Music Stocks Platform Privacy Policy
Last updated: May 28, 2026
This Privacy Policy governs the processing of personal data of users of the MUSIC STOCKS application (the App). We are firmly committed to respecting users’ privacy and ensuring the protection and security of their personal data. Here you will find information on how and why we collect, process, and protect the personal data you provide to us through the App. All of this is based on Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Organic Law 3/2018 of December 5 on the Protection of Personal Data and the Guarantee of Digital Rights (LOPDGDD), and other applicable legislation.
Unless otherwise indicated,terms capitalized herein shall have the meanings assigned to them in the Music Stocks Terms and Conditions .
1. Data Controller
The data controller for the personal data processed through the App is:
| Data Controller | MUSIC STOCKS TECH, S.L. |
| Tax ID Number | B22728349 |
| Address | Avda. Menéndez Pelayo 89 |
| Privacy Email | support@musicstocks.io |
| Data Protection Officer (DPO) | Ángel Lacalle |
Hereinafter referred to as the Data Controller.
Users may contact our Data Protection Officer at the address or email indicated above for any questions regarding the processing of their personal data.
2. App Users
The App is primarily intended for two types of users:
2.1. Artists: Individuals or authorized representatives of artists who post Auctions or campaigns related to a Phonogram, offer associated Utilities, and manage communications with Fans within the App.
2.2. Fans: Users who participate in Auctions or campaigns, purchase Utilities, receive Tokens in a self-custody Wallet within the App, redeem those Tokens, and may receive a proportional share of certain Economic Participations linked to the auctioned Phonogram.
The Terms and Conditions of the App may establish additional requirements regarding age, verification, residence, legal capacity, or contractual acceptance.
3. Personal Data We Process
We may process the following categories of personal data, depending on the type of user, the use of the App, and the functionalities enabled at any given time.
3.1. Identifying and Contact Information
• First and last names.
• Stage name or username.
• Email address.
• Phone number, if requested.
• Date and place of birth.
• Mailing address, when necessary for shipping physical items, tickets, or other materials associated with a Utility.
• Identification document, when necessary to verify identity, comply with legal obligations, process payments or settlements, prevent fraud, or meet tax or contractual requirements.
3.2. Account and Profile Data
• User type: Artist, Fan, representative, or administrator.
• Profile picture, biography, professional links, or public information that the User voluntarily chooses to provide.
• Communication preferences and account settings.
• History of acceptance of terms, conditions, policies, and consents.
3.3. Data Related to Auctions, Utilities, and Tokens
• Participation in Auctions or campaigns.
• Utilities acquired or requested, such as tickets, merchandise, experiences, or other advantages.
• Proportional percentage attributed to the Fan regarding the Economic Participation and Economic Rights to the auctioned Phonogram, when applicable.
3.4. Financial, Tax, and Payment Data
• Amounts offered, awarded, pending, or paid.
• Data necessary to process payments, refunds, settlements, or billing.
• Tax information necessary to issue invoices, receipts, certificates, withholding statements, or tax returns when required.
• Banking or payment method information, typically processed by third-party payment service providers, unless the Company expressly states otherwise.
3.5. Communications Within the App
• Messages, alerts, notifications, and communications exchanged between Artists and Fans exclusively through the channels provided by the App.
• Communications regarding Auctions, transactions, redemptions, incidents, support, settlements, deliveries, and contractual compliance.
• Metadata associated with communications, such as date, time, sender, recipient, read status, campaign identifier, or transaction reference.
Note: Users must not share external personal contact information, third-party data, sensitive information, or data that is not necessary for the purpose of the communication. The Company may implement technical and organizational measures to prevent, limit, or moderate the exchange of data outside of authorized channels.
3.6. Technical and Usage Data
• IP address.
• Device identifiers, operating system, browser, app version, and technical configuration.
• Access logs, activity logs, security event logs, and logs of App usage.
• Cookies, SDKs, pixels, or similar technologies, where applicable, in accordance with the Cookie Policy .
• Aggregated or statistical data regarding App usage, performance, incidents, and preferences.
3.7. Professional Data
Professional data of Artists located on social media, digital platforms, technology servers, and/or any other location for the purpose of:
• Using that data to generate, through the Company’s proprietary algorithm, a detailed report on the Artist's professional performance.
• Subsequently providing that report and the information generated through said tool to the Fan.
