Skip to content

Privacy Policy

Last updated: 17 October 2026. Deutsche Fassung: Datenschutzerklärung

1. Privacy at a glance

General information

This overview explains what happens to your personal data when you visit this website and when you use our music distribution service. Personal data is any data that can identify you personally. The sections below explain each processing activity in detail.

Who is responsible?

The controller is Lay Distribution UG (haftungsbeschränkt). You can find our contact details in section 2.

What do we process, and why?

What rights do you have?

You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object, and you may withdraw any consent at any time. You can also lodge a complaint with a data protection supervisory authority. Section 3 explains these rights.

2. Controller

Lay Distribution UG (haftungsbeschränkt)
Maxburgweg 1
76187 Karlsruhe
Germany

Represented by the managing directors Philipp Börsig and Yelen Lüle
Email: info@laydistribution.com

We have not appointed a data protection officer because we are not legally required to do so. Please send any privacy question to the email address above.

3. General information and your rights

Legal bases

We process personal data only where a legal basis allows it. Depending on the case, this is your consent (Art. 6(1)(a) GDPR), the performance of a contract with you or steps before entering into one (Art. 6(1)(b) GDPR), a legal obligation (Art. 6(1)(c) GDPR) or our legitimate interests (Art. 6(1)(f) GDPR). Where information is stored on or read from your device, § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG) also applies. Each section below names the legal basis for that processing.

Recipients and processors

We use service providers who process data on our behalf and follow our instructions (processors under Art. 28 GDPR), for example our host and our distribution platform. We have concluded data processing agreements with them. We pass data to other recipients, such as music stores or payment providers, only where this is needed for the purpose described in this policy.

Transfers to countries outside the EU

Some providers are based in the USA or may access data from there. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission's adequacy decision of 10 July 2023. Otherwise we rely on other safeguards under Art. 44 et seq. GDPR, in particular the EU standard contractual clauses, or, where you ask us to deliver your music to a store outside the EU, on Art. 49(1)(b) GDPR. You can ask us for a copy of the safeguards.

How long we keep data

Unless a section states a specific period, we keep personal data only for as long as the purpose requires. Where commercial or tax law requires us to keep records (in particular § 257 HGB and § 147 AO, usually six, eight or ten years), we restrict the data to that purpose and delete it when the period ends.

Your rights

To exercise your rights, email info@laydistribution.com.

Right to object (Art. 21 GDPR)

Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you have the right to object at any time on grounds relating to your particular situation. We will then stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. If we process your data for direct marketing, you may object at any time without giving reasons, and we will then no longer use your data for that purpose.

Right to lodge a complaint

You have the right to complain to a data protection supervisory authority, in particular in the member state of your habitual residence, your place of work or the place of the alleged infringement. The authority responsible for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg
Heilbronner Straße 35
70191 Stuttgart
Germany

Do you have to provide data?

You can visit this website without providing any data yourself. To use our distribution service you need to provide the data the registration and the contract require, such as your email address, payout details and the information stores need for your releases. Without it we cannot provide the service.

Automated decisions

We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).

Encryption

This website and our distribution platform use TLS encryption. You can recognise an encrypted connection by "https://" and the lock symbol in your browser's address bar.

4. Hosting of this website

This website is hosted on Cloudflare Workers by Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA ("Cloudflare"). When you open a page, Cloudflare's servers automatically process technical access data: your IP address, the date and time of the request, the page requested, the amount of data transferred, and your browser and operating system as sent in the user agent. Our pages instruct your browser not to send a referrer.

We use this data to deliver the website, to keep it stable and secure and to defend against attacks. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Cloudflare processes the data on our behalf under a data processing agreement. Cloudflare is certified under the EU-U.S. Data Privacy Framework; it also uses the EU standard contractual clauses. Access data is deleted when it is no longer needed for these purposes.

The application form (section 8) also runs on Cloudflare: when you send it, Cloudflare receives and stores your application on our behalf, as section 8 explains.

The fonts on this website are hosted on our own server. Your browser does not connect to any external font service.

5. Cookies

This website does not set cookies and does not store information on your device or read information from it, apart from what is strictly necessary to deliver the pages you request (§ 25(2) No. 2 TDDDG). Our distribution platform uses cookies that are needed to log you in and keep your session secure (section 8).

6. Web analytics with Plausible

We use Plausible Analytics to understand how our website is used. The provider is Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia. Plausible works without cookies and without any persistent identifier. It records which pages are visited, the referring website, the browser, the operating system, the device type and the approximate location (country, region and city), all derived from the request.

Plausible does not store your IP address or your full user agent. To count unique visitors it creates a daily identifier from a hash of the IP address, the user agent, our domain and a random value that is deleted every 24 hours, so visitors cannot be recognised across days or across websites. We only see aggregated statistics. The data is stored on servers in Germany and does not leave the EU.

The legal basis is our legitimate interest in understanding and improving the use of our website with a privacy-friendly method (Art. 6(1)(f) GDPR). Plausible processes the data on our behalf under a data processing agreement. You can object to this processing (section 3), for example by blocking the Plausible script with a content blocker in your browser.

