CMRRA

Canadian Musical Reproduction Rights Agency

Privacy Policy

Last Updated: December 8th, 2020

The Canadian Musical Reproduction Rights Agency Ltd. (“CMRRA”) is committed to protecting the privacy of information provided by visitors, clients, registrants, and licensees. Throughout this Privacy Policy (this “Policy”), the terms “CMRRA,” “we,” “us,” and “our” refer to the Canadian Musical Reproduction Rights Agency Ltd.  The following sets forth our information gathering and disclosure practices. This Privacy Policy (“Policy”) applies to information collected in the course of commercial activity, including but not limited to, through our web sites, web pages, interactive features, the CMRRA Direct applications, and the respective content at cmrra.ca, whether accessed via computer, mobile device, or other technology (collectively, the “Sites”) as well as by any other means.

CMRRA has developed this Privacy Policy to ensure compliance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws.

For the purposes of European data protection law, the data controller[1] of the Sites is CMRRA. Our address is Suite 320, 56 Wellesley St. West, Toronto, Ontario M5S 2S3.

Summary of Privacy Policy

Information We Collect. We collect Personal Information (which means information that can be used to identify an individual), as well as certain information that cannot be linked with identifiable individuals.

Use of Personal Information. We collect and use Personal Information for customer support, to improve our services, to communicate with you, and for other general business purposes. How we use your Personal Information depends partly on which of the Sites or Services you use.

Disclosure of Personal Information. We share Personal Information with our service providers as necessary for them to provide services to us or perform business functions on our behalf. If we sell or purchase assets, we may share Personal Information and other information with the other party. If we sell or merge our company with another, we may transfer Personal Information to the new company. We transfer certain Personal Information to third parties that operate performer databases. We will also share Personal Information if we are required to do so by law, or if we need to do so to protect our rights or the rights of others. We do not share your Personal Information with third parties for their marketing purposes without your consent.

Data Retention.  We will keep the data we hold about you for as long as reasonably necessary to provide you the information you requested or as reasonably useful for commercial purposes unless you tell us you would like us to stop holding your data.

Security.  We use reasonable efforts to safeguard your Personal Information, but transmissions made by means of the Internet cannot be made absolutely secure. We are not responsible for disclosure of Personal Information due to errors in transmission or the unauthorized acts of third parties.

Links to Other Sites.  We may link to other sites, but we do not control, recommend, or endorse and are not responsible for sites that we do not own or operate.

Visitors Under the Age of 13.  CMRRA does not knowingly collect any Personal Information from anyone under the age of 13.

Consent to Processing and Transfer of Information.  By using the Sites or providing us with any information, you consent to the collection, use and transfer of Personal information in and to Canada and other applicable territories.  We will use our best efforts to reasonably ensure that any third-party agents contracted by CMRRA comply with this policy and prevent unauthorized collection, use and disclosure of Personal Information.

Changes to this Privacy Policy.  We reserve the right to change, modify or otherwise alter this Policy at any time.

European Data Protection Rights.  If you live in the European Economic Area (EEA) or the United Kingdom (UK), you have the right to request that we:

  • Provide you information about how we use your Personal Information;
  • Give you access to, and a copy of your Personal Information in our records;
  • Stop contacting you;
  • Correct, update, or delete your Personal Information in our records; or
  • Stop using, and ensure that all third parties stop using, some or all of your Personal Information.

You also have the right to lodge a complaint with your data protection authority about any violations of the Policy.

Contact Information

If you would like to make a complaint to us about our collection of Personal Information or if you would like more information about the Personal Information we collect or how we use it, you can contact our Privacy Officer using either of the contact methods below. To protect the security of your information, we may ask you to provide us with additional information, or we may try to contact you, so that we can verify your identity.

