PERSONAL DATA PROTECTION POLICY
for users of the Beam for Music Platform

See French version

1 – Definitions
2 – Identity of the data controller
3 – When do we act as a processor of personal data?
4 – What is the purpose of our privacy policy?
5 – What personal data is collected on the Beam for Music platform, when is it collected, and how long is it retained?
6 – What are the conditions for third-party access to personal data of users of the platform?
7 – How is personal data protected during international transfers?
8 – How does Atrack protect the data of its platform users?
9 – What is Atrack’s policy on cookies and other trackers?
10 – What are the rights of users of the Beam for Music platform?
11 – Data protection officer
12 – How can you stay informed about updates to this policy?

PREAMBLE

ATRACK, a simplified joint stock company with a capital of €1,496, registered in the national register of companies under number 904 402 146, with its registered office at 20 rue Auguste Blanqui, 94250 Gentilly, intra-community VAT number: FR50 904 402 146, SIRET number: 904 402 146 00024.

ATRACK offers users of its "BEAM FOR MUSIC" platform, namely the legal representatives, employees or agents of ATRACK's music publishing client companies, songwriters and performers (hereinafter the “Client(s)”), to manage and optimise the royalties generated by the exploitation of the musical works in their catalogue (hereinafter the "Client Catalogue") on various types of media and on French territory (metropolitan France, DROM and COM). 

The Platform is accessible via the website published by ATRACK at the following address: https://beamformusic.com/ (the website and the Platform together hereinafter referred to as the "Platform"). 

The Platform allows users to: 

  • Access data relating to musical works in the customer's catalogue (musical metadata, ISWC codes and ISRC codes) via a personalised dashboard, enriched and enhanced thanks to the tracking services implemented by ATRACK;

  • Monitor in real time the use of musical works from the Customer Catalogue on various media;

  • Access an estimate of the royalties due for each use of each musical work in the Customer Catalogue and compare this estimate with the royalties actually collected by SACEM;

  • Benefit from reprocessed and organised data accompanying claims for royalties not collected by SACEM.


When users browse the Platform, ATRACK may collect or process personal data concerning them. 

In any event, the Platform is not intended for minors. If it transpires that ATRACK has collected or received personal data from a minor without parental consent, this information will be deleted. If a user of the Platform believes that ATRACK may have collected or received data concerning a minor, they may contact ATRACK at the email address contact@beamformusic.com.

  1. DEFINITIONS

"Personal data":
refers to any information relating to an identified or identifiable natural person, directly or indirectly by reference to an identification number or to one or more factors specific to that person (such as surname, first name, identification number, email address, IP address, voice, photograph, location data, etc.).

"Data controller":
refers to any natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing. 

"Processor":
refers to the natural or legal person, public authority, service or any other body that processes personal data on behalf of a data controller, on its instructions and under its authority, without itself determining the purposes of the processing and only, where applicable, certain non-essential means.

"Processing":
refers to any operation or set of operations performed on Personal Data, whether automated or not: collection, recording, organisation, storage, modification, reconciliation, retrieval, consultation, extraction, use, or making available, alignment, combination, as well as blocking, erasure or destruction of such Personal Data. 

  1. IDENTITY OF THE DATA CONTROLLER

The Personal Data of users of the Platform is collected and processed under the responsibility of ATRACK, 20 rue Auguste Blanqui, 94250 Gentilly, acting as Data Controller.

  1. WHEN DO WE ACT AS A PROCESSOR OF PERSONAL DATA? 

In the context of the audit, analysis and enrichment mission of the Client's music data catalogue, we act as processor of the Personal Data included in these music data (first name and last name of the performing artist, author-composer, music publisher, etc.).

The music data are collected, on the one hand, through the download of the Client Catalogue data available on the Client's SACEM portal, authorised by the Client through a download mandate.

They are collected, on the other hand, through the transfer by external data suppliers of music data and exploitation data of the musical works from the Client Catalogue.

  1. WHAT IS THE PURPOSE OF OUR PRIVACY POLICY?

ATRACK is committed to protecting privacy and processes the personal data of users of its Platform with the utmost care and in accordance with applicable data protection legislation. 

This Policy sets out ATRACK's commitments to users of its Platform and informs them of how it processes their Personal Data and their rights in relation to the Data they provide when browsing the Platform. 

It is important that users of the BEAM FOR MUSIC Platform read this Policy so that they are fully aware of how ATRACK uses their Data and why it uses it. 

