1. Data Controller
SMGTY Europe OÜ, a company registered in Estonia, is the data controller for personal data processed through BizPlay.
Contact: [email protected]
2. Data We Collect
We collect the following categories of personal data:
3. Purposes & Legal Basis
Service Delivery
Creating and managing your account, providing platform features.
Billing & Payments
Processing subscriptions, invoices, and payment disputes.
Security & Fraud
Detecting abuse, protecting account security.
Service Improvement
Analyzing usage patterns to improve features and performance.
Legal Compliance
Retaining records required by tax and commercial law.
Marketing (opt-in)
Sending product updates and promotional offers.
4. Data Sharing
We do not sell your personal data. We share data only with:
- Payment processors: Stripe, local bank gateways (for billing)
- Cloud infrastructure: EU-based hosting providers (data hosting)
- Music vendors & collective management organisations (CMOs): playback data for royalty reporting
- Analytics providers: only if analytics cookies are accepted
- Legal authorities: when required by applicable law
All processors are bound by data processing agreements and provide adequate protection under GDPR Art. 28.
5. Data Retention
We retain your data for as long as your account is active. After account deletion:
- Account and profile data: deleted within 30 days
- Billing records: retained for 7 years (legal obligation under Estonian accounting law)
- General usage and technical logs: anonymised within 90 days.
- Rights-reporting records (the venue, playback and revenue data required for royalty reporting to collective management organisations): retained in identifiable form for the term of the applicable licensing agreement and for at least twelve (12) months after its termination; the accounting records supporting royalty calculations are retained for seven (7) years, so that royalties can be reported, distributed and audited.
- Backup systems: purged within 180 days
In addition, where we are required to do so by law or by our licensing agreements with collective management organisations, certain records are kept for longer than the periods above, so that royalties can be reported, distributed and audited (see 'Rights-reporting records' below).
6. Your Rights
Under the GDPR, you have the right to:
Access
Obtain a copy of your personal data we hold.
Rectification
Correct inaccurate or incomplete data.
Erasure
Request deletion of your data (right to be forgotten).
Portability
Receive your data in a machine-readable format.
Objection
Object to processing based on legitimate interest.
Restriction
Request we limit how we process your data.
To exercise your rights, email [email protected]. We respond within 30 days.
7. Cookies
We use cookies and similar technologies as described in our Cookie Policy. You can manage your preferences at any time.
8. International Transfers
Your data is primarily processed within the European Economic Area (EEA). Where data is transferred outside the EEA, we ensure adequate protection via European Commission adequacy decisions or Standard Contractual Clauses (EU SCCs) and equivalent safeguards approved under GDPR Chapter V.
9. Policy Updates
We may update this Policy periodically. Material changes will be communicated via email or in-app notification at least 30 days in advance. The date at the top of this page indicates the most recent revision.
10. Complaints
If you believe we have mishandled your personal data, you have the right to lodge a complaint with a supervisory authority. As an Estonian company, our lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): aki.ee. You may also contact the data protection authority in your own EU country of residence.