Last updated: 18 June 2026
Halo Music — Privacy Policy
**Last updated: **
1. Introduction
Halo Music LLC, a Delaware limited liability company ("Halo", "we", "us", "our"), respects your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, share, and protect personal data when you use the Halo music-publishing administration platform, including partner-branded ("white-label") instances, the writer portal, and the submission tools (the "Platform"), and describes the rights you may have.
The Platform is a private, login-protected service for two main groups of people: writers (songwriters, composers, and their invited co-writers) and partner / publisher administrators who manage a roster of writers and works. This Policy applies to both.
"Applicable Data Protection Law" means all laws that apply to our processing of personal data, including the UK General Data Protection Regulation and the Data Protection Act 2018 ("UK GDPR"), the EU General Data Protection Regulation ("EU GDPR") where applicable, and US state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA").
2. Who is the controller
For most processing connected with your use of the Platform — your account, authentication, and platform activity — Halo is the data controller.
Where Halo administers works on behalf of a partner publisher that operates its own branded instance, that partner may be the controller of its writers' data and Halo acts as its processor; in that case the partner's own privacy notice may also apply, and a data processing agreement governs the relationship.
Separately, Sentric Music Group Ltd. and the collection societies, the MLC, and DSPs that we deliver works and data to are independent controllers for their own processing of that data under their own privacy policies.
3. The personal data we collect
Depending on your role and how you use the Platform, we may collect the following categories of personal data:
- Identity and contact data — name, username, account name, email address, phone number, postal address, and date of birth where relevant.
- Login and authentication data — login credentials, magic-link tokens, and authentication logs.
- Industry identifiers — IPI number, ISNI number, society/PRO membership numbers, and similar music-industry identifiers.
- Payee and financial data — payment/payee details, bank or payment-provider information, and tax status or registration information needed to pay or report royalties.
- Works and rights data — musical-work and recording metadata, ISRCs/ISWCs, writer splits and ownership shares, registration status, and related copyright information you submit or that we generate. (Where this concerns identifiable individuals — e.g. co-writers — it is personal data.)
- Royalty and transaction data — statements, amounts paid or payable, deductions/commission, and revenue-source information.
- Communications — messages, support requests, and the content and metadata of your correspondence with us.
- Usage and device data — IP address, browser type, operating-system version, device identifiers, pages viewed, features used, and interaction logs.
- Approximate location — general geographic region inferred from IP address (not precise geolocation).
- Compliance / KYC data (where applicable, primarily handled by our administrator) — information used for know-your-customer, anti-money-laundering, sanctions, and fraud-prevention screening.
We do not seek to collect special-category data and ask that you do not submit it unless necessary for a specific, agreed purpose.
4. Where we collect personal data from
We collect personal data: (a) directly from you, when you register, submit works, communicate with us, or use the Platform; (b) from a partner, publisher, or organisation you are associated with, where they invite you or administer your works; (c) from co-writers or other writers who name you on a work; and (d) from third-party sources and integrations such as Spotify (to pre-populate work data), the MLC, collection societies, and market-data providers, and from publicly available sources for verification.
5. How and why we use personal data, and our legal basis
| Purpose | Examples | Legal basis (UK/EU GDPR) |
|---|---|---|
| Provide the Platform | Create and authenticate your account; let you register and submit works; show statements and registration status | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) where you act for an organisation |
| Administer works & royalties | Deliver works and metadata to Sentric, societies, and the MLC; reflect royalty data back to you | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Communicate with you | Service emails, invitations, support, and notices | Performance of a contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Secure and maintain the Platform | Logging, troubleshooting, backups, fraud and abuse prevention, access control | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
| Improve and develop | Analytics, statistics, and product improvement (often using aggregated/de-identified data) | Legitimate interests (Art. 6(1)(f)) |
| Marketing / newsletters (if any) | Updates about Halo and the Platform | Legitimate interests (Art. 6(1)(f)) or consent (Art. 6(1)(a)) where required |
| Compliance & KYC/AML | Identity verification, sanctions/PEP screening, tax and accounting obligations | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
| Legal claims & business transactions | Establishing, exercising, or defending claims; merger/acquisition due diligence | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
For US users, our processing is carried out for the corresponding business purposes permitted under CCPA/CPRA (see Section 11).
6. Cookies and similar technologies
Because the Platform is login-protected, we use cookies and similar technologies primarily for essential functions — authentication, session management, security, and remembering your settings — and, where applicable, limited analytics to understand and improve usage. See our (/cookies.html) for details and your choices.
7. Who we share personal data with
We share personal data only as needed for the purposes above:
- Sentric Music Group Ltd. and other administrators / collection societies / the MLC / DSPs — to register, administer, and collect on your works and to pay royalties. These parties are independent controllers under their own privacy policies (for Sentric, see privacy@sentricmusic.com).
- Partner publishers — where your works are administered under a partner's branded instance, within that partner's authorised scope.
- Service providers (processors acting on our behalf) — hosting and database infrastructure, email/notification delivery, authentication, analytics, and IT support providers. They process personal data only on our instructions and under contract.
- Market-data and enrichment providers — e.g. Spotify and market-data services used to enrich work and catalogue data.
- Professional advisers, authorities, and courts — where necessary to comply with law, respond to lawful requests, or establish, exercise, or defend legal claims.
- Buyers / parties to a business transaction — in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate confidentiality.
We do not sell your personal data. (Confirm this remains accurate for any future ad/market-data monetisation; if that changes, the CCPA "sale/share" disclosures in Section 11 must be updated.)
