Flat - Privacy Policy

This Privacy Policy applies to individual users. To view all our policies, check out the index. If you are using Flat for Education, please refer to our specific privacy policy.

This is the current version of these terms, dated 11 Oct 2023.

1. Flat approach to privacy

1.1 We operate a service which allows you to create, edit, share and collaborate on music scores using our website located at flat.io, the Flat application (available for download on your mobile device), through APIs, and through third parties (the "Service").

1.2 We appreciate your interest in our Service. Privacy protection is very important to us and we are committed to protecting you and respecting your privacy. This privacy policy sets out information about how we collect, store, process, transfer, share and use data that identifies or is associated with you when providing our Service (hereinafter "personal information").

1.3 You should also be aware that we use cookies to store and access information whilst providing access to our site or our app. You can find out more about our use of cookies below.

1.4 The Service is operated by Tutteo Limited ("Flat", "we", "our" or "us") and we act as a data controller in relation to the personal information we hold about you.

2. Personal information we collect about you and how we use it

2.1 We collect personal information about you when you voluntarily submit information directly to us through our Service. This can include information you provide to us when you register with us, edit your profile, share content, purchase services, correspond with us, subscribe to our mailing lists, newsletters or other forms of marketing communications, respond to a survey, enter a promotion or use some other feature of our Service.

2.2 At various places on our site or our app you may be requested to enter certain personal information. Personal information that must be provided in order to use the requested services will be indicated at the time of collection. If you choose not to provide this personal information, we may not be able to provide some or all of the features and functionalities of the Service to you or respond to your other requests. Other personal information that you are not required to provide in order to receive our services may be voluntarily given and you are free to decide not to give such personal information.

2.3 The table sets out the categories of personal information we collect about you and how we use that information. The table also lists the legal basis which we rely on to process the personal information and the recipients of the personal information.

2.4 We also automatically collect personal information indirectly about how you access and use the Service and information about the device you use to access the Service.

2.5 The table sets the categories of personal information we collect about you automatically and how we use that information. The table also lists the legal basis which we rely on to process the personal information and the recipients of the personal information.

2.6 We may link or combine the personal information we collect about you and the information we collect automatically. This allows us to provide you with a personalised experience regardless of how you interact with us.

2.7 We may anonymise and aggregate any of the information we collect (so that it does not directly identify you). We may use anonymised information for purposes that include testing our IT systems, research, data analysis, improving our site and developing new products and features.

3.1 We may share your personal information with the following parties (as required in accordance with the uses set out in Annexes 1 and 2):

(a) Social networks: you can choose to make your content public and share your content on a social network. If you do, we will share your content with that social network. As part of the Service, other users can share your public content with social networks.
(b) Companies in the same group of companies as us: our subsidiaries (i.e. any organisation we own or control) or our holding company or ultimate holding company (i.e. any organisation that owns or controls us) and any subsidiaries they own. These companies will only use your personal information in the same way as we can under this privacy policy.
(c) Service providers and advisors: third parties who provide a service to us. For example, third party service providers either provide IT infrastructure or help support it, help us to provide you with support in relation to the Service, process payments from you on our behalf, develop analytical information for us about our products and services and provide professional services such as legal and accountancy services. These third parties will only be allowed to use your personal information in accordance with our instructions and will be required to keep your information secure.
(d) Purchasers of our business: personal information may be disclosed or transferred to buyers or perspective buyers of our business or any of our assets as part of any such sale. We will take all reasonable steps to ensure that such recipients will use your personal information in a way that is consistent with this privacy policy.
(e) Law enforcement, regulators and other parties for legal reasons: third parties who we are under a legal obligation to disclose your personal information to or to whom we need to disclose your personal information to protect our rights, property or safety or to protect the rights, property or safety of others. We may also disclose personal information to third parties to help detect and investigate illegal activities and breaches of any agreement we have with you.

3.2 We do not disclose information about identifiable individuals to anyone else except as set out above. We may provide third parties with aggregate statistical information and analytics about users of our Service but we will make sure no one can be identified from this information before we disclose it.

4. Marketing and advertising

4.1 From time to time we may contact you with information about our products and services. Most marketing messages we send will be by email. If you are using our app we may also send you push notifications. For some marketing messages we may use personal information we collect about you to help us determine the most relevant marketing information to share with you.

4.2 We will only send marketing messages to you if you have given us your consent to do so. We will ask you if you would like to receive these messages when we first collect your contact details. You can also change your marketing preference at a later date by following the instructions outlined below.

Email – click on the unsubscribe link at the bottom of our marketing emails. If you have an online account with us you might be able to opt-out of marketing emails, features updates and comment notifications through your account settings.
App push notifications – you can change your push notification preferences at any time in the account settings for the app.

4.3 If you receive marketing from us through other channels e.g. post or by phone, and you no longer want to receive such messages, you can tell us to stop marketing to you by post or phone marketing messages by using our contact details at the end of this privacy policy.

