SOUNDMAC MUSIC DISTRIBUTION LTD.

How We Collect, Use, Protect & Share Your Data

Version 1.0 | Effective Date: 1 July 2025

Soundmac Music Distribution Ltd | Lagos, Nigeria | legal@soundmac.co | www.soundmac.co

This Privacy Policy explains how Soundmac Music Distribution Ltd collects, processes, stores, shares, and protects your personal data when you use the SoundMac Platform and Services. By registering an account or using the Platform in any capacity, you confirm that you have read and understood this Policy and consent to the processing of your personal data as described herein.

Quick Reference — Key Facts

The table below summarizes the most important data-related facts about SoundMac at a glance.

Data Controller

Soundmac Music Distribution Ltd, Lagos, Nigeria

Contact

legal@soundmac.co | www.soundmac.co/

Governing Law

Nigeria Data Protection Act (NDPA) 2023

Data We Collect

Identity, contact, financial, content, usage, and technical data

Why We Collect It

To provide, operate, improve, and protect the Platform and Services

Who We Share With

DSPs, payment processors, cloud providers, legal authorities where required

How Long We Keep It

Duration of account plus up to 7 years for financial records

Your Rights

Access, correction, deletion, portability, objection, and withdrawal of consent

Yes — essential, functional, and analytics cookies. See Section 10.

Third-Country Transfers

Yes — with appropriate safeguards. See Section 8.

1. Who We Are

Soundmac Music Distribution Ltd ("SoundMac", "We", "Us", "Our") is a music distribution and music-technology infrastructure company incorporated under the laws of the Federal Republic of Nigeria, with its principal place of business in Lagos, Nigeria. SoundMac is the data controller in respect of all personal data processed through the Platform at www.soundmac.co and all associated services.

For all data protection enquiries, requests, or complaints, You may contact SoundMac directly at:

Email: support@soundmac.co

Website: www.soundmac.co/legal

Registered Address: Lagos, Nigeria

2. Scope of This Policy

This Privacy Policy applies to all personal data processed by SoundMac in connection with:

Your registration and use of the SoundMac Platform and all associated Services;
Your communications with SoundMac's support, sales, or partnership teams;
Your use of SoundMac's API services, where applicable under a separate API Partner Agreement;
SoundMac's promotional, marketing, and communications activities directed at you;
Any other interaction between You and SoundMac through any channel.

This Policy does not apply to third-party websites, applications, or services that may be linked to or integrated with the Platform. SoundMac is not responsible for the privacy practices of any third-party platform, including DSPs, payment processors, or social media platforms, and You should review their respective privacy policies independently.

3. Personal Data We Collect

SoundMac collects personal data in the following categories, depending on how You use the Platform and Services:

3.1 Identity & Account Data

Full legal name and artist or stage name;
Date of birth and nationality;
Government-issued identification details, where required for verification;
Username and account login credentials;
Profile photograph or avatar, where uploaded.

3.2 Contact Data

Email address;
Phone number, where provided;
Physical or mailing address, where provided;
Country of residence.

3.3 Financial & Payment Data

Bank account details, including account name, account number, sort code, SWIFT/BIC, and IBAN, where applicable;
PayPal or Payoneer account identifiers;
Payment history, transaction records, and royalty statements;
Tax identification numbers, including TIN, W-8BEN, W-9, or equivalent documentation;
Payout preferences and withdrawal history.

SoundMac does not store full credit or debit card numbers. Card payment processing is handled entirely by our third-party payment processors, who are independently responsible for the security of card data.

3.4 Content & Rights Data

Audio files, music videos, artwork, lyrics, and all other Content submitted to the Platform;
Metadata associated with your Content, including track titles, artist credits, genre, release dates, ISRC and UPC codes;
Rights ownership documentation and written clearances provided to SoundMac;
Label name, publishing information, and PRO registration details, where provided;
Sync licensing preferences and Content ID elections.

