Yousician

Research Privacy Notice

Last edited 8 March 2023

This Research Privacy Notice (the “Notice”) explains how Yousician Ltd. and its subsidiaries (“we”, “us” or “our” in this Notice) collects, stores, uses or otherwise processes the personal data of people who participate in, or may potentially participate in, our voluntary user research-related activities (“you” or “your” in this Notice), as well as your rights and our responsibilities with respect to your personal data.

Please read this Notice before participating in our user research studies, surveys, interviews, product testing or other user research-related activities (collectively, “Research Activity(ies)”) so that you understand how and why we may process your personal data.

This Notice covers Research Activities which we conduct outside of our services (such as our online music learning and instrument tuning applications) (“Services” in this Notice) and supplements the information contained in our Privacy Notice, which provides additional and more comprehensive information about how and why we collect and process your personal data in relation to our Services. If we conduct surveys or other research-related activities inside our Services, those activities shall be subject to our Privacy Notice.

1. CONTACT US

If you have any questions about this Notice or the ways in which we use your data, please contact us at privacy@yousician.com.

For the activities described in this Notice, the data controller (i.e. the entity that determines how and why personal data is processed) is Yousician Ltd. Our address is Siltasaarenkatu 16, 00530 Helsinki, Finland.

In some circumstances, we may utilise a third party in order to facilitate the Research Activities (for example, a video communication service) or to carry out activities which support our Research Activities (for example, a user research recruitment service or insights platforms). These third parties may act as the data controller of the data they collect about you and can determine how and why they process your data. We recommend that you review such third party’s own privacy policies for more information.

2. WHAT PERSONAL DATA WE COLLECT AND WHERE WE GET THE DATA

In connection with our Research Activities, we may process the following data relating to you:

Personal data that you provide to us:

  • contact information, such as your name, phone number, email address or other contact information that we may use to communicate with you about the Research Activities, if you have provided them to us (for example, if you voluntarily participate in a survey);
  • your background information, such as your age, gender, country of residence or other background information;
  • your communications with us, such as emails we may exchange with you regarding the Research Activities;
  • if you participate in Research Activities that are recorded, video, audio or written transcript recordings of your participation in our Research Activities, such as your interactions with or reaction to our Services, your communications, comments or feedback you may provide to us, as well as written notes relating to the aforesaid;
  • if you engage with our Services, your profile information, user ID or other online identifier, as well as data about your use of the Services (for example, features used, songs played, levels, and session length);
  • any other information which you may provide to us during the course of the Research Activities, including any comments, feedback, answers or responses (for example, to our surveys or questionnaires); and
  • with your consent, other information which is explained to you prior to your participation in the Research Activities.

Personal data we receive from third parties:

  • if you have been referred to us by a third party (for example, a user research recruitment service), your contact details, such as your name, email address, and phone number, and your background information, such as your age, gender, or other background information.

We do not intend to collect or process any data relating to you which may be considered special categories of data, such as data revealing racial or ethnic origin, religious or philosophical beliefs or trade union membership, genetic, biometric or health information, or data concerning a person’s sex life or sexual orientation.  Please do not provide this type of information to us in connection with the Research Activities.

3. WHY WE PROCESS YOUR PERSONAL DATA

With your consent, we may process your personal data:

  • to undertake Research Activities, such as surveys, studies, product testing, interviews, or other research related to our Services;
  • to obtain insights into the profile, preferences, experiences, views and opinions of people who use our Services, such as our users’ learning needs, playing habits, motivations or interests;
  • to develop or improve our current or future Services, or the Research Activities themselves;
  • to send you communications about participating in our future Research Activities, if you have informed us of your interest in doing so;
  • to communicate with you about our Research Activities; or
  • for other purposes explained to you when we ask for your consent.

Based on our legitimate interest to find participants for our Research Activities, we may process your personal data to determine your interest in participating in our Research Activities and to ask whether you wish to participate in a specific Research Activity. Based on our legitimate interest to understand our users as a whole, we may process your data to create data that is not identifiable to you (for example, aggregate data), which we may then freely use for our Research Activities.