By E-mail:         privacyofficer (at) cmrra.ca

By Mail:            Attn: Privacy Officer

CMRRA (Canadian Musical Reproduction Rights Agency)
320 – 56 Wellesley Street West,
Toronto, ON
M5S 2S3

INFORMATION WE COLLECT

As used herein, the term “Personal Information” means information from which an individual can reasonably be identified from either the information alone, or from the information in combination with other information   (such as a name, mailing address, e-mail address, company name, phone number, social security number, tax information, financial information, birth date, and place of birth), or information about that individual that is directly linked to personally identifiable information. Personal Information does not include “aggregate information”, which is data we collect about the use of the Sites or about a group or category of services or users from which individual identities or other Personal Information has been removed. Personal Information also does not include Usage Information (as defined below) that is not connected to Personal Information. This Policy in no way restricts or limits our collection and use of aggregate or Usage Information that is not connected to Personal Information.

Collection of Personal Information

In the course of providing services, we may ask you to provide us with Personal Information. CMRRA may also ask you to provide other information about yourself, such as demographic information. If we combine demographic or other information, we collect about you with Personal Information about you, we will treat the combined information as Personal Information. If you do not want your Personal Information collected, please do not submit it.

Information Collected by Automated Means

We collect certain usage information about our website, such as the number and frequency of visitors to certain parts of the website (“Usage Information”). Usage Information is generally non-identifying, but if CMRRA associates it with you as a specific and identifiable person, CMRRA treats it as Personal Information.

CMRRA may provide aggregate statistics about Usage Information or demographic information to third-parties, but this information will not include Personal Information.

In the course of collecting Usage Information, CMRRA also automatically collects your IP address or other unique identifier (“Device Identifier”) for the computer, mobile device, technology or other device (collectively, “Device”) you use to access the Sites. A Device Identifier is a number that is automatically assigned to your Device when you access a web site or its servers, and our computers identify your Device by its Device Identifier. We use this information to improve your experience on the Sites, to enhance our Sites, and to protect the Sites.

The technologies used on the Sites to collect Usage Information, including Device Identifiers, include, without limitation, cookies. Cookies are data files placed on a Device when it is used to visit the Sites. CMRRA places cookies or similar files on your Device for security purposes, to tell us whether you have visited the Sites before, if you are a new visitor or to otherwise facilitate site navigation, and to personalize your experience while visiting our Sites. Cookies allow us to collect technical and navigational information, such as browser type, time spent on our Sites, and pages visited. Cookies may enhance your online experience by saving your preferences while you are visiting a particular part of the Sites. If you would prefer not to accept cookies, most browsers will allow you to:  (i) change your browser settings to notify you when you receive a cookie, which lets you choose whether or not to accept it; (ii) disable existing cookies; or (iii) set your browser to automatically reject any cookies. However, please be aware that if you disable or reject cookies, some features and services on our Sites may not work properly because we may not be able to recognize and associate you with your profile.

We collect the following information:

From Individuals who access the Sites:

We may collect the following information: Internet Protocol (IP) Address; Browser type and Version; Geolocation; Clicking-behavior.  We collect this information for functional and analytical purposes.

We use the tools listed below to collect information via automated means.

  • We use Google Analytics, a website traffic analysis application that provides real-time statistics to help us analyze how users interact with our website.
  • We use Microsoft Azure Application Insights to collect, analyze, and act on telemetry data from our Azure and on-premises environments, maximize the performance and availability of our applications, and proactively identify issues.
  • We use SEMrush for online marketing and market research.
  • We use Yoast SEO to optimize pages for search engines and connect to social sites. It also helps us share your personal data with social sites when you want to share it.
  • We use Hotjar to help us understand where visitors to the website most often interact with the site.
  • We also use marketing tools, Gravity Forms, Mailchimp and Salesforce CRM to provide email, social media and event marketing support.

