Version: May 2025

1. Background:

This Privacy Policy explains how Serenade Sound UK Limited and Serenade Sound Pty Ltd (referred to in this policy as “Serenade” “we”, “us” or “our”) and/or our subsidiaries, affiliates and related bodies corporate, use, collect, store and disclose information supplied to us in connection with our products or services, as part of the Serenade Platform (“Platform”) or other offerings at https://www.serenade.co and associated online platforms (the “Sites”) or through use of products provided by us to third parties (including but not limited to Smart Formats (as described in this Privacy Policy) or by contacting us in person, by phone, or over email (the foregoing collectively as the “Serenade Services”).

Serenade is the provider of Smart Formats (a physical item that is embedded with a NFC chip) that enables purchasers of a Smart Format to access music and content, sometimes referred to as a Digital Pressing) via a redemption link activated by engaging with the Smart Format to unlock access to that music and content by activating the NFC chip. Serenade hosts the content included in a Digital Pressing and purchasers of a Smart Format must register with Serenade to obtain access to the Digital Pressing. These services are specifically included in the Serenade Services.

We are committed to respecting your privacy. This Privacy Policy details how we comply with the Privacy Act 1988 (Cth) (“Privacy Act”), the Australian Privacy Principles (“APPs”), and, to the EU General Data Protection Regulation 2016/679 (“GDPR”), in relation to the collection, storage, use, and disclosure of your information and data.

By providing personal information to us for purposes of accessing Digital Pressing content or for any other purpose (“Personal Information”), you consent to our collection, use and disclosure of your Personal Information in accordance with this Privacy Policy and any other arrangements that apply between us. 

Personal Information includes information that can be used to personally identify you and may include your name, address, email address, phone number, profile picture, and payment details (including your credit card information). We do not knowingly collect or process the Personal Information of anyone under the age of 13 without the express consent of their parent or guardian.

We may update this Privacy Policy from time to time at our sole discretion. Any variations become effective on posting the updated Privacy Policy on our Sites, and we shall have no obligation to provide you with individual notice of such changes. Your continued use of the Serenade Services following the publication of any amended Privacy Policy shall signify your acceptance of that amended Privacy Policy, except where we are otherwise obliged by law to seek your direct consent.

2. What personal information do we collect:

We may collect the following types of Personal Information:
• name;
• mailing or street address;
• email address;
• telephone number and other contact details;
• age or date of birth;
• credit card or other payment information;
• profile pictures;
• your device ID, device type, geo-location information, computer and connection information, statistics on page views, traffic to and from the sites, ad data, IP address and standard web log information;
• details of the products and services we have provided to you or that you have enquired about, including any additional information necessary to deliver those products and services and respond to your enquiries;
• any additional information relating to you that you provide to us directly through our website or app or indirectly through your use of our website or app or online presence or through other websites or accounts from which you permit us to collect information;
• information you provide to us through customer surveys; or any other personal information that may be required in order to facilitate your dealings with us.

We may collect these types of Personal Information either directly from you, or from third parties. We may collect this information when you:

• register on our Platform or Sites;

• seek to access Digital Pressing Content through use of a Smart Format owned by you;

• communicate with us through correspondence, chats, email, or when you share information with us from other social applications, services or websites; or

• interact with our Platform, Sites, services, content and advertising.

This Privacy Policy does not apply to acts and practices in relation to employee records of our current and former employees.

We may additionally collect anonymous aggregate data that is automatically collected through your use of the Serenade Services (“Usage Information”). This includes information that identifies your device, your operating system, your IP address, and dates and times that you access and use the Serenade Services. This information is used to resolve any technical issues that may arise, or for statistical analysis to help us to improve the Serenade Services. The GDPR recognises that Usage Information, whilst for the most part anonymous, can be cumulatively used to directly or indirectly identify you. Usage Information that can be used to identify you in any way shall be included as Personal Information.

3. Why do we collect, use and disclose Personal Information?

Personal Information may be collected from you when you:

• create a user account on the Platform or Sites;

• seek to access Digital Pressing content through use of a Smart Format owned by you;

• post on or otherwise interact with the Platform;
  subscribe to our mailing lists or other direct marketing communications;

• enter a contest or giveaway organised by us;

• complete a survey or questionnaire provided by us;

• contact our support team via our Sites, phone or email; or

• access, browse, use, or otherwise interact with the Sites.

  
  

It is your choice to provide Personal Information to us. Wherever it is lawful and practicable, you have the option not to identify yourself when interacting with us. Please be aware that it may be necessary for us to collect your Personal Information to enable us to provide the Serenade Services to you, including but not limited to access Digital Pressing content through use of a Smart Format owned by you. As such, if you do not wish to provide your Personal Information, this may limit our ability to provide the Serenade Services to you.

