and, if so, to provide you with a copy of that personal information (along with certain other details). • Right to rectification: If the personal information we hold about you is inaccurate or incomplete, you are entitled to ask for rectification or completion. • Right to erasure: You may ask us to delete or remove your personal information in some circumstances, e.g. if we no longer need it or you withdraw your consent (where applicable). • Right to restrict processing: You may ask us to restrict the processing of your personal information in certain circumstances, e.g. if you object to us processing it. • Right to data portability: You have the right to obtain personal information you have provided to us in a structured, commonly used and machine-readable format for reuse under certain circumstances. • Right to object: You may ask us at any time to stop processing your personal information, and we will do so, if we: • rely on legitimate interests to process your personal information except if we can demonstrate compelling legal grounds for the processing or • process your personal information for direct marketing. • Rights in relation to automated decision-making and profiling: You have the right not to be subject to a decision when it is based solely on automated processing, including profiling, and it produces a legal effect or similarly significantly affects you unless such profiling in necessary for entering into, or the performance of, a contract between you and us. • Right to withdraw consent: If we rely on your consent as legal basis for processing your personal information, you have the right to withdraw that consent at any time. This includes, but is not limited, to cases where we use your personal information for direct marketing purposes. You may also be entitled, in accordance with applicable law, to lodge a complaint with a supervisory authority if you consider that our processing of your personal information infringes applicable law. For more information on your rights and accordant requirements, please see the information provided by the EU Commission at https://ec.europa.eu/info/law/law-topic/data-protection/reform/rights-citizens_en 13. CONTACT US If you have questions, comments or requests regarding this privacy policy, please contact us at: Concord Attn: General Counsel 10 Lea Ave. Suite 300 Nashville, TN 37210 Attn: Deputy General Counsel Concord Music’s Data Protection Officer may be contacted at privacy@concord.com For EU/EEA users: Our local representative in the EU/EEA may be contacted via e-mail at dataprotection@boosey.com or via mail at: Data Protection Department Boosey & Hawkes Music Publishers Limited Aldwych House 71-91 Aldwych London WC2B 4HN United Kingdom By clicking “Accept All Cookies”, you agree to the storing of cookies on your device to enhance site navigation, analyze site usage, and assist in our marketing efforts. Cookie Privacy Policy Cookies Settings Accept All Cookies