General Data Protection Regulation (GDPR)

1. Definitions

(a) "Data Protection Legislation" means the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the UK GDPR, and any applicable national implementing laws, regulations, and secondary legislation, as amended or updated from time to time;

(b) "Data Controller", "Data Processor", "Data Subject", "Personal Data", "Processing", "Subprocessor", and "Supervisory Authority" shall be interpreted in accordance with applicable Data Protection Legislation;

(c) "Personal Data" means any information relating to an identified or identifiable natural person who uses YouSound's streaming services, including but not limited to listeners, artists, and rights holders ("Users"). This includes streaming history, playlist data, upload content, and account information;

YouSound acts as Data Controller for user account data and other Personal Data collected through the Service. We have Data Processing Agreements (DPAs) in place with our subprocessors (e.g. cloud infrastructure, payment processors, analytics, identity verification providers) as required by applicable Data Protection Legislation.

2. Data Processing in Music Streaming

2.1. For Users located in the European Economic Area (EEA), their Personal Data will be processed by YouSound, Inc. This may include cross-border transfers necessary for music streaming services, content delivery, and payment processing, conducted in compliance with Data Protection Legislation.

2.2. YouSound processes Personal Data for the following purposes: providing music streaming services, managing artist accounts and content distribution, processing payments and royalties, analyzing listening patterns and preferences, ensuring platform security and preventing fraud, and complying with legal obligations.

2.3. Technical and Organizational Measures include: implementation of encryption for data in transit and at rest, regular security audits and penetration testing, access controls and authentication mechanisms, and monitoring systems for detecting unauthorized access.

2.4. Data Subject Rights include: the right to access Personal Data, right to rectification of inaccurate data, right to erasure ("right to be forgotten"), right to data portability, right to object to processing, and the right to withdraw consent.

3. Subprocessors and Third-Party Services

YouSound utilizes the following categories of Subprocessors: cloud infrastructure providers, payment processing services (Stripe), content delivery networks, analytics services, and identity verification services (e.g. Stripe Identity, Trolley). We have Data Processing Agreements in place with these subprocessors to ensure compliant processing of Personal Data.

4. Data Retention and Deletion

YouSound applies a consistent retention model: operational deletion of account and personal data occurs promptly upon account deletion or request; backup and system purges are completed within 30 days where feasible; data required for legal compliance, fraud prevention, or dispute resolution may be retained as necessary under applicable law. Data export options are provided where technically feasible. For full details, see the Privacy Policy and main Terms of Use.

5. Legal Jurisdiction

Except as set forth in the main Terms of Use (which are governed by the laws of the State of California, U.S.A.), disputes arising solely from data protection, privacy, or the processing of Personal Data under this GDPR Addendum may be brought in the courts of your country of residence where required by applicable Data Protection Legislation. For all other purposes, the main Terms of Use govern, including governing law (California) and venue (Northern District of California). This Addendum does not override the governing law or dispute resolution provisions of the main Terms of Use for non–data-protection matters.

6. International Transfers

Where we transfer Personal Data from the EEA, UK, or similar jurisdictions to countries outside the European Economic Area (including to the United States), we implement appropriate safeguards as required by Data Protection Legislation. We rely on Standard Contractual Clauses (SCCs) approved by the European Commission (and, where applicable, the UK International Data Transfer Agreement or Addendum) to ensure an adequate level of protection for your Personal Data. You may request a copy of the relevant transfer mechanism by contacting us at the address in the main Terms of Use or Privacy Policy.

7. Amendments

YouSound reserves the right to modify this Addendum as required by posting updates on its website. Continued use of the Services constitutes acceptance of any amendments. Users who do not agree with the modified terms should discontinue use of the Services.