Privacy Policy

1. Controller

No data protection officer has currently been appointed. If a statutory obligation to appoint one arises in the future, the relevant contact details will be added here.

2. General legal bases

We process personal data only where a legal basis exists. Depending on the processing activity, the following bases may apply in particular:

• Article 6(1)(b) GDPR for contracts, orders, accounts, downloads, artist and scout agreements and pre-contractual measures;
• Article 6(1)(c) GDPR for compliance with legal obligations, especially commercial, tax and payment-law requirements;
• Article 6(1)(f) GDPR for the secure, efficient and abuse-free operation of the portal, IT security, error analysis and legal defence;
• Article 6(1)(a) GDPR where we expressly request consent for optional processing.

Where required, additional information is provided directly in the relevant form at the time data is collected.

3. Website provision, hosting and server log files

When our pages are accessed, the hosting provider used by us processes technically necessary connection data. This may include the IP address, date and time, requested file, data volume transferred, referrer, browser type, operating system, host name, status messages and error messages.

Processing serves secure delivery, stability, error analysis, protection against attacks and detection of misuse. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure and functional operation of the portal.

The hosting provider processes data on our behalf unless it is independently responsible for a specific processing activity. The exact retention period for log data depends on security and operational requirements. Log data is deleted or anonymised once it is no longer required for these purposes, unless a security incident or statutory obligation justifies longer retention.

4. Cookies, sessions and local storage

The portal uses technically necessary session cookies or comparable storage mechanisms. They are used in particular for the shopping cart, login, permission checks, profile switching, form protection and maintaining a secure session.

Storage or access is necessary to provide functions expressly requested by the user. Where consent is not required, this is based on Section 25(2) TDDDG; subsequent processing of personal data is based, depending on the function, on Article 6(1)(b) or (f) GDPR.

Technically necessary session data generally becomes invalid on logout, on expiry of the session or after a reasonable period of inactivity. Browsers may delete or block cookies earlier; in that case, shopping-cart and account functions may be restricted.

We do not use external advertising trackers. Our internal music-interest statistics count previews after ten seconds of playback progress and new additions to the cart as aggregated events, without an additional consent pop-up or analytics cookies. Previous explicit refusals are honoured until the former preference cookie expires. Details of the technical process, retention and legal basis appear in the separate music statistics section below. Compliance with Section 25 TDDDG for the client-side preview signal requires separate legal assessment.

5. Registration, accounts, login and administration

For artist, scout and administrator accounts, we process in particular name, email address, role, account status, password hash, login and session information, PayPal verification status, balances, commissions, assignments and administrative changes.

Passwords are not stored in plain text but processed as cryptographic hash values. Administrators may manage accounts and, where provided by the portal, open views of other roles for support or troubleshooting. Such access must be limited to legitimate administrative purposes.

The legal basis is Article 6(1)(b) GDPR for use of the account and Article 6(1)(f) GDPR for security, support, abuse prevention and internal administration.

6. Shopping cart, orders, invoices and digital downloads

For contract performance, we may process names, email addresses, billing and contact details, shopping-cart contents, prices, tax information, order and payment status, transaction references and download tokens.

Download tokens enable controlled delivery of purchased or unlocked digital content. For security and evidentiary purposes, creation, validity, use and technical access data may be logged.

The legal basis is Article 6(1)(b) GDPR. Where data is required for invoicing, accounting or tax evidence, processing is additionally based on Article 6(1)(c) GDPR.

7. Payment processing via PayPal

We use PayPal to process the payment methods offered. Depending on the selected payment method, identification, contact, device, transaction, shopping-cart and payment data may be transmitted to PayPal or collected directly by PayPal. PayPal may also use its own cookies and comparable technologies.

The provider for European users is generally PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. Payment processing is based on Article 6(1)(b) GDPR. Where PayPal processes data for its own purposes—particularly fraud prevention, risk assessment, statutory payment-service obligations or its own services—PayPal acts as an independent controller.

When PayPal is used, data may also be processed outside the European Economic Area. PayPal describes the safeguards used and its own processing activities in its current privacy policy.

Open PayPal’s privacy policy

8. Artist, profile, upload and scout data

Artists may provide profile information, images, banners, descriptions, origin, genres, equipment, social-media links, audio files and cover files. Data expressly intended for the public profile is displayed on publicly accessible artist pages.

