DMG Privacy Policy

1.1. The DMG Privacy Policy is Divine LLC's personal-data processing policy, INN 7404072540, OGRN 1207400004030. Address: apartment 37, building 24, Severo-Zapad 2 quarter, Zlatoust, Chelyabinsk region, 456234, Russia; contact: legal@divinemusicgroup.net. It covers visitors, Join applicants, cabinet owners, representatives, artists, catalogue participants and payees.

1.2. This operator-published policy applies independently of a licence or contract acceptance. Reviewing it is not consent. Every purpose needs a basis: requested pre-contract steps, performance, statutory duty, legitimate interests respecting individual rights or specific consent where required.

2.1. Visits involve necessary IP address, request time/route, browser/device and error/security details to serve pages, protect the service and investigate faults. Join receives the supplied name, email, role, catalogue details and message to assess and answer the application. Submission creates no active account.

2.2. After approval, processing covers invitations/use, email confirmation, account and sessions. Passwords are neither published nor disclosed to staff in plain text. Recovery verifies the recipient of a limited link. Initial setup records party/signer name, status, necessary country/representation details, editions and confirmations. Passport scans and selfies are not mandatory registration requirements.

3.1. Catalogue data includes names/stage names, roles/credits, work/recording identifiers, rights, media and restrictions. Labels/representatives provide only necessary information, ensure lawful disclosure, inform individuals and hold authority. Label accounts create no artist advertising consent. Individuals may contact the operator even if a representative supplied their information.

3.2. Accounting involves shares, report amounts, payees, tax/payment details, requests and transfer history. Evidence is requested only for a specific identity, authority, legal-basis or payment-detail need. It is not promotional material and is not published; other users have no access to its contents.

4.1. Likeness, photograph copyright and dissemination of selected personal data need independent grounds. Individuals define scope/restrictions; refusal does not block basic distribution. Artwork, private-document or folder uploads are not blanket promotional permission. Withdrawal ends the relevant use without automatically cancelling another choice.

5.1. Authorised staff/processors receive necessary information only. Platforms and delivery aggregators receive agreed media, credits and rights for placement; banks and lawful payment participants receive necessary payment data. Split recipients see authorised information only. Public-authority disclosures require lawful grounds. Passwords, private documents and full bank details are not sent to Analytics Advisor, which uses authorised aggregates only.

5.2. Accounts, authentication, contractual information, payment details and private documents of the Russian cabinet are hosted in Russia on Selectel infrastructure. Access is limited by duties and authority. Backups of this data, when created, are stored in restricted Russian storage. The Russian cabinet does not use an overseas database as a backup destination for new Russian data.

5.3. Yandex 360 handles system mail and correspondence: the recipient address, necessary message content and, where needed, a limited confirmation or recovery link are transmitted. Such messages contain neither passwords nor complete bank details. Delivery to an overseas mailbox involves the recipient's mail provider.

5.4. Cloudflare R2 is used for agreed media-catalogue materials. Photographs, voice, names and credits may contain personal data; treating a file as media does not exempt its processing. International Cloudflare infrastructure and music-partner delivery may involve cross-border transfers. Each flow requires the applicable legal grounds and statutory procedures; this policy is not consent to any transfer. Disclosures are limited to the placement purpose. Recipients and countries of a particular external flow are disclosed before use; an unconfirmed flow must not be enabled.

6.1. Necessary cookies and local preferences support sessions, security, language and cookie choices. Cabinet analytics uses music-platform reports. Optional visitor statistics and advertising tools require the corresponding connection and user choice. Disabling necessary cookies may prevent sign-in.

7.1. Data is retained no longer than necessary: applications/correspondence for review and necessary follow-up; contractual data for the agreement and until DMG fulfils obligations; accounting/tax data for mandatory statutory periods; dispute evidence during an actual dispute and rights protection. Scope is limited to the basis. Account deletion/withdrawal does not cancel mandatory records or authorise further advertising.

7.2. When a purpose ends or consent is withdrawn, processing without another basis stops and destruction follows statutory periods, generally within 30 days; where immediate destruction is lawfully impossible, blocking and subsequent destruction apply. Backup access is limited to recovery and lawful grounds. Restoration does not return removed data to ordinary use: current deletions/restrictions are reapplied. Withdrawal evidence is kept separately.

8.1. Individuals may obtain statutory processing information, seek correction, blocking, destruction or cessation, withdraw consent and complain to the operator, Roskomnadzor or a court. Send the requested remedy and reply contact to legal@divinemusicgroup.net or the operator's address. DMG verifies entitlement proportionately, protects others' data and requires no music-licence acceptance for requests.

8.2. Access information: 10 working days with a notified reasoned extension up to 5 working days. Established inaccuracies are corrected within 7 working days. Cessation requests: 10 working days with the statutory 5-working-day extension, unless an independent basis permits continuation. Article 10.1 dissemination ends within 3 working days after a proper request. Other statutory periods remain. Policy updates show their date and create no new consent themselves.