Privacy Policy

SERENADA PRIVACY POLICY

Last updated: 26 June 2026

1. INTRODUCTION

Serenada is operated by Penny Play Limited, a company registered in England and Wales with company number 15920703, whose registered office is at 167–169 Great Portland Street, 5th Floor, London, England, W1W 5PF ("Serenada", "we", "us", "our").

We are committed to protecting the privacy and personal data of everyone who uses the Serenada platform, whether as an Artist, Contributor or Fan (collectively, "Users", "you", "your").

This Privacy Policy explains:

  • what personal data we collect;

  • how and why we collect and use it;

  • who we share it with;

  • how we protect it; and

  • the rights you have in relation to your personal data.

This Privacy Policy applies to:

  • the Serenada platform and all related websites, applications and services (the "Platform");

  • Artists and Contributors who upload and manage content on the Platform; and

  • Fans who access, discover and stream content via the Platform.

This Privacy Policy should be read alongside our:

  • Artist & Contributor Terms of Service;

  • Content & Community Rules;

  • Royalties & Payments Policy;

  • Referral & Referral Payment Policy; and

  • Disputes Policy.

For the purposes of the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018, Penny Play Limited is the data controller.

Serenada has not appointed a formal Data Protection Officer. Privacy enquiries should be directed to:

privacy@serenada.music

2. PERSONAL DATA WE COLLECT

2.1 Information you provide directly

When you create an account or use the Platform, we may collect:

Identity information

  • legal name;

  • artist or stage name;

  • date of birth;

  • profile photographs;

  • biographies and profile information.

Contact information

  • email address;

  • postal address;

  • other contact details you choose to provide.

Account information

  • usernames;

  • passwords;

  • account preferences;

  • account settings.

Rights and royalty information

  • contributor allocations;

  • royalty participation information;

  • PRO, CMO, publisher and collection society details;

  • rights ownership information.

Payment information

  • bank account details;

  • payment processor account details;

  • identity verification information;

  • royalty and referral payment history.

Artist Content metadata

  • track titles;

  • release dates;

  • genres;

  • ISRC codes;

  • contributor credits;

  • associated metadata.

Communications

  • support requests;

  • complaints;

  • copyright notices;

  • correspondence with Serenada.

2.2 Information collected automatically

When you use the Platform, we may automatically collect:

Listening and usage information

  • tracks played;

  • listening duration;

  • replay activity;

  • saves;

  • boosts;

  • discovery interactions;

  • referral activity;

  • subscription activity.

Taste profile information

We generate inferred taste profiles and recommendation signals based on listening behaviour in order to operate Serenada's discovery and recommendation systems.

Technical information

  • IP address;

  • browser type and version;

  • device identifiers;

  • operating system;

  • access logs;

  • security logs;

  • authentication records;

  • email delivery records.

Platform Data

We may generate aggregated, statistical, analytical and anonymised information relating to use of the Platform.

2.3 Information received from third parties

We may receive information from:

Stripe

Including payment processing information, payment verification information, identity verification information and payment account administration information.

Rights administration organisations

Including PROs, CMOs, collection societies and other rights administration organisations where relevant to rights administration.

Artists (in relation to Contributors)

Artists are required to provide certain information relating to Contributors, including names, contact details and contributor allocation information, in order to enable contributor onboarding and royalty administration.

Prior to registration of their own account, Serenada will use such information solely for the purpose of:

  • contacting the relevant Contributor;

  • verifying contributor information;

  • administering contributor participation; and

  • inviting the Contributor to create an account.

3. HOW WE USE YOUR PERSONAL DATA

Account creation and administration

We use your personal data to:

  • create and maintain accounts;

  • verify identity;

  • administer profiles;

  • provide access to the Platform.

Legal basis: Performance of a contract.

Content hosting and streaming

We use personal data to:

  • host content;

  • provide streaming services;

  • operate the Platform.

Legal basis: Performance of a contract.

Royalty and referral administration

We use personal data to:

  • calculate royalties;

  • administer contributor payments;

  • administer referral payments;

  • process payments;

  • maintain payment records.

Legal basis: Performance of a contract and compliance with legal obligations.

Rights administration

We use personal data to:

  • administer contributor participation;

  • process rights ownership information;

  • report to rights administration organisations where required.

Legal basis: Performance of a contract and compliance with legal obligations.

Discovery and recommendations

We use listening behaviour and taste profile information to:

  • operate recommendation systems;

  • personalise discovery experiences;

  • improve matching between listeners and artists.

Legal basis: Legitimate interests.

