Privacy Policy of PhonoNet AG

Version 1.1 / 24.08.2026

phononetlogo final gross ch

This privacy policy (the “Privacy Policy”) explains and sets out the basis on which we collect personal data when you visit our websites, use our services, interact with us under a contract, communicate with us, or otherwise deal with us, how we use such data, the conditions under which we disclose it to third parties, and the measures we take to protect it. We operate various websites. Where we refer to our website, we mean in each case the website for which this Privacy Policy is published. Individual websites may not offer all of the functions mentioned in this Privacy Policy, in which case this Privacy Policy is not relevant to that extent. Should the data processing on individual websites differ from the data processing described in this Privacy Policy, we will inform you separately of this (e.g. only necessary cookies are used on the eMediaCatalog website, see clause 2.12 below). We may also inform you separately, in another form, about the processing of your data, for example in consent declarations, terms and conditions, additional privacy notices, forms and other notices. The term “data” is used here as a synonym for “personal data”.

If you provide us with information about individuals other than yourself, you must ensure that the data is accurate and that those individuals understand how their data will be used, that they have given their consent to this, and that they authorise us and our service providers to use it. You are welcome to provide them with a copy of this Privacy Policy.

1. Controller

Unless we inform you otherwise in a particular case, the controller responsible for the processing of your data under this Privacy Policy (the “Controller”) is:

PhonoNet AG
Seefeldstrasse 104
CH-8008 Zürich

If you have any questions about data protection or wish to exercise your rights, please feel free to contact us at dataprotection@phononet.ch.

2. Data Collection and Purpose of Processing

We process the following data about you for the purposes set out below:

2.1 Data Collection on Our Website

When you visit our website, we collect personal data required for the functionality and security of our website.

The data collected includes, among other things: IP address; information about your device’s operating system; cookies; referrer URL; volume of data transferred; date, region and time of the server request; websites from or through which access takes place; the sub-pages accessed on the website, browser type and version and language; screen resolution, name of your internet service provider; logs, etc.

For registered users logged into the Music Promotion Network (MPN), a randomly generated, non-descriptive UUID (Universally Unique Identifier) is stored as a technical primary key linked to the user account. The UUID contains no directly identifying information. It serves as a unique, cross-system identifier that enables the data described below to be linked to the relevant user account.

The UUID is stored both server-side and in the user’s browser (local storage). Storage in the browser serves exclusively to ensure, at a technical level, when the user interface is displayed, that certain security-relevant actions cannot be carried out on the user’s own account. Specifically, comparison with the UUID stored in the browser prevents a user from deleting their own account, from changing their own role (SuperUser/administrator/normal user) on the “Edit User” page, from blocking their own account, or from activating alias mode for their own account. Within the browser, the UUID is used solely for these technically necessary authorisation checks when displaying the user interface. No logging, tracking or other recording of usage behaviour takes place by means of the UUID stored in the browser. On the back end (server side), the UUID is logged as the technical primary key of the user entity with every request. This server-side logging comprises linking server requests to the relevant user account, including the time (date, time) of the request. Since a large number of log entries is generated per user, the UUID, as a unique identifier, is technically essential in order to be able to attribute these log entries to the relevant user account.

2.2 Communication and Contact Forms

When you contact us via an online contact form, email, telephone, letter or other means, we record the data exchanged between you and us in order to communicate with you and offer you our services, in particular to respond to your enquiries. By providing us with this data, you agree that we may use your personal data in accordance with this Privacy Policy.

The data collected includes, among other things: contact details; the manner, method, place and time of the communication; the content of the communication, etc.

If you communicate with us via our accounts on third-party platforms such as LinkedIn, Twitter/X or Facebook, your data will also be processed in accordance with the privacy provisions of the relevant platform.

Further information on the purpose and scope of data processing by third-party providers can be found in their respective privacy policies.

2.3 Provision of Services and Performance of a Contract

We process your data in order to conclude, perform and manage a contract with you and to provide our products and services to you.

The data collected includes, among other things: your contact details and other information you provide to us; information relating to your use of our online services (e.g. eMediaCatalog, Music Promotion Network (MPN), see also clause 2.5 in this regard) and/or in connection with a possible conclusion of a contract and the conclusion of a contract (e.g. products purchased by you, services provided to you; application processes); information on the performance and administration of contracts; information on defects, complaints and contract amendments; financial data; details of downloads of offers, information, brochures, etc.