From Clients, Licensees and each of their Authorized Representative(s) by phone, email, fax, and/or letters, we may collect the following information:

  • Name, address, telephone number, email address
  • Date of Birth
  • Secure login information
  • Social Insurance Number / Business number
  • Credit Card
  • Financial Information
  • Citizenship
  • Works details
  • Estate information
  • Trust account information
  • Any other information that you may share with CMRRA

USE OF PERSONAL INFORMATION

How we use your Personal Information depends partly on which of our Sites or Services you use, as described below. We also use Personal Information to respond to requests for customer support or general inquiries; to improve the CMRRA service; to personalize and support your experience; to send communications including newsletters and other notifications including notifications about changes to our Sites, updates, and administrative messages; to detect or prevent fraud, or security alerts; for any other purpose for which the information was collected; and for other uses consistent with CMRRA’s business purposes.

Online Registration – CMRRA Direct

CMRRA Direct provides Publisher, Administrator and Self-Publisher Songwriter clients with registered user accounts secure access to their work, licence and royalty information in CMRRA’s Licensing Distribution System (LDS), with the ability to update account information; view existing works, register new works, view counterclaims metadata and counterclaimant contact information, view and download client communications and access the Unclaimed Works Portal.

CMRRA Direct provides Licensee Users with registered user accounts secure access to an online database of all of their licences which have been issued via the portal as well as licences awaiting acceptance, with the ability to accept or reject licences, view the status of any licences in process, and download their licence data.

Powered by CMRRA Direct, the Unclaimed Works Portal provides registered users information related to the availability of recordings on online music services operating in Canada. Recordings listed on the Portal are limited to those for which the underlying musical composition has not yet been identified and/or for which certain ownership information remains unknown or unregistered with CMRRA, with the ability to match individual recordings to musical works, submit missing ownership claims online, and request online service take-down requests. Unclaimed Works Portal Access is available to both CMRRA Clients and non-clients, subject to the applicable terms and conditions.

DISCLOSURE OF PERSONAL INFORMATION

We use the services of third parties who:  (a) provide vendor services to us (e.g., data management, billing, storage services, and IT services); (b) assist us in completing or effectuating payment of royalties (e.g., sharing Personal Information to ensure payment is made properly); or (c) perform functions on our behalf, such as companies or individuals that host or operate our Sites, analyze data, or provide customer service. We disclose Personal Information to these third parties only to the extent it is necessary, and we further require that the third party maintain the confidentiality of your Personal Information.

We may sell or purchase assets. If another entity acquires us or all or a portion of our assets, or merges with us, Personal Information, Usage Information, and any other information that we have collected about the users of the Sites may be disclosed or transferred to such entity.

Except as described in this policy, we will only make your Personal Information available to non-affiliated third parties in the following circumstances:  (i) if we are compelled to do so by law or by a governmental agency, court or other entity (e.g., to respond to subpoenas, court orders or legal process); (ii) if we believe your actions violate a law, regulation, this Policy or any applicable website terms of use, or if you threaten the rights, property or safety of us, our website, any other users or third party; or (iii) if, in our sole discretion, we believe disclosure is necessary to investigate or resolve possible problems or inquiries, to protect our assets, to defend our interests or comply with our legal and regulatory obligations.

DATA RETENTION

We will keep your Personal Information only for as long as it is necessary to fulfill the purposes described above unless a longer retention is required or permitted by law, after which we will delete, anonymize, or disable access to it. The period we keep your information will vary depending on your interactions with our Sites or use of our services. For example, we may retain your account data for a reasonable period of time after you disable your account. This is to enable you to easily come back and start using our Sites again. We may also keep a record of our communications with you, for example, if you have made a complaint, for as long as is necessary to protect us from a legal claim.

In accordance with our routine record keeping, we may delete certain records that contain Personal Information you have submitted through the Sites or otherwise. We are under no obligation to store such Personal Information indefinitely and disclaim any liability arising out of, or related to, the destruction of such Personal Information. In addition, you should be aware that it is not always possible to completely remove or delete all of your information from our databases without some residual data, because of system backups and for other technical reasons.

We do not share your Personal Information with third parties for their marketing purposes without your consent.