For music uploads, we additionally process metadata such as track name, genre, release year, BPM, album, label, ISRC, composer, copyright details, description, price, preview range and file paths. This data is used for publication, contract performance, rights allocation, sales presentation and accounting.

Scout data may include name, email/PayPal address, verification status, balances, commissions, attributed sales, invitation and switching information and payout data. Invitation links contain random tokens and are time-limited.

The legal basis is Article 6(1)(b) GDPR. Public display of voluntary profile information is based on the profile function requested by the user; information can be changed or removed in the dashboard. Statutory retention and documentation obligations remain unaffected.

9. Audio previews and media files

When an audio preview is played, the browser requests the relevant media file from the server. Technically necessary connection and access data is generated in the process. The preview may be limited to a defined segment. The legal basis is Article 6(1)(b) GDPR for the requested use and Article 6(1)(f) GDPR for secure technical delivery.

10. External platforms and social-media links

Public artist profiles may contain links to TikTok, Instagram, SoundCloud, YouTube, Spotify, Beatport, Bandcamp or the artist’s own website. According to the current functionality, these are ordinary external links; no connection to the destination platform is established merely by displaying the link.

When you click such a link, you leave our portal. The destination platform receives at least the technically necessary connection data and processes data under its own terms. Depending on the platform, data may be processed in third countries, especially the United States. Please review the respective provider’s privacy information before use.

Links entered by artists are supplied by those artists. We cannot guarantee that external content will remain unchanged or available.

11. Email communication, release updates and password reset

If you contact us by email, we process the sender address, content, metadata and any attachments in order to handle the request. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and otherwise Article 6(1)(f) GDPR.

For password resets, we process the email address, user assignment, a random token with limited validity, the time and usage status. For security, the link can be used only once. Tokens are deleted or invalidated after expiry or use.

If you subscribe to release updates on the home page, we process your email address, selected language, signup source and the time of signup or most recent update in order to inform you by email about new artists and releases. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw this consent at any time with effect for the future, for example by emailing the contact address stated in Section 1. After withdrawal, the address will no longer be used for release updates; it will be retained beyond that only where necessary to document the withdrawal or comply with statutory obligations.

12. Recipients and service providers

Data is received only by parties that need it for the relevant purpose. Categories of recipients may include hosting and IT service providers, email providers, PayPal and other payment participants, tax or legal advisers, and public authorities or courts where legally required.

Processors are bound by agreements under Article 28 GDPR where required. Data is not disclosed for advertising purposes unless separate consent has been given.

13. Retention period

We retain data only for as long as necessary for the relevant purpose. Account data is generally stored for the duration of the account and afterwards until outstanding claims have been clarified. Profile and upload data that is no longer required is deleted unless contractual, security-related or statutory reasons prevent this.

Commercial, tax and accounting documents are retained for the legally prescribed periods; depending on the type of document, these may be six, eight or ten years in particular. Data required for legal defence may be retained until the relevant limitation periods expire.

14. Rights of data subjects

Subject to the statutory requirements, you have in particular the right to:

• access personal data processed about you (Article 15 GDPR),
• rectification of inaccurate data (Article 16 GDPR),
• erasure (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• object to processing based on legitimate interests (Article 21 GDPR),
• withdraw consent with effect for the future (Article 7(3) GDPR).

To exercise your rights, a message to the email address stated above is sufficient. Where necessary, we may request additional information to verify your identity.

Right to lodge a complaint

You also have the right to lodge a complaint with a data-protection supervisory authority. In particular, you may contact the authority at your habitual residence, workplace or the place of the alleged infringement. For our registered office, the competent authority is generally the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia.

15. Data security

We use TLS/HTTPS transport encryption and appropriate technical and organisational measures to protect data against loss, manipulation and unauthorised access. These include access and role restrictions, secure password hashes, time-limited tokens, server-side validation, database transactions and regular updates of security-relevant components.

Despite appropriate safeguards, data transmission over the internet cannot be made completely risk-free. Users are responsible for keeping access credentials confidential and using secure, unique passwords.

16. Minors

Contracts, artist accounts and scout accounts are generally intended for adults or persons with valid legal representation. Persons under 18 may use registration-required or payment-related functions only where the necessary consent or representation by a parent or legal guardian is in place.

17. Changes to this privacy policy

We update this policy when functions, service providers or legal requirements change. The version published on this page at the relevant time is authoritative. We will inform registered users in an appropriate manner of material changes affecting them.