3.8. Specially Protected Data
The App is not designed to process special categories of personal data, such as health data, political opinions, religious beliefs, union membership, sexual orientation, biometric data intended to identify an individual, or data relating to criminal convictions and offenses, unless there is a valid legal basis and a specific legal obligation or authorization.
Users must not enter this type of information into the App or in internal communications, unless expressly instructed to do so by the Company and when strictly necessary.
4. Purposes of Processing and Legal Bases
We process personal data for the purposes and on the legal bases set forth below:
| Purpose | Main Data | Legal Basis |
|---|---|---|
| Create and manage User accounts | Identification, contact information, account, profile | Performance of the Terms and Conditions |
| Enable participation in Auctions or campaigns | Account, participation, Bids, Utilities, Economic Participations, Tokens | Performance of the Terms and Conditions |
| Manage the allocation of Tokens in the self-custody Wallet | Identification, account, Tokens, traceability | Performance of the Terms and Conditions; legitimate interest in ensuring security and traceability |
| Enable communication between Artists and Fans within the App | Messages, metadata, User identifiers | Performance of the Terms and Conditions; legitimate interest in maintaining a secure and traceable environment |
| Prevent or limit communication outside the App’s channels | Messages, metadata, security events | Legitimate interest in protecting Users, preventing fraud, and ensuring compliance with the Terms and Conditions |
| Provide support and resolve issues | Contact information, account, communications, technical information | Performance of the Terms and Conditions; legitimate interest in addressing requests |
| Comply with legal, tax, accounting, regulatory obligations, or requirements from authorities | Identification, financial, tax, activity, records | Compliance with legal obligations |
| Prevent fraud, abuse, money laundering, identity theft, misuse, or contractual breaches | Identification, activity, payments, Tokens, communications, technical data | Legitimate interest; legal compliance where applicable |
| Improve the App, analyze performance, and develop features | Technical data, usage, aggregated metrics | Legitimate interest; consent where required for Cookies or similar technologies |
| Send operational communications regarding the App | Contact information, account, activity | Performance of the Terms and Conditions; legitimate interest |
| Send our own or third-party marketing communications, if applicable | Contact information, preferences, activity | Consent or legitimate interest in cases permitted by applicable regulations |
When processing is based on consent, the User may withdraw it at any time, without this affecting the lawfulness of the processing carried out prior to such withdrawal.
When processing is based on legitimate interest, the User may request additional information regarding the balancing test performed and object to the processing under the terms set forth in applicable regulations.
5. Communication Within the App
Communications between Artists and Fans must take place exclusively through the channels provided by the App. The purpose of this restriction is to:
• Protect the privacy of Artists and Fans.
• Prevent the unnecessary disclosure of external contact information.
• Prevent fraud, impersonation, abuse, or unauthorized communications.
• Enable the traceability of communications relevant to Auctions, Utilities, exchanges, payments, settlements, and incidents.
• Ensure compliance with the Terms and Conditions, Auction terms, and applicable legal obligations.
Users may not use the App to share, request, or publish external contact information, private addresses, phone numbers, email addresses, messaging profiles, external payment links, or other means intended to circumvent the channels provided by the Company, unless expressly authorized by the Company or required by law.
The Company will not share an Artist’s personal data with Fans or Fans’ personal data with Artists beyond what is strictly necessary to provide the service, comply with the terms accepted by Users, manage the delivery or redemption of Utilities, settle Economic Rights, address issues, or fulfill legal obligations.
6. Self-Custody Wallet and Tokens
The App will provide Users with a self-custody Wallet within the App itself to receive, hold, and manage Tokens associated with acquired or provided Utilities.
Tokens may represent redemption rights for specific Utilities, such as tickets, merchandise, experiences, or other advantages defined in each Auction. Once a Token has been redeemed for the acquired Utility, the Fan must pay the price corresponding to that Utility, in accordance with the applicable terms and conditions.
The Company will not process data related to the Wallet or the Tokens, beyond the allocation of Tokens corresponding to each Auction, as this is a self-custody Wallet provided by a third-party Wallet provider (see theProvider’s Privacy Policy).
Since this is a self-custody Wallet, it is the sole and exclusive responsibility of the User to safeguard and not share their access credentials, information, and related documentation.
7. Economic Rights to Phonograms and Recurring Settlements
The Company will not process or store data related to Auctions or to the Economic Rights acquired by the Fan following the award of an Auction.
