Goongoonalo Privacy Policy

1. About this Policy

This Privacy Policy describes how we process your personal data at Goongoonalo AB. From now on, we'll call it the 'Policy'.

It applies to your use of:

• all Goongoonalo streaming services as a user. For example this includes:
  • your use of Goongoonalo on any device
  • the infrastructure required to provide our services
  • connection of your Goongoonalo account with another application
  • both our free or paid streaming options (each a 'Service Option')
• other Goongoonalo services which include a link to this Policy. These include Goongoonalo websites, Customer Service and the Community Site

From now on, we'll collectively call these the 'Goongoonalo Service'.

From time to time, we may develop new or offer additional services. They'll also be subject to this Policy, unless stated otherwise when we introduce them.

This Policy is not...

• the Goongoonalo Terms of Use, which is a separate document. The Terms of Use outline the legal contract between you and Goongoonalo for using the Goongoonalo Service. It also describes the rules of Goongoonalo and your user rights
• about your use of other Goongoonalo services which have their own privacy policy.

Other resources and settings

Key information about your personal data is right here in this Policy. However, you might want to take a look at our other privacy resources and controls:

• Privacy Center: A user-friendly hub with summaries of key topics and helpful videos. It includes the 'Your Privacy Controls' video which shows you how to exercise your user rights and make choices about the way we process your data. See Section 2 'Your personal data rights and controls' for more on user rights.
• Account Privacy: Control the processing of certain personal data, including tailored advertising.
• Notification Settings: Set which marketing communications you get from Goongoonalo.
• Settings (found in the Desktop and Mobile versions of Goongoonalo): Control certain aspects of the Goongoonalo Service such as 'Social' or 'Explicit Content'. On the 'Social' setting, you can:
  • start a Private session
  • choose whether to share what you listen to on Goongoonalo with your followers
  • choose whether to show your recently played artists on your public profile

On the 'Explicit Content' setting you can control whether explicit-rated content can be played on your Goongoonalo account.

• Cookies Policy: Information on how we use cookies and how to manage your cookie preferences. Cookies are files saved on your phone, tablet or computer when you visit a website.

2. Your personal data rights and controls

Many privacy laws give rights to individuals over their personal data. These laws include the General Data Protection Regulation, or 'GDPR'.

Some rights only apply when Goongoonalo uses a certain 'legal basis' to process your data. We explain each legal basis, and when Goongoonalo uses each one, in Section 4 'Our purpose for using your personal data'.

3. Our purpose for using your personal data

• Performance of a Contract: When it's necessary for Goongoonalo (or a third party) to process your personal data to:
  • comply with obligations under a contract with you. This includes Goongoonalo's obligations under the Terms of Use to provide the Goongoonalo Service to you, or
  • verify information before a new contract with you begins.
• Legitimate Interest: When Goongoonalo or a third party has an interest in using your personal data in a certain way, which is necessary and justified considering any possible risks to you and other Goongoonalo users. For example, using your Usage Data to improve the Goongoonalo Service for all users. Contact us if you want to understand a specific justification.
• Consent: When Goongoonalo asks you to actively indicate your agreement to Goongoonalo's use of your personal data for a certain purpose.
• Compliance with Legal Obligations: When Goongoonalo must process your personal data to comply with a law.

5. Sharing your personal data

This section sets out who receives personal data which is collected or generated through your use of the Goongoonalo Service.

Publicly available information

The following personal data will always be publicly available on the Goongoonalo Service (except to any user you have blocked):

• your profile name
• your profile photo
• your public playlists
• other content you post on the Goongoonalo Service, and any associated titles, descriptions and images
• who you follow on the Goongoonalo Service
• who follows you on the Goongoonalo Service

You or another user can share certain information on third party services, like social media or messaging platforms. This includes:

• your profile
• any content you post on Goongoonalo and details about that content
• your playlists and any associated titles, descriptions and images

When this sharing occurs, the third-party service may store a copy of it to support their features.