4.4 Please note that if you do opt-out of or do not grant consent to receiving marketing related messages from us, we may still send you non-marketing messages, such as communications relating to the provision of our Service.

4.5 You can also let us know at any time that you do not wish to receive marketing anymore by sending an email to us at support@flat.io. You may also be able to unsubscribe from our marketing emails by clicking on the unsubscribe link in the emails we send to you.

5. Storing and transferring your personal information

5.1 Retention period: We will store the personal information we collect about you for no longer than necessary for the purposes set out in Annex 1 and Annex 2 and in accordance with our legal obligations and legitimate business interests.

5.2 Security: we implement appropriate and reasonable technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, change, or damage. All personal information we collect will be stored on our secure servers.

5.3 Phishing: We will never send you unsolicited emails or contact you by phone requesting your account ID, password, credit or debit card information or national identification numbers.

5.4 International Transfers of your Personal Information: the personal information we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third party service providers have operations. Some of these countries offer differing levels of protection in respect of personal information and may, in certain instances, be less protective than the country you are typically resident in. These international transfers of your personal information will be made pursuant to appropriate safeguards, such as the EU-U.S. Privacy Shield framework or standard data protection clauses adopted by the European Commission. If you wish to enquire further about these safeguards used, please contact us using the details set out at the end of this privacy policy. We will take all reasonable steps to ensure that your personal information is treated securely and in accordance with applicable law and this privacy policy.

6. Our policy towards children

Our Flat Individual Service is not directed to persons under 13 and we do not knowingly collect personal information from children under 13. If you become aware that your child has provided us with personal information, without your consent, then please contact us using the details below so that we can take steps to remove such information and terminate any account your child has created with us.

7. Your rights in respect of your personal information

7.1 If you are resident in the European Economic Area, in accordance with applicable privacy law, you have the following rights in respect of your personal information that we hold:

(a) Right of access. You have the right to obtain:
- (i) confirmation of whether, and where, we are processing your personal information;
- (ii) information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods;
- (iii) information about the categories of recipients with whom we may share your personal information; and
- (iv) a copy of the personal information we hold about you.
(b) Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.
(c) Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.
(d) Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.
(e) Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
(f) Right to object. You have a right, in some circumstances, to object to any processing based on our legitimate interests. There may, however, be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case.

7.2 If you wish to exercise one of these rights, please contact us using the contact details at the end of this privacy policy. You may also review and edit the personal information you have submitted to us by logging into your account on our website.

7.3 You also have the right to lodge a complaint to your national data protection authority. Further information about how to contact your local data protection authority is available at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

7.4 Residents in other jurisdictions may have similar rights to the above. If you would like to exercise one of these rights, please contact us using the contact details at the end of this privacy policy. We will comply with any request to the extent required under applicable law.

8. Cookies and similar technologies

8.1 Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our website.

8.2 Cookies are pieces of code that allow for personalisation of our website experience by saving your information such as user ID and other preferences. A cookie is a small data file that we transfer to your computer's hard disk for record-keeping purposes.

8.3 We use the following types of cookies:

(a) Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.
(b) Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily. We may use third-party analytics tools such as Google Analytics, to help us measure traffic and usage trends for the Online Services and to understand more about the demographics of our users. You can learn more about Google's practices at http://www.google.com/policies/privacy/partners, and view its currently available opt-out options at https://tools.google.com/dlpage/gaoptout.
(c) Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

8.4 The table at Annex 3 sets out further details about the cookies which are most frequently used on our website.

8.5 The cookies we use are designed to help you get the most from the website but if you do not wish to receive cookies, most browsers allow you to change your cookie settings. Please note that if you choose to refuse cookies you may not be able to use the full functionality of our website. These settings will typically be found in the "options" or "preferences" menu of your browser. In order to understand these settings, the following links may be helpful, otherwise you should use the "Help" option in your browser for more details.

(a) Cookie settings in Edge
(b) Cookie settings in Firefox
(c) Cookie settings in Chrome
(d) Cookie settings in Safari web and iOS.

8.6 If you would like to find out more about cookies and other similar technologies, please visit www.allaboutcookies.org or the Network Advertising Initiative's online sources at www.networkadvertising.org.

9. Links to third party sites

Our Service may, from time to time, contain links to and from third party websites of our partner networks, advertisers, partner merchants, news publications, retailers and affiliates. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.

10. Changes to this policy

We may update this privacy policy from time to time and so you should review this policy periodically. When we change this privacy policy in a material way, we will update the "last modified" date at the top of this privacy policy. Changes to this privacy policy are effective when they are posted on this page.

11. Notice to you

If we need to provide you with information about something, whether for legal, marketing or other business related purposes, we will select what we believe is the best way to get in contact with you. We will usually do this through email or by placing a notice on our site. The fact that we may send notices to you will not stop you from being able to opt out of certain types of contact as described in this privacy policy.

12. Contacting us

Questions, comments and requests regarding this privacy policy are welcome and should be addressed to: legal@tutteo.com