1 Introduction

TONO is committed to protecting the personal data processed by the organization and thus the privacy of its data subjects. Pursuant to the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the “GDPR“), TONO is obliged to provide you with information on its processing activities.

TONO acts as the data controller for the personal data it processes about its data subjects. If you have any questions about how TONO processes your personal data or would like to make use of your rights as a data subject, please contact us at:

TONO SA, tel. +47 2205 7200, e-mail: [email protected].

2 Definitions

Throughout this policy we use a number of terms that have the following meaning:

  • Personal data” means, briefly, any and all data which can be attributed to a (living) natural person, for example name, e-mail, address, or any combination of data which entails that a person can be identified.
  • Processing” means any and all measures performed on personal data such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
  • Data controller” is the person who alone, or together with others, determines the purposes and means for the processing of the relevant personal data. The controller of personal data is the party with primary responsibility for ensuring that personal data is processed in accordance with the GDPR.
  • Data processor” is the person who processes personal data on behalf of the controller of personal data, for example a supplier of salary administration services.
  • Data subject” is the person whose personal data is processed by TONO, i.e. members, customers, potential customers, contact persons at our sister societies and other partners, employees, job applicants and references.
  • Affiliation contract” means the rights management agreement in which a rightholder assigns to TONO the management of his/her copyrights, and whereby TONO undertakes to collect and distribute payments/royalties for the performance of the rightholder’s copyright protected works.
  • Collecting society” means a collective rights management organisation, such as TONO.
  • Sister societies” are other collecting societies located world-wide which, on the basis of reciprocal representation agreements we have with such societies, ensure the collection and distribution of royalties to TONO’s members for performances carried out in the sister societies’ respective territories, and vice versa.
  • Reciprocal representation agreement” means the agreement TONO has with its sister societies for the reciprocal management of rights.

3 Our processing of your personal data

I am a TONO-member:

What information we process about you and why

If you are a member of TONO, we may process personal data about you such as your contact details, banking details, information about your artistic works and the use of such works, royalty payment history, performance reports, proxies, exchange certificates, IPI-number, log-in details for “Mitt Tono” and certain other information necessary for administering and fulfilling the affiliation contract with you. This information is either provided by you or obtained from third party sources such as TONO’s sister societies and public agencies/databases which may provide us with information regarding you or your repertoire, and the usage of the latter. The legal basis for the processing is that the processing is necessary in order to fulfil the affiliation contract with you, or to take steps at your request prior to entering into the contract.

If you have applied for a TONO-grant we will process the information you have provided to us in the electronic application form, as well as income statistics we have on you, in order for us to process the application and select the chosen recipients of the grant. The legal basis for the processing is that the processing is necessary in order to fulfil our legitimate interest in distributing the TONO-grants.

We may also process your personal data for the purposes of publishing anonymised sales figures and statistics, in order to provide you with market updates and information from TONO (e.g. newsletters), and otherwise as required in order for us to manage your rights in the most effective manner. This processing is based on our legitimate interests related to the abovementioned purposes,  which we deem not to be overridden by your privacy interests. We may also process your personal data to the extent that we have a legal obligation to do so.

Transfer of your data to third parties

In order to be able to fulfil the affiliation contract we have with you, TONO discloses your personal data to its sister societies, organised through CISAC’s (umbrella organisation for collecting societies worldwide) systems, in order for them to be able to represent you on their territory. Further, TONO may disclose your personal data (only name, IPI-number, member number, role in the work and work share) to your co-authors, as well as to our partners such as Nordisk Copyright Bureau (NCB), who licenses mechanical rights (phonograms, CDs, synchronisation rights etc.), and Network of Music Partners (NMP), who carries out back-office services related to the largest online services (Spotify, YouTube, iTunes etc).   We also disclose your personal data to our service providers such as ICE International Copyright Enterprise Germany GmbH, who processes personal data on behalf of TONO and thus act as TONO’s data processors.