Personal data you may choose to share

We will only share the following personal data with those outlined in the table below:

• where you have chosen to use a Goongoonalo Service feature, or a third party application, service or device, and we need to share personal data to enable this, or
• if you otherwise grant us your permission to share the personal data. For example, you can do it by selecting the appropriate setting in the Goongoonalo Service or by giving your consent

6. Data retention

We keep your personal data only as long as necessary to provide you with the Goongoonalo Service and for Goongoonalo's legitimate and essential business purposes, such as:

• maintaining the performance of the Goongoonalo Service
• making data-driven business decisions about new features and offerings
• complying with our legal obligations
• resolving disputes

Here are some of the categories of our retention periods, and the criteria we use to determine them:

• Data retained until you remove it It's your right to request that we delete certain of your personal data. See the section on 'Erasure' in Section 2 'Your personal data rights and controls' for more information, and the circumstances in which we can act on your request. You can also delete certain personal data directly from the Goongoonalo Service: for example, you can edit or delete your profile picture. Where users are able to see and update the personal data themselves, we keep the information for as long as the user chooses unless one of the limited purposes described below applies.
• Data that expires after a specific period of time We have set certain retention periods so that some data expires after a specific period of time. For example, personal data you may input as part of search queries is generally deleted after 90 days.
• Data retained until your Goongoonalo account is deleted We keep some data until your Goongoonalo account is deleted. Examples of this include your Goongoonalo username and profile information. We also typically keep streaming history for the life of an account, for example, to provide retrospective playlists that users enjoy and personalised recommendations that take listening habits into account (for example, Your Time Capsule or Your Summer Rewind). When your Goongoonalo account is deleted, this category of your data is deleted or de-identified.
• Data retained for extended time periods for limited purposes After your account is deleted, we keep some data for a longer time period but for very limited purposes. For example, we may be subject to legal or contractual obligations that require this. These may include mandatory data retention laws, government orders to preserve data relevant to an investigation, or data kept for the purposes of litigation. We may also keep data that has been removed from the Goongoonalo Service for a limited period of time. This could be:
  • to help ensure user safety, or
  • to protect against harmful content on our platform.

This helps us investigate potential breaches of our User Guidelines and Platforrm Rules. On the other hand, we will remove unlawful content if the law requires us to do so.

7. Transfer to other countries

Because of the global nature of our business, your personal data will be shared internationally among Goongoonalo group companies, subcontractors and partners when carrying out the activities described in this Policy. They may process your data in countries whose data protection laws are not considered to be as strong as EU laws or the laws which apply where you live. For example, they may not give you the same rights over your data.

Whenever we transfer personal data internationally, we use tools to:

• make sure the data transfer complies with applicable law
• help to give your data the same level of protection as it has in the EU

To ensure each data transfer complies with applicable EU legislation, we use the following legal mechanisms:

• Standard Contractual Clauses ('SCCs'). These clauses require the other party to protect your data and to provide you with EU-level rights and protections. For example, we use SCCs to transfer the personal data described in Section 3 'Personal data we collect about you' to our hosting provider which uses servers in the US. You can exercise your rights under the Standard Contractual Clauses by contacting us or the third party who processes your personal data.
• Adequacy Decisions. This means that we transfer personal data to countries outside of the European Economic Area which have adequate laws to protect personal data, as determined by the European Commission. For example, we transfer the personal data described in Section 3 'Personal data we collect about you' to vendors based in the United Kingdom, Canada, Japan, Republic of Korea and Switzerland.

We also identify and use additional protections as appropriate for each data transfer. For example, we use:

• technical protections, such as encryption and pseudonymisation
• policies and processes to challenge disproportionate or unlawful government authority requests

8. Keeping your personal data safe

We're committed to protecting our users' personal data. We put in place appropriate technical and organisational measures to help protect the security of your personal data. However, be aware that no system is ever completely secure.

