Kollekt — Privacy Notice
Version 2.3 · Effective 27 October 2026
1. Who we are
Kollekt Group Oy (business ID 3336449-2), c/o WA Yhtiöt Oy, Maistraatinportti 1, 00240 Helsinki, Finland (“Kollekt”, “we”, “us”) runs the Kollekt platform at kollekt.io, app.kollekt.io and in the Kollekt apps for iOS and Android (the “Platform”).
This notice explains what personal data we process, why, on what legal basis, who receives it, how long we keep it and what rights you have. Capitalised words have the meaning given in our Terms of Service.
Contact: privacy@kollekt.io, or by post to the address above, marked “Privacy”.
2. Our role
- Kollekt is the controller of personal data processed on the Platform, except as set out below.
- Kollekt and an Artist are joint controllers when we make Member Data and Engagement Data available to that Artist on the Platform (section 7).
- Whoever exports Member Data from the Platform (the Artist, or an organisation such as a label or management company acting for the Artist) is an independent controller of that copy and may use it only for that Artist.
3. The personal data we process
| Category | What it includes | Whose |
|---|---|---|
| Account data | Email address, username, country (derived from your connection at signup), language, role | Everyone with an Account |
| Acceptance and consent records | Which Terms version you accepted and when; consents and withdrawals | Everyone with an Account |
| Sign-in data | Sign-in links and tokens, session cookies, the devices you sign in on | Everyone with an Account |
| Profile data | Display name and avatar; optionally your name, city and phone number | Members |
| Membership data | Which Artist Spaces you have joined, when, your tier, when you were last active, your communication settings | Members |
| Content | What you post, upload or send on the Platform | Members, Artists |
| Engagement Data | Activity and spending measures, scores and rankings in each Artist Space | Members |
| Referral data | Who referred you and whom you referred | Members |
| Purchase data | What you buy, amounts, transaction and receipt identifiers, refunds and chargebacks, payment method type; for a gift, the recipient’s email or username. Card details are held by the payment provider or app store, not by us | Members |
| Notification data | Push tokens, records of messages we send you, your settings | Everyone with an Account |
| Usage and diagnostic data | Pages and features used, IP address, browser and device information, error reports | Everyone who uses the Platform |
| Artist data | Artist page information, roles, revenue splits, records of data access and exports | Artists, Admins |
| Payout data | Legal or company name, business ID, date of birth, address, tax residence and number, bank details, sanctions-screening results, payout statements | Payout Recipients |
| Verification data | Information used to verify that someone claiming an Artist page is that Artist | Artists |
| Support data | What you send to our support channels | Anyone who contacts us |
| Notify requests | Your email address and the preview pages you asked to be told about | People who ask to be notified when an Artist joins |
| Business contact data | Name, role, organisation, work email and our correspondence | Music-industry professionals we contact (section 12) |
You need to give an email address to create an Account, and payout details to receive payouts; everything else is optional. We do not ask for sensitive data such as health information or political views. Please don’t include it in what you post.
4. Where the data comes from
- From you, when you create an Account, join an Artist Space, post, buy, set up payouts or contact us.
- From your device and your use of the Platform (section 9).
- From Artists and Admins, when they manage their Artist Spaces.
- From payment providers and app stores, about purchases, refunds and payouts.
- From public sources, when we create preview pages for Artists. We do not contact each Artist when we create a preview page; instead, every preview page says that it is built from public information and how the Artist can claim it or ask us to remove it.
- From people who refer you or send you a gift.
