Privacy Policy

Purpose and Scope

1.1. This Policy explains which personal data is collected and used by FRESHTUNES SELECT Limited Liability Partnership, Business Identification Number 260840023357.

1.2. The Company is an owner and operator of personal data within the meaning of the laws of the Republic of Kazakhstan. For certain processing activities, the Company may act as a third party on the instructions of another owner or operator. The roles of the parties may be further defined in an agreement.

1.3. This Policy applies to Users, rightsholders, artists, authors, performers, representatives of counterparties, payment recipients, website visitors and persons who contact support. A separate internal policy may apply to employees and job candidates.

1.4. Processing is carried out under the Law of the Republic of Kazakhstan On Personal Data and Their Protection, the Law On Informatization and other applicable legislation. Where a particular operation requires consent, the Company obtains it in a manner that allows the data subject’s expression of will to be verified.

Personal Data We Process

2.1. Registration and contact data: first name, last name, stage name, date of birth, country, address, telephone number, email address, language, user-account information and contact-verification information.

2.2. Identification and contractual data: identity-document details, individual identification number or business identification number, information concerning a representative’s authority, agreements, consents and the history of their acceptance. The Company collects such data only where necessary for verification, entering into an agreement, making a payment or complying with applicable law.

2.3. Payment and tax data, including but not limited to bank details, currency, country of tax residence, information about payments, withholdings, refunds and accounting records. Full payment-card details may be processed by a payment provider without being transferred to the Company where this is provided for by the selected payment method.

2.4. Content and rights data, including but not limited to the names and details of artists, authors, performers, producers, rightsholders and share recipients, and information about releases, agreements, licenses, disputes and supporting documents. This information may relate to the User or to third parties identified by the User.

2.5. Technical data, including but not limited to IP addresses, device and session identifiers, operating system, browser, language, dates and times of actions, security logs, error information, cookies and similar technologies.

2.6. Communications data, including the content of emails and chats, attached files, records of decisions, request history and support-quality ratings. Telephone calls are recorded only after notice is given, if this function is used.

2.7. The Company does not request biometric data, health information, religious or political views or other sensitive information unless required by law or a separate identity-verification process. Where an external identity-verification service is used, the data subject receives advance information about the operator, the data involved and the processing terms.

Sources of Personal Data

3.1. The Company obtains personal data directly from the data subject, the subject’s authorized representative, employer or counterparty, from uploaded documents and materials, from payment organizations, digital music services and analytics and security providers, and from lawful publicly available sources.

3.2. A User who provides another person’s data must have a lawful basis for doing so and must inform that person of the disclosure. The Company may request evidence of authority or consent.

Purposes and Legal Bases of Processing

4.1. The Company processes personal data to register and administer user accounts, identify Users, enter into and perform agreements, receive and review Content, deliver releases, prepare reports, calculate remuneration and make payments.

4.2. Personal data is used to provide support, send service notices, consider complaints, protect rights, prevent fraud, artificial streaming and unauthorized access, and comply with the requirements of courts, competent authorities, tax laws and other applicable laws.

4.3. Technical and de-identified data is used to operate the platform, perform diagnostics, maintain security, compile statistics and improve functions. Marketing communications are sent only with the required consent, which may be withdrawn through each communication or through the settings.

4.4. The legal bases for processing are the data subject’s consent, performance of an agreement with the data subject or steps to enter into an agreement at the subject’s request, the Company’s legal obligations, protection of the rights of the Company and third parties in cases provided by law, and other grounds expressly established by the laws of the Republic of Kazakhstan.

4.5. The Company does not make decisions that produce legal effects for a data subject solely on the basis of automated processing unless permitted by law or by separate consent. Automated risk indicators may be used to refer a transaction for human review.

Processing Operations and Retention Periods

5.1. To the extent necessary for the stated purposes, the Company may collect, record, organize, accumulate, store, update, retrieve, use, de-identify, block, transfer, delete and destroy personal data.

