Effective Date: June 23, 2026

LAST UPDATED: June 23, 2026

Universal Music Group is committed to protecting the privacy of Personal Data. “Personal Data” is defined as information that identifies or is reasonably linked to a specific individual. This Privacy Notice describes how we process Personal Data collected in connection with our royalty portal websites and mobile apps (the “Services”).

As used in this Privacy Notice, “UMG,” “we,” and “our” refers to the Universal Music Group family of companies, including Universal Music Investments, Universal Music Publishing, Universal Music Group Holdings, and Universal Music Group Commercial Services, together with their subsidiaries and affiliates.

The UMG entity responsible for the processing of your Personal Data as the controller is the entity that has the primary relationship with you. This may be the UMG group entity with which you contract or that engages with you as an artist, or whose website you are viewing or using. You can view UMG group companies’ here. For further details, please do not hesitate to contact us using the contact details in the Contact Information section below.

We may revise and update this Privacy Notice from time to time without additional notice to you. Any changes we may make to this Privacy Notice in the future will be posted on this page. Please review the most recent version of the Privacy Notice by clicking on any “Privacy Notice” link on the site with which you are interacting. When we update this Privacy Notice, we will revise the “Last Updated” date above.

1. Sources of Personal Data

We collect Personal Data about you from the following sources:

Directly from you. We may collect Personal Data you provide to us directly when you access the Services.
Data collected automatically and through Cookies. We may automatically collect information or inferences about you; such as through cookies, pixels, tags, scripts, server-side tools, and similar technologies (collectively, “Cookies”), when you interact with our Services. This may include information about how you use and interact with our Services, information about your device, and internet usage information.
From third parties. We may collect Personal Data from third parties, such as service and content providers, our affiliated companies and subsidiaries, business partners, and other parties who interact with us.

We may combine information that we receive from the various sources described in this Privacy Notice, including third party sources, and use or disclose the combined information for the purposes identified below.

2. Types of Personal Data We Collect

We may collect the following types of Personal Data:

Identifiers, such as your name, email address, physical address, telephone number, business contact information, and device identifiers (e.g., cookie IDs and IP address).
Records about you, such as signatures and the content, timing and method of communications you have with us, such as online chats, calls, and emails;
Commercial information, such as financial account information necessary to complete royalty payments, information about royalty payments you have received, and other transactional information necessary to calculate, provide and validate royalty payments.
Internet or other electronic network activity information, such as your interactions with and use of the Services.
Non-precise geolocation information, such as your location as derived from your IP address.
Audio, electronic, visual, or other sensory information, such as photographs and video recordings where you choose to provide it for purposes of identity verification.
Professional or employment information, such as your representation details.

Sensitive Personal Data, where required or you choose to provide it for identity verification purposes or to facilitate royalty payments, such as your Social Security number, driver’s license number, passport number, or other government issued ID, and biometric information processed for the purpose of uniquely identifying you.

3. How We Use Personal Data

We may use Personal Data for the following purposes:

To provide you or your representatives products and services, such as making our Services available to you; registering, verifying, and maintaining your account with us; providing you with royalty payments; providing customer service; communicating with you (including soliciting feedback or responding to requests, complaints, and inquiries); sending push notifications and SMS messages with your consent; and providing similar services or otherwise facilitating your relationship with us. You can opt out of push notifications within your profile or device settings. You can unsubscribe from SMS messages by responding “STOP” (or using a similar command), or within your profile settings.
To verify your identity in connection with providing access to the Services and facilitating royalty payments.
For our internal business purposes, such as day-to-day operation of our business; maintaining internal business records, such as accounting, document management and similar activities; enforcing our policies and rules; developing and improving algorithms, artificial intelligence or machine learning tools and models; management reporting; auditing; and IT security and administration.
For legal, safety or security reasons, such as complying with legal, reporting, and similar requirements; investigating and responding to claims against us, our personnel, and our customers; for the establishment, exercise or defense of legal claims; protecting our, your, our customers’, and other third parties’ safety, property or rights; detecting, preventing, and responding to security incidents and health and safety issues; and protecting against malicious, deceptive, fraudulent, or illegal activity.
In connection with a corporate transaction, such as if we acquire assets of another business, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.

We may use your personal information for other purposes as we may notify you at the time of collection

We may use anonymized, de-identified, or aggregated information for any purpose permitted by law. When we collect, process, or disclose aggregated or deidentified information, we will maintain and use it in deidentified form and will not to attempt to reidentify the information, except to determine whether our deidentification processes satisfies any applicable legal requirements.

4. How We Disclose Personal Data

We may disclose Personal Data to third parties, including the categories of recipients described below:

Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.
Service providers that work on our behalf to provide the products and services you request or support our relationship with you, such as our identity verification service provider, IT providers, internet service providers, data and web hosting providers, software service providers, payment processing companies, data analytics providers, and companies that provide business support services, financial administration, or event organization.
Professional consultants, such as accountants, lawyers, financial advisors, and audit firms.
Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce or apply our Terms of Service and other agreements or policies; and to protect ours, our customers’, or third parties’ safety, property, or rights.
Other entities in connection with a corporate transaction, such as if we acquire assets of another entity, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.
Entities to which you have consented to the disclosure.

