Data protection
The GDPR and your label: who does what
Your artists' names, addresses, IBANs and contracts are personal data. Here is what the European regulation asks of you, what Labelmate does for you, and what stays in your hands.
This page is for information only; it is not legal advice.
The regulation
The GDPR in brief
The GDPR, or General Data Protection Regulation, is Regulation (EU) 2016/679. Adopted on 27 April 2016, it has applied since 25 May 2018. It is a regulation, not a directive: it applies directly in every EU country, in France as in Belgium, where Labelmate is published.
It protects natural persons, meaning human beings, with regard to the processing of their personal data. Personal data is "any information relating to an identified or identifiable natural person" (Article 4): a name, an address, an account number, an email. And processing is almost anything you can do with it: collecting, recording, organising, consulting, passing on or erasing it.
In France, the CNIL oversees how it is applied. The full text is on EUR-Lex, the official site for EU law, and in French on the CNIL's website.
Why you
A label processes personal data every day
Paying an artist means handling their data: their name, their address, their IBAN, their contract, their statements, the emails exchanged with them or their manager. As soon as a label keeps this information, in a spreadsheet, an inbox or a binder, it is processing it in the GDPR's sense.
Your artists aren't the only ones concerned. Featured artists, producers, managers, lawyers, your contacts at the distributor: anyone named in a contract or an email is too.
The GDPR doesn't forbid any of this. It asks you to process this data for specific purposes, to keep only what you need and for no longer than necessary, to protect it, and to be able to answer the people who ask you about it.
- Your artists' and their contacts' identity and contact details
- Bank details, to pay them
- Contracts, advances, amounts and statements
- Emails and documents exchanged
‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data […]
The roles
Who is responsible for what
The GDPR distinguishes whoever decides, the controller, from whoever acts on their behalf, the processor. With Labelmate, the roles are shared out like this.
Your label decides
For your artists' and contacts' data, your label is the controller: it decides why it processes the data, what it keeps and for how long. Our terms say so, and the label must be entitled to process this data.
Labelmate acts for you
Where the label's data passes through our services, Labelmate acts on its behalf, as a processor (Article 28). A data processing agreement sets out what we do and within which limits; it forms part of our terms and applies as soon as the label uses Labelmate.
Two sub-processors
We use two providers ourselves. Supabase hosts our relay, the service that keeps a label's computers in sync, in the European Union (Ireland); Anthropic reads documents in the United States, if the label turns the AI on. We tell the label at least thirty days before adding or replacing one; if it objects on reasonable grounds, it can end the service.
For our own needs
When you apply for early access or write to us, Labelmate is the controller of that data. Our privacy policy says which data, why, and how long we keep it.
What Labelmate does
Your label's data stays on your computers
Labelmate is a desktop app for Mac and Windows, not a website. The emails it reads, the contracts, invoices and reports it files, the statements it prepares: everything is stored in an encrypted database on the label's computers. Its key is kept in the system's secure keychain, the protected place where Mac and Windows keep secrets. We have access to none of it.
The mailbox is read-only: Labelmate moves and deletes nothing in it, and its password is never sent to us.
When several of the label's computers work together, every change is sealed before it leaves: encrypted on the computer, with keys that never leave it. Our relay in Ireland only carries these sealed copies, which we cannot read. To work, it still sees this:
- The technical identifiers of the label's workspace and computers, and their public keys, which are made to be shown
- The size and date of the sealed copies
- The IP address of requests
The AI
The AI reads nothing until you turn it on
Reading documents with the AI is optional, and stays off until the label turns it on. Once it is on, the app sends the text of a document, a contract or an invoice, to Claude, Anthropic's AI model, which proposes the values to use: a rate, an advance, an amount.
Before sending, IBANs, card numbers and social security numbers are masked. Neither the file nor the mailbox is sent, but the text may contain names and amounts. The app calls Anthropic directly, with Labelmate's access key: the text does not go through our servers.
Anthropic processes this text in the United States, as our sub-processor, and its commercial terms rule out using this data to train its models. This transfer outside the European Economic Area relies on a mechanism the GDPR recognises: a European Commission adequacy decision, which finds that protection is adequate, or the Commission's Standard Contractual Clauses, model contracts it has adopted.
