CMC Picanto Privacy Policy

The Canadian Music Centre (“CMC”, “we”, “our”, and “us”) understands the importance of protecting the personal information of individuals and the importance of securing confidential information of all types. We have created this Privacy Policy (the “Policy”) to demonstrate our commitment to protecting your privacy. This Policy explains:

• what personal information we collect and why we collect it;
• how we use your personal information;
• who we share your personal information with; and
• the choices you have to access, update, and remove your personal information.

We created this Policy to give you confidence as you make use of the Service and to demonstrate our commitment to fair information practices and the protection of user privacy. Our Policy regarding how personal information entrusted to us is collected, used, disclosed, and retained reflects the principles set forth in Canada’s Personal Information Protection and Electronic Documents Act, SC 2000, c 5. Your use of the Service is governed by this Policy, as well as our Terms and Conditions of Use, which is incorporated herein by reference and available at Terms. Unless otherwise defined herein, all capitalized terms in this Policy shall have the meanings indicated in the Terms.

This Policy governs the Picanto Service and describes the information that we collect from users of our Service (“you” and “your”). This personal information may be obtained directly from you or collected from third parties that have the right to disclose this information to us. From time to time, we may develop new or offer additional services. If the introduction of these new or additional services results in any material change to the way we collect or process your personal information we will provide you with more information or additional terms or policies. Unless stated otherwise when we introduce these new or additional services, they will be subject to this Policy.

1. Consent for Personal Information
   1. By providing CMC with your personal information, accepting the Privacy Policy in registering for an Account, or by visiting and using the Service, you expressly consent to the collection, use, and disclosure of such information in accordance with this Policy or for the purposes identified to you at the time you provided the personal information. Any secondary use of the personal information will only be processed with your express consent, except as required by law.
   2. You have the opportunity to withdraw your consent, or to opt-out at any time from our email or mailing list. If you wish to withdraw your consent or to opt-out at any time, please contact us as set out in Section 14 below.
2. Your Rights and Access
   1. Privacy Settings. When you register for the Service, you create an Account and you may manage your privacy settings through the Account. You may modify or remove any of the information in your Account at any time by logging into your Account and making the desired changes. For technical reasons, any modifications or deletions which you request may take a short period of time to take effect. Please note that withdrawing certain personal information in your Account that is required for you to access the Service may result in the closing of your Account.
   2. Access. You have the right to access the personal information that CMC processes about you. You can request from us information about: (i) the personal information we hold about you; (ii) the categories of personal information concerned; (iii) the purposes of the processing; (iv) details to whom your personal information has been/will be disclosed; (v) how long we retain your personal information; (vi) if we did not collect the information directly from you, information about the source; and (vii) how to lodge a complaint with the correct supervisory authority.
   3. Correction of Inaccuracies. CMC, to the best of its ability, will strive to collect and maintain the most accurate personal information available. You have the right to request the update and correction of inaccuracies in your personal information in our custody and control, subject to certain exceptions prescribed by law. You may request the updating and correction of inaccuracies in your personal information we have in our custody or control by emailing or writing to us at the contact information set out in Section 14 below. We may request certain personal information for the purposes of verifying the identity of the individual seeking access to their personal information records.
   4. Deletion. You may request that we delete your personal information in accordance with applicable laws.
3. Why Do We Collect Your Information?
   1. When you use or interact with the Picanto Service, we use a variety of technologies to process the personal information we collect about you (as described in Section 5.2) for various reasons. We have set out in the table below the reasons why we collect your personal information and the categories of personal information (identified in Section 4) used for such purposes:
      
      