3.5 Usage & Behavioural Data

Log-in history, session duration, and access timestamps;
Pages visited, features used, and actions taken on the Platform;
Search queries and content upload activity;
Error logs and crash reports;
Communications between You and SoundMac's support team, including emails, chat logs, and support ticket history.

3.6 Technical Data

IP address and approximate geolocation derived therefrom;
Device type, operating system, and browser type and version;
Cookie identifiers and tracking pixels, as described in Section 10;
Referring URL and traffic source data.

3.7 Performance & Revenue Data

Streaming counts, download figures, and play data reported by DSPs in respect of Your Content;
Revenue data, royalty calculations, and payment records;
Neighboring rights and Content ID revenue data;
Promotional campaign performance data, where applicable.

3.8 Data We Collect From Third Parties

SoundMac may receive personal data about You from third parties in the following circumstances:

From DSPs — streaming and revenue data associated with Your Content;
From payment processors — payment confirmation and verification data;
From identity verification providers — verification results and risk scores;
From PROs and CMOs — neighboring rights and publishing royalty data;
From fraud detection services — risk signals and behavioral data associated with your account activity.

4. How We Use Your Personal Data

SoundMac processes your personal data for the following purposes and on the following legal bases:

4.1 To Provide and Operate the Platform and Services

Legal basis: Performance of contract.

Creating and managing your account;
Processing and distributing Your Content to selected DSPs;
Assigning ISRC, UPC, and other identifying codes;
Collecting and processing Royalties on your behalf;
Administering Content ID, neighboring rights, and sync licensing where elected;
Processing withdrawal requests and disbursing payments;
Communicating with You about your account, releases, and royalty statements;
Providing customer support and resolving disputes.

4.2 To Verify Your Identity and Rights

Legal basis: Legal obligation and legitimate interests.

Verifying that You are who You claim to be;
Verifying that You own or are authorized to distribute the Content You submit;
Complying with anti-money laundering and counter-terrorism financing obligations;
Conducting fraud detection and prevention screening.

4.3 To Manage Financial Transactions and Tax Compliance

Legal basis: Legal obligation and performance of contract.

Processing royalty payments and maintaining accurate transaction records;
Complying with tax withholding obligations under Nigerian law and applicable international tax treaties;
Generating invoices, receipts, and royalty statements;
Maintaining financial records for the period required by applicable law.

4.4 To Improve and Develop the Platform

Legal basis: Legitimate interests.

Analyzing usage patterns to understand how artists use the Platform;
Identifying bugs, errors, and areas for improvement;
Developing new features, products, and services;
Conducting internal research and analytics.

4.5 To Communicate With You

Legal basis: Legitimate interests and, where required, consent.

Sending service-related notifications, including release status updates, royalty alerts, and policy changes;
Sending promotional communications, newsletters, and product updates — where You have opted in or where permitted by applicable law;
Responding to your inquiries, support requests, and feedback.

4.6 To Protect SoundMac's Legal Interests

Legal basis: Legitimate interests and legal obligation.

Detecting, investigating, and preventing fraud, abuse, or unauthorized use of the Platform;
Enforcing SoundMac's Terms of Service, Anti-Fraud Policy, and other legal agreements;
Defending against legal claims and managing disputes;
Complying with applicable laws, regulations, court orders, and lawful requests from competent authorities.

5. Data Retention

SoundMac retains your personal data only for as long as is necessary for the purposes set out in this Policy, subject to the following:

Account data and content data are retained for the duration of your account and for a period of three (3) years following account closure, to enable the resolution of any post-termination disputes or claims;
Financial records, royalty statements, and payment data are retained for a minimum of seven (7) years from the date of the relevant transaction, in compliance with Nigerian financial record-keeping requirements and applicable tax law;
Identity verification data is retained for the duration required by applicable anti-money laundering regulations, which is generally five (5) years from the end of the business relationship;
Support and communication records are retained for three (3) years from the date of the last communication;
Usage and technical data collected through cookies and analytics tools is retained for periods set out in SoundMac's Cookie Policy, which forms part of this document at Section 10;
Where SoundMac is required by law, court order, or regulatory direction to retain data beyond the above periods, SoundMac will comply with that obligation.