We may hold, use and disclose your Personal Information for the following purposes:

• to enable you to access and use our Platform or Sites;

• to operate, protect, improve and optimise our Platform or Sites, our business and our users’ experience, such as to perform analytics, conduct research and for advertising and marketing;

• to send you service, support and administrative messages, reminders, technical notices, updates, security alerts, and information requested by you;

• to provide you marketing and promotional messages and other information that may be of interest to you, including information sent by, or on behalf of, our business partners that we think you may find interesting;

• to enable rights holders of Digital Content accessed via a Smart Format purchased by you (which may include artists, artist managers, artist agents, record labels, event or concert promoters, music venues and music publishers) to provide you marketing and promotional messages that may be of interest to you;

• to administer rewards, surveys, contests, or other promotional activities or events sponsored or managed by us or our business partners or rights holders of Digital Content accessed via a Smart Format purchased by you; and

• to comply with our legal obligations, resolve any disputes that we may have with any of our users, and enforce our agreements with third parties.
  
  

We may also disclose your Personal Information to a trusted third party third party may combine that information in order to enable it and us to develop anonymised consumer insights so that we can better understand your preferences and interests, personalise your experience and enhance the products and services that you receive.

4. Do we use your personal information for direct marketing?

We may send you direct marketing communications and information about products and services we offer, including software add-ons, in-app purchases and Smart Format products provided by us or rightsholders we work with. This may take the form of emails, SMS, mail or other forms of communication, in accordance with the Spam Act 2003 (Cth) and the Privacy Act and similar legislation in other countries. We recognise your right under the Spam Act 2003 (Cth) and the GDPR to opt out from direct marketing, and as such these consents can be modified at any time by emailing our Privacy Officer (per the details at the end of this Privacy Policy) or clicking unsubscribe on any direct marketing communications,

Please note certain non-marketing related correspondence from us, including messages relating to payment and your use of redemption links, will be automatically sent to you by virtue of your use of the Serenade Services and you may not have the option to unsubscribe from receiving this correspondence.

5. To whom do we disclose your personal information?

We may disclose Personal Information for the purposes described in this Privacy Policy to:

• our directors, officers, employees, consultants, contractors, agents and related bodies corporate;

• third party suppliers and service providers (including providers for the operation of our Platform and Sites and/or our business or in connection with providing our products and services to you);

• rightsholders of Digital Content accessed via a Smart Format purchased by you (which may include artists, artist managers, artist agents, record labels, event or concert promoters, music venues and music publishers) providing services or licensing or lawfully exploiting rights (including copyrights) via Serenade, the Platform, Sites or Smart Formats;

• our professional advisers, dealers and agents;
  payment systems operators (including merchants receiving card payments);

• our existing or potential agents, business partners or partners;

• our sponsors or promoters of any competition that we conduct via our services;

• anyone to whom our assets or businesses (or any part of them) are transferred;

• specific third parties authorised by you to receive information held by us; and/or
  other persons, including government agencies, regulatory bodies and law enforcement agencies, or as required, authorised or permitted by law.

Without limiting the foregoing, we may share your personal information (such as your name, email address, and details of your interactions or purchases on the Serenade Platform) (which may include artists, artist managers, artist agents, record labels, event or concert promoters, music venues and music publishers). These parties may use your information to contact you directly with marketing communications about their own products, services, events, or other promotional opportunities. These third parties will act as independent data controllers and are responsible for ensuring compliance with applicable data protection laws. You may withdraw your consent at any time by clicking the unsubscribe link in any communication you receive, or by updating your preferences in your Serenade account settings.

We will take reasonable steps to ensure that any third parties that we share your Personal Information agree to be bound by applicable privacy laws.

You can withdraw your consent for us to share your Personal Information with third parties at any time by emailing our Privacy Officer (per the details at the end of this Privacy Policy), but please note that withdrawal of such consents may affect your ability to access and use the Serenade Services including but not limited to access Digital Pressing content through use of a Smart Format owned by you.

6. Disclosure of personal information internationally

We may, in the course of providing the services to you, disclose Personal Information to cloud providers and other service providers in overseas countries that are deemed by the EU Commission as having an ‘adequate’ level of Personal Data protection. Where we transfer data to a third party in a country where no adequacy decision has been made, we will take reasonable steps to ensure person or entity handling your data in those countries are bound under contract to meet the requirements of the Privacy Act, APPs, and GDPR (as applicable).