      Description of why CMC collects your personal information (“collection purpose”)	Categories of personal information used for the collection purpose
      To provide and personalize the Picanto Service.	User Data Account Data Payment and Purchase Data Data from Advertising Partners Data from Technical Service Partners
      To resolve disputes regarding the Picanto Service.	User Data Account Data Customer Service Data
      To evaluate and develop new features, technologies, and improvements to the Picanto Service.	User Data Account Data Usage Data
      For marketing, promotion, and advertising purposes.	User Data Account Data Usage Data Email Offers, Mailing Lists, and Newsletters Data Data from Advertising Partners
      To comply with legal obligations and law enforcement requests.	User Data Account Data Payment and Purchase Data Contests, Surveys, and Sweepstakes Data
      To fulfill contractual obligations with third parties (such as licensing agreements) and to take appropriate action with respect to reports of intellectual property infringement and inappropriate content.	User Data Account Data Payment and Purchase Data
      To establish, exercise, or defend legal claims.	User Data Account Data Usage Data Payment and Purchase Data Contests, Surveys, and Sweepstakes Data
      To conduct business planning, reporting, and forecasting.	User Data Account Data Usage Data Payment and Purchase Data
      To process your payment.	User Data Account Data Payment and Purchase Data
      To detect fraud, including fraudulent payments and fraudulent use of the Picanto Service.	User Data Account Data Usage Data Payment and Purchase Data
      To conduct research, contests, surveys, and sweepstakes.	User Data Account Data Usage Data Contests, Surveys, and Sweepstakes Data
      To inform you about online and offline offers, products, services, events, product news, and updates, where you have signed up to receive such communications.	User Data Account Data Email Offers, Mailing Lists, and Newsletters Data
      To measure consumer interest in our products and Service.	User Data Usage Data Surveys and Customer Research Data Data from Technical Service Partners
      To generate analytics about how users browse and interact with the Service.	User Data Usage Data Data from Technical Service Partners

4. What Personal Information Do We Collect?
   1. CMC collects and processes personal information in accordance with this Policy. We will not sell, share, or rent this information to others, unless in accordance with your consent, except as otherwise set out herein. CMC collects personal information for the purposes of providing our products, services, promotions, and events to you. We have set out in the tables below the categories of personal information we collect and use about you and how we collect it.
   2. The table below describes the personal information collected when you sign up for the Picanto Service:
      
      

      Categories of Personal information	Description of Category
      User Data	This is the personal information that is provided by you or collected by us to enable you to sign up for and use the Picanto Service. Depending on the type of Picanto Service plan you sign up for, this may include your name, email address, mailing address, and country of residence. You may have the option to provide us with additional personal information in order to make your Account more personalized or to provide CMC with insight about you as a user of the Picanto Service, such as your demographic information. Where possible, we indicate which fields are required and which fields are optional. We may collect your login credentials for the purpose of the administration of your Account.
      Payment and Purchase Data	When you create a Paid Subscription Account, you will need to provide us with payment and billing information. Your personal information may be processed or requested by a third-party service provider in connection with facilitating payments through the Picanto Service, as further described in Section 6.4.

   3. The table below describes the personal information collected through your use of the Picanto Service.
      
      

      Categories of Personal information	Categories of Personal information Description of Category
      Account Data	This is the personal information that is collected about you when you access and/or use the Picanto Service, including: information about your type of Picanto Service plan; information about your interactions with the Picanto Service, Content, and other Picanto users, such as your search queries (including the date and time of any requests you make), streaming history, playlists you create, your library, and your browsing history;   inferences drawn about your interests and preferences based on your usage of the Picanto Service; and User Content you post to the Picanto Service, such as photos, playlist titles, and interactions with the CMC Customer Service team. Please note that we will only access your camera or photos from your Device if you give us permission to do so, and we will only access images that you specifically choose to share with us and metadata related to those images, such as the type of file and the size of the image. We will never scan or import your Device’s photo library or camera roll.
      Usage Data	When you use or access the Picanto Service, we automatically collect certain technical information about your Device, which may include: URL information; online identifiers including cookie data and IP addresses; information about the types of Devices you are using, such as unique device IDs, network connection type (e.g. WiFi, 3G, LTE, Bluetooth), provider, network and device performance, browser type, language, information enabling digital rights management, operating system, and Picanto application version; attributes of the Devices on your WiFi network that are available to connect to the Picanto Service (such as speakers); and your non-precise location, which may be derived or inferred from certain technical data (e.g. your IP address, language setting of your Device, or payment currency), to comply with geographic requirements in our licensing agreements, and deliver personalized content and advertising to you. We use this information to help us understand our activity, and to monitor and improve our Service. We also use this information to do internal research on our users’ demographics, interests, and behavior to better understand, protect, and serve you and our community.

