Legal
Privacy Policy
1Data Controller
This notice is prepared by The Lost Label platform ("Platform") under Turkey's Personal Data Protection Law No. 6698 ("KVKK") and, where applicable, the EU General Data Protection Regulation ("GDPR"). Data controller: The Lost Label. Contact: [email protected].
2Personal Data We Collect
When you create an account and use the Platform, we process: name, stage name, email address, phone number, address and legal name (for contracts and invoicing), password (stored irreversibly hashed), two-factor authentication data, Spotify artist profile and public listener statistics, demo audio files and links you upload, signed contracts, earnings and royalty records, invoice and payment information, Discord account link (for optional notifications), and technical log data such as IP address and activity records.
3Purposes and Legal Bases
Your data is processed for: membership and artist account management, demo review processes, concluding and performing contracts, royalty and earnings payments, accounting and tax law obligations, platform security (preventing unauthorized access and fraud), and sending you notifications. Legal bases: performance of a contract, compliance with legal obligations, our legitimate interests, and your explicit consent where required.
4Data Sharing
Your data may be shared with: Spotify (artist profile matching), Discord (only for notifications you opt into), digital distribution partners (e.g. Believe, minimum data required for publishing), and service providers for accounting and invoicing. Our servers are located in Germany; your data is transferred there with KVKK and GDPR standard protections. Your data is never sold to third parties for marketing.
5Retention Periods
Your data is kept while your account is active. Accounting and tax records are kept for 10 years as legally required. Other data is deleted or anonymized when you close your account or request deletion, unless a legal retention duty applies.
6Your Rights
You have the right to learn whether your data is processed, request information, learn the purposes and whether data is used accordingly, know the third parties it is shared with, request correction of incomplete or inaccurate data, request deletion or destruction where conditions are met, request notification of such actions to third parties, object to results arising from automated analysis, and claim compensation for unlawful processing. Send requests to [email protected]; we respond within 30 days at the latest.
7Cookie Policy
The Platform uses only strictly necessary cookies: session cookie (login state), security cookies (CSRF protection, two-factor authentication steps) and login-flow state cookies. No analytics, advertising or tracking cookies are used, and cookies are not shared with third parties. Blocking cookies in your browser may prevent you from logging in.
8Data Security
Passwords are stored hashed with bcrypt, two-factor secrets encrypted with AES-256. Data access is limited by role-based authorization, sensitive actions are audit-logged, and connections are encrypted (HTTPS).
9Changes
When this notice is materially updated you will be asked to accept it again at panel login. The last update date is shown at the top of this page.
End of document[email protected]