Privacy Policy

DATED 2023-02-22 · VERSION 20230301_rev01 · COMPARED WITH 20230101_rev01 · ARCHIVE SNAPSHOT

Full text changes — 20230101_rev01 to 20230301_rev01

COLOUR MARKS THE SEVERITY OF A FLAGGED CLAUSE · + AND − MARK ADDED AND REMOVED

+Your privacy is important. As of 30 December, we've updated our Privacy Policy to make it easier to read and comply with new U.S. laws.
+Effective as of 22 February 2023
+Effective as of 1 January 2023
 [1\. About this Policy]()
 [2\. Your personal data rights and controls]()
 [3\. Personal data we collect about you]()
     - choose whether to show your recently played artists on your public profile
 On the 'Explicit Content' setting you can control whether explicit-rated content can be played on your Spotify account.
 - [Cookies Policy](https://www.spotify.com/legal/cookies-policy/): Information on how we use cookies and how to manage your cookie preferences. Cookies are files saved on your phone, tablet or computer when you visit a website.
+[Top of page ↑]()
 ## **2\. Your personal data rights and controls**
 Privacy laws give certain rights to individuals over their personal data.
 Some rights only apply when Spotify uses a certain 'legal basis' to process your data. We explain each legal basis, and when Spotify uses each one, in [Section 4 'Our purpose for using your personal data']().
+ |
 .5 days
+ |
+[Top of page ↑]()
+## [**3\. Personal data we collect about you**]()
+## **3\. Personal data we collect about you**
 These tables set out the categories of personal data we collect from you. You can also watch our video about [Personal Data at Spotify](https://www.spotify.com/privacy).
 | **Collected when you sign up for the Spotify Service** **or when you update your account** |
 | --- |
+|
 **Categories**
 Usage Data
+ |
 If you download the Spotify mobile app and try Spotify using a logged out user experience, we will collect limited information about your usage of the Spotify Service, including Usage Data. We do this to understand how you are accessing and using the Service. We also do this to ensure we provide the right experience for you, for example based on your country or region. If you decide to create a Spotify account to experience our service in full, then we will combine this data with your Spotify account data.
+[Top of page ↑]()
+## [**4\. Our purpose for using your personal data**]()
+## **4\. Our purpose for using your personal data**
 The table below sets out:
 - our purpose for processing your personal data
 - our legal justifications (each called a '**legal basis**') under data protection law, for each purpose
 - categories of personal data which we use for each purpose. See more about these categories in [Section 3 'Personal data we collect about you']()
 - **Consent:** When Spotify asks you to actively indicate your agreement to Spotify's use of your personal data for a certain purpose.
 - **Compliance with Legal Obligations:** When Spotify must process your personal data to comply with a law.
 | **Purpose for processing your data** | **Legal basis that permits the purpose** | **Categories of personal data used for the purpose** |
 | --- | --- | --- |
+|
+To provide the Spotify Service in accordance with our contract with you. See [Section 1 'About this Policy']() for what we mean by the Spotify Service.
+To provide the Spotify Service in accordance with our contract with you.
 For example, when we use your personal data to:
 - set up an account for you
 - personalize your account, or
 - provide the Spotify app when you download it onto your device
 - Survey and Research Data
 - Payment and Purchase Data
+ |
+|
+To understand, diagnose, troubleshoot, and fix issues with the Spotify Service.
+To diagnose, troubleshoot, and fix issues with the Spotify Service.
+For example, we use your personal data to:
+- respond to your messages when you contact customer services
+- spot unusual data or behavior in our logs which might indicate a bug or other issue, or
+- check and verify accounts to find and prevent unauthorized users
+ |
 Performance of a Contract
+ |
 - Payment and Purchase Data
 - Street Address Data
+ |
+|
+To detect and prevent fraud.
+To keep the Spotify Service secure and to detect and prevent fraud.
 For example, when we analyze Usage Data to check for fraudulent use of the Spotify Service.
+ |
 Legitimate Interest
 - Usage Data
 - Voice Data
 - Survey and Research Data
+ |
+[Top of page ↑]()
+## [**5\. Sharing your personal data**]()
+## **5\. Sharing your personal data**
 This section sets out who receives personal data which is collected or generated through your use of the Spotify Service.
 **Publicly available information**
 The following personal data will always be publicly available on the Spotify Service (except to any user you have blocked):
 If we were to sell or negotiate to sell our business to a buyer or possible buyer.
 In this case, we may transfer your personal data to a successor or affiliate as part of that transaction.
+ |
+[Top of page ↑]()
+## [**6\. Data retention**]()
+## **6\. Data retention**