5.2. User-account data is retained while the account remains active and for 3 (three) years after closure, unless a longer period is required for settlements, protection of rights or compliance with law. Contractual, payment and accounting records are retained for the periods prescribed by law. Security logs are retained for 5 (five) years. Support requests are retained for 3 (three) years.

5.3. At the end of the applicable retention period, the Company deletes or de-identifies personal data unless another lawful basis for retention applies. Backup copies are deleted in accordance with the backup-retention cycle and are isolated from ordinary use until deletion.

Storage in Kazakhstan and Cross Border Transfers

6.1. The database or digital object in which personal data is initially collected and stored is located in a server room or data center within the Republic of Kazakhstan in accordance with mandatory requirements.

6.2. For distribution, payments, support, analytics, cloud infrastructure and protection of the platform, personal data may be transferred to recipients in other countries. The Company makes such transfers with the data subject’s consent or on another lawful basis and in compliance with personal-data protection requirements.

6.3. Before making a cross-border transfer, the Company assesses the necessity and scope of the data, the recipient’s circumstances and the applicable safeguards. If a country does not provide the level of protection required by law, the transfer is permitted only in cases expressly provided for by the laws of the Republic of Kazakhstan.

Recipients of Personal Data

7.1. Access is granted to Company employees and contractors who require the data to perform their duties. They are bound by confidentiality requirements and receive access only within the scope of their roles.

7.2. Personal data may be transferred to digital music services, user-content platforms, payment and banking organizations, providers of hosting, communications, analytics, identification and information-security services, professional advisers and auditors. Current categories and, where required, the names of recipients are stated in the consent or made available upon request.

7.3. The Company transfers personal data to public authorities, courts and other persons where required by law or a lawful request or where necessary to protect rights. The Company does not sell personal data as a standalone product.

7.4. Release information, such as an artist’s name and image, authors, performers and metadata, may be published as part of Content distribution. Such publication is based on an agreement, consent or another lawful basis and does not constitute unrestricted distribution of other user-account data.

Cookies

8.1. Essential cookies support sign-in, security, language preferences and the operation of core functions. Disabling them may interfere with the operation of the platform.

8.2. Analytics and marketing cookies are used only after the User makes a choice where consent is required by law. The settings panel must allow the User to accept or reject optional categories and subsequently change that choice.

8.3. The cookie panel identifies the technology, provider, purpose and duration. Browser settings also allow cookies to be deleted or restricted but do not replace the consent settings on the website.

Data Security

9.1. The Company implements legal, organizational and technical measures appropriate to the volume of data and the relevant risks. These measures include access controls, User identification, activity logging, backups, protection of transmission channels, software updates, incident response and employee training.

9.2. The Company appoints a person responsible for organizing the processing and protection of personal data. In the event of a personal-data security breach, the Company follows its established procedure and notifies the competent authority and data subjects in the cases and within the periods prescribed by law.

Rights of Data Subjects

10.1. A data subject has the right to know whether the Company holds the subject’s data and to receive information about its processing; to request correction, completion, blocking or destruction of data that was collected or processed unlawfully; and to withdraw consent where permitted by law.

10.2. A request may be sent to support@ftselect.kz or to the Company’s registered address. The request must state the requester’s name and contact details, describe the request and provide information that allows the data to be located. The Company may verify the requester’s identity to prevent disclosure to an unauthorized person.

10.3. Withdrawal of consent does not invalidate processing required to perform an outstanding obligation, comply with law or protect rights in cases provided by law. The Company communicates the outcome of its review within the period prescribed by the laws of the Republic of Kazakhstan.

10.4. A data subject may challenge the Company’s actions before the competent authority or a court. The competent authority’s contact details are available on its official website.

Changes to this Policy and Contact Details

11.1. The Company updates this Policy when its processing activities or the law changes. Each new version is published with its effective date. If a change requires new consent, the Company will request it separately.

11.2. FRESHTUNES SELECT Limited Liability Partnership. Business Identification Number 260840023357. Registered address: Block 2A, 138 Dostyk Avenue, Almaty, Republic of Kazakhstan. Person responsible for personal-data processing: Senior Legal Counsel. Email: support@ftselect.kz