Platform improvement and machine learning

We may use Artist Content and Platform Data to improve:

  • recommendation systems;

  • taste matching;

  • search;

  • analytics;

  • fraud prevention;

  • platform performance.

For the avoidance of doubt:

  • Artist Content will not be used to train generative AI systems;

  • Artist Content will not be used to replicate Artist Content;

  • Artist Content will not be used to generate derivative musical works.

Legal basis: Legitimate interests.

Communications and support

We use personal data to:

  • respond to enquiries;

  • investigate complaints;

  • administer disputes;

  • send service-related communications.

Legal basis: Performance of a contract and legitimate interests.

Security, fraud prevention and legal compliance

We use personal data to:

  • detect fraud;

  • prevent abuse;

  • investigate suspicious activity;

  • enforce platform rules;

  • comply with legal obligations.

Legal basis: Legal obligations and legitimate interests.

4. HOW WE SHARE YOUR PERSONAL DATA

We do not sell personal data.

We may share personal data with the following categories of recipient.

Payment providers

  • Stripe, Inc.

For payment processing, payment administration, identity verification and compliance purposes.

Cloud hosting and infrastructure providers

  • Amazon Web Services (AWS).

For cloud hosting, storage, infrastructure, email delivery and security services.

Video hosting and content delivery providers

  • Bunny.net.

For video hosting, streaming and content delivery services.

Email and communications providers

  • Intuit Mailchimp.

For onboarding communications, service communications and transactional messaging.

Rights administration organisations

Including:

  • PRS for Music;

  • ICE;

  • ASCAP;

  • BMI;

  • The MLC; and

  • other relevant rights administration organisations.

Professional advisers

Including:

  • lawyers;

  • accountants;

  • auditors;

  • professional advisers.

Law enforcement and regulators

Where disclosure is required by law or regulation.

Business transfers

In connection with mergers, acquisitions, reorganisations or business transfers.

5. INTERNATIONAL TRANSFERS

Serenada operates internationally.

Some of our service providers and rights administration partners are located outside the United Kingdom, including in the United States.

Where personal data is transferred internationally, we ensure that appropriate safeguards are implemented in accordance with applicable UK data protection law, including:

  • adequacy regulations;

  • approved international transfer agreements; and

  • other recognised transfer mechanisms.

Further information is available on request.

6. DATA RETENTION

We retain personal data only for as long as reasonably necessary.

Our general retention periods are:

Category — Retention Period

  • Account information: Duration of account plus up to 7 years

  • Payment and royalty records: Minimum 7 years

  • Rights and contributor information: Duration of content availability plus up to 7 years

  • Listening and taste profile information: Duration of account

  • Communications records: Up to 3 years

Where data is no longer required, it will be securely deleted or anonymised.

7. DATA SECURITY

We implement appropriate technical and organisational security measures, including:

  • access controls;

  • encryption in transit;

  • security monitoring;

  • fraud detection systems;

  • authentication controls;

  • regular security reviews.

No method of electronic transmission or storage can be guaranteed to be completely secure.

8. YOUR RIGHTS

Under UK data protection law, you have the right to:

  • access your personal data;

  • rectify inaccurate data;

  • request deletion of personal data;

  • restrict processing;

  • receive portable copies of personal data;

  • object to certain processing activities;

  • object to direct marketing;

  • challenge certain automated decision-making.

Requests should be sent to:

privacy@serenada.music

We will normally respond within one calendar month.

You also have the right to complain to the Information Commissioner's Office:

https://www.ico.org.uk

9. COOKIES AND SIMILAR TECHNOLOGIES

At launch, Serenada uses cookies and similar technologies necessary for:

  • authentication;

  • security;

  • account management;

  • essential platform functionality.

We may introduce additional analytics or preference technologies in the future and will implement any consent mechanisms required by applicable law.

You may manage cookies through your browser settings.

10. CHILDREN

The Platform is intended only for persons aged 18 years or older.

We do not knowingly collect personal data from persons under 18 years of age.

If we become aware that such information has been collected, we will take reasonable steps to delete it.

11. THIRD-PARTY WEBSITES

The Platform may contain links to third-party websites and services.

We are not responsible for the privacy practices of those third parties and encourage you to review their privacy policies.

12. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time.

Where changes are material, we will provide notice through the Platform or by email where appropriate.

Continued use of the Platform following publication of an updated Privacy Policy constitutes acceptance of the revised policy.

13. CONTACT DETAILS

Penny Play Limited (trading as Serenada)

167–169 Great Portland Street

5th Floor

London

England

W1W 5PF

Email: privacy@serenada.music

We aim to respond to legitimate privacy enquiries within one calendar month.