Carbon – Privacy Policy
Last updated: June 18, 2024

The Carbon mobile application (hereinafter the "Application"), published by Voodoo is a platform allowing Users to stream music.

As part of accessing, consulting, browsing and using the Application and its services, you are required to communicate personal data concerning you to Voodoo.

This data is protected by law. For this reason, Voodoo, in its capacity as data controller, has put in place appropriate security measures to protect your personal data.

Please read this policy, explaining how your personal data is used by Voodoo and how to exercise your rights in this regard. This policy supplements the Terms and Conditions, as well as any document or information that refers to this policy.

If necessary, you can ask all your questions directly to Voodoo by sending an email to the following address: music.support@voodoo.io

1. WHAT PERSONAL DATA MAY BE PROCESSED BY VOODOO?

All data that you enter on the Application or when you communicate with Voodoo, namely:

Categories of data	Sample data
Identification data	First name, date of birth, photograph, identification data from your Google or Apple account, if applicable
Contact details	Email address
Data relating to your profile	Nickname, date of registration, presentation, profile status (public or private), subscription to a Premium membership, topics of interest, subscriptions and subscribers
Data relating to your use of the Application	Date, time and name of the tracks played, group subscriptions
Data relating to your interactions with Voodoo	Date, purpose and content of your requests for information/complaints, exchanges with Voodoo's services

Some of this data is mandatory, others optional in order to benefit from all the services offered on the Application. The mandatory nature of the personal data to be provided is indicated at the time of collection. If you refuse to provide the mandatory data requested, Voodoo will not be able to process your request (such as your request to create an account or your contact request).

In addition, some data is automatically collected by the Application via trackers, namely:

Categories of data	Sample data	Purposes
Connection and navigation data	Date and time of connection, IP address, device, browser, operating system, system configuration data, pages and content viewed, mobile advertising IDs and device identifiers	This data is necessary for the proper technical functioning of the Application and its services, as well as for analytical, advertising and social media purposes.

2. WHY DOES VOODOO USE YOUR PERSONAL DATA?

Voodoo processes your personal data only for the following reasons:

Purposes	Examples of how we use your personal data	Legal basis
Creating and managing your account	To create your account to allow you to authenticate yourself on the Application to allow you to access the services of the Application To allow you to update your account	Execution of the T&Cs
In app Advertising	To serve advertising tailored to your preference and interests	Express consent. In the countries where collecting users’ consent may be required by applicable laws and regulations, Voodoo's only processes or shares personal data collected through its apps for personalized advertising purposes once you express your consent through the pop-up notice included in our app.
Provision of the services offered on the Application	to offer you personalized content on the Application (e.g. tracks by your favorite artists To process your contact requests/complaints, if any	Execution of the T&Cs
Improving the Application and its services, as well as your user experience on the Application	to evaluate and improve the App and its services to facilitate your navigation on the Application to ensure the security of the Application to collect and take into account your opinions on the Application and its services via optional satisfaction questionnaires to carry out audience analyses and develop statistics based on the information provided on the Application via internal tools that make it possible, in particular, to search for the volume of mentions of a track or artist on the Application	Voodoo's legitimate interest in improving the Application and its services, as well as your user experience on the Application
Management of a pre-litigation or litigation	to sanction any identified violation to manage any dispute or litigation	Voodoo's legitimate interest in defending its rights and interests
Compliance with legal and regulatory obligations	to comply with legal and regulatory obligations to respond to your requests to exercise rights	Legal and regulatory obligations imposed on Voodoo as publisher of the Application

3. WHO CAN ACCESS YOUR PERSONAL DATA?

In the context of accessing, consulting, browsing and using the Application, your personal data may be communicated to the following recipients:

Recipients	Purposes
Voodoo and its authorized personnel	For administrative, operational and commercial management purposes of the Application and its services
Other users of the Application	Only for information that is public by default or made public by you (public information about your profile, interactions, group memberships)
Voodoo's subcontractors (hosting provider, IT maintenance provider, etc.)	For purely technical or logistical purposes relating to the management of the Application and its services
Administrative or judicial authorities	Only in the event of an express and reasoned request on their part or in the event of a proven infringement of legal or regulatory provisions
External Advice	Only in connection with the management of possible disputes and other legal matters where necessary
Other Third Parties	As a result of or in connection with the restructuring, reconstitution, acquisition, debt financing, merger, sale of assets of Voodoo similar transaction, as well as in the event of insolvency, bankruptcy or receivership in which personal data is transferred to one or more third parties as assets of Voodoo

4. INTERNATIONAL TRANSFERS

Some of the partners and processors referred to in this policy are located outside of the European Union.

In such case, we ensure that:

the personal data is transferred to countries recognized as offering an equivalent level of protection or,

For personal data transferred outside of countries recognized by the European Commission as having a sufficient level of protection, any of the mechanisms offering appropriate guarantees is used, for which provision is made by applicable regulations, and notably the adoption of the standard contractual clauses of the European Commission.

5. HOW DOES VOODOO PROTECT YOUR PERSONAL DATA?

Voodoo has implemented technical and organisational measures to protect your personal data, in particular against possible breaches that may result, accidentally or unlawfully, in the destruction, loss, alteration, unauthorised access or disclosure of your personal data. These measures ensure an appropriate level of data security and take into account the state of knowledge, the costs of implementation in relation to the risks and the nature of the data to be protected.