   4. The table below describes the personal information that you choose to give us that enables us to provide you with additional features/functionality:
      
      

      Categories of Personal information	Description of Category
      Authentication Partners	If you register for or log into the Services using third party credentials (e.g. Facebook), we will import your information from such third party to help create your Account with CMC.
      Technical Service Partners	We work with technical service partners that provide us with certain data, such as mapping IP addresses to non-precise location data (e.g. city, province), to enable us to provide the Picanto Service, content, and features.
      Advertising Partners	From time to time, we may place advertisements on third party sites (such as Facebook and Instagram). When you view or otherwise interact with our advertisements, we may obtain certain data about you from our advertisers and advertising partners, such as cookie ID, mobile device ID, email address, and inferences about your interests and preferences, which allows us to deliver more relevant ads to you and measure their effectiveness. We use this information to learn how our users use our Service, in order to grow our business and to inform our marketing strategy.

5. How Do We Collect Your Personal Information?
   1. Direct Interactions. You may give us your personal information by filling in online fields through the Picanto Service or by corresponding with us by mail, phone, email, or otherwise. This includes, but is not limited to, personal information you provide when you: (i) sign up for the Service by creating an Account; (ii) submit User Content through the Picanto Service; (iii) sign-up to receive our email newsletter or other communications; (iv) participate in one of our surveys or other customer research; (v) contact us with a question, comment, or complaint; (vi) react to marketing posts on our social media forums or pages; or (vii) provide us with feedback.
   2. Automated Technologies or Interactions. As you interact with the Picanto Service, we may automatically collect technical data by using the following technologies:
      1. “Cookies” are data files that are placed on your Device and often include an anonymous unique identifier. Our “accept cookies” banner will require you to accept the use of cookies on the Services. This is required for many aspects of the Service including playing embedded videos. Our Cookie Policy is further described in Section 10 of this Policy.
      2. “Log files” track actions occurring on the website, and collect data including your IP address, browser type, Internet service provider, referring/exit pages, and date/time stamps.
      3. “Web beacons”, “tags”, and “pixels” are electronic files used to record information about how you browse the website.
6. Use and Disclosure of Personal Information
   1. Personal information submitted to CMC, including through the Picanto Service or a prescribed form, is kept confidential unless disclosed in accordance with your express consent or legal requirements. In any event, any personal information provided through the Picanto Service by a user is voluntary. Please note that revoking your consent may result in not being able to access or utilize certain features, programs, or services offered by CMC, including the Picanto Service.
   2. Publicly Available Information. The following personal information will be publicly available on the Picanto Service: your name and/or username, profile picture, who you follow and who follows you on the Picanto Service, your recently played artists, and your public playlists.
   3. Anonymized Aggregated Data. We aggregate and anonymize data and use and disclose such information for a variety of purposes. For example, we may share anonymized and aggregated information to CMC partners, which are Canadian institutions and organizations that have a relation to arts and culture, in order to perform statistical analysis, research, and to help us and them understand the demographic of our users, for the benefit of the Canadian arts community. However, in these situations, we do not disclose any information that could be used to identify you personally.
   4. Information We May Share. CMC may disclose your personal information to the following categories of recipients for the reasons set out in the table below:
      
      