2.4 Improvement and Innovation of Our Products and Services

We process your data for marketing and business purposes in connection with our products and services, in particular to further develop our products, services, website and other platforms on which we are active, and to expand our products and services.

The data collected corresponds to the data referred to in clause 2.3.

2.5 Our Online Offerings

As part of our online offerings, we provide, among other things, information on music titles, albums and artists. Use of our online offerings (e.g. eMediaCatalog, MPN, purchases in our shop) requires you to sign up or register. We process the data collected in this connection in order to provide our services and ensure the functionality and security of the online offerings.

The data collected includes, among other things: medium; institution; position; salutation; title; surname, first name; address; email address, telephone; fax; login name/username; password, etc.

2.5.1 Music Promotion Network (MPN)

The following additionally applies to media partners when using the MPN:

When using the MPN, you may store additional data linked to your user account alongside this information (e.g. preferred genres, watchlist entries, etc.). This serves solely to enable use of the MPN. This information is not processed for any other purpose. Within your user account, you further have access to the following functions, the use of which makes personal data visible within the MPN to other registered users or industry partners:

Playlist: you can save tracks to a digital watchlist. You have the option of sharing this playlist with colleagues at your company. Depending on the rights granted by the creator of the playlist, your colleagues can view, delete and add tracks to those saved there themselves. In doing so, the titles you have saved and your name are disclosed to your colleagues at your company.

The following additionally applies to industry partners when using the MPN:

On the basis of the data transmitted by you, a user account is set up once the industry participant agreement has been formed. This user account gives you access to the functionalities of the MPN offering for industry partners. This includes, in particular, a Customer Relationship Management system through which you can create and manage your music products, promotional data and contact addresses, and transmit data to participating media partners in connection with sampling and promotional campaigns. The data you enter may also include personal data (e.g. contact information in the address book). Data you provide when uploading products to the MPN may be viewed by media partners participating in the MPN. Via the MPN user administration, administrators of a company can manage the various users of their company (e.g. restrict or grant usage rights). The names of the users within the same group of users (company) are visible both to the company’s administrators and, depending on the user rights granted, to the other users within the same group of users.

Cost-triggering activities, namely sampling and bookings of newsletter placements, are logged as usage data and stored in connection with your user account, together with the following data: date, time, product selection, recipient selection, campaign periods, newsletter selection, and costs incurred.

2.5.2 Purchases in Our Shop System

Industry partners can make purchases via their user account in our integrated online shop system (operated on the basis of Shopware). In connection with a purchase, we process the personal data required to conclude and perform the purchase contract. The mandatory fields marked with an asterisk “*” in our shop must be completed by you, as otherwise we are unable to conclude a purchase contract with you. To settle the purchase price, the following payment methods are available to you via the payment service provider Stripe: credit card and — on the Swiss instance of our website — TWINT. When you complete your order, the data required for payment is passed on to the payment service provider Stripe.

2.6 Third-Party Online Offerings, such as the Tracking Portal

Our website may also contain third-party offerings, for example a link to the tracking portal of Phononet GmbH, Germany. Please note that we are not responsible for such offerings or for the processing of data by third parties. Further information on the relevant offerings and the related data processing can be found on the website or in the privacy policy of the relevant third party. See also clause 2.14 (“Links to Third-Party Offerings”) below.

2.7 Job Applications

We process your data in connection with the application process in order to respond to your contact, review your profile, and prepare for and manage a possible future employment relationship.

The data collected includes, among other things: contact details and personal information (e.g. name, address, email, telephone number, date of birth, nationality); details from your application form (e.g. motivation, position applied for, workload, etc.); application documents (e.g. CV, information on previous employers, references and employment references, data on professional experience, information on education and further training, other qualifications), etc.

We store your data for a period of six (6) months following completion of the application process. If we are unable to offer you a currently vacant position but consider, based on your profile, that your application may be of interest for future job openings, we will store your personal application data for twelve (12) months, provided you have expressly consented to such storage and use.

