Privacy policy for Gramo

This is an unofficial translation. If there is any difference between the versions, the Norwegian version applies: Personvern (in Norwegian).

Gramo processes personal data because we collect and pay out remuneration on behalf of rights holders in recorded music. In this policy, we explain which data we process, why, and what rights you have.

Who is the controller?

Gramo is the controller for the personal data covered by this policy.

Which rules do we follow?

We process personal data in accordance with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act. In addition, several specific acts give us both the right and the duty to process data:

• Section 21 of the Norwegian Copyright Act, on remuneration for public performance and communication to the public of sound recordings.
• Section 18 of the Norwegian Copyright Act, on performers' right to additional remuneration.
• The Act on collective management of copyright etc. (the Collective Management Act), which implements the CRM Directive (2014/26/EU) in Norwegian law.
• The Act relating to a levy on public performance of performing artists' performances etc.
• Section 3-15 of the Electronic Communications Act, on cookies.

Article 42 of the CRM Directive establishes that data protection law applies in parallel with the rules on collective management. In the preparatory works to the Collective Management Act (Prop. 53 L (2020–2021)), the Ministry assumed that the privacy impact of identifying and locating rights holders is limited, weighed against the purpose of paying remuneration to the right person.

Why do we process personal data about you?

We collect remuneration from those who use recorded music in Norway, and pay it out to those who have rights in the music. To do this, we need to process certain personal data.

Specifically, we use personal data to:

• collect remuneration from those who use recorded music
• identify you as a rights holder and pay out remuneration you are entitled to
• report payments to the tax authorities
• document that we manage rights and remuneration correctly
• prevent and detect fraud and other criminal offences
• give you information about membership, payments and the Annual General Meeting, as well as general member and customer service

On what legal basis do we process the data?

Which legal basis applies depends on the purpose of the processing.

Legal obligation (GDPR Article 6(1)(c))

We have a statutory duty to manage remuneration rights under the Copyright Act and the Collective Management Act. This includes the duty under section 22 of the Collective Management Act to identify and locate rights holders who are entitled to remuneration.

Contract (GDPR Article 6(1)(b))

If you have a membership or customer relationship with Gramo, we process data that is necessary to perform the contract with you, or to take steps before entering into such a contract.

Legitimate interest (GDPR Article 6(1)(f))

To provide information services and general member and customer service, we process certain data on the basis of legitimate interest.

Consent (GDPR Article 6(1)(a))

We ask for consent when we process data that has no other legal basis. This applies, for example, to signing up for newsletters, use of photographs in marketing and non-essential cookies. You can withdraw your consent at any time.

Processing of national identity numbers

We process national identity numbers to make sure you are correctly identified as a rights holder, so that remuneration and tax deductions are correct. The processing is based on section 12 of the Personal Data Act.

What personal data do we process about you?

Which data we process depends on your relationship with Gramo.

If you are a musician, artist or other rights holder

We process the following data about you:

• name, and any artist name or pseudonym
• national identity number, date of birth and gender
• address, email address and telephone number
• citizenship, country of birth and country of residence
• bank details
• role in the recording, for example performer or producer
• instrument and relationship to a band, orchestra or choir
• membership of Norwegian and foreign member organisations and sister organisations
• recordings you have rights in
• IPN (International Performer Number), which is the international identification number for performers
• TIN (Tax Identification Number), which is an identification number for tax purposes
• photographs, if you have given them to us or have consented to us using pictures of you, for example from events and the Annual General Meeting

If you have inherited rights, we also register the year of death of the person you inherit from.

It is important that you keep your details up to date, so that we can pay out remuneration you are entitled to.

If you represent a business that uses recorded music

We process the following data about the business and about you as a contact person:

• organisation number and the name of the business
• postal address and visiting address
• industry
• name, email address and telephone number of the contact person(s)
• information about the premises, such as size, opening hours and other parameters that affect the remuneration tariff
• information about the use of music, such as plays of background music and foreground music

We use this data to calculate the correct remuneration and send invoices.

If you have signed up for our newsletter

We process your email address and the type of newsletter you have chosen to receive. If you are also a member, we store your name and information about your membership, so that we can tailor the content to you.

We do not share the mailing list with others. You can unsubscribe from the newsletter at any time using the link at the bottom of each newsletter.

Even if you unsubscribe from the general newsletter, we will continue to inform you as a member about matters that concern your membership, for example rights, payments or the Annual General Meeting.

If you visit our website

We collect information about how the website is used by means of cookies. See the separate section on this below.

Where do we get the data from?

We get personal data from several sources:

• Directly from you, for example when you join Gramo, fill in a Gramo list, log in or contact us.
• From public registers, for example the Norwegian Tax Administration, the State Register of Personal Addresses (Statens personadresseregister) and the Brønnøysund Register Centre.
• From commercial directories, for example accounting information and information about new businesses.
• From banks and credit reference agencies, where necessary for payment and identification.
• From national and international partners, in particular other collective management organisations and SCAPR (Societies’ Council for the Collective Management of Performers’ Rights), which manages the international databases VRDB and IPD.

Who do we share data with?

To manage your rights and fulfil our obligations under the law, we sometimes have to share data with others. We only share what is necessary for the purpose.

Other collective management organisations

We exchange data with sister organisations in other countries, so that you also receive remuneration when your music is played outside Norway. The exchange takes place either directly or via SCAPR's international databases:

• VRDB (Virtual Recording Database), a database of recordings.
• IPD (International Performer Database), a database of performers that shows which organisation represents each performer.

Your IPN may also be shared with parties outside the SCAPR community, such as record companies, distributors and other partners in the music industry. This is done to make sure you are correctly identified throughout the chain from recording to payment. When we share data with parties outside SCAPR, it is limited to your IPN.