SECURITY

CMRRA takes the security and privacy of your data seriously. All sensitive or potentially sensitive data reside in datacenters that are compliant with the highest standards in data protection, including global benchmarks SOC1, SOC2, SOC3, ISO27001, ISO27018. The networks and infrastructure safeguarding this comply with standard security practices and are tested annually by an accredited security auditor. Any PII data stored off-site from these datacenters reside in encrypted databases. While CMRRA uses reasonable efforts to ensure the confidentiality and integrity of your Personal Information, transmissions made by means of the Internet cannot be made absolutely secure. We are not responsible for disclosure of Personal Information due to errors in transmission or the unauthorized acts of third parties.

LINKS TO OTHER SITES

The Sites may provide links to other websites that we do not own or operate. To the extent that any linked websites are not part of the Sites, we do not control, recommend, or endorse and are not responsible for these websites or their content, products, services, or privacy policies or practices. These other websites may send their own cookies to your Device, they may independently collect data or solicit Personal Information and may or may not have their own privacy notices or policies. You should also independently assess the authenticity of any website which appears or claims that it is our Sites (including those linked to through an email or social networking page).

VISITORS UNDER THE AGE OF 13

CMRRA does not knowingly collect any Personal Information from anyone under the age of 13. If a child under 13 submits Personal Information to CMRRA and we learn that the Personal Information is the information of a child under 13, we will attempt to delete the information as soon as possible.

CONSENT TO PROCESSING AND TRANSFER OF INFORMATION 

Given that we are an international business, our use of your information necessarily involves the transmission of data on an international basis. If you are located in the European Union, the United States or elsewhere outside of Canada, please be aware that information we collect may be transferred to and processed in Canada. By using the Sites or providing us with any information, you consent to the collection, processing, maintenance, and transfer of such information in and to Canada and other applicable territories in which the privacy laws may not be comprehensive as or equivalent to, those in the country where you reside and/or are a citizen.

CHANGES TO THIS PRIVACY POLICY

CMRRA reserves the right, at its sole discretion, to change, modify or otherwise alter this Policy at any time.  Such changes and/or modifications shall be posted on the CMRRA Sites and shall be effective immediately upon the posting thereof. We will indicate at the top of the Policy when it was most recently updated.  Please review this Policy periodically. Your continued use of the Sites following the posting of changes and/or modifications to this Policy will constitute your acceptance of the revised policy.

To the extent that any provision of this Policy conflicts with a provision of a CMRRA affiliation agreement signed by you or your authorized representative, the terms of the CMRRA affiliation agreement shall control.

EUROPEAN DATA PROTECTION RIGHTS  

If you live in the EEA or the UK, please note that we process Personal Information based on your consent, where necessary, our legitimate interest in operating the Sites and offering our services, or on the basis that your personal data is required for us to provide the Services to you. This involves several specific purposes as outlined in the section of this Policy entitled, “Use of Personal Information.”

Please note that you always have the right to request that we:

  • Provide you information about how we use your Personal Information;
  • Give you access to, and a copy of your Personal Information in our records;
  • Stop contacting you;
  • Correct, update or delete your Personal Information in our records (please note that we are permitted to exclude some Personal Information from a deletion request if that personal information is necessary for us to maintain for certain permitted purposes, including for compliance with a legal obligation and for the establishment, exercise or defense of legal claims);
  • Stop using, and ensure that all third parties stop using, some or all of your Personal Information; or
  • Lodge a complaint with your data protection authority about any violations of the Policy. If you would like to make a request, or if you would like us to change how we deal with your Personal Information, you can contact us at the email address or mailing address provided below. To protect the security of your information, we may ask you to provide us with additional information so that we can verify your identity.

  

CONTACT US

CMRRA welcomes your questions and comments.

For questions regarding this Privacy Policy, you may contact CMRRA’s Privacy Officer by using either of the contact methods below:

By E-mail:         privacyofficer (at) cmrra.ca

By Mail:            Attn: Privacy Officer

CMRRA (Canadian Musical Reproduction Rights Agency)
320 – 56 Wellesley Street West,
Toronto, ON
M5S 2S3

[1] A data controller is responsible for determining why your data is collected and how it is processed.