 We keep your personal data only as long as necessary to provide you with the Spotify Service and for Spotify's legitimate and essential business purposes, such as:
 - maintaining the performance of the Spotify Service
 - making data-driven business decisions about new features and offerings
 - complying with our legal obligations
 - resolving disputes
     - to take action with reports of intellectual property infringement
 This also helps us investigate potential breaches of our [User Guidelines](https://www.spotify.com/legal/user-guidelines/) and [Platform Rules](https://www.spotify.com/platform-rules/).
 - **Is Spotify subject to a legal or contractual obligation to keep or delete the data?** Examples include mandatory data retention laws, government orders to preserve data relevant to an investigation or data kept for the purposes of litigation. Conversely, we will remove unlawful content if the law requires us to do so.
+[Top of page ↑]()
+## [**7\. Transfer to other countries**]()
+## **7\. Transfer to other countries**
 Because of the global nature of our business, Spotify shares personal data internationally with Spotify group companies, subcontractors and partners when carrying out the activities described in this Policy. They may process your data in countries whose data protection laws are not considered to be as strong as EU laws or the laws which apply where you live. For example, they may not give you the same rights over your data.
 Whenever we transfer personal data internationally, we use tools to:
 - make sure the data transfer complies with applicable law
 - help to give your data the same level of protection as it has in the EU
 We also identify and use additional protections as appropriate for each data transfer. For example, we use:
 - technical protections, such as encryption and pseudonymization
 - policies and processes to challenge disproportionate or unlawful government authority requests
+[Top of page ↑]()
+## [**8\. Keeping your personal data safe**]()
+## **8\. Keeping your personal data safe**
 We're committed to protecting our users' personal data. We put in place appropriate technical and organizational measures to help protect the security of your personal data. However, be aware that no system is ever completely secure.
 We have put various safeguards in place to guard against unauthorized access and unnecessary retention of personal data in our systems. These include pseudonymization, encryption, access, and retention policies.
 To protect your user account, we encourage you to:
 You can log out of Spotify in multiple places at once by using the 'Sign out everywhere' function on [your account page](http://www.spotify.com/account).
 If other individuals have access to your Spotify account, then they can access personal data, controls and the Spotify Service available in your account. For example, you might have allowed someone to use your account on a shared device.
 It's your responsibility to only allow individuals to use your account where you're comfortable sharing this personal data with them. Anyone else's use of your Spotify account may impact your personalized recommendations and be included in your data download.
+[Top of page ↑]()
+## [**9\. Children**]()
+## **9\. Children**
 Note: This Policy doesn't apply to Spotify Kids unless the [Spotify Kids Privacy Policy](https://www.spotify.com/legal/kids-privacy-policy/) says so. Spotify Kids is a separate Spotify application.
 The Spotify Service has a minimum 'Age Limit' in each country or region. The Spotify Service is not directed to children whose age:
 - is under the age of 13 years
 - makes it illegal to process their personal data, or
 If you're a parent of a child under the Age Limit and become aware that your child has provided personal data to Spotify, [contact us]().
 If we learn that we've collected the personal data of a child under the applicable Age Limit, we'll take reasonable steps to delete the personal data. This may require us to delete the Spotify account for that child.
 When using a shared device on the main Spotify Service, be cautious about playing or recommending any inappropriate content to individuals under 18 years old.
+[Top of page ↑]()
+## [**10\. Changes to this Policy**]()
+## **10\. Changes to this Policy**
 We may occasionally make changes to this Policy.
 When we make material changes to this Policy, we'll provide you with prominent notice as appropriate under the circumstances. For example, we may display a prominent notice within the Spotify Service or send you an email or device notification.
+[Top of page ↑]()
+## [**11\. How to contact us**]()
+## **11\. How to contact us**
 For any questions or concerns about this Policy, contact our Data Protection Officer any one of these ways:
 - email [privacy@spotify.com](mailto:privacy@spotify.com)
 - write to us at: Spotify USA Inc., 150 Greenwich Street, Floor 62, New York, NY 10007, USA
 Spotify USA Inc. is the data controller of personal data processed under this Policy.
 © Spotify USA Inc.
+[Top of page ↑]()