8. Recipients and Disclosure of Data
In general, the Company will not disclose personal data of Artists or Fans to other Users or third parties, except in the cases described in this Privacy Policy, in the Terms and Conditions, in the terms of each campaign, or when there is a valid legal basis.
We may disclose personal data to the following categories of recipients:
• Other Users of the App, only to the extent strictly necessary for the App’s operation and always through the designated channels. For example, an Artist may receive operational information necessary to manage a Utility, an issue, or a settlement, without this implying the disclosure of external contact information unless it is essential or legally required.
• Technology service providers, such as those offering hosting, maintenance, cybersecurity, transactional messaging, analytics, customer support, or internal management tools.
• Other service providers necessary for the proper operation of the App, Auctions, or any other process/activity accessed by the User, such as Wallet providers for User-managed financial transactions, etc.
• Legal advisors, tax advisors, accountants, auditors, or insurance companies, when necessary to comply with obligations or defend rights.
• Public administrations, authorities, courts, law enforcement agencies, or regulators, when there is a legal obligation, a valid request, or a need to file, exercise, or defend claims.
• Third parties involved in corporate transactions, such as mergers, acquisitions, restructurings, asset transfers, or financing rounds, always with adequate safeguards and to the extent permitted by applicable regulations.
Vendors that process data on behalf of the Company will act as data processors and will be subject to contracts that include the safeguards required by data protection regulations.
9. International Data Transfers
The Company will ensure that personal data is processed within the European Economic Area. However, some technology providers may be located outside the European Economic Area or provide services from third countries.
When international data transfers occur, the Company will implement the safeguards required by applicable regulations, such as:
• Adequacy decisions by the European Commission.
• Standard contractual clauses approved by the European Commission.
• Binding corporate rules, where applicable.
• Supplementary technical, organizational, and contractual measures when necessary.
Users may request additional information about the safeguards applied in each case by contacting support@musicstocks.io
10. Retention Periods
We will retain personal data for as long as necessary to fulfill the purposes for which it was collected and, thereafter, for the periods required by law or for as long as necessary to address potential liabilities.
As a general guideline:
| Data Category | Approximate Retention Period |
|---|---|
| Account data | As long as the account remains active and, thereafter, for the period necessary to address liabilities. |
| Auction, Utility, and Token data | For the duration of the contractual relationship and as long as obligations, claims, or liabilities may arise. |
| Internal communications | For as long as necessary to manage the contractual relationship, incidents, claims, security, and compliance. |
| Technical data and security logs | For as long as necessary to ensure security, prevent fraud, and address incidents or liabilities. |
| Data processed with consent | Until consent is withdrawn, unless there is another legal basis for retention. |
Once the applicable retention periods have expired, the data will be deleted or, where appropriate, blocked for the duration of the statute of limitations for liabilities, remaining available to judges, courts, the Public Prosecutor’s Office, public administrations, or competent authorities. Once these periods have elapsed, the data will be permanently deleted or anonymized.
11. Users’ Rights
Users may exercise the following data protection rights:
• Access: to know what personal data we process and to obtain information about its processing.
• Rectification: to request the correction of inaccurate or incomplete data.
• Erasure: to request the deletion of data when appropriate.
• Objection: to object to certain processing activities based on legitimate interests or direct marketing.
• Restriction of processing: to request that processing be restricted in certain circumstances.
• Data portability: to receive the data in a structured, commonly used, and machine-readable format, where applicable.
• Withdrawal of consent: to withdraw consent, without affecting the lawfulness of processing based on consent prior to withdrawal.
• Right not to be subject to automated decision-making: to request human intervention, to express their point of view, and to challenge decisions based solely on automated processing that produce legal effects or significantly affect them, where applicable.
To exercise these rights, the User may send a request to support@musicstocks.io, indicating the right they wish to exercise and providing sufficient information to verify their identity.
Users may also file a complaint with the Spanish Data Protection Agency through its website ( www.aepd.es), particularly if they believe their rights have not been adequately addressed.
12. Data Security
The Company will implement appropriate technical and organizational measures to protect personal data against destruction, loss, alteration, unauthorized access, disclosure, or unlawful processing.
These measures may include, as appropriate:
• Access control and User authentication.
• Encryption or pseudonymization, where appropriate.
• Logging and monitoring of security events.
• Backups and business continuity plans.