When you provide your Personal Information to us, you consent to the disclosure of your information internationally.

7. Using our website and cookies:

We may collect personal information about you when you use and access our Platform and Sites.

While we do not use browsing information to identify you personally, we may collect anonymous Usage Information from the Serenade Services, by utilising cookies, pixel tags and other tracking technologies (collectively “Cookies”). Cookies are small packets of data that are downloaded onto your device when you access a website. Cookies hold specific information that helps a website ‘remember’ your actions and preferences over time. These are the types of Cookies that we may use to operate the Sites:

• Strictly Necessary Cookies – these Cookies are essential to ensure that the Sites work correctly, and record information that allows you to move around the Sites and navigate their features;

• Performance Cookies – these Cookies collect information about how you use the Sites, such as how often you access the Sites and if you encounter any errors;

• Functionality Cookies – these Cookies allow the Sites to remember the choices you make to provide a more personalised experience;

• Targeting/Advertising Cookies – these Cookies deliver targeted advertising to you based on your interests and use of the Sites.

We may also use cookies to enable us to collect data that may include Personal Information. For example, where a cookie is linked to your account, it will be considered Personal Information under this Privacy Policy. We will handle any Personal Information collected by cookies in the same way that we handle all other Personal Information as described in this Privacy Policy.

We may also use tracking technology to collect information relating to usage patterns, preferences, location and other data, including Google Analytics and other analytics software.

Cookies can stay on your device temporarily (“Session Cookies”) or until you manually delete them (“Persistent Cookies”). You can adjust your browser settings at any time to block Cookies, however please note that doing so may limit our ability to provide the Serenade Services to you in a fully operational form.

To request a full list of the individual Cookies and tracking technologies we use, please email our Privacy Officer (per the details at the end of this Privacy Policy).

8. Security:

We may hold your Personal Information in either electronic or hard copy form. We take reasonable steps to protect your Personal Information from misuse, interference and loss, as well as unauthorised access, modification or disclosure and we use a number of physical, administrative, personnel and technical measures to protect your Personal Information (including use of SSL certificates and other database security mechanisms). No security measures are, however, 100% secure so we cannot guarantee the security of your Personal Information. To the extent permitted by law, we accept no liability for any breach of security, or direct hacking of our security measures, or any unintentional disclosure, loss or misuse of any information or data, or for the actions of any third parties that may obtain any information or data.

Notwithstanding the above, we acknowledge our obligation to report any data breach that is likely to risk the rights and freedoms of natural persons to the relevant data security authorities including where our data breach involves the information of EU subjects, report to the European Data Protection Supervisor. We will also inform you, where possible, if your Personal Information has been breached in the circumstance where it poses a risk of serious harm or your rights and freedoms.

We also train our personnel who may have access to your Personal Information about this Privacy Policy and our obligations under the Privacy Act, APPs, and GDPR. For more information on our internal policies, email the Privacy Officer (per the details at the end of this Privacy Policy).

9. Links:

Our website may contain links to websites operated by third parties, including but not limited to business partners and rightsholders of Digital Content accessed via a Smart Format purchased by you. Those links are provided for convenience and may not remain current or be maintained. Unless expressly stated otherwise, we are not responsible for the privacy practices of, or any content on, those linked websites, and have no control over or rights in those linked websites. The privacy policies that apply to those other websites may differ substantially from our Privacy Policy, so we encourage individuals to read them before using those websites.

From time to time, we may offer products and services for purchase through the Apple Store, Google Play or other application platforms authorised by us (“Software Stores”). If you choose to make a purchase, you will be prompted to enter details for your account with your Software Store (“SS Account”), and your SS Account will be charged for the purchase in accordance with the terms disclosed to you at the time of purchase as well as the general terms that apply to your SS Account.

Please note that this Privacy Policy does not cover the privacy practices of Software Stores or any other third party site. We do not have access to, or control over, the technologies that Software Stores or other third-party sites may use to collect information about you. We disclaim all liability in connection with the services of any Software Stores, or any third-party sites integrated or otherwise linked to the Serenade Services. If you have any concerns about the privacy practices of a Software Store or other third-party site, we encourage you to contact them directly.

10. Accessing or correcting your personal information:

You have a general right to access any Personal Information that is held about you by us, unless a valid exception applies. You can request the Personal Information we hold about you by contacting our Privacy Officer (per the details at the end of this Privacy Policy). We may not be able to provide you with access to all of your Personal Information and, where this is the case, we will tell you why we cannot do this. We may also need to verify your identity when you request your Personal Information.

Please note that we cannot modify your Personal Information. You can modify your own information at any time by emailing the Privacy Officer (per the details at the end of this Privacy Policy).