We also may process your data as necessary to:

  • comply with legal obligations which we consider to apply to us (including cooperating with authorities upon due request and for accounting and tax requirements);
  • to establish, exercise, or defend our legal rights based on our legitimate interest to safeguard our operations; or
  • as necessary to protect your vital interests or the vital interests of another person.

We may also process your data for additional purposes compatible with any of the purposes listed above. We do not use your personal data to make any automated decisions (meaning decisions without any human involvement) which significantly affect you.

4. WHO CAN SEE YOUR DATA

Your data may be shared with third parties in order to achieve the purposes described in this Notice. Accordingly, we may share your data with the following types of recipients:

Yousician companies – Other companies belonging to the Yousician group of companies, for example, to help us to develop or operate our Services to which the Research Activities relate.

Service providers working for us – Persons or companies outside of the Yousician group that process personal data on our behalf and according to our instructions and control. These service providers include, for example, providers of hosting services, communications services, user insights platforms and other services.

Public authorities and other entities.

  • Competent law enforcement bodies or courts of law where we find it necessary as a matter of applicable law or regulation;
  • Potential or actual buyers or their advisors in connection with a planned or actual corporate acquisition or other business restructuring or a similar arrangement; or
  • To any person or entity where we find disclosure necessary to combat fraud or illegal activity, or to exercise or defend our legal rights or to protect your vital interests or those of any other person.

With your consent, we may also share your data with any other third parties.

5. INTERNATIONAL DATA TRANSFERS

In connection with the processing activities described in this Notice, your data may be transferred to and processed in countries outside of the European Union (“EU”) and the European Economic Area (“EEA”). For example, our subsidiaries and some of the servers we use to host our data are located in the United States. We also use third party service providers that are located outside the EU and the EEA to provide services for us. Since these countries may have different data protection laws than your own country, we take steps to ensure that there are adequate safeguards in place to protect your personal data.  These safeguards may include having standard contractual clauses approved by the EU Commission in place or other lawful safeguards.

6. DATA RETENTION

We retain your data for as long as is necessary to achieve the purpose(s) for which it was collected. In any case, we will retain your Research Activity data for a period not to exceed four years from the date upon which it was first collected. After this period of time, we will either permanently delete or anonymise your data or, if neither deletion or anonymisation is possible, isolate your data from further processing until deletion or anonymisation is possible. We may keep and continue to use data that is no longer identifiable to you (for example, aggregate data).

7. YOUR RIGHTS

In connection with the processing of your data, you have the right to:

  • access the personal data that we hold about you;
  • correct or update the personal data we hold about you;
  • request that we erase the personal data we hold about you;
  • demand the restriction of our processing of your personal data in accordance with the legal requirements;
  • where technically feasible, request a copy of the personal data you have provided to us in machine-readable format; or
  • object to our processing of your personal data to the extent our processing is based on our legitimate interests or the legitimate interests of a third party.

Any consent that you might have provided to us can be withdrawn at any moment.

If you wish to exercise any of the rights mentioned above, please email us a privacy@yousician.com. If you have any complaints about our handling of your personal data or want to know about something specific in this regard, please contact us at the aforementioned address. We take these matters seriously and will look into all requests and complaints. Finally, you always have the right to lodge a complaint with the local data protection authority (for example, the Office of the Data Protection Ombudsman in Finland).

8. HOW DO WE KEEP YOUR DATA SECURE

We use appropriate technical and organisational measures designed to protect your data. The measures we employ are designed to provide a level of security appropriate to the risk of processing your personal data and we continuously develop them. Our measures vary, but typically include controls to limit access to services or systems that contain personal data, pseudonymisation, databases protected by firewalls, passwords and other technical measures.

9. AGE MATTERS

Where we process your personal data based on consent and you are unable to give consent due to being under the minimum legal age or for other reasons, as determined by the applicable laws and regulations, we will ask for your parent’s or legal guardian’s consent.

10. CHANGES

We may update this Notice from time to time by posting a new version of this Notice on yousician.com.