Privacy

Version from 23.09.2022

1. Scope of application

1.1 This Privacy Policy governs the processing of personal data by Universal Edition AG, Karlsplatz 6, 1010 Vienna (“UE”; “we”; “us”).

1.2 The processing of personal data by UE as controller is subject to the General Data Protection Regulation (“GDPR”) as well as the Austrian Data Protection Act (“DPA”).

2. PURPOSES OF DATA PROCESSING AND Cookies AND the LEGAL BASIS for these

2.1 For the purposeful and trouble-free use of our website.

2.1.1 You can visit our website without providing any personal information. We only store access data in so-called server log files, such as the name of the requested file, the date and time of the request, the amount of data transferred and the requesting provider. This data is evaluated exclusively to ensure trouble-free operation of the website and to improve our offer and does not allow us to draw any conclusions about your person.

2.1.2 When you visit our website and add items to your shopping cart or when you log in, we transfer session cookies. This is technically necessary so that you as a user can make full use of our offers. This can be, for example, saving your input in form fields (so that you do not have to fill them in more than once), your geographical location or user settings. The information collected by such functionality cookies only relates to the website visited, but no information is collected about your surfing behaviour on other websites. Blocking these cookies may mean that the full functionality of our website is not available to you.

2.1.3 The following cookies are transferred:

Name	Expiration	Purpose
CookieConsent	1 year	Stores the user’s consent fort he current domain
test_cookie	1 day	Used to check oft he user’s browser supports cookies.
currentLang	29 days	This cookie is used to direct the user to the correct language.
UEStore	persistent	This one is used for the online shop.

2.2 To open a customer account and to process the contract.

2.2.1 In order to maintain a customer account for you and to provide you with our services and products, we process the following personal data (Art. 6 para. 1(b) GDPR):

(a) First and last name;

(b) Date of birth;

(d) Address;

(e) E-mail address;

(f) Purchase history;

(g) Payment method (Visa/MasterCard, instant bank transfer, eps online transfer, paybox) in connection with payments, transaction data (account number/IBAN, credit card data, PayPal data, etc.).

2.2.2 There is no obligation to disclose this data. However, if you do not provide it, we cannot offer you a customer account or the products and services available through our website.

2.2.3 We store the aforementioned personal data as long as necessary to fulfil the contractual obligations, or to fulfil statutory retention obligations (Section 132 para. 1 BAO: 7 years; Sections 190, 212 UGB: 7 years) or as long as necessary to pursue or defend against legal claims (usually for a maximum period of 3 years, although in the case of an emerging or specific procedure, longer processing of the data may be necessary), or we can prove a legitimate interest.

2.3 To execute the contract for the use of the UE online platform for composers

2.3.1 To enable you to use the UE online platform for composers, we process the following personal data from you (Art. 6 para. 1(b) GDPR):

(a) First and last name;

(b) Date of birth;

(d) E-mail address;

(e) Address;

(f) Payment method (Visa/MasterCard, instant bank transfer, eps online transfer, paybox) and, in connection with payments, transaction data (account number/IBAN, credit card data, PayPal data, etc.);

(g) Biography, about the composers’ music;

(h) Link to website / social media profile;

(i) Overview of the current order situation;

(j) Overview of performances;

(k) References (consisting of music sample, audio sample, title, description of the work, links).

2.3.2 We store the aforementioned personal data as long as necessary to fulfil the contractual obligations, or to fulfil statutory retention obligations (Section 132 para. 1 BAO: 7 years; Sections 190, 212 UGB: 7 years) or as long as necessary to pursue or defend against legal claims (usually for a maximum period of 3 years, although in the case of an emerging or specific procedure, longer processing of the data may be necessary), or we can prove a legitimate interest.

2.4 Accounting and payment transactions.

2.4.1 To process payment transactions and for invoicing, we process the following personal data (Art. 6 para. 1(b) GDPR and Art. 6 para. 1(f) GDPR):

(a) First and last name;

(b) Address (country, city/town, postcode, street, house number);

(d) E-mail address;

(e) Date and time of acquisition;

(f) Payment method (Visa/MasterCard, instant bank transfer, eps online transfer, paybox);

(g) Invoice data (invoice address, invoice amount, invoice date, etc.);

(h) Transaction data (account number/IBAN, credit card data, PayPal data, etc.);

(i) Additional information provided voluntarily by you.

2.4.2 We store the aforementioned personal data as long as necessary to fulfil the contractual obligations, or to fulfil statutory retention obligations (Section 132 para. 1 BAO: 7 years; Sections 190, 212 UGB: 7 years) or as long as necessary to pursue or defend against legal claims (usually for a maximum period of 3 years, although in the case of an emerging or specific procedure, longer processing of the data may be necessary), or we can prove a legitimate interest.

2.4.3 In addition, the data protection conditions of the respective payment service provider apply within the framework of the processing of payment transactions.

2.5 Advertising.

2.5.1 We process the following personal data in order to send you information about our own similar services and products by letter (Art. 6 para. 1(f) GDPR) or via e-mail (Art. 6 para. 1(a) GDPR and Section 174 para. 1 TKG 2021) as well as (only via e-mail) evaluation reminders (Art. 6 para. 1(a) GDPR and Section 174 para. 1 TKG 2021):

(a) First and last name;

(b) E-mail address.