The above retention periods do not apply where statutory provisions preclude deletion, where further storage is required for evidentiary purposes, or where you have expressly consented to longer storage.

2.8 Security Reasons

We process your data in order to protect our IT and other infrastructure. For example, we process data to monitor, analyse and test our networks and IT infrastructure, including access controls. We may also use monitoring systems, e.g. cameras, for security purposes. In such a case, we will inform you separately at the relevant locations.

2.9 Compliance with Laws and Legal Proceedings

We process your data to comply with statutory requirements, e.g. to combat money laundering and the financing of terrorism, to fulfil tax obligations, etc., and we may need to request further information from you in order to comply with such requirements or as otherwise required by law or by the authorities. In addition, we may process your data to assert legal claims and to defend ourselves in disputes and proceedings before authorities.

2.10 Risk Management, Corporate Governance and Business Development

We process your data as part of our risk management and corporate governance, in order to protect ourselves against criminal or abusive activities. As part of our business development, we may sell businesses, parts of businesses or companies to others, or acquire them from others, or enter into partnerships, which may, where applicable, result in the exchange and processing of data on the basis of your consent.

2.11 Newsletter

If you subscribe to our newsletter, we process the data you have provided (e.g. contact details) in order to send you our newsletter. You can unsubscribe from our newsletter by using the unsubscribe option contained in the newsletter or by sending us an email to the address mentioned above.

The data collected includes, among other things: name; email address.

2.12 Cookies

Our website uses cookies. Cookies are small text files that are stored on a user’s device when visiting a website. Cookies contain information that allows a device to be recognised and, where applicable, enables certain functions of a website. We distinguish between our own cookies and external, so-called third-party cookies. Our website uses “session cookies” and “persistent cookies”. “Session cookies” are automatically deleted when you end your internet session and close your browser. Persistent cookies remain stored on your device for a longer period. In addition to cookies, we also use other tracking technologies, such as pixels or so-called fingerprinting. All other cookies and tracking technologies that are not technically required are only set after you have actively consented to the use of cookies/tracking technologies via our consent management tool. We use the service https://cookieconsent.orestbida.com/ to obtain and document consent. The consent management tool itself stores your selection in a cookie on your device. As a result, you do not need to make a decision about cookies again on a subsequent visit to our website.

You can find out in the consent management tool’s settings which cookies are used on our website, for what purpose, how long they are stored on your device, and which consents you may already have given.

On our website cat.phononet.ch, we only use strictly necessary session cookies. These are cookies that are strictly necessary for the functionality of the website and the functions offered there. No other cookies are used on this website; in particular, no website analytics or use of tracking technologies take place. The processing of these cookies is based on our legitimate interest. For this reason, you will not find a consent management tool on this website either.

2.13 Embedded Social Media Content

On individual sub-pages of our website, in particular on the detail pages of releases, we embed social media content from the relevant artists from the platforms TikTok, Facebook and Instagram. These are posts that the artists have themselves published on the social networks mentioned and that we integrate directly into our website by means of so-called iFrames or embed codes (“embedding”). Through embedding, the content is not stored on our server but is loaded directly from the servers of the relevant social networks and displayed within our website. Embedding only takes place after you have given your consent. You can give this consent via the consent management tool or at the relevant point where social media content is to be displayed. As long as no consent has been given, only a placeholder together with a corresponding notice is displayed there. Only after you have given your consent is a connection established with the servers of the relevant social network. In doing so, the social network’s server is informed which sub-page of our website you have visited. In addition, your IP address and, where applicable, further technical information about your browser (such as browser type, operating system, screen resolution and language settings) are transmitted to the relevant provider. If you are logged into the relevant social network at the time of your visit to our website, the provider may be able to link the information collected via our website to your account there. You can prevent this by logging out of the relevant social network before visiting our website. In the course of this embedding, the social networks may set cookies and other tracking technologies on your device and use the data thereby obtained for their own purposes, in particular for personalising advertising and creating usage profiles. We have no influence on the nature and extent of the data processed by the social networks.

This processing takes place in order to enable us to display, on the relevant artists’ and releases’ sub-pages, their current social media content from TikTok, Facebook and Instagram directly on our website, and thereby to offer you an appealing and informative user experience.