In accordance with the regulations in force, and in particular: 

  • Regulation (EU) No. 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (known as the "GDPR", which came into force on 25 May 2018); 

  • Law No. 2018-493 of 20 June 2018 on the protection of personal data, which amends Law No. 78-17 of 6 January 1978 known as the "Data Protection Act"; 

ATRACK undertakes to ensure that its Personal Data Protection Policy complies with the following principles: 

  • Lawfulness: the Personal Data of users of the BEAM FOR MUSIC Platform is only used in one of the following cases: 

  • ATRACK has obtained their consent; 

  • Such use is necessary for the performance of a contract to which the user is a party; 

  • This use is necessary for compliance with a legal obligation; 

  • This use is necessary to safeguard the vital interests of Platform users; 

  • ATRACK has a legitimate interest in using the Personal Data and this use does not infringe on the freedoms and interests of users of its Platform. 

  • Fairness: ATRACK indicates during its interactions and/or in this Policy how the Personal Data it collects from users is useful to it. 

  • Purpose limitation and data minimisation: only Personal Data that is truly necessary for ATRACK is collected. ATRACK undertakes to use as little Personal Data as possible in accordance with the purpose it is seeking to achieve. 

  • Transparency: ATRACK informs Platform users, during its interactions and/or in this Policy, of how it uses their Data. 

  • Storage limitation: ATRACK only stores the Personal Data of its Platform users for limited periods of time and in accordance with the purpose it is pursuing. 

  • Exercise of rights: ATRACK facilitates the exercise of Platform users' rights with regard to their Personal Data, such as access, rectification and erasure of Data, or opposition to its Processing. 

  • Integrity and confidentiality: ATRACK ensures the security and confidentiality of the Personal Data of Platform users. In this regard: 

  • If a third party is to use this Data, ATRACK shall ensure that the latter provides the necessary guarantees for the protection of the Data used; 

  • If Data must be transferred outside the European Union, ATRACK shall ensure that this transfer is governed by appropriate legal provisions; 

  • In the event that personal data is compromised (in the event of loss, theft, damage, unavailability, etc.), ATRACK undertakes to notify the competent authorities and the persons concerned of this breach, in accordance with the applicable legal and regulatory provisions.

  1. WHAT PERSONAL DATA IS COLLECTED ON THE BEAM FOR MUSIC PLATFORM, WHEN IS IT COLLECTED, AND HOW LONG IS IT RETAINED?

5.1. Nature of the Data collected and time of collection: 

ATRACK may collect and process various personal data concerning users of its Platform, including: 

  • When the user creates an account and then logs in to the Platform:  in particular, surname, first name, email address and certain optional information (postal address, location, nationality, telephone number, etc.).

This Data is mandatory in order to access the Platform. Without it, the user will not be able to register and use the application's services. 

  • When ATRACK downloads musical data from the Client Catalogue onto the Platform : in particular, surname, first name, and last name of authors-composers, performing artists or music publishers associated with the musical works in the Client Catalogue.

  • When external database suppliers transfer music exploitation data to ATRACK, via API provision or ad hoc metadata sharing : in particular surname, first name, and last name of authors-composers, performing artists or music publishers associated with the musical works in the Client Catalogue.

  • When the user browses the Platform: 

  • Technical information (connection data, browser and plug-in type and version, etc.) and location (IP address, time zone setting and location, etc.) generated in connection with the use of the Platform, the traffic and browsing history of users on the Platform, as well as tracking information on their actions with regard to emails that ATRACK may send them (opens, clicks, etc.); 

  • The use of cookies and other trackers (see ATRACK's cookie and other tracker policy available here: XXX) 

  • Analysis of usage and behavioural data of Platform users: 

ATRACK collects Data (usage and behavioural data) for research and analysis purposes via its Plausible Analytics tool, after anonymising it or, in any case, after implementing processes designed to prevent the Data from being reattributed to an identified person, such as truncating and hashing users' IP addresses. 

5.2. Summary of the processing of personal data carried out by ATRACK (purposes of 

collection and retention periods for the personal data collected) 

The use of Personal Data under applicable data protection provisions must be justified by a legal basis provided for by law. ATRACK is required to indicate the reason for each use of the Personal Data of users of its Platform in this Policy. 