Upon expiry of the applicable retention period, SoundMac will securely delete or anonymize your personal data in a manner that prevents its reconstruction or re-identification.

6. Who We Share Your Data With

SoundMac does not sell your personal data to any third party. SoundMac may share your personal data with the following categories of recipients, strictly on a need-to-know basis and subject to appropriate confidentiality and data protection obligations:

6.1 Digital Service Providers (DSPs)

SoundMac shares your Content metadata, artist name, label information, and release data with DSPs as necessary to deliver and administer your Content on those platforms. DSPs process this data in accordance with their own privacy policies and distribution agreements with SoundMac.

6.2 Payment Processors

SoundMac shares payment details — including your name, payment account identifiers, and transaction amounts — with payment processors including PayPal, Payoneer, and banking partners, solely for the purpose of processing royalty disbursements to You.

6.3 Cloud Infrastructure & Technology Providers

SoundMac uses third-party cloud infrastructure providers, including Amazon Web Services (AWS), to host, store, and process data on SoundMac's behalf. These providers act as data processors under SoundMac's instruction and are contractually bound to process data only as directed by SoundMac and to maintain appropriate security standards.

6.4 Identity Verification Services

Where SoundMac conducts identity or rights verification, SoundMac may share relevant identification data with third-party verification service providers. These providers are contractually bound to use the data solely for verification purposes.

6.5 Performing Rights Organisations & Collective Management Organisations

Where SoundMac administers neighboring rights or publishing royalties on your behalf, SoundMac will share relevant artist and content data with PROs and CMOs in the applicable territories, as necessary to register your rights and collect royalties.

6.6 Legal and Regulatory Authorities

SoundMac may disclose your personal data to courts, law enforcement agencies, tax authorities, regulatory bodies, or other competent public authorities where SoundMac is required to do so by applicable law, court order, or lawful governmental request. SoundMac will, where permitted by law, notify You of any such disclosure.

6.7 Professional Advisers

SoundMac may share personal data with its legal advisers, accountants, auditors, and other professional service providers, subject to strict professional confidentiality obligations, where necessary for the purpose of obtaining professional advice or managing legal proceedings.

6.8 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of SoundMac's business or assets, your personal data may be transferred to the acquiring entity as part of that transaction. SoundMac will notify You of any such transfer and the acquiring entity will be required to honor this Privacy Policy or to provide You with a new privacy policy before processing your data for any new purpose.

7. Legal Basis for Processing

SoundMac processes your personal data on the following legal bases under the Nigeria Data Protection Act (NDPA) 2023 and applicable data protection law:

Performance of Contract — processing necessary to perform SoundMac's obligations under the Terms of Service, including distributing Your Content, processing royalties, and administering your account;
Legal Obligation — processing necessary to comply with SoundMac's legal obligations, including tax reporting, anti-money laundering compliance, and responses to lawful authority requests;
Legitimate Interests — processing necessary for SoundMac's legitimate business interests, including fraud prevention, platform security, product improvement, and marketing communications to existing users, where those interests are not overridden by your data protection rights;
Consent — where SoundMac relies on consent as a legal basis, including for certain marketing communications and non-essential cookies, You have the right to withdraw that consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent may be submitted to support@soundmac.co.

8. International Data Transfers

SoundMac operates globally and, in the course of providing its Services, your personal data may be transferred to and processed in countries outside Nigeria, including but not limited to the United Kingdom, the United States, the European Union, and other jurisdictions where SoundMac's DSP partners, cloud infrastructure providers, and payment processors are based.