7. Contact by email

If you email us, for example at support@laydistribution.com or info@laydistribution.com or about a Partner plan, we process your email address, your name if you give it, your message and any data it contains in order to answer you. If your enquiry relates to a contract or to steps before entering into one, the legal basis is Art. 6(1)(b) GDPR; otherwise it is our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the correspondence when your enquiry is fully dealt with, unless statutory retention periods apply.

Our mailboxes are hosted by Namecheap, Inc., 4600 East Washington Street, Suite 300, Phoenix, AZ 85034, USA, as a processor. Transfers to the USA are based on the safeguards described in section 3.

8. Your artist account and our distribution service

Applying for an account

We set up every account ourselves; there is no self-registration. You apply through the application form on our website. We process what you enter there: whether you apply as an artist or band, a label or a manager, your name, email address and country, your artist or label name, a link to your music and your note if you add one. We also record that you confirmed you are at least 18 years old and accepted our Terms and the Distribution Agreement: the time, the version of each document and the language of the form. We use this data to decide on your application, to set up your account on our distribution platform and to contact you about it. The legal basis is steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR). We keep the acceptance record to be able to prove the contract (Art. 6(1)(f) GDPR).

To detect fraudulent or fake applications, we check each application with automated scoring that uses public signals only: your music link, public profile data, the domain of your email address, whether your artist or label name, note or email address claims to be a well-known artist (compared with a fixed list in our own system), whether your single-word name only repeats your artist or label name, and whether the same email address, artist or label name or music link has been used in an application before. It also compares the country you enter with the country your connection comes from; we store that country with the score, never your IP address. The score is advisory only; a person decides on every application. The legal basis is our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).

The form sends your application to Cloudflare (section 4), which stores it in a database located in the EU, as our processor under a data processing agreement. Your IP address is used only briefly, in memory, to limit how many applications one connection can send; it is not stored with your application.

To keep bots out, the form uses Cloudflare Turnstile. Before you send it, Turnstile checks in your browser that a person is using the form; for this Cloudflare processes your IP address and technical information about your browser and its connection, as our processor. Cloudflare also uses this information under its own responsibility to improve its bot detection; it does not use it to identify, profile or target you. The legal basis is our legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR); reading information in your browser for this is strictly necessary for sending the form you requested (§ 25(2) No. 2 TDDDG).

We delete an application 180 days after you sent it or, if we declined it, 180 days after our decision. If we set up your account, we delete the details of your application 30 days later and keep only your email address, your role and the acceptance record, for as long as your contract runs and for three years after it ends.

Our distribution platform

Login and all distribution functions run on our distribution platform at laydistribution.sonosuite.com. The platform is operated on our behalf by SONOSUITE, S.L., Trafalgar 10, pral 1, 08010 Barcelona, Spain ("SonoSuite"), as our processor under a data processing agreement. SonoSuite may use its own sub-processors, for example for hosting; where these are outside the EU, SonoSuite ensures appropriate safeguards.

We process the following data on the platform:

We use this data to register you, to deliver your releases, to account for and pay out your revenue and to support you. The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR). We keep accounting and tax records to meet our legal obligations (Art. 6(1)(c) GDPR). We use data to prevent fraud, artificial streaming and rights infringements on the basis of our legitimate interest, and that of the stores, in a lawful and fraud-free service (Art. 6(1)(f) GDPR).

Music stores and streaming services

To deliver your releases we pass release data (audio files, artwork, metadata including the names of artists and contributors, and where a store requires it the name of the rights holder) to the stores and services you choose, for example Spotify or Apple Music. They use this data under their own responsibility to offer your music. Some of them are located outside the EU; the transfer is necessary to perform our contract with you (Art. 49(1)(b) GDPR). Stores send us sales and usage reports for your releases and may report suspected artificial streaming.

Fraud prevention

To detect fraud, artificial streaming and infringements, our platform checks uploads and analyses sales data for unusual patterns, and it takes into account reports from stores and fraud indicators from industry initiatives. The legal basis is Art. 6(1)(f) GDPR.

Verification of identity and rights

In individual cases, for example if a store asks us to or if there are indications of fraud or a rights infringement, we may ask you for proof of your identity and of your rights, such as a copy of an identity document, project files or licence agreements. You may black out any information on an identity document that we do not need. We use these documents only for the verification and delete them once they are no longer needed for it or for the establishment or defence of legal claims. The legal bases are Art. 6(1)(b) and (f) GDPR.

Payouts with PayPal

We pay out your revenue via PayPal. For this we pass your PayPal account details, your name and the payout amount to PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg, which processes the data as an independent controller. The legal basis is Art. 6(1)(b) GDPR. PayPal's privacy statement: paypal.com.

How long we keep account data

We keep your account data for as long as your contract with us runs. After it ends we delete the data, except for records we must keep under commercial and tax law (see section 3) and data we need to account for revenue that stores pay for the period before your releases were taken down or to defend legal claims.

9. Links to other websites and social media

Our website links to our distribution platform and to our profiles on social networks, for example Instagram and YouTube. These are plain links. No data is sent to these services until you click a link; after that, the privacy policy of the service you visit applies.

10. Changes to this policy

We update this privacy policy when our services or the law change. The current version is always available on this page.

Parts of this privacy policy are based on templates from eRecht24 (e-recht24.de).