Further, as appropriate for the administration of your membership, TONO may disclose your personal data (only name, IPI-number, member number and role in the work) to other members (copyright holders and music publishers).

If we have a legal obligation to do so, personal data may also be disclosed to public authorities such as the tax authorities.

TONO may transfer your personal data to countries outside the European Economic Area (EEA). This applies inter alia to the exchange of data between TONO and its sister societies who are located world-wide. In case personal data is transferred outside the EEA, TONO will ensure that suitable safeguards are in place to ensure an adequate protection of the personal data.

I am a rightholder who is not a member of TONO

What information we process about you and why

Even though you are not a member of TONO, TONO may process personal data about you which we receive from our sister societies (if you are a member of such a society) or from other right holders, publicly available sources and from you directly. This includes personal data such as your name, contact details, proxies, information on your authorized representative, IPI-number, information about your artistic works and the use of such works, royalty payment history, performance reports, and society affiliation. The information is necessary in order for us to pursue our legitimate interests in fulfilling the reciprocal representation agreement we have with your collecting society, to take steps in order to enter into an affiliation contract with you, or otherwise in order to manage your rights.

Additionally, we may process your personal data for the purposes of publishing anonymised sales figures and statistics, and otherwise as required in order for us to manage your rights in the most effective manner. This processing is based on our legitimate interests related to the abovementioned purposes which we deem not to be overridden by your privacy interests.

Transfer of your data to third parties

In order to manage your rights, TONO may disclose your data to your co-authors, entities that manage TONO’s rights on certain areas such as Nordic Copyright Bureau (NCB), Network of Music Partners (NMP), as well as TONO’s sister societies through the systems of CISAC.

Further, TONO may disclose your personal data to other members, as well as our service providers such as ICE International Copyright Enterprise Germany GmbH, who process personal data on behalf of TONO and thus act as TONO’s data processors. If we have a legal obligation to do so, personal data may also be disclosed to public authorities such as the tax authorities.

TONO may transfer your personal data to countries outside the European Economic Area (EEA). This applies inter alia to the exchange of data between TONO and its sister societies who are located world-wide. In case personal data is transferred outside the EEA, TONO will ensure that suitable safeguards are in place to ensure an adequate protection of the personal data.

I am a customer or a potential customer:

What information we process about you and why

If you are a private customer, sole proprietorship or a contact person at a company/organisation which is a customer of TONO, we may process certain information that is provided by you or the company/organisation in which you work, such as your name, contact details, payment information, information about the use of copyright protected works, licenses, etc. This information is processed in order to administer and follow-up on the customer relationship we have with you or the company/organisation in which you work. The legal basis is either that the processing is necessary in order to fulfil the contract TONO has with you as a private customer or sole proprietorship, or in order to pursue our legitimate interests in fulfilling the contract we have with your company/organisation. We consider that these interests are not incompatible with the safeguarding of your privacy interests.

Additionally, we may use the information in order to publish anonymised sales figures and statistics, which we do based on our legitimate interest which we deem not to be overridden by your privacy interests.

If you are a potential customer, i.e. someone who is using copyright protected works without a current license, we may process certain information about you, including your name, contact details, place of work and information about the use of the works. The information is obtained through publicly available sources such as social media, news articles, as well as music surveillance services, our inspectors and collaborators, etc. We process this information in order to contact you to ensure that you obtain the necessary license from us to make use of the works in question. The legal basis for this processing is that the processing is necessary in order to fulfil our legitimate interests as a collecting society. We consider that these interests are not incompatible with the safeguarding of your privacy interests.

Transfer of your data to third parties

We may transfer your personal data to Gramo, which administers the rights of performing artists and record companies and with whom TONO collaborates regarding use of music at customer premises. Further, your personal data may be disclosed to our service providers who process personal data on behalf of TONO and thus act as TONO’s data processors, as well as to relevant third parties in connection with collection of payment. If we have a legal obligation to do so, personal data may also be disclosed to public authorities such as the tax authorities.