• Permission segmentation and the principle of least privilege.
• Measures to prevent impersonation, fraud, abuse, and misuse.
• Review of vendors and data processing agreements.
• Security breach management procedures.
The User is responsible for maintaining the confidentiality of their credentials, devices, and authentication methods. If the User detects unauthorized access, loss of credentials, or misuse of their account, they must immediately notify the Company.
13. Minors
The App is not intended for individuals under the age of 18 ,unless the Terms and Conditions expressly provide otherwise and appropriate authorization, verification, and control mechanisms are in place.
In Spain, consent for the processing of minors’ personal data may be provided by individuals over the age of eighteen under the terms set forth in applicable regulations, without prejudice to the fact that certain Utilities, financial transactions, participation in Auctions, payments, settlements, or acceptance of contractual terms may require the User to be of legal age, authorization from legal representatives, or additional requirements.
If the Company detects that it has processed a minor’s data without the necessary safeguards, it will take the appropriate measures to delete such data or rectify the situation in accordance with applicable regulations.
14. Commercial Communications
The Company may send commercial or promotional communications regarding its services, campaigns, Artists, Utilities, updates, or functionalities when there is a valid legal basis.
When necessary, the User’s consent will be requested. In other cases, communications regarding services similar to those contracted or used may be sent, provided that applicable regulations permit it and the User can opt out easily and free of charge.
Users may opt out of commercial communications by using the mechanisms provided in each communication or by sending a request to support@musicstocks.io.
Operational, transactional, security, support, and contractual change communications, as well as those regarding the essential functioning of the App, are not commercial in nature and may be sent as long as they are necessary to provide the service or comply with legal or contractual obligations.
15. Automated Decisions and Profiling
The Company may use automated systems for technical functions, security, fraud prevention, operational Token allocation, percentage calculations, or settlement calculations, always within the limits permitted by applicable regulations.
Unless expressly stated otherwise, the Company will not make decisions based solely on automated processing that produce legal effects on the User or significantly affect the User in a similar manner.
If automated decisions of this type are implemented in the future, the Company will inform the User in advance of the logic applied, the significance and anticipated consequences of the processing, as well as the User’s rights, including the possibility of requesting human intervention, expressing their point of view, and challenging the decision.
16. Accuracy and Up-to-Date Status of Data
The User warrants that the data provided is accurate, complete, and up-to-date. The User also agrees to report any changes through the channels provided in the App.
The Company shall not be liable for any consequences arising from false, inaccurate, incomplete, or outdated data provided by the User, without prejudice to its obligations as the data controller.
17. Third-Party Data
The User shall not provide personal data of third parties unless they have a valid legal basis for doing so and have informed such third parties in accordance with applicable regulations.
In particular, Users must not share on the App contact information, addresses, documents, images, financial information, or any other personal data of third parties that is not necessary for the operation of the App or that has not been expressly requested by the Company.
18. Confidentiality and Restriction of Access Among Users
The Company agrees not to disclose personal data of Artists or Fans to other Users except in cases strictly necessary for the provision of the service, compliance with the accepted Terms and Conditions, the management of Utilities or Tokens, or compliance with legal obligations.
Specifically:
• Fans will not receive any personal data from Artists that is not necessary for the use of the App or the performance of the contractual relationship.
• Communications must remain within the App and may not be used to request, share, or transfer conversations to unauthorized external channels.
• The Company may limit, block, review, or moderate communications when necessary to prevent fraud, protect rights, ensure security, comply with the law, or enforce the Terms and Conditions.
This provision does not prevent the Company from disclosing data when necessary to comply with legal obligations, respond to requests from authorities, perform contracts, defend against claims, or protect legitimate rights and interests in accordance with applicable regulations.
19. Updates to the Privacy Policy
The Company may update this Privacy Policy to reflect legal, technical, organizational, or functional changes to the App.
When changes are significant, Users will be notified via the App, by email, or through other appropriate means. If the processing requires new consent, it will be requested before the corresponding processing begins.
The current version of the Privacy Policy will be available in the App and, where applicable, on the associated website.
20. Contact
For any questions regarding this Privacy Policy or the processing of personal data, Users may contact the Company at:
| Channel | Information |
|---|---|
| support@musicstocks.io | |
| Mailing Address | Avda. Menéndez Pelayo 89, 28007 Madrid, España |
| Data Protection Officer (DPO) | Angel Lacalle |
