Regulation (EU) 2016/679 (GDPR) • Updated: October 23, 2026
This policy explains how Listen.to.it S.r.l. collects, uses, stores, and protects personal data of users and artists using the futura.music platform and its digital music distribution and career support services.
1. Data Controller
Listen.to.it S.r.l., Strada di Oselin 80, 33047 Remanzacco (UD) – Italy, VAT IT04362230965.
Privacy inquiries & rights requests: info@futura.music.
2. Categories of Processed Data
- Navigation & Technical Logs: IP addresses, HTTP status codes, connection parameters, user-agents, and security logs for network safety and fraud defense.
- Audit & Contact Data: Name or artist alias, email address, phone number, social/streaming links, and demo audio tracks submitted for evaluation.
- Artist Account & Contractual Data: Full identification & tax records (full name, birth details, residence, tax code/VAT ID), payout details for royalty accounting (IBAN, bank account, PayPal), and digital signature audit logs (timestamp, IP address, cryptographic hash).
- Payment Data: For optional paid services, card data is processed directly by Stripe via encrypted PCI-DSS certified channels. We do not store or access full credit card numbers.
- Support & AI Chatbot: Messages are logged and anonymized to resolve support inquiries and continuously improve service reliability.
3. Purposes, Legal Bases & Retention
A. Free AI Audit delivery and contact inquiries
Legal basis: Performance of pre-contractual steps requested by data subject (Art. 6.1.b GDPR).
Retention: Up to 12 months from inquiry, unless a distribution contract is formed.
B. Artist Account management, contract execution & music distribution
Legal basis: Execution of the distribution contract (Art. 6.1.b GDPR).
Retention: For the full term of the contractual relationship and catalog availability.
C. Royalty reporting, tax & accounting obligations
Legal basis: Compliance with a legal obligation (Art. 6.1.c GDPR; civil & tax law).
Retention: 10 years as mandatory under statutory fiscal regulations.
D. Website security, fraud prevention & legal defense
Legal basis: Legitimate interest in safeguarding systems and asserting rights (Art. 6.1.f GDPR).
Retention: Up to 6 months for technical access logs; for the duration of disputes.
E. Optional updates & service newsletters
Legal basis: Explicit consent (Art. 6.1.a GDPR).
Retention: Until consent is withdrawn (instant one-click opt-out).
4. Obligation vs Optional Provision
Providing data for contract fulfillment, audit delivery, security, and statutory tax reporting (§ 3, items A, B, C, D) is mandatory: refusal prevents service delivery and distribution. Providing data for optional newsletters or analytics/marketing cookies (§ 3, item E) is voluntary and does not affect core services.
5. Data Recipients
Personal data may only be communicated to:
- Authorized personnel bound by confidentiality agreements;
- Technical providers, cloud/VPS hosting services acting as Data Processors (Art. 28 GDPR);
- Streaming platforms and DSPs (e.g. Spotify, Apple Music, Amazon Music, YouTube) for music catalog distribution and reporting;
- Payment gateways (Stripe Payments Europe) for accounting settlements;
- Legal and accounting advisers for compliance requirements;
- Judicial or regulatory authorities where required by law.
6. Location of Processing & International Transfers
The core technical infrastructure, databases, and application servers are hosted inside the European Union, specifically within secure datacenters located in Finland, ensuring European data sovereignty and direct application of the GDPR without cross-border third-country transfer requirements for our core databases.
Where specific integrated partners (such as global DSPs or payment processors) process data outside the EEA, transfers strictly comply with GDPR Chapter V: adequacy decisions (Art. 45 GDPR), participation in the EU-US Data Privacy Framework (DPF), or Standard Contractual Clauses (SCC, Art. 46 GDPR).
7. Security Measures
We apply appropriate technical and organizational measures under Art. 32 GDPR, including end-to-end TLS/HTTPS encryption, password hashing, strict least-privilege access control, perimeter firewalls, and regular automated backups.
8. Data Subject Rights (Arts. 15-22 GDPR)
You have the right to request at any time:
- Access to and copies of your personal data (Art. 15);
- Rectification or completion of inaccurate information (Art. 16);
- Erasure ('Right to be forgotten', Art. 17), subject to statutory retention obligations;
- Restriction of processing (Art. 18);
- Data portability in structured, machine-readable format (Art. 20);
- Objection to processing based on legitimate interests (Art. 21);
- Withdrawal of consent at any time without affecting past lawful processing.
To exercise your rights, email: info@futura.music. We reply within 30 days.
9. Right to Lodge a Complaint
You have the right to lodge a complaint with your local EU Data Protection Authority or the lead Italian authority: Garante per la Protezione dei Dati Personali (www.garanteprivacy.it).