I am a contact person at a sister society, music publisher or another business partner of TONO

What information we process about you and why

If you are an employee/contact person at one of our sister societies, music publishers or other business partners, we may process personal data that we receive from you or the organisation/company to which you are associated, including your name and contact details. We do this in order for us to administer and follow-up on the contractual relationship we have with the organisation/company to which you are associated (e.g. the reciprocal representation agreements). The legal basis for the processing is that the processing is necessary in order to fulfil our legitimate interest in administering and fulfilling the aforementioned contractual relationships. We consider that this interest is not incompatible with the safeguarding of  your privacy interests.

Transfer of your data to third parties

To the extent necessary in order for us to carry out our operations, we may transfer contact details pertaining to contact persons at music publishers or sister societies to our members or others such as our sister societies. In case contact details are transferred to our sister societies located outside the EEA, TONO will ensure that suitable safeguards are in place to ensure an adequate protection of the personal data.

4 how long do we keep your personal data?

In general, certain key information about copyright protected works will be kept without any limitation in time, as the works databases are of importance for an optimal management of your and others’ (including your heirs’) rights under TONO’s mandate. Otherwise, TONO retains your personal data for no longer than is necessary for the purposes for which it was collected.

When deciding relevant retention periods, we will take into account factors including:

  • legal obligations under applicable law to retain data for a certain period of time;
  • statute of limitations under applicable law;
  • (potential) disputes; and
  • guidelines issued by relevant data protection authorities.

Once retention is no longer necessary, we securely delete or anonymise your personal data.

5 your rights as a data subject

As a data subject you have certain rights that you may make use of in relation to TONO’s processing of your personal data. The various rights are not absolute and each is subject to certain exceptions or qualifications.

  • Right to access: As a data subject, you have a right to request us to confirm whether we process personal data concerning you, and if so, to give you access to the personal data and more detailed information about the processing activity.
  • Right to data portability: If the processing is carried out by automated means and the legal basis for the processing activity is consent or performance of a contract, you may be entitled to request us to provide you with a subset of your personal data in a structured, commonly used and machine-readable format. If the above apply, you may also require us to transmit the subset of your personal data directly to another data controller.
  • Right to rectification: TONO has a constant obligation to ensure that the personal data it is processing is accurate and up to date. If you discover that the personal data we process about you is inaccurate or incomplete, you may require us to rectify or complete the personal data.
  • Right to erasure: TONO has an obligation to delete or anonymize your personal data when it is no longer necessary to process the data for the purpose it was collected for. Additionally, you have a right to request us to delete your personal data in certain situations.
  • Right to restriction: You have the right to require that we (temporarily) restrict the processing of your personal data in certain circumstances.
  • Right to objection: In certain circumstances, e.g. where the legal basis for processing is a legitimate interest, you may object to the continued processing. If you do so, TONO will re-evaluate the legitimate interest and the interest of your data privacy. We will only continue the processing activity if i) there are compelling legitimate reasons for the processing which outweigh your interests, rights and freedoms; or ii) the processing is necessary to establish, enforce or defend against legal claims.

If you would like to make use of your rights as a data subject, please contact us at the contact details set forth above.

6 Safeguarding your personal information

TONO takes all reasonable precautions to keep your personal data secure and has implemented technical and organizational measures to do so. We also require any third parties that handle or process your personal information for us to do the same.

7 Right to lodge a complaint

We hope that we can resolve any query or concern you raise about our use of your personal data.

The GDPR also gives you right to lodge a complaint with a supervisory authority, in particular in the European state where you work, normally live, or where any alleged infringement of data protection laws occurred. The supervisory authority in Norway is Datatilsynet (www.datatilsynet.no). On this website you can find more information about your rights and our duties under the applicable data protection legislation.

8 update of policy

This privacy policy may be updated, e.g. to ensure TONO’s continued compliance with the GDPR and applicable local data privacy laws, and to provide our data subjects with up to date information on our processing activities. We recommend you to visit this policy on a regular basis.