Data controller
UW Music AS, Norwegian organisation no. 920 464 181, is the controller for the processing described here. Privacy enquiries may be sent to:
Scope of this Policy
This Policy covers both the public website uwm.no and the signed-in customer portal at portal.uwm.no. Data from an ordinary visit to uwm.no is kept separate by purpose from customer data and authentication data in the portal. The customer portal sections apply only when you create or use a customer account.
Data we process
For ordinary page views, we record the time, page visited, language, referring domain, traffic source and any campaign parameters. Before you consent to analytics, the page view is stored in our analytics database without a visitor ID, IP address or browser information.
If you consent to visitor analytics, we may also record a random visitor ID, IP address, browser and operating system, device type, language and time zone, screen and viewport size, colour preference, connection and performance data, and technical errors. Our hosting provider may process technical server logs for operation and security.
When you contact us by email or telephone, we process your contact details and the content of your enquiry so that we can respond and follow it up.
Cookies
We use uwm_language for up to 365 days to remember your language choice and uwm_cookie_consent for up to 180 days to remember your consent choice. If you allow analytics, we also use uwm_vid for up to 180 days to link page views to a random visitor ID. We do not use third-party tracking.
You can change your choice at any time through “Cookies” in the footer. Withdrawal does not affect the lawfulness of processing already carried out on the basis of your consent.
Customer portal
portal.uwm.no is the signed-in service for UW Music customers. The portal provides each customer with secure access to their own customer details, music data, metadata, cover images, reports and payout information as those features become available.
The data may include name, email address, customer number, user role, Auth0 user ID and verification status, login history, active sessions, session ID, IP address and activity timestamps. Customer and music data entered by you or UW Music are processed to provide and administer the service.
Processing is necessary to enter into or perform the customer agreement under Article 6(1)(b), comply with legal obligations under point (c), and protect security, access control and abuse prevention as a legitimate interest under point (f). If you share data about artists, rights holders or others, you must have the right to share it with UW Music.
Authentication and email verification are provided by Auth0, part of Okta. Auth0 processes necessary identity, login, device, IP and security data. UW Music does not receive your password in plain text. Google Cloud Fraud Defense (reCAPTCHA) may process technical data and risk signals to protect the login process against automated abuse.
Read the Okta/Auth0 Privacy Policy Read about privacy for Google Cloud Fraud Defense
Cookies in the customer portal
The customer portal uses necessary cookies and similar local storage for authentication, security, language and display preferences. Auth0 may set necessary authentication and security cookies. The browser session is linked to an active server-side session and normally expires after 30 minutes of inactivity. If the active session, session ID or IP address does not match, the user is signed out. These mechanisms are necessary for secure use of the portal and cannot be disabled without preventing sign-in.
Chat and social media
If you contact us through Facebook, Messenger or other social media, the platform provider processes data about you under its own terms and privacy rules. This may include profile information, device data and the content of your message.
UW Music processes the sender details visible to us and the content of the conversation so that we can respond and follow up. Avoid sending sensitive or particularly confidential information through social media; use email instead where the enquiry requires it.
Use of artificial intelligence
UW Music may use AI-assisted features in approved, access-controlled services for internal work such as drafting, summarisation, quality assurance and customer support. Customer data are not published openly or made publicly available as part of AI use. Only data necessary for the task should be used, and providers must be approved and governed through appropriate agreements, security settings and access controls. Where relevant, the service must be configured so that customer data are not used to train open or publicly available models.
Replies from us or features on our websites may be wholly or partly AI-generated. Such replies may contain errors and are not treated as automated decisions producing legal or similarly significant effects. Material decisions about customers are not made solely by AI without human review.
Purposes and legal bases
Visitor analytics and the optional analytics cookie are used to understand use of the website and improve content, performance and technical quality, and are based on consent under Article 6(1)(a) of the GDPR and applicable cookie rules. Necessary cookies, technical operation and security are based on our legitimate interest in providing a secure and functional website under Article 6(1)(f). Enquiries are processed where necessary to respond to you, prepare or perform an agreement, or pursue our legitimate interest in proper communication.
Sharing and transfers
Data may be processed on our behalf by hosting providers, Auth0/Okta, Google Cloud Fraud Defense, approved AI services and other necessary technical providers, or disclosed where we are legally required to do so. We do not sell personal data. We do not use solely automated decision-making producing legal or similarly significant effects. If a provider processes data outside the EEA, the transfer will rely on a valid transfer mechanism, such as an adequacy decision or the EU Standard Contractual Clauses.
Retention
Cookies on uwm.no are retained for the periods stated above. Analytics, login, security and technical data are kept only for as long as necessary for their purpose and are then deleted or anonymised. Customer, music, reporting and payout data are retained during the customer relationship and afterwards for as long as necessary for contract administration, accounting, legal claims or other statutory documentation requirements. Enquiries, including those received through social media, are retained for as long as necessary to follow them up, subject to the platform provider’s own retention rules.
Your rights
Where the conditions are met, you may request access, rectification, erasure, restriction and data portability, and object to processing based on legitimate interests. You may withdraw consent at any time. Contact us if you wish to exercise your rights. You also have the right to lodge a complaint with the Norwegian Data Protection Authority.
Reservation regarding errors
We take reasonable steps to keep information, customer data and replies accurate and up to date, but errors, omissions, delays, technical issues or inaccuracies in AI-generated content may occur. Contact us if you notice anything that appears incorrect and we will investigate and correct it as soon as reasonably practicable. This reservation does not limit any rights or liability that cannot lawfully be excluded.
Changes
We will update this Policy if our processing or the applicable rules change. The current version will always be available on this page.