Where SoundMac transfers personal data outside Nigeria, SoundMac will ensure that appropriate safeguards are in place to protect your data, including:

Entering into data processing agreements with recipients that incorporate appropriate data protection obligations consistent with the NDPA 2023;
Transferring data only to countries or recipients that provide an adequate level of data protection as recognized by the Nigeria Data Protection Commission or applicable Nigerian law;
Implementing standard contractual clauses or equivalent transfer mechanisms where required.

You may request information about the specific safeguards in place for any international transfer of your personal data by contacting SoundMac at support@soundmac.co.

9. Your Data Protection Rights

Subject to applicable law and certain conditions, You have the following rights in respect of your personal data held by SoundMac:

9.1 Right of Access

You have the right to request a copy of the personal data SoundMac holds about You, together with information about how that data is processed. SoundMac will respond to access requests within thirty (30) days of receipt.

9.2 Right to Rectification

You have the right to request that SoundMac correct any inaccurate or incomplete personal data held about You. You may update most of your account information directly through your account dashboard at any time.

9.3 Right to Erasure

You have the right to request that SoundMac delete your personal data in certain circumstances, including where the data is no longer necessary for the purposes for which it was collected, or where You withdraw consent on which processing was based. This right does not apply where SoundMac is required by law to retain the data, or where retention is necessary for the establishment, exercise, or defense of legal claims.

9.4 Right to Data Portability

You have the right to receive the personal data You provided to SoundMac in a structured, commonly used, and machine-readable format, and to request that SoundMac transmit that data to another data controller where technically feasible. SoundMac will fulfill portability requests within fourteen (14) days of receipt.

9.5 Right to Restrict Processing

You have the right to request that SoundMac restrict the processing of your personal data in certain circumstances, for example where You contest the accuracy of the data or object to SoundMac's processing pending verification of SoundMac's legitimate grounds.

9.6 Right to Object

You have the right to object to SoundMac's processing of your personal data where that processing is based on SoundMac's legitimate interests. SoundMac will cease processing unless SoundMac can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms.

9.7 Right to Withdraw Consent

Where SoundMac processes your data on the basis of consent, You may withdraw that consent at any time by contacting SoundMac at legal@soundmac.co or by adjusting your account settings where applicable. Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

9.8 Right to Lodge a Complaint

If You believe that SoundMac has processed your personal data in breach of applicable data protection law, You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) or with the data protection authority in your country of residence.

9.9 How to Exercise Your Rights

To exercise any of the rights set out in this Section 9, please submit a written request to SoundMac at support@soundmac.co, including your full name, account email address, and a clear description of the right you wish to exercise. SoundMac will respond within thirty (30) days of receiving a complete and valid request. SoundMac reserves the right to verify your identity before processing any rights request.

10. Cookies & Tracking Technologies

SoundMac uses cookies and similar tracking technologies on the Platform to operate core functionality, improve user experience, and analyze usage patterns. This section explains what cookies SoundMac uses, why, and how You can control them.

10.1 What Are Cookies

Cookies are small text files placed on your device when you visit a website. They allow the website to recognize your device and store certain information about your preferences or past actions.

10.2 Categories of Cookies SoundMac Uses

Essential Cookies

These cookies are strictly necessary for the Platform to function. They enable core features such as account login, session management, and security. Essential cookies cannot be disabled without significantly impairing the functionality of the Platform. No consent is required for essential cookies.

Functional Cookies

These cookies remember your preferences and settings, such as language selection and dashboard layout, to provide a more personalized experience. They are not strictly necessary but improve the usability of the Platform.

Analytics Cookies

These cookies collect information about how users interact with the Platform, including which pages are visited most frequently, how long users spend on each page, and where users come from. SoundMac uses this data to improve the Platform. Analytics cookies require your consent where applicable law so requires.

Marketing Cookies

Where SoundMac runs marketing campaigns, marketing cookies may be used to measure the effectiveness of those campaigns. SoundMac does not use marketing cookies to deliver targeted advertising on behalf of third parties.