The main reasons justifying the use of BEAM FOR MUSIC Platform users' information are as follows: 

  • The consent of Platform users: when the user has consented to ATRACK using their personal information (the user provides explicit, informed and freely given consent for such use and may withdraw their consent by informing ATRACK). 

  • ATRACK's legitimate interest: ATRACK's interest in conducting and managing its business in order to provide users of its Platform with the best experience under the best conditions. ATRACK considers and manages any potential impact on the user (positive or negative) and their rights before processing their Personal Data for its legitimate interests. 

  • Performance of a contract to which the Platform user is party: processing Data when necessary to perform a contract with the Platform user or taking steps at their request prior to entering into such a contract. 

  • Compliance with a legal or regulatory obligation: processing Personal Data when necessary to comply with a legal or regulatory obligation to which ATRACK is subject. 

  • Legal claims: when the personal Data of Platform users is necessary to defend them, take legal action or file a claim against a user or third party. 

In general, ATRACK retains the Data of its Platform users for a period that does not exceed the time necessary for the purposes for which it was collected, including to meet legal, accounting or reporting requirements. 

To determine the appropriate retention period for Personal Data, ATRACK takes into consideration the amount, nature and sensitivity of the Personal Data, the risk of harm from unauthorised use or disclosure of the Personal Data collected, the purposes for which ATRACK processes the Personal Data and whether it can achieve those purposes through other means, as well as applicable legal requirements. 

  1. WHAT ARE THE CONDITIONS FOR THIRD PARTIES TO ACCESS THE PERSONAL DATA OF USERS OF THE BEAM FOR MUSIC PLATFORM?

In order to offer the services provided on the Platform under the best possible conditions, ATRACK may share the personal data of its Platform users with internal or external recipients under the following conditions:

  • With a limited number of authorised persons and departments within ATRACK, in order to offer the best possible experience: 


  • IT services 

  • Commercial services 

  • Commercial partners and marketing services 

  • Generally, any appropriate person within ATRACK for certain specific categories of Personal Data. 

  • With service providers and partners 


The Personal Data of Platform users may be transmitted to a third party for the purpose of providing services and improving their experience on the Platform, in particular to: 

  • External service providers (IT subcontractors, banks, credit card issuers, routers, hosts, etc.) 

  • Business partners: unless the Platform user objects to the service responsible for personal data protection, ATRACK may enrich the user's profile with certain information about them from its preferred business partners (mailing tools, website security tools, form managers, audience measurement tools, document sharing tools, website browsing tracking tools, social media and internet advertising targeting tools, etc.). In this case, cross-checking, analysis and combination of Data may be carried out via a trusted third party. This Processing will enable ATRACK and its preferred contractual partners to determine the interests of Platform users and their customer profile, and to send them personalised offers.

  • With local authorities: 

ATRACK may be required to transmit information about its Platform users to local authorities if required by law or as part of an investigation and in accordance with applicable regulations. 

  1. HOW DOES ATRACK PROTECT THE PERSONAL DATA OF ITS PLATFORM USERS?

In order to ensure the security of your Data, we take all necessary and appropriate precautions and measures, whether physical, logical, technical, functional, administrative or organisational, in light of the state of knowledge, the costs of implementation and the nature, scope, context and purposes of the Processing, as well as the risks to the rights and freedoms of natural persons, in order to preserve the security and confidentiality of the Data and to guarantee a level of security appropriate to the risk, and in particular to prevent your Personal Data from being accidentally lost, used or obtained in an unauthorised manner, altered or disclosed.

However, due to the inherent difficulties of operating on the Internet and the risks associated with electronic data transmission, we cannot be held liable for any failure to achieve a specific result. 

We have procedures in place to deal with any suspected breach of personal data protection and will notify you and any applicable regulatory body of any breach of personal data protection where we are legally required to do so.

ATRACK, as Data Controller, shall notify the CNIL of any personal data breaches as soon as possible and, where possible, within seventy-two hours of becoming aware of any personal data breach that may pose a risk to the rights and freedoms of the individuals concerned. 

Any breach of the personal data of users of the BEAM FOR MUSIC Platform that could pose a high risk to their rights and freedoms will be notified to ATRACK as soon as possible in accordance with the regulations in force. 

In the event of subcontracting all or part of the processing of personal data, we contractually impose security guarantees on our subcontractors, in particular confidentiality guarantees with regard to the personal data to which they may have access.