5. Why we process your data, and our legal basis
References are to Article 6(1) of the GDPR.
| Purpose | Legal basis |
|---|---|
| Running your Account, signing you in, Artist Spaces, Content, purchases, gifts, refunds and support | Contract (b) |
| Making your Member Data available to the Artists you join and their Admins, so they can serve and contact you | Contract (b): this is part of the membership you ask for when you join |
| Email and push messages from Artists you join about their music, merchandise, shows and products | Consent (a), given when you create your Account. Turn off either channel at any time in your settings, without leaving any Artist Space |
| Sharing your optional name, city and phone number with Artists you join, and texts from them | Consent (a). Withdraw by removing the details or changing your settings |
| Service messages about your Account, purchases, security, changes to our terms and how to use the Platform | Contract (b); legal obligation (c) where applicable |
| Kollekt’s own promotional messages | Consent (a), or legitimate interests (f) for similar offers to customers who bought from us, with an opt-out when we collect your email and in every message |
| Telling you when an Artist whose preview page you followed joins Kollekt | Consent (a), given when you ask to be notified |
| Promoting Artists on Kollekt with their name, image and page | Contract (b) with the Artist |
| Engagement scores and leaderboards in each Artist Space | Legitimate interests (f) in recognising Members. You can object (section 13) |
| Analytics and improving the Platform, including with AI tools | Legitimate interests (f) in running and improving the Platform. You can object |
| Producing anonymous statistics, including for commercial use | Legitimate interests (f) in developing the Platform and offering insights about music audiences. You can object to your data being used for this |
| Advertising and analytics tags an Artist adds to their pages | Consent (a), asked on the page before any tag runs. Kollekt and the Artist are joint controllers for this collection; the Artist and the tag provider are responsible for later use |
| Security, fraud prevention, moderation and enforcing our Terms | Contract (b); legitimate interests (f); legal obligation (c) where applicable |
| Payouts, identity and eligibility checks, tax reporting and accounting | Contract (b); legal obligation (c) |
| Verifying Artists and building preview pages from public information | Legitimate interests (f) in preventing impersonation and letting Artists claim their page |
| Records of acceptance and consent; legal claims; requests from authorities | Legal obligation (c); legitimate interests (f) |
We do not make solely automated decisions with legal or similarly significant effects on you. Artists must have a person review decisions where engagement scores are used to allocate scarce benefits.
We do not sell personal data, give one Artist access to another Artist’s Member Data, or upload Member Data to advertising audiences.
We use AI providers to support Users, analyse how the Platform is used and develop it. When an AI assistant answers you, for example in support chat, we tell you. They act under contracts that prohibit training on the data and using it for their own purposes. We do not use Content, Member Data or Engagement Data to train AI models.
6. Who receives your data
6.1 Artists you join, and their Admins
When you join an Artist Space, the Artist and their Admins receive the following for that Artist Space only. Admins may act for organisations working with the Artist, such as labels, management companies, publishers, agencies and promoters; they may use the data only for that Artist.
| Data | Shared |
|---|---|
| Display name, avatar, email address, country | Yes |
| Name, city and phone number | Only if you have added them and agreed to share them |
| Tier, date joined, date last active, total spent with that Artist | Yes |
| Communication settings | Yes |
| Engagement Data for that Artist Space | Yes |
| What you post in that Artist Space | Viewable in the Platform only |
Never shared with Artists or Admins: your date of birth, payout details, payment details, sign-in credentials, device identifiers, IP address or anything about your activity in other Artist Spaces.
Other Members of an Artist Space can see your display name, avatar and what you post there. Leaderboards in an Artist Space are visible to its Members and show your display name, avatar and position. Spending can affect your position, but other Members do not see how much you have spent.
6.2 Service providers
These providers process data for us only on our instructions, under data-processing terms that meet Article 28 of the GDPR:
| Provider category | What for | Where |
|---|---|---|
| Hosting, content delivery and storage | Running the Platform, storing Content, security, sending email | EU and US; global delivery network |
| Database | Storing Platform data | EU |
| Payments | Web payments, receipts and customer records | EU and US |
| Payouts | Paying Artists and other Payout Recipients | EU, and the recipient’s country |
| Push notifications | Delivering notifications to your device | EU and US |
| Error monitoring | Finding and fixing errors | EU |
| Support chat | Answering support requests | EU |
| Artist verification messaging | Verifying Artists through social-media messages | US |
| AI | Support and analysis of Platform data | US |
You can ask us at privacy@kollekt.io for the names of current providers.
6.3 Others
- App stores (Apple, Google), for purchases you make through them, as controllers under their own terms.