10.3 Cookie Retention Periods

Session cookies — deleted when you close your browser;
Persistent functional cookies — retained for up to twelve (12) months;
Analytics cookies — retained for up to twenty-four (24) months;
Marketing measurement cookies — retained for up to twelve (12) months.

10.4 Managing Cookies

You may manage or disable cookies through your browser settings at any time. Please note that disabling essential cookies will impair your ability to use the Platform. You may also opt out of analytics cookies by adjusting your preferences in the cookie consent banner displayed on the Platform. For further information on managing cookies in your specific browser, please refer to your browser's help documentation.

11. Data Security

SoundMac implements appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure. These measures include:

Encryption of data in transit using industry-standard TLS/SSL protocols;
Encryption of sensitive data at rest, including financial data and identity documentation;
Access controls restricting internal access to personal data on a strict need-to-know basis;
Regular security assessments and vulnerability testing of SoundMac's infrastructure;
Staff training on data protection and information security;
Contractual data security obligations imposed on all third-party processors handling personal data on SoundMac's behalf.

Notwithstanding the foregoing, no data transmission over the internet or data storage system can be guaranteed to be completely secure. SoundMac cannot warrant the absolute security of your data and You transmit data to SoundMac at your own risk. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, SoundMac will notify You and the relevant supervisory authority as required by applicable law.

12. Children's Data

The SoundMac Platform is not directed at or intended for use by persons under the age of eighteen (18). SoundMac does not knowingly collect personal data from anyone under the age of eighteen. If SoundMac becomes aware that it has collected personal data from a minor without appropriate parental consent, SoundMac will take immediate steps to delete that data. If You believe SoundMac has inadvertently collected data from a minor, please contact SoundMac immediately at support@soundmac.co.

13. Marketing Communications

SoundMac may send You promotional communications, product updates, and industry news by email or through in-platform notifications. SoundMac will only send marketing communications where:

You have explicitly opted in to receive them; or
You are an existing user of SoundMac's Services and the communication relates to similar services, and You have not opted out.

You may opt out of marketing communications at any time by clicking the unsubscribe link in any marketing email, by adjusting your notification preferences in your account settings, or by contacting SoundMac at support@soundmac.co. Opting out of marketing communications will not affect your receipt of service-related or transactional communications, which SoundMac is required to send in connection with your account.

14. Third-Party Links & Integrations

The Platform may contain links to third-party websites, applications, or services that are not operated by SoundMac. SoundMac has no control over and accepts no responsibility for the content, privacy policies, or data practices of any third-party site or service. SoundMac strongly encourages You to review the privacy policy of any third-party site or service You visit or use in connection with your music distribution activities.

15. Changes to This Privacy Policy

SoundMac reserves the right to update or amend this Privacy Policy at any time to reflect changes in applicable law, SoundMac's data processing practices, or the nature of the Services offered. Where any amendment is material, SoundMac will notify You by email to the address registered on your account and by posting the revised Policy on the Platform at least fourteen (14) days before the amendment takes effect. Your continued use of the Platform following the effective date of any amendment constitutes your acceptance of the revised Policy.

The date at the top of this Policy indicates when it was last updated. SoundMac encourages You to review this Policy periodically to stay informed about how SoundMac is protecting your data.

16. Governing Law & Regulatory Oversight

This Privacy Policy is governed by and construed in accordance with the laws of the Federal Republic of Nigeria, including the Nigeria Data Protection Act (NDPA) 2023 and any regulations, guidelines, or directives issued thereunder by the Nigeria Data Protection Commission (NDPC).

SoundMac is committed to cooperating with the NDPC and with competent data protection authorities in other jurisdictions where required by applicable law. Where SoundMac processes the personal data of individuals located in the European Union or the United Kingdom, SoundMac will additionally comply with the General Data Protection Regulation (GDPR) and the UK GDPR respectively, to the extent applicable.

17. Contact Us

For all data protection enquiries, rights requests, complaints, or questions about this Privacy Policy, please contact SoundMac at:

Soundmac Music Distribution Ltd

Lagos, Nigeria