Through the embedding of social media content, personal data is transmitted to the providers of the relevant social networks listed below:

  • Facebook and Instagram: Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland. Meta also processes personal data in the USA. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, so that an adequate level of data protection is ensured for data transfers to the USA in this respect. Further information on data protection at Meta can be found at https://www.facebook.com/privacy/policy/ (Facebook) and at https://privacycenter.instagram.com/policy/ (Instagram).
  • TikTok: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland. TikTok also processes personal data in third countries, in particular in the USA and Singapore. To the extent personal data is transferred to third countries without an adequacy decision of the European Commission, TikTok relies on the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Further information on data protection at TikTok can be found at https://www.tiktok.com/legal/page/eea/privacy-policy/.

2.14 YOUTUBE

Our website embeds videos from the “YouTube” platform, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereinafter “Google”). YouTube is a video platform on which users can upload, share and view video content. We use YouTube in enhanced data protection mode. According to YouTube, this mode means that YouTube does not store information about visitors to our website before they watch an embedded video. When you access a page of our website containing an embedded YouTube video, a connection is established with YouTube’s servers. In doing so, the YouTube server is informed which page you have visited. If you are logged into your YouTube or Google account at that time, YouTube may be able to link the connection information to your profile. You can prevent this by logging out of your YouTube or Google account before using our website. When an embedded video is played, YouTube sets cookies and receives information indicating that you have accessed a page containing an embedded video. Further information on data processing and data protection at YouTube/Google can be found at https://policies.google.com/privacy.

This processing takes place for the purpose of embedding and displaying video content on our website, in order to make it more appealing and to make multimedia content accessible to you. This includes, in particular, the embedding of tutorials on the use of the MPN and of music videos that industry partners provide as part of the promotion of their products within the MPN.

The data is transmitted to Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google is a US company. A transfer of data to the USA cannot be ruled out. Google is certified under the EU-US Data Privacy Framework, so that an adequate level of data protection is ensured. Further information can be found at https://policies.google.com/privacy.

2.15 SPOTIFY

Our website uses services from “Spotify”, an audio streaming platform operated by Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden. We use Spotify by embedding individual audio files and playlists from the platform on our website as a so-called iFrame (“embedding”), so that they can be played directly on our website. When you visit a sub-page of our website on which a Spotify player is embedded, a connection is established with Spotify’s servers, and the player is displayed within our website. This discloses to Spotify which website you have visited. Where applicable, your IP address is also transmitted to Spotify. If you play an embedded audio file, this information is also passed on to Spotify. If you are logged in as a Spotify user at that time, Spotify links this data to your user account. Further information on data protection at Spotify can be found at https://www.spotify.com/de/legal/privacy-policy/.

This processing takes place in order to enable playable audio files, playlists and podcasts from Spotify to be embedded on our website.

Through the use of the Spotify service, personal data may be transmitted to Spotify AB, Regeringsgatan 19, SE-111 53 Stockholm, Sweden. As Spotify is based in Sweden, processing generally takes place within the EU. However, it cannot be ruled out that data is also processed outside the European Union. To the extent personal data is transferred to third countries, this is done on the basis of the EU Standard Contractual Clauses or other appropriate safeguards pursuant to Art. 46 GDPR.

2.16 Links to Third-Party Offerings

Our website may contain third-party offerings. Please note that when you use such a link, your data, such as IP address, personal browser settings, etc., is transmitted to these third-party providers. We have no control over these third-party websites, do not review them, and are not responsible for them. Please note that the terms of this Privacy Policy do not apply to these third-party websites or their content, or to the collection of your data after you have clicked on links to such third-party websites. We recommend that you read the privacy policy of each website you visit. All links to third-party websites or locations are provided for your convenience and do not mean that we endorse those third parties or their products, content or websites.

3. Legal Basis for Data Processing

Where we have asked for your consent, we process your data on the basis of that consent. Where we have not asked for your consent and this is required under applicable law, we process your data on other legal grounds, for example:

  • a contractual obligation;
  • a legal obligation;
  • a vital interest of the data subject or of another natural person;
  • the performance of a task carried out in the public interest;
  • our legitimate interest.