5. Cookies

As you navigate through and interact with our Services, we and our authorized third parties may use automatic data collection technologies such as Cookies to collect certain information about your equipment, browsing actions, and patterns.

We may use Google Analytics to better understand how our Services are used and to improve them. To learn more about how Google Analytics collects and processes data, please visit www.google.com/policies/privacy/partners.

We do not use any marketing or advertising Cookies on our Services. As a result, our websites do not currently respond to “Do Not Track” or GPC browser settings or similar mechanisms.

6. Data Security and Data Retention

Although we maintain reasonable security safeguards, no security measures or communications over the Internet can be 100% secure, and we cannot guarantee the security of your information.

Your Personal Data will be retained as long as necessary to fulfill the purposes we have outlined above unless we are required to do otherwise by applicable law. This includes retaining your Personal Data to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Data in our systems and records to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest. If you would like to know more about the retention periods applicable to your Personal Data, you can contact us using details provided in the Contact Information below.

7. Children’s Privacy

Our Services are not directed at, marketed to, nor intended for, individuals under 18 years of age. We do not knowingly collect any Personal Data within the scope of this Privacy Notice from children under 18 years of age. If you believe that we have inadvertently collected Personal Data from a child under the age of 18, please contact us using the information in Contact Information below, and we will take prompt steps to delete the information.

8. International Transfers of Personal Data

Depending on where you are located, we may transfer and store information on servers and equipment in other countries depending on a variety of factors, including the locations of our users and service providers. These countries may not have the same rights as you do under local law. We will conduct such transfers in accordance with applicable laws.

9. External Links

Our Website may contain links to external sites or other online services that we do not control, including those embedded in third party advertisements or sponsor information. We are not responsible for the privacy practices or data collection policies of such third-party services. You should consult the privacy notices of those third-party services for details on their practices.

10. Contact Information

If you have questions regarding this Privacy Notice, please contact us at: privacy.officer@umusic.com.

11. Supplemental U.S. Privacy Disclosures

The following terms supplement the above disclosures with respect to UMG’s processing of U.S. Personal Data and only apply to the extent that U.S. State consumer privacy laws apply to UMG’s processing of Personal Data.

Data Subject Rights: Depending on our commercial or individual relationship with you as an artist, an individual, or a corporate entity, and depending on which state you reside in within the United States (such as California, Colorado, Oregon, Delaware, or Maryland), you may have certain rights regarding Personal Data that you can exercise via our webform or by emailing us at privacy.officer@umusic.com:

· Right to Know. You may have the right to request information about the categories of Personal Data we have collected about you, the categories of sources from which we collected the Personal Data, the purposes for collecting, selling, or sharing the Personal Data, and to whom we have disclosed your Personal Data and why. You may also request the specific pieces of Personal Data we have collected about you. Residents of certain states, such as Oregon, Minnesota, and Maryland, may have the right to request a list of specific third parties to whom we sell or disclose Personal Data.

· Right to Delete. You may have the right to request that we delete Personal Data that we have collected about you.

· Right to Correct. You may have the right to request that we correct inaccurate Personal Data that we maintain about you.

· Right to Limit Use and Disclosure of Sensitive Personal Data. You may have the right to limit the use and disclosure of Sensitive Personal Data. As described below, we do not use or disclose Sensitive Personal Data in ways that would require us to provide a right to limit.

We do not “sell” or “share” Personal Data collected in connection with our Services, as such terms are defined by applicable laws. To the extent required by law, we will honor at the browser level opt-out preference signals sent in a format commonly used and recognized by businesses, such as an HTTP header field or JavaScript object.

We will not discriminate or retaliate against you for exercising your privacy rights.

Appeals: Depending on the laws in your state, you may have the right to submit an appeal based on a decision UMG made about your rights request. You can submit an appeal by sending an email with the subject line “Appeal” to privacy@univeralmusic.com. We will inform you in writing of our response.

Verification: To process rights requests, we may need to obtain information to locate you in our records or verify your identity depending on the nature of the request. For Requests to Know, Delete, and Correct: We collect information necessary to verify your identity and that you are a resident of a state that provides for these rights. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. If we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity, and for security or fraud-prevention purposes. We may deny your request to know, access delete or correct if we cannot verify your identity.

Authorized Agent: Where permitted by law, you may also designate an authorized agent to requests on your behalf. Depending on the request, UMG may reach out to you directly to verify your own identity or to confirm that you provided the authorized agent with permission to submit the request or seek additional information directly from the authorized agent to process the request.

Disclosures of Personal Data: Within the past 12 months, we have disclosed each of the types of Personal Data we collect, as described in the Types of Personal Data we Collect section above, to a service provider or contractor described in the How we Disclose Personal Data section for the business or commercial purposes described in the How we Use Personal Data section.

