Privacy Policy

1. Scope and Application

This Privacy Policy describes how Afro Soundtrack collects, uses, discloses, retains, and protects personal data of individuals (“you”) in accordance with the Nigeria Data Protection Act 2023 (NDPA) (and General Application and Implementation Directive (GAID) 2025) and the European Union (EU) General Data Protection Regulation (GDPR). It applies to all users of our websites, mobile apps, services, content licensing platform, and related applications (collectively, the “Services”), regardless of device or location.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your personal data as described. If you do not agree, you may not use our Services. We will update this Privacy Policy as needed; the updated version will be effective upon posting with a new date.

Application of this Privacy Policy

This Privacy Policy applies to your use of (regardless of means of access) our Services. You may access or use our Services through a desktop, laptop, mobile phone, tablet, or other consumer electronic device (each, a “Device”).

2. Disclosure of Personal Data

We are committed to maintaining the confidentiality of your Personal Data and will only disclose it where necessary, lawful, and consistent with this Privacy Policy. We do not sell your Personal Data to third parties.

We may disclose or share your Personal Data in the following circumstances:

• Compliance with legal obligations:To comply with applicable local, state, federal, or international laws and regulations, or to respond to lawful requests from courts, regulatory authorities, law enforcement agencies, or other governmental bodies, including subpoenas, court orders, warrants, or other legal processes.
• Protection of legal rights and safety:Where disclosure is necessary to establish, exercise, or defend legal claims; enforce our Terms of Use or other agreements; protect the rights, property, or safety of Afro Soundtrack, our users, employees, partners, or the public; investigate suspected fraud, cyberattacks, security incidents, intellectual property infringement, or other unlawful activities; or cooperate with lawful investigations.
• Service providers and data processors:We may share your Personal Data with carefully selected third-party service providers that perform services on our behalf, including cloud hosting providers, payment processors, email and communication platforms, analytics providers, customer support services, IT service providers, marketing service providers, and other vendors necessary for the operation of our website, products, services, and applications. These third parties are contractually required to implement appropriate technical and organisational security measures, maintain the confidentiality of your Personal Data, process such data only in accordance with our documented instructions, and use it solely for the purposes for which it was disclosed.
• Authorized Account Access for Support and Review:In certain circumstances, we may require temporary access to your account or user portal to investigate account inconsistencies, resolve technical issues, verify login activity, recover access, troubleshoot platform errors, review rights management information, or provide other customer support services you request. Such access will only be undertaken with your prior express authorization or where it is reasonably necessary to perform our contractual obligations or protect the security and integrity of our Services, and only to the extent permitted by applicable law. Where you voluntarily authorize the use of secure administrative access credentials or masterkey for this purpose, such access shall be strictly limited to the specific issue for which authorization was granted, performed only by authorized personnel who are subject to confidentiality obligations, and restricted to the minimum level of access necessary to resolve the issue. We will not retain, use, or disclose your login credentials beyond the duration reasonably required to provide the requested support, unless retention is required by law or expressly authorized by you. All support access activities may be logged, monitored, and audited to maintain security, accountability, and compliance with applicable data protection laws.
• Affiliated companies:We may share your Personal Data with our parent company, subsidiaries, affiliates, or other companies within the Spring Sound group where necessary to provide our Services, administer our business operations, or improve our products and services. Any affiliated entity receiving your Personal Data will be required to maintain privacy and data protection standards that are substantially equivalent to those set out in this Privacy Policy.
• Analytics and advertising partners:We may share limited information with trusted analytics and advertising partners to understand how users interact with our Services, improve functionality, measure the effectiveness of our campaigns, and deliver relevant content. Where feasible, such information will be aggregated, anonymised, or pseudonymised. We will only share identifiable Personal Data for marketing or advertising purposes where we have your consent or another lawful basis for processing.
• Business transactions:If Afro Soundtrack or substantially all of its assets are involved in a merger, acquisition, corporate restructuring, financing, reorganisation, sale of assets, or similar business transaction, your Personal Data may be transferred to the acquiring or successor entity as part of that transaction. Any successor entity will be required to process your Personal Data in accordance with this Privacy Policy or provide you with notice of any material changes before processing your data for new purposes.
• International data transfers:Where it is necessary to transfer your Personal Data outside Nigeria, the European Economic Area (EEA), the United Kingdom, or any other jurisdiction with applicable data protection laws, we will ensure that such transfers are carried out in accordance with applicable legal requirements and are protected by appropriate safeguards, including contractual clauses, adequacy decisions, or other legally recognised transfer mechanisms.

Where legally permitted, we will notify you before disclosing your Personal Data in response to requests from public authorities or where your information is to be shared in a manner materially different from that described in this Privacy Policy.

You may request that we restrict or object to certain disclosures or sharing of your Personal Data by contacting us using the contact details provided in this Privacy Policy. Please note, however, that restricting certain disclosures may affect our ability to provide some features or functionality of our Services.

What Personal Data Do We Collect?

We collect and process categories of personal data (depending on context), including:

• Identity data: Name, professional/stage name, username.
• Contact data: Email address, phone number, postal/mailing address.
• Account data: Account credentials, profile details, preferences.
• Payment/Financial data: Billing address, bank or card details (collected only via secure payment processors).
• Rights/licensing data: Ownership shares, copyright or publisher information, metadata about songs/works.
• Communications data: Records of your communications with us (e.g., support requests, emails).
• Marketing data: Subscription preferences, newsletter signups, survey responses.

