Privacy Policy (EU)

1. Data Controller

The data controller is Noise Symphony S.r.l., with registered office in Rome. Contact email: [email protected]. The controller is responsible for processing personal data collected through the website www.noisesymphony.com and the Indieffusione platform.

2. Types of Data Collected

During use of the platform, the following data may be collected: identifying data (first name, last name, artist name, email, social media contacts or website), data related to uploaded content (tracks, images, texts, artistic descriptions), technical browsing data (IP address, browser type, operating system, cookies), and statistical platform usage information (in aggregated and anonymous form).

3. Purposes of Processing

Data is processed to enable account registration and management, provide editorial and promotional services, send communications relating to opportunities or events promoted by Indieffusione, fulfil legal obligations, and improve service quality.

4. Legal Basis for Processing

Processing is based on the performance of the platform membership contract (Art. 6(1)(b) GDPR), the user’s express consent for promotional activities (Art. 6(1)(a) GDPR), and compliance with legal obligations (Art. 6(1)(c) GDPR).

Legitimate interest of the controller (Art. 6(1)(f) GDPR) in website security, fraud prevention and the fairness of the charts (see section 14).

5. Processing Methods

Data is processed in digital form and, where necessary, in paper form, with appropriate technical and organisational measures to ensure its security and confidentiality. Access is permitted only to authorised Noise Symphony and Indieffusione staff and to technical partners bound to the service.

6. Data Retention

Data is retained for the time necessary to provide services or fulfil legal obligations. Uploaded content remains associated with the account as long as the artist maintains an active subscription. Upon cancellation, data will be removed or anonymised within 30 days.

Data related to chart voting is retained for the periods set out in section 14.5.

7. Data Communication and Disclosure

Data will not be transferred or sold to third parties. It may be shared with technical service providers, authorised editorial partners, or competent authorities, only within the limits provided by law and with the artist’s prior authorisation.

8. Data Subject Rights

Users may exercise the rights provided under Articles 15–22 of the GDPR: access, rectification, erasure, restriction, objection, portability, and withdrawal of consent. Requests should be sent to [email protected] and will be fulfilled within 30 days.

9. Cookies and Tracking Tools

The website uses technical cookies and, with prior consent, analytical and third-party cookies. For more information or to change your preferences, please visit the ‘Cookie Management’ section on the dedicated page.

9 bis. AI-based virtual assistant (ASI chatbot)

The website and the Indieffusione platform provide users with an artificial-intelligence-based virtual assistant (“ASI”) that offers information support to artists. Under Regulation (EU) 2024/1689 (AI Act), users are informed that when they interact with ASI they are dealing with an automated system and not a human operator; this is clearly stated at the start of the conversation. ASI does not carry out automated profiling with legal effects on the user. For assistance from a human member of staff, you can write to [email protected].

10. Minors

Use of the platform is reserved for users aged 16 or over. Registrations by minors must be accompanied by parental or legal guardian consent.

11. Updates

This policy may be updated periodically. The most recent version will always be available at www.noisesymphony.com/en/privacy-policy-eu/. Last updated: October 2026.

12. International Data Transfers

Some personal data may be processed through services located outside the European Union, in particular through platforms such as Google Analytics and Brevo (analytics and communication services). In such cases, data transfers comply with Articles 44 et seq. of Regulation (EU) 2016/679 (GDPR), on the basis of European Commission adequacy decisions or Standard Contractual Clauses that ensure an adequate level of protection.

Cloudflare, Inc. (website security and delivery services), on the basis of the standard contractual clauses and/or the EU-US adequacy decision (Data Privacy Framework).

13. Complaints to the Supervisory Authority

Users have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), headquartered in Rome, Piazza Venezia 11 – www.garanteprivacy.it, if they believe that the processing of their personal data violates the provisions of Regulation (EU) 2016/679 (GDPR).

14. Charts and voting

14.1 What data. When you vote in the Indieffusione or Indiescreti charts we process:

the choices made and the date and time of the vote;
the IP address and the approximate country derived from it;
technical data about the browser and device: browser type and version, language setting, device time zone and a technical fingerprint generated by the voting form;
the voting technical cookies described in the Cookie Policy, and the website you came from;
your account, if you vote as a registered user.

14.2 Why. We use this data to:

record and count votes, applying the rules (Art. 17 of the Terms and Conditions);
protect the fairness of the charts, i.e. prevent and detect repeated, automated or fraudulent votes;
establish, exercise or defend the rights of Noise Symphony, artists and voters in the event of reports or disputes.

14.3 Legal basis. For counting votes, the application of the rules (Art. 6(1)(b) GDPR). For protecting the charts and defending rights, the legitimate interest of Noise Symphony and of the artist community in having fair charts (Art. 6(1)(f) GDPR; fraud prevention is recognised as a legitimate interest in Recital 47). The balancing assessment is available on request.

14.4 Automated checks. An automated system may reject a voting attempt that does not comply with the rules. Votes already recorded are excluded only after human review. If your vote has been rejected, you can ask for a person to look at it and give your point of view by writing to [email protected], quoting the reference code shown on screen.

14.5 How long.

Data	Retention
Full data of all votes and attempts	180 days
The same data in pseudonymised form (IP addresses and identifiers replaced by non-reversible codes), used only to improve the checks	up to 12 months from the vote, then deleted
Excluded or flagged votes, rejected attempts, staff interventions	5 years from the close of the week, the limitation period for damages claims (Art. 2947 of the Italian Civil Code)
Data relating to a dispute or to ongoing proceedings	until their final conclusion
Official charts and totals per week and artist	no time limit, as they contain no personal data

14.6 Who sees it. Authorised staff who manage the charts, the hosting provider and Cloudflare (website security and delivery service). Upon lawful request, the competent authorities. Voting data is not sold or used for advertising.

14.7 Your rights. In addition to the rights in section 8, you can object to processing based on legitimate interest (Art. 21 GDPR). We may continue to process the data only if there are overriding legitimate grounds or if it is needed to defend a legal claim.

Last updated: October 2026.