  1. WHAT IS ATRACK'S POLICY ON REGARD TO COOKIES AND OTHER TRACKERS?

ATRACK uses cookies and other trackers on its Platform and on the corresponding website. For more information, users can refer to the company's "Cookies and Other Trackers Policy" available at: XXX

  1. WHAT ARE THE RIGHTS OF USERS OF THE BEAM FOR MUSIC PLATFORM?

In accordance with the aforementioned legal and regulatory provisions, users of the Platform have the following rights:


  • Right of access to their Personal Data (commonly referred to as a "data subject access request"): this allows them to receive a copy of the Personal Data that ATRACK holds about them and to verify that it is being processed lawfully.


  • Right to rectify their Personal Data: this allows Platform users to have incomplete or inaccurate Data held about them by ATRACK corrected, although ATRACK has the right to verify the accuracy of new Data provided by its Platform users. 


  • Right to erasure of Personal Data: this allows Platform users to request that ATRACK modify or delete Personal Data when there is no valid reason for it to continue processing it. Platform users also have the right to request that ATRACK delete Personal Data when they have successfully exercised their right to object to Processing (see below), when ATRACK has processed information unlawfully, or when ATRACK is required to erase Personal Data to comply with applicable law. It should be noted that ATRACK is not always able to comply with a request for deletion for specific legal reasons, which will be notified to the user, if applicable, at the time of their request.


  • Right to object to the Processing of Personal Data: when ATRACK relies on a legitimate interest (or that of a third party) and there is something in a user's particular situation that causes them to object to the Processing on that ground, as they believe it affects their fundamental rights and freedoms. The user also has the right to object to the processing of their personal data for direct marketing purposes. In certain cases, ATRACK may demonstrate that it has compelling legitimate grounds for processing their personal information that override the rights and freedoms of the Platform user. 


  • Right to restrict the processing of personal data: this allows the Platform user to request that the processing of their personal data be suspended in the following scenarios: (a) if they wish the company to establish the accuracy of the data; (b) when the use of the Data by ATRACK is unlawful but the user does not want the company to erase it; (c) when the Platform user needs ATRACK to retain the Data even if it no longer needs it, because they need it to establish, exercise or defend their rights; or (d) the user has contested the use of their Data, but the company must verify whether it has compelling legitimate reasons to use it.


  • Right to Data portability: ATRACK provides users of its Platform, or a third party of their choice, with their personal Data in a structured, commonly used and machine-readable format. It should be noted that this right only applies to automated information that Platform users have initially authorised for use or when ATRACK has used it to perform a contract with them.


  • Right to withdraw consent: at any time when the company requires the consent of its Platform users for the Processing of their Personal Data. However, this will not affect the lawfulness of any Processing carried out before they withdraw their consent. If users withdraw their consent, the company may not be able to provide them with certain services. The company will notify them if this is the case at the time they withdraw their consent.



    All requests to exercise these rights, as well as all requests for information concerning the protection of Personal Data, must be made by post to the following address: 20 rue Auguste Blanqui, 94250 Gentilly, France, or by email to the following address: here.

    In order to ensure confidentiality and protect personal data, ATRACK must verify the identity of users of its Platform before responding to such requests. Therefore, any request to exercise these rights must be accompanied by a copy of a signed identity document.

    Users of the BEAM FOR MUSIC Platform may, in any event, lodge a complaint with a national authority responsible for the protection of personal data (in France, this is the Commission Nationale de l'Informatique et des Libertés or "CNIL") if they believe that their Data is not being processed in accordance with the applicable provisions.

  1. PERSONAL DATA PROTECTION OFFICER

Given the volume of personal data processing carried out by the company, ATRACK could appoint a Data Protection Officer (DPO) to the CNIL. 

The role of the Data Protection Officer is to ensure compliance with regulations relating to the protection of personal data. For more information, you can contact the DPO at the following address: contact@beamformusic. 

  1. HOW CAN YOU STAY INFORMED ABOUT UPDATES TO THIS POLICY?

This personal data protection policy is subject to change or adjustment at any time.

In the event of any changes or adjustments, the new policy will be posted on the Platform in the dedicated section. In addition, all personal data collection forms on the relevant Platform provide a link to this policy. We therefore invite Platform users to consult it regularly.

If you have any questions regarding the processing of personal data, you can contact ATRACK at the following email address: contact@beamformusic. The company will respond as soon as possible.

Last modified: 01.2026.