Sensitive Personal Data: We do not use or disclose Sensitive Personal Data for purposes other than (i) performing services or providing goods reasonably expected by an average consumer; (ii) detecting security incidents; (iii) resisting malicious, deceptive, or illegal actions; (iv) ensuring the physical safety of individuals; (v) short-term, transient use, including non-personalized advertising; (vi) performing or providing internal business services; (vii) verifying or maintaining the quality or safety of a service or device; or (viii) purposes that do not infer characteristics about you.

12. Supplemental Information for the EEA, Switzerland and the UK

The following terms supplement the above disclosures with respect to our processing of EEA, Swiss, and UK Personal Data, and only apply to the extent that EEA, Swiss, or UK data protection laws apply to our processing of your Personal Data. To the extent applicable, in the event of any conflict or inconsistency between the other parts of the Privacy Notice and the terms of this Section 12, this Section 12 shall govern and prevail with regards to the processing of such EEA, Swiss and UK Personal Data.

Data Controller

In some cases, more than one UMG entity may make decisions on how your Personal Data is processed. In these situations, all such entities are jointly responsible for the lawfulness of the specific processing activities as joint controllers. In other cases, different UMG entities may independently determine how your Personal Data is processed as independent controllers. For further details, please do not hesitate to contact us using the contact details in the Contact Information section above.

Legal Bases for Processing

We process the following categories of personal data for the following processing purposes based on the following legal bases:

*Processing purposes*	*Categories of personal data*	*Legal bases*
To provide you with products and services	· Identifiers · Records about you · Commercial information	· Performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. · Legitimate interests as set out in the How We Use Personal Data section above. · Your consent, when appropriate.
To verify your identity	· Audio, electronic, visual, or other sensory information · Sensitive Personal Data	· Performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. · Your consent, when appropriate.
For our internal business purposes	· Identifiers · Commercial information · Internet or other electronic network activity information · Non-precise geolocation data	· Performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. · Compliance with a legal or statutory obligation to which we are subject · Legitimate interests as set out in the How We Use Personal Data section above. · Your consent, when appropriate
For legal, safety or security reasons	· All categories of information we collect	· Performance of a contract to which you are a party or to take steps at your request prior to entering into a contract. · Compliance with a legal or statutory obligation to which we are subject · Legitimate interests as set out in the How We Use Personal Data section above. · Establishment, exercise or defense of legal claims · Protection of vital interests · Your consent, when appropriate
In connection with a corporate transaction	· All categories of information we collect	· Legitimate interests as set out in the How We Use Personal Data section above.

Your Data Protection Rights

Under the conditions set by applicable data protection laws, and depending on our commercial or individual relationship with you as an artist, an individual, or a corporate entity, you may exercise certain rights regarding your Personal Data.

· Right to Access. You have the right to obtain confirmation from us whether we are processing your Personal Data and related information, as well as the right to obtain a copy of your Personal Data undergoing processing.

· Right to Data Portability. You may receive your Personal Data that you have provided to us in a structured, commonly used and machine-readable format.

· Right to Rectification. You have the right to request the rectification of inaccurate Personal Data and to have incomplete data completed.

· Right to Objection. You have the right to object to the processing of your Personal Data in certain cases.

· Right to Restrict Processing. You may request that we restrict the processing of your Personal Data in certain cases.

· Right to Erasure. You may request that we erase your Personal Data in certain cases.

· Right to Lodge a Complaint. You have the right to lodge a complaint with a supervisory authority in the country where you reside or where the conduct that is the subject of the complaint occurred. You can also lodge a complaint with us using the information in Section 9 (Contact Information) if UK laws apply to you and you think we have infringed our UK data protection obligations when handling your personal data.

· Right to Refuse or Withdraw Consent. In case we ask for your consent to process your Personal Data, you are free to refuse to give it. If you have given your consent, you may withdraw it at any time without any adverse consequences. The lawfulness of any processing of your Personal Data that occurred prior to the withdrawal of your consent will not be affected.

· Right to Not Be Subject to Automated Decision-making. You have the right not to be subject to a decision based solely on automated processing and to be given more information about why any such decision was made.

You may exercise these rights by contacting us using the details in the Contact Information section above or by using this link.

International Transfers of Personal Data

Due to the global nature of our operations, some of the recipients mentioned in the How We Disclose Personal Data section of this Privacy Notice may be located in countries outside the EEA, Switzerland or the UK that do not provide an adequate level of data protection as defined by data protection laws in the EEA, Switzerland and the UK. Certain third countries have been officially recognized by the European Commission, Switzerland, and the UK Secretary of State as providing an adequate level of protection. Transfers within our corporate group or to third parties located in third countries that have not received such recognition take place using an acceptable data transfer mechanism, such as the EU and/or UK Standard Contractual Clauses, Binding Corporate Rules, approved Codes of Conduct and Certifications, on the basis of permissible statutory derogations, or any other valid data transfer mechanism issued by the EEA, Swiss or UK authorities.

Please reach out to us using the contact information in the Contact Information section above if you want to receive further information about how we transfer Personal Data or, where available, a copy of the relevant data transfer mechanism.

You may contact UMG’s Data Protection Officer by email at privacy.officer@umusic.com.