8. International transfers
We and our service providers and administrators may process personal data in countries other than your own, including the United Kingdom, the European Economic Area, and the United States. Where we transfer personal data across borders in a way that triggers UK/EU GDPR transfer rules, we put appropriate safeguards in place — such as the UK International Data Transfer Agreement / Addendum or the EU Standard Contractual Clauses, together with any additional measures required. You may request a copy of the relevant safeguards using the contact details below.
9. How long we keep personal data
We keep personal data only as long as necessary for the purposes described in this Policy, or as required by law. Retention periods are driven by: the life of your account and administration relationship; our need to evidence registrations, splits, and royalty history (which may require retention well beyond account closure); legal, tax, and accounting obligations; and the period for bringing or defending legal claims. When personal data is no longer needed, we delete it or irreversibly anonymise it.
10. How we protect personal data
We use appropriate technical and organisational safeguards to keep personal data from being lost, altered, destroyed, or accessed by anyone who shouldn't see it — including access controls, role-based permissions, encryption in transit, row-level security on our database, and activity logging.
To confirm it's really you signing in, the Platform uses measures such as magic-link sign-in and, where enabled, an extra verification step (a one-time code or an authenticator app). If you choose to use a third-party authenticator app, that's the app provider's product, not ours — their privacy terms govern what they do with your information.
No online system is ever completely secure, so while we work hard to protect your data we can't promise it's immune to every risk. You can help by keeping your login details private and signing out when you're on a shared device.
11. Your rights — UK/EU GDPR
Where UK/EU GDPR applies, you have the right, subject to conditions, to: access your personal data and receive a copy; request rectification of inaccurate or incomplete data; request erasure; request restriction of processing; object to processing based on legitimate interests or to direct marketing; data portability; and withdraw consent at any time (without affecting prior lawful processing). You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ICO); in the EU, your local data-protection authority.
To exercise any right, contact us at info@halomusic.us. We may need to verify your identity.
12. United States — California Privacy Notice and other state rights
This section supplements the Policy and applies to US residents, in particular California residents, under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA") and comparable state laws. Consistent with our service, this primarily concerns personal information about residents who, as writers/creators or as partner/publisher representatives, engage with Halo on a business-to-business basis.
12.1 Categories of personal information we collect. In the last twelve (12) months we may have collected the following CCPA categories: identifiers (name, pseudonym/persona, email, phone, address, account name, government-issued and tax identification numbers, IPI/ISNI and online identifiers); California Civil Code § 1798.80(e) information (name, signature, contact details, government ID numbers, and payment/bank/financial information); protected characteristics (e.g. date of birth/age); commercial information (works and services obtained or considered, royalty/transaction history); internet/network activity (cookie and device identifiers, usage data); geolocation (approximate, from IP address); professional/employment information (for partner representatives — employer, role); and inferences. Because categories overlap, some data may fall under more than one.
12.2 Sensitive personal information. Some of the above may be "sensitive personal information," including government identifiers (Social Security, passport, driver's licence/state ID numbers) and account log-in credentials. We use sensitive personal information only to provide and secure the Platform and administer works/royalties, and for other purposes permitted by the CCPA — not to infer characteristics. You have the right to limit its use and disclosure to those permitted purposes.
12.3 Sources and disclosures. We collect from the sources in Section 4 and disclose to the recipients in Section 7, in each case for the business purposes in Section 5. We disclose personal information to service providers under contracts requiring confidentiality and use only to perform the service. Halo does not "sell" or "share" personal information (including for cross-context behavioural advertising) as those terms are defined by the CCPA.
12.4 Your California rights. Subject to exceptions, you have the right to: know/access the categories and specific pieces of personal information collected, the sources, purposes, and recipients (up to twice in a 12-month period); delete; correct; opt out of sale/sharing (we do not sell or share); limit the use of sensitive personal information; and non-discrimination for exercising these rights.
12.5 How to submit a request. Email info@halomusic.us. Before we act, we need to be confident the request really comes from you, so we'll ask you to confirm details we already hold — normally your name and account email, and for sensitive requests we may ask you to confirm something only the account holder would know, such as a figure from a recent royalty statement. You can authorise an agent to act for you (with written permission or a power of attorney and confirmation of your identity). We aim to respond within 45 days, and will tell you if we need a further 45 days. We don't hold household data.
12.6 California "Shine the Light." California residents may request, once per calendar year and free of charge, information about personal information disclosed to third parties for their direct-marketing purposes in the prior year. Halo does not disclose personal information to third parties for their own direct marketing. Requests: info@halomusic.us.
12.7 Nevada residents. Nevada residents may opt out of the sale of certain personal information to third parties who intend to license or sell it. Halo does not sell such information, but you may submit a request to info@halomusic.us with the subject "Nevada Privacy Rights", including your full name, email, and postal address so we can verify Nevada residence.
13. Children
The Platform is not directed to children and is for users aged 18 or over. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact us and we will delete it.
14. Changes to this Policy
We review this Policy regularly and may update it. We will change the "Last updated" date and, for material changes, may provide additional notice (for example, by email or an in-Platform notice). Please check this page periodically.
15. Contact us
For any question about this Policy or to exercise your rights:
Halo Music LLC (a Delaware limited liability company) Email: info@halomusic.us
Halo is your contact for personal data relating to your account and your use of the Platform. Where your request concerns data that Sentric Music Group Ltd. holds and controls as our administrator (for example, royalty payment, tax, or KYC/AML records), that data sits with Sentric as an independent controller and you can also contact them directly at privacy@sentricmusic.com. We will help direct your request to the right place where we can.