Voodoo also guarantees that its staff members and any person required to process your personal data comply with the internal rules and procedures relating to the processing of personal data and in particular the technical and organizational security measures put in place to protect your personal data. In this context, Voodoo's practices are regularly reviewed and updated to ensure the confidentiality of personal data and to ensure that internal policies are respected.

If you find a vulnerability or want to report a security incident, we invite you to send us an email at music.support@voodoo.io.

6. HOW LONG IS YOUR PERSONAL DATA STORED?

In general, your personal data will only be retained for as long as necessary to achieve the purposes for which the data was collected or to comply with legal or regulatory requirements.

Generally :

The data attached to your account (including your interactions) is kept until your account or contribution is deleted or if your account is inactive for two (2) years;
The data collected in the context of your contact requests / complaints are kept until they have been fully processed

Beyond these periods, your data is kept for:

five (5) years from the deletion of your account for data retained for evidentiary purposes;
ten (10) years from the end of the accounting year for data kept for accounting purposes, in particular in the event of payment of a Premium subscription on the Application.

Finally, regarding trackers used on the Application:

The information collected through trackers is kept for a maximum period of twenty-five (25) months;
The lifespan of trackers is a maximum of thirteen (13) months.

7. WHAT ARE YOUR RIGHTS OVER YOUR PERSONAL DATA?

In accordance with the regulations on the protection of personal data, you have the following rights over your personal data:

Your rights	Scope of your rights
Right of access	You have the right to request: confirmation as to whether or not Voodoo is processing your personal data; clear, transparent and comprehensible information on how Voodoo uses your personal data as well as on your rights (as set out in this policy); a copy of your personal data.
Right to rectification	You have the right to request the rectification of your personal data in order to obtain the modification of your personal data if it is outdated, inaccurate or incomplete.
Right to erasure	You have the right to request erasure of your personal data (or right to be forgotten) where one of the following grounds applies: you object to the processing of your personal data and there are no overriding legitimate grounds for continuing to process your personal data (such as Voodoo's obligation to keep certain documents containing personal data); you object to commercial prospecting operations; you decide to withdraw your consent on which the processing is based; when your personal data is no longer useful for the original purposes for which it was collected or otherwise processed; The use that is made of your data does not comply with the applicable legislative or regulatory provisions.
Right to Limitation	You have the right to request the temporary restriction of the processing of your personal data, in particular for the purpose of carrying out verifications, namely: when you contest the accuracy of your information, the time it takes for Voodoo to verify that it is correct; if the processing is unlawful and, rather than requesting its erasure, you prefer to restrict its use; if Voodoo no longer needs the data for processing but it is still necessary to enable you to establish, exercise or defend legal claims; if you object to the processing pursuant to your right to object, for the duration of the verification period to confirm that the legitimate grounds pursued by Voodoo prevail over yours.
Right to portability	You have the right to request the portability of your personal data allowing you to receive the personal data provided, in a structured, commonly used computer format, and for it to be transmitted to a third party if technically feasible. This right is not exercised in all circumstances, it only applies if it meets all of the following conditions: it relates only to your personal data, excluding all anonymous data or data of third parties; it does not infringe the rights and freedoms of Voodoo (in particular trade secrets) or third parties (in particular intellectual property rights); it concerns personal data processed in an automated manner (paper files are therefore not concerned); the processing is based on your consent or the performance of a contract concluded with Voodoo (to verify this, you can refer to section 2 of this policy).
Right to object	You have the right to object to the processing of your personal data where it is based on Voodoo's legitimate interest. Thus, Voodoo will cease the processing, unless there are compelling legitimate grounds that override your interests, rights and freedoms (such as compliance with a legal obligation or the establishment, exercise or defence of legal claims).
Right to withdraw consent	You have the right to request the withdrawal of your consent once it has been obtained, without this withdrawal affecting the legitimacy of the processing previously carried out.

In certain circumstances, Voodoo may ask you for specific information in order to confirm your identity and guarantee the exercise of your rights. This is another appropriate security measure to ensure that personal data is not disclosed to someone who does not have the right to receive it.

If you have any questions and wish to exercise your rights, you can contact Voodoo directly by sending an email to the following address: music.support@voodoo.io.

You may lodge a complaint with a Data Protection Authority. Voodoo being a French company, our supervisory authority is in France: CNIL www.cnil.fr

8. CALIFORNIA RESIDENTS

This Section supplements the information in our Privacy Policy, and applies solely to California residents. It applies to Personal Data we collect as a business as defined under the CCPA.

In the preceding 12 months, Voodoo has collected the categories of personal information from consumers described in Section 1 of this Privacy Policy.

As a California resident, you have the following rights under the CCPA:

Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you.
Right to Delete: You have the right to request the deletion of your personal information that we have collected from you.
Right to Opt-Out: You have the right to opt-out of the sale of your personal information. Please note however that we do not sell personal information under applicable law.

To exercise your rights under the CCPA, please contact us at music.support@voodoo.io. We will not discriminate against you for exercising any of your CCPA rights.

9. UPDATES TO THIS PRIVACY POLICY

The privacy policy is precisely dated and may be modified and updated by Voodoo at any time, in particular in the event of changes in the services offered on the Application or in the applicable regulations. Therefore, we recommend that you review this policy each time you access the Application.