2.5.2 We process the aforementioned personal data to send e-mails on the basis of your consent pursuant to Art. 6 1(a) GDPR and Section 174 para. 1 TKG 2021. Granting consent is voluntary and not required for the use of the website or other functions. Your consent can be revoked at any time with effect for the future by (i) contacting us at the above contact details or (ii) clicking on the “unsubscribe link” in each email you receive containing the information If you do not give us consent, we will not be able to send you information via email.

2.5.3 We use Campaign Monitor Pty Ltd, 404/3-5 Stapleton Avenue, Sutherland, NSW, Australia, 2232 (“Campaign Monitor”) as a processor to send information via email.

When using Campaign Monitor, your personal data may be transferred to the USA. We would like to inform you that according to the European Court of Justice ruling (C-311/18, Schrems II), the level of data protection in the USA is inadequate and there are no suitable guarantees to protect your data. The transfer of your data to the USA will therefore only take place on the basis of your consent.

If your data is transferred to the USA, there is a particular risk that your data will be subject to access by US authorities for control and monitoring purposes and that no effective legal remedies will be available against this. Nor can the enforcement of data subjects’ rights be guaranteed. Overall, according to the Court of Justice of the European Union, the access and use of data by US authorities is not limited to what is absolutely necessary and is therefore disproportionate.

2.5.4 We store the aforementioned personal data as long as necessary to fulfil the contractual obligations, or to fulfil statutory retention obligations (Section 132 para. 1 BAO: 7 years; Sections 190, 212 UGB: 7 years) or as long as necessary to pursue or defend against legal claims (usually for a maximum period of 3 years, although in the case of an emerging or specific procedure, longer processing of the data may be necessary), or we can prove a legitimate interest.

2.5.5 You may opt out of receiving postal mail at any time by sending us a letter stating your objection or by sending an email to datenschutz@universaledition.com.

2.6 Analysis of your use of the website (Matomo).

2.6.1 The website uses the tool Matomo (formerly PIWIK), a web analytics service to analyse our users’ surfing behaviour.

2.6.2 We process your data mentioned under point 2.6.3 on the legal basis of your consent (Art. 6 para. 1(a) GDPR).

2.6.3 When Matomo is used, cookies are stored on your device. These cookies can be used to analyse your use of the website. For this purpose, the usage information obtained through the respective cookie is transmitted to UE’s server and stored so that the usage behaviour can be evaluated.

2.6.4 The following data is processed for the purpose of analysing your use of the website and compiling statistics:

1^st party cookie

2.6.5 For the purpose of analysing your use of the website and compiling statistics, Matomo transfers the following cookies:

Name	Lifetime	Purpose
MATOMO_SESSID	14 days	When the opt-out feature is used.
_pk_id#	1 year	Collects statistics on the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been read.
_pk_ses#	1 year	Used to track page requests from the visitor during the session.

2.6.6 Matomo is operated exclusively on our website’s own servers. Personal user data is only stored there. Data is not, therefore, transferred to third countries.

3. DATA ProcessorS

3.1 We use data processors to perform services on our behalf (see among others above under point 2.5.3.): The processors may only process the data provided to them in accordance with our instructions and to the extent necessary to perform services for us. We contractually oblige these processors to ensure the confidentiality and security of the personal data processed within the scope of the contract.

3.2 The level of data protection in other countries outside the EEA may not be the same as within the EEA. However, we only transfer your personal data to countries that the European Commission has decided to have an adequate level of data protection or we take steps to ensure that all recipients in third countries ensure an adequate level of data protection. To this end, we conclude, for example, the standard contractual clauses issued by the European Commission with these recipients. To the extent that this is insufficient, your personal data will only be transferred to third countries with an in adequate level of data protection if you provide consent.

4. Your rights

4.1 If you have any questions in connection with the processing of your personal data or wish to exercise any rights, such as your right to erasure or your right to information, please feel free to contact us at: datenschutz@universaledition.com

4.2 You have the following rights in relation to UE:

4.2.1 The right to information about the personal data processed by us, according to Art. 15 GDPR.

4.2.2 The right to rectification under Art. 16 GDPR, the right to erasure under Art. 17 GDPR and the right to restriction of processing under Art. 18 GDPR.

4.2.3 The right to data portability, according to Art. 20 GDPR.

4.2.4 The right to object, according to Art. 21 GDPR.

4.2.5 The right to lodge a complaint with the competent data protection authority, according to Art. 77 GDPR.

4.3 You can withdraw your consent to have personal data processed at any time with effect for the future. The withdrawal of consent does not affect the lawfulness of any data processing carried out before the withdrawal.

5. Responsibity for data processing

5.1 The responsible person within the meaning of the GDPR is:

Universal Edition AG

Karlsplatz 6

1010 Vienna

Austria

Tel.: +43 1 337 23 - 0

Fax: +43 1 337 23 - 400

E-mail: datenschutz@universaledition.com