How We Collect Data

• Directly from you: When you register for an account, license a track, purchase a service, subscribe to a newsletter, or otherwise provide information via forms or communications.
• Automatically via Technology: Through cookies, pixels, web beacons, and our servers. These technologies collect technical and usage data about your visits.
• From Third Parties: Such as payment processors, music distribution platforms, public databases (e.g. PROs/CMOs), analytics providers, or other users who submit your artist/work information.

Where required by law, we will obtain your consent before collecting data in any way that demands consent (e.g., marketing emails, profiling for ads, non-essential cookies).

3. Data Security

We maintain robust security measures (technical and organizational) to protect your personal data against unauthorized access, loss, alteration, or destruction. These include encryption of data at rest and in transit, access controls, firewalls, intrusion detection, and regular security assessments. All staff and contractors with access to personal data are trained on privacy requirements and bound by confidentiality. Our vendors and processors must implement security measures and notify us of any breach promptly. While we strive to protect your data, no system is 100% secure. Your communication of data to us is at your own risk, and we cannot guarantee the absolute security of Internet transmissions.

4. Data Retention

We retain personal data only as long as necessary for the purposes stated above, plus any retention periods required by law. Our retention approach follows the data minimization and storage limitation principles. Representative retention periods are:

• Account data: Retained as long as your account is active, plus up to 3 years after account closure (for fraud prevention and service history).
• Transaction/payment data: Retained for up to 7 years (to meet Nigerian tax and accounting laws).
• Marketing consent/preferences: Retained until you withdraw consent or opt out.
• Support inquiries: Retained for 2 years after resolution for service improvement and reference.
• Cookies/tracking data: Session cookies are deleted after the session; persistent cookies remain for up to 2 years or until consent is withdrawn.
• Log files/analytics: Aggregated logs may be kept longer (anonymized), but anything linked to you is purged or de-identified within 1 year. After a retention period ends, personal data will be securely deleted or rendered anonymous. If you request erasure, we will purge data unless there is a legal obligation to retain it (e.g., for audits or claims).

5. Your Rights

Under the NDPA and GDPR, you have extensive rights regarding your personal data. In summary, you may:

1. Access: Request confirmation and a copy of the personal data we hold about you.
2. Rectification: Ask us to correct incomplete or inaccurate data.
3. Erasure (“right to be forgotten”): Request deletion of data if it is no longer needed, or if processing is unlawful, or if you withdraw consent. (We will honor erasure requests unless we have an overriding legal obligation.)
4. Restriction: Ask us to pause processing in certain situations (e.g., accuracy is contested, unlawful, but you prefer restriction to deletion).
5. Data Portability: Request to receive your data in a structured, machine-readable format or to have it transmitted to another controller, where we process it by automated means and based on consent or contract.
6. Object: Object to processing based on legitimate interests or profiling. Also, always have the right to opt out of marketing communications.
7. Withdraw Consent: If processing is based on consent, you can withdraw consent at any time without affecting past processing.
8. Complaint: Lodge a complaint with the Nigeria Data Protection Commission (NDPC) or, for EU data subjects, with any relevant EU supervisory authority.

To exercise your rights, email copyright@afrosoundtrack.com or write to our Privacy Contact at the address above. We will verify your identity and respond within the legal timeframe (usually 30 working days in accordance with GDPR requests).

6. Opting Out of Marketing

From time to time, we may send you informational or marketing communications related to our website, services, and applications, such as announcements or other information. If you wish to opt out of such communications, you may contact the following email address: copyright@afrosoundtrack.com. You may also click the opt-out link, which will be provided at the bottom of all such communications.

Please be advised that even though you may opt out of such communications, you may still receive information from us that is specifically about your use of our website, services, and applications or your account with us.

By providing any Personal Data to us, or by using our website, services, and applications in any manner, you have created a commercial relationship with us. As such, you agree that any email sent from us or third-party affiliates, even unsolicited email, shall specifically not be considered SPAM, as that term is legally defined.

7. Notification of Breach

In the event of a personal data breach, we will act promptly. If we become aware of a breach likely to risk individuals’ rights, we will notify the NDPC within 72 hours of awareness, as required by Section 40(2) of the Nigerian Data Protection Act 2023. The notification will include all available information about the breach (nature, affected data categories, number of subjects, consequences, measures taken). We will also notify affected individuals without undue delay, Section 40(3) of the Nigerian Data Protection Act 2023, if their personal data was compromised in a way that may harm them. This notice will be in plain language and advise steps to protect themselves (e.g., changing passwords, monitoring accounts). If we delay notification, we will document the reasons.

8. Contact Information

If you have any questions about this Privacy Policy or the way we collect information from you, or if you would like to launch a complaint about anything related to this Privacy Policy, you may contact us at the following email address: copyright@afrosoundtrack.com

9. Changes to the Privacy Policy

This Privacy Policy is effective as of the date written above and will remain in effect except with respect to any changes in its provisions in the future, which will be in effect immediately after being posted on this page.

We reserve the right to update or change our Privacy Policy at any time, and you should check this Privacy Policy periodically. Your continued use of the Service after we post any modifications to the Privacy Policy on this page will constitute your acknowledgement of the modifications and your consent to abide by and be bound by the modified Privacy Policy.