Privacy Policy

This policy explains which personal data SRC Music Distribution collects, why we collect it, how long we keep it and which rights you can exercise. It applies to the panel at distribution.srcmusic.com and to the related services (music distribution, statistics, wallet and support).

1. Data controller

The controller of your data is SRC Music Distribution. For any matter related to privacy or data protection you can write to info@srcmusic.com.

2. What data we collect

• Account: username, email, password (stored encrypted, never in plain text), full name, country, phone (if you provide it), language, plan and the dates of acceptance of the Terms and Conditions.
• Distribution and musical data: releases, tracks, cover art, audio files (WAV), Credits, artists, labels, territories and shops, and the identification codes of your releases (UPC) and tracks (ISRC).
• Statistics and earnings: reports from shops and distributors that we import to calculate reproductions and earnings (period, shop, country, units and amounts).
• Payments and wallet: withdrawals requested, method chosen, amount and the payment details needed to send the money (such as the PayPal email or the bank account).
• Security and technical data: access records (date, time, IP address, session), security log, usage of the two-factor authentication and the blocks applied to protect platforms.
• Support: tickets and messages you send to our team, including any attachment you decide to send.

We do not ask for special categories of data and you should not include them in the messages or files you send us.

3. For what purpose and with what legal basis

• To provide the service (create your account, review and distribute your music, show your statistics and pay you your share): execution of the contract you sign with us.
• To keep you informed about the status of your releases, your payments or important changes in the platform: performance of the contract and our legitimate interest in keeping you informed.
• To protect the platform (detecting fraud, abuse, artificial streaming, attacks or unauthorised access): legitimate interest in protecting the service and our users.
• To comply with legal, tax and accounting obligations: legal obligation.
• To send you commercial communications, if you have expressly asked for them: your consent, which you can withdraw at any time.

4. Who may receive your data

• Shops, platforms and distributors: the minimum data needed to publish your music and to obtain the reports of reproductions and earnings (release metadata, credits, cover art and audio).
• Payment providers (such as PayPal) and banks: the data needed to pay your withdrawals.
• Technology and email providers that host the platform and send the notifications (mail server and hosting).
• Public authorities, when there is a legal obligation to hand over the data.

We do not sell your personal data or use it for third-party advertising.

5. International transfers

Some of the shops are outside the European Economic Area. The delivery of your release metadata to those platforms is carried out under the standard contractual clauses of our distributors, in order to be able to distribute to those territories. We do not carry out other international transfers unless you ask us to distribute in specific territories.

6. How long we keep the data

• Account and releases: while you keep your account. When you ask for its deletion, the data is deleted or anonymised in the periods indicated below.
• Closing the account: when you close your account (or we close it for a breach of the Terms), your personal data and your releases are deleted or anonymised within a maximum of 30 days, except the billing documents, the record of the accepted Terms, the access logs and the evidence of the case, which are kept during the legal periods (as a rule, 4 years for tax matters and 5 years for civil liabilities).
• Financial and billing documents and reports: during the legal periods for tax, accounting and commercial obligations, and at least the time required to defend ourselves against claims.
• Security and access logs: during the strictly necessary time for the incident investigation, and then deleted or anonymised.
• Support tickets: while the ticket is open and a reasonable period afterwards, to keep the history.

7. Your rights

You can exercise your rights of access, rectification, deletion, opposition, limitation of processing and portability, and to withdraw your consent, by writing to info@srcmusic.com, from the email address of your account. You can update most of your data yourself from your panel, in Settings. If you consider that we have not attended you properly, you can file a claim with the Spanish Data Protection Agency (AEPD, www.aepd.es).

8. How we protect the data

Accounts, devices and IP addresses. To protect the platform we keep access records (date, time, IP address and session). If we detect fraud, artificial streaming, attacks or abusive use, we may block the account and the IP addresses, devices or connection ranges involved, and we keep those records during the investigation and for the maximum period of one year afterwards, unless the case requires keeping them longer to defend ourselves against claims or to attend the authorities.

We apply reasonable technical and organisational measures to protect your information: passwords stored with encryption, unique codes (CSRF) in the forms, two-factor authentication available for your account, session expiry, collaborator accounts with view-only permissions and access records for the team. Keep in mind that no system connected to the internet is completely infallible; help us by keeping your credentials safe.

9. Cookies and local storage

• Session cookie (panel_session): indispensable to keep you logged in. It does not work without it and it is not used for advertising.
• Preference cookies (language and light/dark theme): remember how you like to see the panel.
• Browser local storage: we save the theme so that the page does not flicker when it loads.

We do not use third-party advertising or analytics cookies in the panel.

10. Minors

The platform is aimed at people over 18 years of age. If you are a minor, you need the consent of your legal guardian and, if we know that we have collected data of a minor without that consent, we will delete it.

11. Changes to this policy

We may update this policy to reflect legal or operational changes. We will publish the new version on this same page, with its version number and update date, and we will inform you inside the panel if the changes are significant.

12. Contact

For any question about privacy: info@srcmusic.com or open a ticket in Support.