Last updated: 6 November 2026

PayPal account linking for artists

When linking is enabled, artists sign in directly with PayPal. After consent, PayPal sends the PayPal email address, email confirmation status, account verification status and unique account ID (payer ID). ReleaseGround stores the payout email, payer ID, verification status and date to associate the account with future payouts and prevent unauthorized address changes. The login email is confirmed separately. We never receive PayPal passwords. Account verification does not guarantee payout eligibility. PayPal handles sign-in under its own privacy notice. This verification is part of the artist account agreement (GDPR Article 6(1)(b)).

Basic first-party page view counts

On our own server, we count requests for selected ReleaseGround pages. In addition, entry requests are grouped into broad traffic-source categories (e.g. TikTok, Google or unknown) using the referrer or the utm_source parameter when available. Only daily totals per section or source category are stored, not full referrer URLs or UTM parameters. We do not set additional analytics cookies or browser identifiers, and do not run scripts to measure clicks or dwell time. Browser software information normally sent with page requests is checked transiently to filter known automated traffic, but no IP addresses or browser identifiers are stored in these aggregates. These figures are page views, not unique people or proven first-time visitors. Operational daily aggregates older than 90 days are deleted on subsequent page requests. When the administrator intentionally restarts the statistics, a separate archival copy containing only aggregated counts without personal or device identifiers is retained for internal comparisons. Legal basis: our legitimate interest in understanding basic page usage and operating the website (GDPR Article 6(1)(f)). No external analytics providers. Security logs and existing artist and fan login data are handled separately.

Internal, aggregated music statistics

We count on our own server how often an audio preview reaches at least ten seconds of playback progress and how often a product is newly added to the cart. After ten seconds the site sends a signal containing only the release ID and event type. Regular preview reports do not send analytics cookies, session identifiers, login details or device identifiers to the counting endpoint. A release is reported at most once per page load; repeated visits may count again. Cart additions are counted on the server during the normal shop process, which requires an operational cart session. Our statistics retain only the day, release ID, event type, test/regular classification and aggregate count, not IP addresses, device identifiers or visitor profiles. Separate technical server and security logs may still exist. These totals are events, not distinct individuals; automated or repeated playback cannot be ruled out completely. Previous explicit refusals remain honoured until the old choice cookie expires. Earlier pilot figures were consent-based and are not directly comparable with newer counts. Daily aggregates older than 90 days are cleared when the admin report is opened. Only administrators can view them. Our basis for the internal, minimised statistics is legitimate interests (GDPR Article 6(1)(f)); requirements under section 25 TDDDG apply separately. Checkout, invoices and existing page-view statistics are unchanged.

Internal promotion-link and sales statistics

On our own server we count artist promotional-link and existing artist QR-code requests as daily totals by artist and platform. We do not store additional analytics cookies, visitor identifiers or full referring URLs for these counts. Repeated requests may be counted more than once; unique people are not identified. Sales per artist are recorded only after payment confirmation. Linking an earlier page request to a later purchase, including first- and last-contact reporting, is currently disabled, so purchase sources are marked unknown. A country code supplied by PayPal may be saved with an order; city and postcode are already invoice data and do not establish a buyer’s physical location. Administrators see portal-wide reports. Artists see revenue for their own titles and aggregated promotion/referral counts, never other artists’ revenue. Small regional groups are combined in artist reports. Order-related entries are retained with order records.

Daily account sign-in counts

For successful artist and fan sign-ins, we maintain an internal per-account daily login count. Together with the existing lifetime counters and last-login timestamps, this lets administrators understand account activity. The daily counts do not store IP addresses, passwords or device identifiers and are not shared with external analytics providers. Daily figures older than 90 days are removed when the admin overview is next opened; existing lifetime counters remain. Legal basis: account administration and legitimate interest in operating and understanding account use (GDPR Art. 6(1)(b) and (f)).

Optional fan emails

Only after you expressly opt in and confirm a separate email (double opt-in) do we use your registered email address, language and followed or favourited artists to send occasional artist-support campaigns and QR profile links. We store request, confirmation and withdrawal timestamps and technical tokens to document consent. You may unsubscribe via any email or your fan account. Existing fans are not contacted without consent. Legal basis: GDPR Art. 6(1)(a). We use our configured email provider to send messages and DeepL to translate general messages without providing fan or favourite-artist details.