We have put various safeguards in place including pseudonymisation, encryption such as Transport Layer Security (TLS) and AES, access, and retention policies to guard against unauthorised access and unnecessary retention of personal data in our systems. In addition, personal data stored in our computer systems are secured by physical security measures.

To protect your user account, we encourage you to:

• use a strong password which you only use for your Goongoonalo account
• never share your password with anyone
• limit access to your computer and browser
• log out once you have finished using the Goongoonalo Service on a shared device
• read more detail on protecting your account

You can log out of Goongoonalo in multiple places at once by using the 'Sign out everywhere' function on your account page.

If other individuals have access to your Goongoonalo account, then they can access personal data, controls and the Goongoonalo Service available in your account. For example, you might have allowed someone to use your account on a shared device.

It's your responsibility to only allow individuals to use your account where you're comfortable sharing this personal data with them. Anyone else's use of your Goongoonalo account may impact your personalised recommendations and be included in your data download.

9. Children

Note: This Policy doesn't apply to Goongoonalo Kids unless the Goongoonalo Kids Privacy Policy says so. Goongoonalo Kids is a separate Goongoonalo application.

The Goongoonalo Service has a minimum 'Age Limit' in each country or region. The Goongoonalo Service is not directed to children whose age:

• is under the age of 13 years
• makes it illegal to process their personal data, or
• requires parental consent to process their personal data

We do not knowingly collect or use personal data from children under the applicable Age Limit. If you're under the Age Limit, do not use the Goongoonalo Service, and do not provide any personal data to us. Instead, we recommend using a Goongoonalo Kids account.

If you're a parent of a child under the Age Limit and become aware that your child has provided personal data to Goongoonalo, contact us.

If we learn that we've collected the personal data of a child under the applicable Age Limit, we'll take reasonable steps to delete the personal data. This may require us to delete the Goongoonalo account for that child.

When using a shared device on the main Goongoonalo Service, be cautious about playing or recommending any inappropriate content to individuals under 18 years old.

10. Changes to thris Policy

We may occasionally make changes to this Policy.

When we make material changes to this Policy, we'll provide you with prominent notice as appropriate under the circumstances. For example, we may display a prominent notice within the Goongoonalo Service or send you an email or device notification.

11. How to contact us

For any questions or concerns about this Policy, contact our Grievance Officer/Data Protection Officer any one of these ways:

• email privacy@Goongoonalo.com

For the purposes of the GDPR, Goongoonalo AB is the data controller of personal data processed under this Policy.

© Goongoonalo

Goongoonalo User Guidelines

Hello! Welcome to the Goongoonalo User Guidelines ("User Guidelines") which apply when using Goongoonalo's websites, applications and services that reference these User Guidelines (the "Services") including accessing any type of material or content made available through those Services ("Content"). These User Guidelines are designed to ensure the Services stay enjoyable for everyone. In addition to these User Guidelines, content must adhere to the Goongoonalo Platform Rules ("Platform Rules").

We may update these User Guidelines and the Platform Rules from time to time - you can find the latest version on our website.

Violating the User Guidelines or Platform Rules may result in removal of any content or material you've contributed to the Services and/or termination or suspension of your account. We try to make the Services broadly available to everyone, but you cannot use our Services if we've previously terminated your account on any of our Services. We also prohibit attempts to circumvent prior enforcement actions, including through the creation of new accounts.

The following is not permitted for any reason whatsoever in relation to the Services and the material or content made available through the Services, or any part thereof:

