Privacy notice

Last updated 10 October 2026.

Register holder

Nettiteeri Oy (3331525-2)
rauhanmusiikki(ät)rauhanmusiikki.fi
Viereläntie 4 A, 90630 Oulu

Contact person in matters concerning the register

Juha-Pekka Teirikangas
rauhanmusiikki(ät)rauhanmusiikki.fi

Name of the register

Rauhanmusiikki customer and producer register

Purpose and legal basis of processing

Personal data is processed to manage the customer relationship and subscription, to provide the service, to fulfil rights and obligations, to develop the service and produce statistics, and to prevent misuse.

Legal bases for processing:
- Managing the account and subscription: performance of a contract (GDPR Art. 6(1)(b)).
- Accounting and retention of payment transactions: legal obligation (Art. 6(1)(c)).
- Service development, statistics and fraud prevention: the controller's legitimate interest (Art. 6(1)(f)).

Name, email address, password and the information needed for payment are required to enter into the contract; without them an account or subscription cannot be created.

Register information

Common
- Customer's or producer's name
- Email address
- Crypted password
- Language
- Country
- IP address
- Partial credit card number (e.g. 492057******1234)
- Credit card validity time
- Credit card issuer name
- Order details and history
- Gift card details: name, amount, code and dates
- Track-specific listening statistics
- PDF note purchases
- Google Play subscription details
- Playlists
- Sessions
- Date the information was created
- Date the information was modified

Producer
- Image
- Description
- Homepage address
- IBAN bank account number
- Payment reference number
- Producer payment details: sum, date and status
- Album details: name, images and description

Paytrail collects the IP address, payment method and payment date in connection with the payment transaction.

Register sources

User inputs the information when registering into the service. Order and usage details are collected when the user uses the service. Producer information is collected based on the contract from them or from their publications. Where a producer's personal data is collected from a source other than the producer themselves, the data subject is provided with the information required by GDPR Article 14 within a reasonable period, at the latest within one month. A producer's prepayment register status is checked with their business ID from the open YTJ interface of the Finnish Patent and Registration Office.

Recipients, processors and disclosure of data

Personal data may be disclosed to a competent authority based on a lawful request, and in connection with a business acquisition.

The service uses the following recipients and processors of personal data (the data sent to them in brackets):
- Payment intermediation: Nets Oy / Netaxept (card payments and recurring card charges for the subscription) or Paytrail Oyj (online payments), depending on the service's payment method (name, email address, customer number and the amount). Card details are entered directly on the payment provider's page.
- Email delivery: Mailgun (EU region) (the recipient's email address and the message).
- Verification of in-app purchases: Google (Google Play) and Apple (App Store) (the store's purchase token or receipt).

Processors handle personal data on behalf of the controller under a data processing agreement, not for their own purposes.

Some processors may process personal data outside the European Economic Area (EEA). In that case the transfer is based on the European Commission's Standard Contractual Clauses (SCC). A copy of the database backup, encrypted on the server, is transferred to the registrar's Dropbox account (Dropbox Inc., United States); Dropbox has no encryption key and no access to the backups' contents, and the transfer to the United States is based on the EU–US Data Privacy Framework. Further information on the safeguards is available from the controller.

Data retention time

Data is stored in the service for as long as the customer relationship is in force or until the user deletes their account. The account can be deleted with a button in the profile view.

Logs (the service's logs, which may contain an IP address, browser identifier and user ID) are kept for a year, after which they are deleted automatically. Visitor statistics compiled from the logs are kept, but the IP addresses in them are anonymised after 90 days. Individual listening events are deleted after three years at the latest; until then they are used to produce recommendations and statistics.

The database is backed up daily and the backups are kept on the server. In addition, each backup is encrypted on the server and the encrypted copy is transferred to the registrar's Dropbox account (Dropbox Inc., United States). Dropbox has no encryption key and no access to the backups' contents. The transfer to the United States is based on the EU–US Data Privacy Framework. Backups are kept for at most 12 months, so data deleted from the service may remain in the backups for that time.

Payment transactions are kept for the period required by accounting law. Logs of purchase and payment processing (in-app purchase requests and the payment provider's responses) are accounting records: they are kept, as the Finnish Accounting Act requires, for six years from the end of the year in which the financial year ended, and deleted automatically after that.

Data security

The register is located in a server secured by a firewall, passwords and other commonly accepted security measures and can only be accessed by people working for the registrar. Contracts and their digital copies are also protected: physical copies behind locked doors and digital copies protected by a password.

Data subject's rights

The data subject has the right to access their data, rectify inaccurate data, erase their data ("be forgotten"), restrict and object to processing, and to data portability. Where processing is based on consent, the data subject has the right to withdraw consent at any time. Requests are addressed to the controller and answered within the period required by law.

The data subject has the right to lodge a complaint with the supervisory authority. In Finland the supervisory authority is the Data Protection Ombudsman (tietosuoja.fi).

The service does not carry out decisions based solely on automated processing that significantly affect the data subject within the meaning of GDPR Article 22.

Use of cookies on the site

The site uses only strictly necessary first-party cookies, for example to enable login and maintain the session (including the session cookie, XSRF protection, cookie acceptance, listening history and browser-support check). The service does not use third-party analytics or tracking tools and does not profile users for advertising.