You acknowledge that it is your responsibility to maintain the truth, accuracy, and completeness of your Personal Information and your failure to do so may inhibit our ability to provide the Serenade Services to you including but not limited to access Digital Pressing content through use of a Smart Format owned by you. You acknowledge and agree that you remain solely responsible for maintaining the truth, accuracy, and completeness of your Personal Information at all times, and we shall have no liability to you or any third party arising from your failure to do the same.

In accordance with the GDPR, we acknowledge the additional rights of EU subjects to:

• have their data erased that is no longer being used for a legitimate purpose;

• request a copy of all Personal Information held about them in a readable format, along with supplementary information to verify that such Personal Information is being processed lawfully; and

• request restricted processing of their Personal Information whilst any complaints or concerns are being resolved.

To erase, request, or restrict processing of your Personal Information, please email the Privacy Officer (per the details at the end of this Privacy Policy).

If you are a resident of California USA with whom we have an established business relationship, you may have the right under California Civil Code Section 1798.83 to receive free of charge no more than once per calendar year: (i) information identifying any third party(ies) to whom we may have disclosed, within the preceding calendar year, your personal information for that third party’s direct marketing purposes; and (ii) a description of the categories of personal information disclosed. To do so, please contact us at [email protected] stating your specific request and your name, address, email address and phone number. Please allow a minimum of 30 days for a response. This will not prohibit disclosure of information for non-marketing purposes.

11. Making a complaint:

If you think we have breached the relevant privacy legislation, or you wish to make a complaint about the way we have handled your Personal Information, you can contact us using the details set out in item 12 below.

Please include your name, email address and/or telephone number and clearly describe your complaint. We will acknowledge your complaint and respond to you regarding your complaint within a reasonable period of time.

If you are not satisfied with our handling of your Personal Information, or have any other concern over our Privacy Policy, then you may lodge a formal complaint with the Office of the Australian Information Commissioner (for more information, please see www.oaic.gov.au) or with the European Data Protection Supervisor (for more information, please see https://edps.europa.eu).

12. Contact Us:

Thank you for taking the time to read our Privacy Policy. For further information about our Privacy Policy or practices, or to access or correct your Personal Information, or make a complaint, please contact our Privacy Officer at the following email address: [email protected]

---

Residents in the European Economic Area

We have described the purposes for which we may use your personal information. If the GDPR applies to you, we are permitted to process your personal information in this way, in compliance with the GDPR, by relying on one or more of the following lawful grounds:

• you have explicitly agreed to us processing your information for a specific reason;

• the processing is necessary to perform the agreement we have with you or to take steps to enter into an agreement with you;

• the processing is necessary for compliance with a legal obligation we have; or

• the processing is necessary for the purposes of a legitimate interest pursued by us, which might be:

  • to prevent fraud;

  • to protect our business interests;

  • to ensure that complaints are investigated;

  • to evaluate, develop or improve our services; or

  • to keep our customers or those of our business partners informed about relevant services, unless you have indicated at any time that you do not wish us to do so.

  
  

If the GDPR applies to you, you have the following additional and specific rights in relation to your personal information (where applicable):

• Access: you have the right to request a copy of any personal information we hold about you. Any request for access to or a copy of your personal information must in writing, and we will endeavour to respond within a reasonable period and in any event within one month (in compliance with the GDPR).

• Rectification: you have the right to the rectification of your personal data, if you consider that it is inaccurate.

• Deletion: you have the right to request that we delete personal information that we process about you, except we are not obliged to do so if we need to retain such personal information in order to comply with a legal obligation or to establish, exercise or defend legal claims.

• Restriction: you have the right to erasure of your personal information, if you consider that we do not have the right to hold it.

• Portability: you have the right to ask us to transfer a copy of your personal information to you or to another service provider or third party where technically feasible.

• Objection: you have the right to object to your personal information being processed for a particular purpose or to request that we stop using your information.

• Complaint: If you are unhappy with our treatment of your personal information, and you have contacted us as set out below, you have the right to lodge a complaint with the local data protection authority.

If you have consented to our processing of your personal information, you have the right to withdraw, at any time, any consent that you have previously given to us for use of your personal information. In certain circumstances even if you withdraw your consent, we may still be able to process your personal information if required or permitted by law or for the purpose of exercising or defending our legal rights or meeting our legal and regulatory obligations.

Thank you for taking the time to read our Privacy Policy for European residents. For further information about our Privacy Policy or practices, or to access or correct your Personal Information, or make a complaint, please contact our Privacy Officer at the following email address: [email protected]