1. reverse-engineering, decompiling, disassembling, modifying, or creating derivative works, except where such restriction is expressly prohibited by applicable law. If applicable law allows you to decompile any part of the Services or Content where required in order to obtain the information necessary to create an independent program that can be operated with the Services or with another program, the information you obtain from such activities (a) may only be used for the foregoing objective, (b) may not be disclosed or communicated without Goongoonalo's prior written consent to any third party to whom it is not necessary to disclose or communicate in order to achieve that objective, and (c) may not be used to create any software or service that is substantially similar in its expression to any part of the Services or the Content;
2. copying, reproducing, redistributing, "ripping," recording, transferring, performing, framing, linking to or displaying to the public, broadcasting, or making available to the public, or any other use which is not expressly permitted under the Agreements or applicable law, or which otherwise infringes intellectual property rights;
3. importing or copying any local files that you do not have the legal right to import or copy in this way;
4. transferring copies of cached Content from an authorized Device to any other Device via any means;
5. "crawling" or "scraping", whether manually or by automated means, or otherwise using any automated means (including bots, scrapers, and spiders), to view, access or collect information, or using any part of the Services or Content to train a machine learning or AI model or otherwise ingesting Goongoonalo Content into a machine learning or AI model;
6. selling, renting, sublicensing, leasing or other monetization except as expressly permitted under the Agreements;
7. selling a user account or playlist, or otherwise accepting or offering to accept any compensation, financial or otherwise, to influence the name of an account or playlist or the content included on an account or playlist; or
8. artificially increasing play counts or follow counts, artificially promoting Content, or other manipulation including by (i) using any bot, script or other automated process, (ii) providing or accepting any form of compensation (financial or otherwise), or (iii) any other means;
9. circumventing any technology used by Goongoonalo, its licensors, or any third party, including any territorial or other content access restrictions applied by Goongoonalo or its licensors;
10. circumventing or blocking advertisements or creating or distributing tools designed to block advertisements;
11. removing or altering any copyright, trademark, or other intellectual property notices (including for the purpose of disguising or changing any indications of ownership or source);
12. deleting or altering any part of the Services or Content except as expressly permitted under the Agreements or, in the case of Content made available by another user, with such user's express consent; or
13. providing your password to any other person or using any other person's username and password.

Please respect Goongoonalo, the owners of the material and content on the Services, and other users of the Services. Don't engage in any activity, post any User Content, or register or use a username, which is or includes material that:

1. is illegal, or intended to promote or commit an illegal act of any kind, including violations of intellectual property rights, privacy rights, publicity rights, or proprietary rights of Goongoonalo or a third party, or would violate any agreement to which you are a party, such as, by way of example and not limitation, an exclusive recording agreement or publishing agreement;
2. includes your password or purposely includes any other user's password or purposely includes personal data of third parties or is intended to solicit such personal data;
3. exposes confidential or proprietary information of a third party or personal information about yourself that is not intended to be broadcast to people around the world;
4. includes malicious content such as malware, Trojan horses, or viruses, or otherwise interferes with any user's access to the Goongoonalo Service;
5. impersonates or misrepresents your affiliation with Goongoonalo (including, for instance, by using Goongoonalo's copyrighted content, using the Goongoonalo logo without permission, or otherwise using Goongoonalo trademarks in a confusing manner), another user, person, or entity, or is otherwise fraudulent, false, deceptive, or misleading;
6. involves the transmission of unsolicited mass mailings or other forms of spam, junk mail, chain letters, or similar;
7. unauthorized commercial or sales activities, such as advertising, promotions, contests, sweepstakes, gambling, bookmaking, or pyramid schemes;
8. unauthorized linking to, referencing, or otherwise promoting commercial products or services, except as expressly authorized by Goongoonalo;
9. interferes with or in any way disrupts the Goongoonalo Service, tampers with, breaches, or attempts to probe, scan, or test for vulnerabilities in the Goongoonalo Service or Goongoonalo's computer systems, network, usage rules, or any of Goongoonalo's security components, authentication measures or any other protection measures applicable to the Goongoonalo Service, the Content or any part thereof;
10. conflicts with the Goongoonalo Terms and Conditions of Use or any other terms or policies applicable to your use of any of the Services; or
11. has been removed from any of our services for a breach of our terms or policies, such as a prohibited track, episode or show. This includes content being created or repurposed to reconstitute or serve the same objective as previously removed Content.