4. Disclosure of Data to Third Parties

In connection with our processing of data, we may disclose your personal data to third parties, in particular to the following categories of recipients:

  • Service Providers

We may disclose your data to service providers and business partners around the world with whom we cooperate to fulfil the purposes referred to above (e.g. IT providers, shipping companies, advertising service providers, security companies, banks, insurers, telecommunications companies, credit reference agencies, address verification providers, lawyers) or whom we engage to process personal data for one of the purposes referred to above on our behalf and solely in accordance with our instructions. To process your payment, personal data is specifically disclosed to the payment service provider Stripe, Inc., 354 Oyster Point Blvd, South San Francisco, California 94080, USA. Stripe is certified under the EU-US Data Privacy Framework, so that an adequate level of data protection is ensured for data transfers to the USA in this respect. Further information on data protection at Stripe can be found at https://stripe.com/de/privacy. If you select TWINT as your payment method, the data required to process the payment is passed on via Stripe to TWINT AG, Stauffacherstrasse 41, 3014 Bern, Switzerland.

  • Third-Party Offerings

Our website may contain third-party offerings. Please note that when you use such a link, your data, such as IP address, personal browser settings, etc., is transmitted to these third-party providers. See also clause 2.14 (“Links to Third-Party Offerings”) in this regard.

  • Contracting Parties

Where the relevant contract requires it, we disclose your data to other contracting parties. If we sell or purchase a business or assets, we may disclose your data to the potential seller or buyer of such business or assets, to whom we assign our rights and obligations.

  • Acquirers of Business Units

We may disclose your data to acquirers of, or parties interested in acquiring, business units, companies or other parts of PhonoNet AG.

  • Legal Authorities

We may disclose personal data to offices, courts and other authorities in Switzerland or abroad, where we are legally obliged or entitled to do so, or where this appears necessary to safeguard our interests. The authorities are responsible for their processing of data about you that they receive from us.

5. Transfer of Data Abroad

The data we collect from you may be transferred to, processed in and stored in a country outside the European Economic Area (EEA) or Switzerland, in particular the USA. From an EEA and Swiss perspective, the laws of some of these countries may not provide an adequate level of data protection. We only transfer data to such countries where this is necessary to perform a contract or to assert or defend legal claims, or where such transfer is based on your express consent or is subject to safeguards ensuring the protection of your data, such as the EU-US Data Privacy Framework, the Swiss-US Data Privacy Framework (where and to the extent in force and applicable) and/or the EU Standard Contractual Clauses, adapted to Swiss law where necessary and required.

6. Data Retention and Storage

We process your data only for as long as is necessary to fulfil the purposes for which we collected it, including compliance with statutory retention obligations and, to the extent necessary to assert or defend legal claims, until the end of the relevant retention period or until the relevant claims have been resolved. Once the relevant retention period has expired, we will securely destroy your data in accordance with applicable laws and regulations.

7. Data Security

We take appropriate organisational and technical security measures to prevent your personal data from being accidentally lost, used or accessed, altered or disclosed in an unauthorised manner. Nevertheless, we and your personal data may become the victim of cyberattacks, cybercrime, brute-force methods, hacking and other fraudulent and malicious activities, including but not limited to viruses, forgeries, malfunctions and disruptions that are beyond our control and responsibility. We have also implemented procedures for dealing with suspected personal data breaches and will notify you and any competent supervisory authorities of a breach where we are legally required to do so.

8. Your Rights as a Data Subject

To the extent provided for under applicable law, you may request, free of charge, information about the data concerning you that is being processed, its origin and recipients, and the purpose of the data processing. You also have the right to rectification, erasure, restriction of processing or objection to the processing, as well as the right to have the data transferred to another controller.

You may also withdraw your consent at any time with effect for the future. To do so, you need only send us an informal email.

Please note that the aforementioned rights are subject to statutory restrictions and may affect or make it impossible to provide our services.

9. Updating Your Data

The accuracy of your information is important to us. If you change your contact details or if any other information held about you is inaccurate or out of date, please send us an email to the email address mentioned above.

10. Changes to This Privacy Policy

Due to the ongoing development of our website and its content, as well as changes in the law or regulatory requirements, we may need to amend this Privacy Policy from time to time. Our current Privacy Policy can be found on our website.