      Categories of Recipients	Reason For Sharing
      Service Providers	We may transfer (or otherwise make available) your personal information to our affiliates and other third parties who provide services on our behalf. For example, we may use service providers to host our websites, operate certain features on our websites, serve advertisements on our websites, send emails or other communications, or conduct customer research. Our service providers are given the information they need to perform their designated functions, and we do not authorize them to use or disclose personal information for their own marketing or other purposes.  To the extent that any personal information is provided to these third party service providers, CMC requires that the provider be bound by obligations consistent with this Policy and that such providers only collect, use, or disclose users’ personal information for the purposes of providing CMC the services set out in this section. For more information about the way in which our third-party service providers treat your personal information, contact us as set out below in Section 14 below.  Presently, CMC uses and discloses personal information to the following service providers, including payment processors: We use Muvi to host the Picanto Service. User Data is jointly owned by CMC and Muvi. Both CMC and Muvi will have equal and independent rights to use such User Data for any purposes set out in this Policy, or any other purpose permitted under applicable law, without the consent of the other party. Muvi will comply with applicable Canadian privacy laws and only store User Data in Canada. We use Stripe to process credit card payments made through the Picanto Service. We use SendGrid as the embedded email notification system through the Picanto Service. We use CleverReach to manage and create our email newsletters, collect and store email addresses for marketing purposes, and generate automated mailings. We use Google Analytics to track anonymous website activity and measure the usage patterns on our website. Google Analytics uses persistent cookies to track things like visitor sessions, visitors across multiple sessions, referral sources to the website, and the performance of promotional links to our website. The information generated by cookies about your use of our website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. In compliance with the Google Analytics Terms of Service, no personally identifiable information is passed to Google Analytics and Google will not associate your IP address with any other data held by Google. For more information regarding how Google uses your personal information through Google Analytics, please see www.google.com/policies/privacy/partners/.
      Advertising Partners	We work with advertising partners to enable us to customize the advertising content you may receive on the Picanto Service. These partners help us deliver more relevant ads and promotional messages to you, which may include interest based advertising (also known as online behavioral advertising), contextual advertising, and generic advertising on the Picanto Service. We and our advertising partners may process certain personal information to help CMC understand your interests or preferences so that we can deliver advertisements that are more relevant to you.
      Purchaser of Our Business	We may transfer any information we have about you as an asset in connection with a merger or sale (including transfers made as part of insolvency or bankruptcy proceedings) involving all or substantially all of CMC’s assets or as part of a corporate reorganization or other change in corporate control. If we do this, the disclosure will be subject to confidentiality arrangements customary in such transactions.
      Law Enforcement and Data Protection Authorities	We cooperate with law enforcement inquiries and demands for information that are made under force of law. We are also cognizant of the need to address emergencies. Therefore, we may disclose your personal information: (i) to any governmental authority as part of an investigation to determine our compliance with any applicable law, rule, or regulation (including privacy laws, rules, and regulations); (ii) in response to a court order, subpoena, discovery request, or other lawful judicial or administrative proceeding; (iii) as otherwise required under any applicable law, rule, or regulation; and (iv) in good faith, to protect or defend our rights or property or those of other users.