TONO

Gramo and TONO cooperate on joint collection of remuneration for background music. It may therefore be necessary to share data about music users with TONO.

Fund for Performing Artists (FFUK)

We collect a levy under the Act relating to a levy on public performance of performing artists' performances etc. on behalf of FFUK, and share data with the fund where necessary.

Public authorities

We report payments to the Norwegian Tax Administration in line with our reporting obligation. We also share data with other authorities when required by law, for example when ordered by the police or a court.

Norwegian member organisations

We share your name and national identity number or organisation number with member organisations you are registered with. This is done to quality-assure information and to determine which members are entitled to vote or to be represented by proxy at the Annual General Meeting, see our articles of association.

Subcontractors and data processors

Gramo uses IT suppliers and other subcontractors who process personal data on our behalf. We have entered into data processing agreements with them, so that your data is protected in accordance with data protection law.

Transfers to countries outside the EU/EEA

Gramo stores personal data within the EU/EEA. Some services are provided by US suppliers that are certified under the EU-US Data Privacy Framework. If we need to transfer personal data to recipients outside the EU/EEA that are not covered by an adequacy decision from the European Commission, this is done on a valid basis under Chapter V of the GDPR.

How long do we keep the data?

The main rule is that we delete or anonymise personal data when the purpose of the processing has been fulfilled.

Rights holders

The term of protection for recordings is 70 years, see section 20 of the Copyright Act. We therefore have to keep data about rights holders for at least as long as the recording is protected, so that we can identify contributors and avoid incorrect payments.

Even if you leave Gramo or ask us to delete your data, we have to keep the following data for as long as the recording is protected:

• name and any artist name
• date of birth
• country (citizenship, country of residence, country of birth)
• relationship to a band, orchestra or choir
• recordings

Payment history

We have to keep information about all payments for ten years, to document the payments for the tax authorities. This follows from the Bookkeeping Act, among other things.

Music users

We delete contact information about businesses that use recorded music when we are notified that they no longer use music, or that the business has been wound up.

Newsletter

If you unsubscribe from the newsletter, we delete your email address from the mailing list.

Website visitors

How long cookies are stored depends on the individual tool.

Gramo carries out regular automatic reviews of our systems to make sure personal data is deleted when it is no longer needed.

What are your rights?

You have the following rights under data protection law:

• Access: You can ask to find out what data we hold about you.
• Rectification: You can ask us to correct data that is wrong or incomplete.
• Erasure: You can ask us to delete data where we have no legal basis or other reason to keep it.
• Restriction: You can ask us to restrict the processing in certain cases.
• Objection: You can object to processing that is based on legitimate interest.
• Data portability: You can ask to receive certain data in a machine-readable format, or for us to transfer it to another controller.
• Withdrawal of consent: If we process data on the basis of consent, you can withdraw your consent at any time.

To exercise your rights, you can log in at gramo.no, email medlem@gramo.no or post@gramo.no, or call us on +47 22 00 77 77.

Do we use automated decision-making?

No. Gramo does not use automated decision-making or profiling that produces legal effects concerning you or similarly significantly affects you, see Article 22 of the GDPR.

Automated routines are only used for practical purposes, for example to delete data that is no longer needed.

How do we keep the data secure?

We protect your personal data with technical and organisational measures. The most important are:

• Encrypted communication: When you use our services or log in, data is exchanged securely using established cryptography such as TLS.
• Two-factor authentication: We use two-factor authentication where possible.
• Secure core system: Our core system has access control, logging and backups in line with good practice.
• Data processing agreements and confidentiality agreements: We set requirements for all employees through confidentiality agreements, and for subcontractors through data processing agreements.

The platform consists of solutions we run ourselves and services we rent from external suppliers such as Amazon Web Services (AWS), Heroku and Microsoft Azure.

Cookies

When you visit our website, your browser may store small data files called cookies. They help us make the website better and easier to use.

Under section 3-15 of the Electronic Communications Act, we must have your consent before we use cookies that are not strictly necessary to provide the service. The consent must be active, freely given, specific and informed, in line with the GDPR.

Necessary cookies

These do not require consent:

• Intercom: Used to give you information while you use the website, and to receive and answer enquiries you send us.
• Skyra: Used to show surveys. No data is stored unless you choose to respond.

Optional cookies (require consent)

• Google Analytics: Used to analyse traffic and visitor patterns.
• Hotjar: Used to analyse how users move around the website.

We do not use cookies for advertising or marketing, and we do not share information with others without your consent.

What do we look at in the statistics?

If you have consented to statistics cookies, we look at things such as which browser and device are used, which language the browser is set to, which countries the website is visited from, which pages and links are clicked, and where the visit came from (for example search engines, social media or newsletters).

Some web addresses may contain your email address if you are logged in. It is only used to show you your own information, and is only visible to you and Gramo.

Changing or withdrawing consent

You can change or withdraw your consent at any time in the consent settings on our website.

Changes to this policy

We may update the privacy policy when needed, for example if the rules change or if we change how we process personal data. Changes are published with an updated date. If there are significant changes, we will notify you in an appropriate way.

How can you complain?

If you believe that Gramo processes personal data in breach of data protection law, you can complain to the Norwegian Data Protection Authority (Datatilsynet). You can find information about how to complain on datatilsynet.no.

Before you complain, we encourage you to contact us first, so that we can answer questions or correct any errors.

How can you contact us about privacy?

If you have questions about privacy at Gramo, you can contact us:

Email: post@gramo.no

Telephone: +47 22 00 77 77

See also:

• General principles
• About us
• Contact us
• Complaints