- Can be turned off at any time, in Settings
- Every value quotes the passage it came from
- Nothing is saved until a person at the label accepts it
- A monthly cap limits what it reads
Example
The journey of a contract received by email
A contract arrives in the label's mailbox. Here is where it sits at each step, and who can read it.
| Step | Where it is | Who can read it |
|---|---|---|
| It arrives by email | In the label's mailbox, at your email provider | Whoever already had access to the mailbox; Labelmate reads it without changing anything |
| Labelmate files it | In the encrypted database, on the label's computer | The label, on its computers |
| The AI reads it, if you turned it on | Its text goes to Anthropic, with IBANs and sensitive numbers masked | Anthropic, for the time of the reading, then under its terms |
| A colleague opens it on their computer | It travels as a sealed copy, through our relay in Ireland | The label's computers; the relay cannot open it |
| The label makes a backup | An encrypted file, in your Documents folder | The label: the backup stays with you |
An example: if the AI stays off, step 3 never happens.
What stays in your hands
On what basis do you process your artists' data?
That is for the label to determine. Article 6 of the GDPR provides six legal bases, the grounds that make processing lawful: consent is only one of them, alongside, for example, performing a contract or complying with a legal obligation. Labelmate doesn't choose for you; an adviser can help.
Do you have to inform your artists?
The GDPR asks the controller to inform the people whose data it processes: who it is, why and on what basis it processes their data, and who receives it (Articles 13 and 14). Our pages describe exactly what Labelmate and its sub-processors do with it, should you need to explain.
An artist asks to see their data. Who answers?
The label: the data is on its computers, and we have no access to it. The GDPR provides for an answer within one month, which can be extended by two further months given the complexity and number of requests (Article 12). In the data processing agreement, we commit to helping you answer.
Do you need to keep a record?
Article 30 asks every controller to keep a record of its processing activities, with exceptions set out in the same article. If you keep one, our data processing agreement describes what Labelmate processes for you, where, and for how long.
What about the security of your computers?
Labelmate encrypts the label's database on every computer, but the computers remain yours: who uses them, their passwords, their updates. Keep your backups somewhere safe too: if the label loses all its computers and the means to restore its backups, nobody, not even us, can recover its data.
Our commitments
What Labelmate commits to
The data processing agreement puts our commitments in writing. Here is what matters most.
Helping you, and letting you check
We help the label answer requests from its artists and contacts, carry out an impact assessment (a study of the risks a processing poses to people) where one is needed, and meet its security obligations. Once a year, it can check that we keep these commitments.
Keeping little, not for long
Sealed copies stay on the relay while the label uses Labelmate, then are deleted no later than one month after it asks. Its data stays on its computers: there is nothing to retrieve from us.
Telling you fast
If we become aware of a personal data breach affecting the label, such as a loss, a leak or unauthorised access, we tell it without undue delay and no later than 48 hours after becoming aware of it. The GDPR then asks the label to notify the competent supervisory authority (in France, the CNIL) without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to people's rights and freedoms (Article 33).
Saying what's missing
Our Security page also says what we don't have yet: no penetration test by an outside firm, no SOC 2 or ISO 27001 certification. You judge the rest knowing the gaps.
Sources
- Regulation (EU) 2016/679, the GDPR, on EUR-Lex
- CNIL: the General Data Protection Regulation (in French)
- Privacy policy, sections 2 to 4: what stays with the label, the relay, the AI
- Data processing agreement: commitments, sub-processors, breaches, audits
- Security, section 8: what we don't have yet
- Terms of use, sections 3 and 4: your keys, the label's data
Read next
All resources
The lawRoyalty statements in the US
What record contracts usually ask, and California's audit law.
Read
The lawArticle L. 212-15, explained
What French law asks of labels: account for the calculation every six months, explicitly and transparently, and give the supporting documents to the artist's accountant.
Read
MethodAdvances and recoupment
How an advance and costs are recouped from an artist's royalties, statement after statement, with a worked example.
Read
Your next statements, without spreadsheets.
Free early access for 10 independent labels.
Photos Daniel Trylski, RDNE Stock project, Cup of Couple, Khwanchai Phanthong on Pexels.