7. Security & Breach
   1. CMC has used commercially reasonable efforts to implement procedural, technical, and physical safeguards in an effort to protect against unauthorized access, use, modification, and disclosure of your personal information. It is important to remember that no method of transmitting or storing data is completely secure. We have implemented various controls including server-side security, encryption, access control, and retention policies to guard against unauthorized access and unnecessary retention of personal information. Our servers on which your personal information reside are located in Canada
   2. Your password protects your user Account, so we encourage you to use a strong password that is unique to your Picanto Account. You can prevent unauthorized access to your Account and personal information by selecting and securing your access password properly and limiting access to your computer, device, and browser. You should always log out after accessing your Account.
   3. CMC shall comply with, and provide CMC users with reasonable assistance in complying with, applicable laws with respect to any unauthorized use, access, or disclosure of personal information.
8. Data Retention and Deletion
   1. We keep your personal information only as long as necessary to provide you with the Picanto Service and for legitimate and essential business purposes, such as maintaining the performance of the Picanto Service, making data-driven business decisions about new features and offerings, complying with our legal obligations, and resolving disputes. When personal information is no longer required for these purposes, it is securely destroyed or deleted. We keep some of your personal information for as long as you are a user of the Picanto Service. For example, we keep your playlists, song library, and Account information. For further details on our data retention periods, please contact us.
   2. If you request, we will delete or anonymize your personal information so that it no longer identifies you, unless we are legally allowed or required to maintain certain personal information, including situations such as the following:
   1. if there is an unresolved issue relating to your Account, such as an outstanding credit on your Account or an unresolved claim or dispute, we will retain the necessary personal information until the issue is resolved;
   2. where we need to retain the personal information for our legal, tax, audit, and accounting obligations, we will retain the necessary personal information for the period required by applicable law; and/or
   3. where necessary for our legitimate business interests such as fraud prevention or to maintain the security of our users, we will retain the necessary personal information for the period required by applicable law.
9. Behavioural Advertising
   1. We may use your personal information to provide you with targeted advertisements or marketing communications we believe may be of interest to you, as described in Section 4.5. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.
   2. You can opt-out of targeted advertising by using the links below:
      1. Facebook: https://www.facebook.com/settings/?tab=ads
      2. Google: https://www.google.com/settings/ads/anonymous
      3. Bing: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads
   3. Additionally, you can opt-out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal at http://optout.aboutads.info/.
10. Cookie Policy. A cookie is a small text file sent from a website and stored on the user’s computer by the user’s web browser. Upon visiting a site that uses cookies, a cookie is downloaded onto your computer or mobile device. The next time you visit that site, your device will remember useful information such as preferences, visited pages, or logging in options. Cookies are widely used to add functionality to websites, or to ensure they work more efficiently. Our Service relies on cookies to optimize the user experience and ensure the Service functions properly. Most web browsers allow some control to restrict or block cookies through the browser settings; however, if you disable cookies you may find this affects your ability to use certain parts of the Service. For more information about cookies please visit https://www.aboutcookies.org.
11. Social Media
    1. We may offer you the opportunity to engage with our content on or through third-party social networking websites, plug-ins, and applications. When you engage with our content on or through third-party social networking websites, plug-ins, and applications, you may allow us to have access to certain information associated with your social media account (e.g. name, username, email address, profile picture, gender). When you provide information from your social media account, we may use this information to personalize your experience through the Service and on the third-party social networking websites, plug-ins, and applications.
    2. If you voluntarily submit or post any information, photographs, or other content to any CMC social media forums or other social networking pages/sites, certain elements of your personal information may be automatically included in the posting, including your user name and email address, and this information may be collected and used by others. CMC has no control over, and is not liable for, the collection, use, or disclosure of any personal information posted by users of such forums and social media networking pages. For further clarity, any personal information posted, used, or disclosed via such sites is not subject to this Policy.
12. Other Information Collectors
    1. We may display advertisements from third parties and other content that links to third-party websites. These links are not intended as an endorsement of or referral to the linked websites. The linked websites have separate and independent privacy statements, notices, and terms of use, which we recommend you read carefully. We do not have any control over such websites, and, therefore, we have no responsibility or liability for the manner in which the organizations that operate such linked websites may collect, use, disclose, or otherwise treat your personal information.
    2. Except as otherwise expressly included in this Policy, this document only addresses the use and disclosure of information we collect from you. To the extent that you disclose your information to other parties through the Service, different terms and conditions may apply to their use, collection, and disclosure of the personal information. Since we do not control the information use, collection, or disclosure policies of third parties, you are subject to their privacy policies. We encourage you to ask questions before you disclose your personal information to others.
13. Changes to this Policy. Please note that CMC reserves the right to update or change this Policy at any time. When we make material changes to this Policy, we will provide you with prominent notice as appropriate under the circumstances (e.g. by displaying a prominent notice within the Picanto Service or by sending you an email and/or a notification to your Device). Please make sure you read any such notice carefully. The most current version of this Policy will govern CMC’s use of your personal information. By continuing to access the Picanto Service after changes are made to this Policy, you agree to be bound by the revised terms.
14. Access, Questions, and Concerns. Any questions regarding this Policy may be directed to our Privacy Officer. To review or update your personal information in CMC’s possession, or to withdraw consent for the collection, use, and/or disclosure of your personal information or name from an email or other mail list, please contact our Privacy Officer at:
    

    Canadian Music Centre

    Attention: Kevin Liu, Director of Finance and Administration

    20 St. Joseph Street

    Toronto ON M4Y 1J9

    Tel: 416-961-6601

    Email: kevin.liu@cmccanada.org