Understanding Privacy at Spotify

What personal data does Spotify collect about me?

It is very important to us that you understand what personal data we collect about you, how we collect it, and why it’s necessary.

We collect your personal data in the following ways:

1. When you sign up for the Spotify Service or when you update your account - we collect certain personal data to create your Spotify account so you can use the Spotify Service. This includes your profile name and email address, as described in more detail in section 3 of our Privacy Policy.
2. Through your use of the Spotify Service - when you use or access the Spotify Service, we collect and process personal data about your actions. This includes the songs you have played and playlists you have created. This is the Usage Data category contained in section 3 of our Privacy Policy.
3. Personal data that you choose to give us - from time to time, you may also provide us with additional personal data or give us permission to collect personal data e.g. to provide you with more features or functionality. These could include Voice Data, Payment and Purchase Data and Survey and Research Data categories contained in section 3 of our Privacy Policy.
4. Personal data we receive from third party sources - if you sign up for Spotify using another service or connect your Spotify account to a third party application, service or device, we’ll receive your data from those third parties. We may also receive your data from technical service providers, payment partners and advertising and marketing partners. See section 3 of the Privacy Policy for more details.

Why does Spotify collect and use this personal data?

We collect and use your personal data for the following reasons:

• to provide the Spotify Service
• to provide certain additional voluntary features of the Spotify Service
• to understand, diagnose, troubleshoot, and fix issues with the Spotify Service
• to evaluate and develop new features, technologies, and improvements to the Spotify Service
• for marketing, promotion, and advertising purposes
• to comply with legal obligations and law enforcement requests
• to fulfill contractual obligations with third parties
• to take appropriate action with reports of intellectual property infringement and inappropriate content
• to establish, exercise, or defend legal claims
• to conduct business planning, reporting, and forecasting
• to process your payment
• to detect and prevent fraud, including fraudulent use of the Spotify Service
• to conduct research and surveys

For more information about why Spotify uses your personal data, and our legal basis for doing so, see section 4 of our Privacy Policy.

How does Spotify protect my personal data?

We are committed to protecting our users’ personal data. We implement appropriate technical and organisational measures to help protect the security of your personal data. However, please note that no system is ever completely secure.

We have put various safeguards in place including pseudonymization, encryption, access, and retention policies to guard against unauthorised access and unnecessary retention of personal data in our systems.

To protect your user account, we encourage you to:

• use a strong password which you only use for your Spotify account
• never share your password with anyone
• limit access to your computer and browser
• log out once you have finished using the Spotify Service on a shared device
• read more detail on protecting your account

For more detail, see section 8 of our Privacy Policy.

How does Spotify share / transfer my personal data?

Because of the global nature of our business, Spotify shares your personal data internationally with Spotify group companies, subcontractors and partners when carrying out the activities described in our Privacy Policy. They may process your data in countries whose data protection laws are not considered to be as strong as EU laws or the laws which apply where you live. For example, they may not give you the same rights over your data.

Whenever we transfer personal data internationally, we use tools to:

• make sure the data transfer complies with applicable law
• help to give your data the same level of protection as it has in the EU

See section 7 of our Privacy Policy for more details about the protections we use when transferring personal data internationally.

Your Personal Data Rights

You may be aware that privacy laws, including the General Data Protection Regulation or "GDPR", give certain rights to individuals over their personal data. These are described below.

For more detailed information, including how to exercise your rights, see section 2 of our Privacy Policy.

Where can I go to control what personal data Spotify uses?

1. Privacy Settings page - control the processing of certain personal data, including Tailored Ads.
2. Notification Settings page - set which marketing communication you get from Spotify.
3. Settings (found in the Desktop and Mobile versions of Spotify) - control certain aspects of the Spotify Service such as “Social” and “Explicit Content”. On the “Social” setting, you can:
   • start a Private session
   • choose whether to share what you listen to on Spotify with your followers, and
   • choose whether to show your recently played artists on your public profile

   On the “Explicit Content” setting you can control whether explicit-rated content can be played on your Spotify account.

Our Policies

At Spotify we are dedicated to providing you with the best user experience. Below are the policies that we apply when providing you with this service.

How to contact us

For any questions or concerns about this page, contact our Data Protection Officer any one of these ways:

• Email privacy@spotify.com
• Write to us at: Spotify USA Inc., 150 Greenwich Street, Floor 62, New York, NY 10007, USA