- Our payment and payout providers, which also act as controllers for their own fraud prevention, identity and legal checks.
- The recipient of a gift you buy, who is told who it is from.
- Advertising and analytics providers whose tags an Artist adds to their pages, only after your consent on that page.
- Authorities, courts and advisers where the law requires it or to establish or defend legal claims; tax authorities for payout reporting.
- A buyer or successor in a business transfer.
7. Joint controllership with Artists
Kollekt and each Artist you join share responsibility for the Member Data the Platform makes available. Kollekt decides what data is available, secures the Platform, gives you this notice and is your main contact. The Artist decides whom to contact, secures its own systems and exported copies, and gives you its own information if it uses your data for its own purposes. You can exercise your rights against Kollekt, the Artist or both: contact privacy@kollekt.io and we will act and pass the request on. Artists and their Admins must apply your opt-outs and objections within 72 hours of being told and delete data they no longer need within 30 days.
8. International transfers
Our main database is in the EU. Some providers, and some Artists and Admins, are outside the European Economic Area, including in the United States. Transfers use an adequacy decision, the EU–US Data Privacy Framework for certified recipients, or EU Standard Contractual Clauses. Contact privacy@kollekt.io for a copy of the safeguards. Artists and Admin Organisations are responsible for transfers through their own tools.
9. Cookies and device storage
We store only what is needed to sign you in, keep you signed in, keep the Platform secure and complete actions you start, such as a referral link you followed. Our analytics store nothing on your device. Artist advertising and analytics tags run only after you consent on that Artist’s page, and you can withdraw consent there at any time.
10. How long we keep data
| Data | How long |
|---|---|
| Account, profile and membership data | While your Account exists; deleted within 30 days after you delete it, except as listed below |
| Content you post | Until you delete it or your Account is deleted |
| Engagement Data | While you are a Member of that Artist Space; deleted when you leave, object or delete your Account |
| Acceptance and consent records | Life of your Account plus 3 years |
| Accounting records | Books and financial statements 10 years from the end of the financial year; vouchers 6 years from the end of the calendar year in which the financial year ended (Accounting Act 1336/1997) |
| Payout identity, sanctions and tax records | 5 years after the relationship ends, or longer where tax law requires |
| Usage analytics | 13 months, then deleted or made anonymous |
| Error reports | 90 days |
| Notification records | While your Account exists |
| Support conversations | 3 years after the conversation ends |
| Verification data | Until verification is complete, then 12 months |
| Referral data | While the referral can earn a benefit, and at most while your Account exists |
| Records of Member Data access and exports | 3 years |
| Sign-in links | Until they expire |
| Notify requests | Until we tell you the Artist has joined, or 2 years |
| Business contact data | 2 years after our last contact; a suppression record is kept if you opt out |
| Backups | Deleted data leaves backups within 30 days |
11. Children
The Platform is for people aged 13 or over, or the higher minimum age in their country. Users under 18 need a parent or guardian’s permission. Payout Recipients must be at least 18. If we learn that an Account is below the minimum age, we close it and delete its data, subject to legal retention.
12. Music-industry professionals
We contact music-industry professionals at their work addresses about Kollekt, using contact details from public sources and data providers, on the basis of legitimate interests. You can opt out by replying to the message or emailing privacy@kollekt.io. We keep a suppression record so that we do not contact you again.
13. Your rights
You may access, correct, erase, restrict or receive a portable copy of your personal data. You may object to processing based on legitimate interests, including engagement scores and leaderboards, analytics and anonymous statistics, and to direct marketing at any time. You can withdraw consent at any time without affecting earlier processing.
Use your settings or contact privacy@kollekt.io. We reply within one month, which may be extended by up to two further months for complex requests; we will tell you if so. We may need to verify your identity.
You may complain to the Finnish Data Protection Ombudsman (tietosuoja.fi) or the supervisory authority where you live or work.
14. Security
We use technical and organisational safeguards appropriate to the risk, including access restrictions. We notify the supervisory authority and affected people of personal-data breaches where the law requires.
15. Changes to this notice
We update this notice when our processing changes and tell you about material changes before they take effect.