Global Privacy and Data Protection Policy

1. Purpose, Acceptance and Territorial Scope

This Policy applies to any person who visits, uses, contracts, purchases, registers, communicates, participates, submits content or interacts with any official website, application, form, channel, social network, service, broadcast, product or project of the Fluye Ecosystem.

It has been drafted with special consideration for operations in the United States and Ecuador. It will also apply to users in other countries, without prejudice to mandatory rules that may apply based on their place of residence. When local law grants broader non-waivable rights, that law will prevail only to the mandatory extent.

2. Who We Are and Distribution of Responsibilities

"Fluye Ecosystem" is a collective name for the activities carried out under the legal entities Fluye Radio LLC and Fluye Radio S.A.S., as well as under the brands and divisions they control, operate, license or manage.

Fluye Radio Studios is the main public brand for creation, technology, development, production, consulting and client services. It should not automatically be interpreted as a separate legal entity unless expressly stated otherwise in the future.

Fluye Radio and FluyeRadio.com operate as communication, culture, entertainment and digital content distribution brands. Fluye News is the editorial and news project. Frequencies of the World is a music curation, production, discovery and promotion project.

The specific responsible entity will depend on factors such as the country, contract, invoice, project, payment provider, website used and nature of the service. The entities may act as independent controllers, joint controllers or processors, as applicable.

3. Definitions

• Personal data: information related to an identified or identifiable person.
• Processing: any operation performed on data, such as collecting, consulting, organizing, storing, disclosing, modifying, analyzing, publishing or deleting.
• Data subject: the person to whom the data relates.
• Controller: the entity that determines the purposes and means of processing.
• Processor or provider: a third party that processes data on behalf of an Ecosystem entity.
• Content: text, images, designs, music, recordings, mixes, videos, documents, messages, reviews, data, code and any material submitted or published.

4. Categories of Data We May Collect

• Name, alias, stage name, email, phone number, address, city, country and language.
• Business data, position, brand, social media, website, needs, budget and business communications.
• Account data, credentials, preferences and access logs.
• Orders, products, invoices, payments, refunds, deliveries and customer support.
• Technical data: IP address, browser, device, operating system, identifiers, logs, approximate location, pages, clicks, errors and performance.
• Data from forms, bookings, requests, surveys, promotions, contests and campaigns.
• Submitted content: music, masters, compositions, mixes, photographs, videos, voice, image, biographies, press kits, links, interviews and files.
• Editorial data obtained from public sources, authorities, press releases, testimonials, social networks and legitimately accessible records.
• Data from Fluye Radio Studios clients when necessary to develop, host, operate, analyze or support a project.

Through general forms, we do not request banking passwords, PINs, private keys, full card numbers or unnecessary sensitive documents.

5. Sources of Data

We receive data directly from the data subject; automatically through logs, cookies and similar technologies; from authorized clients, contractors and collaborators; from payment, hosting, security, analytics, logistics, social media, messaging and advertising providers; and from legitimate public sources when there is an editorial, contractual, verification or public interest purpose.

6. General Purposes

• Provide, operate, maintain, secure, adapt and improve services.
• Respond to inquiries, requests, bookings, orders, contracts and support needs.
• Produce, schedule, broadcast, publish, archive and promote content.
• Manage artists, DJs, creators, podcasts, interviews, events and collaborations.
• Perform design, branding, web, app, PWA, SEO, reputation, booking, CRM, content, analytics, automation, archive and technology services.
• Process purchases, billing, payments, deliveries, warranties and fraud prevention.
• Measure traffic, audience, performance, conversions and campaigns.
• Protect rights, investigate abuse, prevent incidents and comply with legal obligations.
• Create statistics, aggregated information, analytical models and internal improvements.

7. Legal Bases

Depending on applicable law, processing may be based on consent; performance of a contract or pre-contractual measures; compliance with legal obligations; protection of rights; legitimate interest; public interest or editorial activity; and other recognized bases.

When we rely on legitimate interest, we will seek to assess the necessity, proportionality and reasonable expectations of the data subject. When consent is required, it may be withdrawn without affecting prior processing.

8. Visitor Data and Technical Logs

Systems may generate security, availability and diagnostic logs. These logs help detect fraud, bots, attacks, misuse, errors, incompatibilities and service degradation. We may correlate technical events to investigate incidents, apply limits and protect infrastructure.

9. Cookies, Local Storage and Equivalent Technologies

We may use essential, functional, analytics, advertising and personalization cookies; pixels; tags; SDKs; browser storage; identifiers; and similar technologies.

Non-essential technologies will be activated in accordance with applicable controls or required consents. Users may manage preferences in the browser or in the available panel. Disabling essential technologies may prevent certain features from working.

10. Analytics, Advertising and Attribution

We may integrate tools from Google, Meta and other providers to measure usage, attribute campaigns, show ads, limit frequency, fight fraud and understand audiences.

We do not claim to sell personal data in exchange for money. However, certain laws may define some exchanges of identifiers as a "sale," "sharing" or targeted advertising. When applicable, opt-out mechanisms will be provided.

11. Third-Party Services and Infrastructure

The Ecosystem may use providers for hosting, CDN, attack protection, domains, email, forms, payments, databases, storage, social media, distribution, artificial intelligence, analytics, printing and logistics.

We do not disclose in this Policy internal configurations, detailed architecture, credentials, specific measures or information whose publication could reduce security. The use of providers may change without needing to modify every technical reference, provided the processing remains within the disclosed purposes.

12. Fluye Radio Studios and Client Projects

In services for businesses, Fluye Radio LLC or Fluye Radio S.A.S. may process data on behalf of the client. The client remains responsible for the legality of its bases, notices, authorizations, instructions and materials.

We may receive authorized access, contact databases, bookings, reviews, messages, files and operational data. They will be used only to perform the service, security, support, billing, compliance and improvements permitted by contract.

Specific obligations may be expanded through contracts, data protection addenda, work orders or documented instructions.

13. Digital Radio, Audio and Broadcasting

Digital audio and communication areas may process audience information, requests, messages, greetings, participation, programming and technical metadata. The availability of broadcasts, catalogs, episodes or signals may vary by territory, provider, applicable rights and operating conditions.

This Policy does not represent a public certification regarding specific permits, registrations, licenses or contractual relationships. The organization manages its operations and rights in accordance with obligations that may apply at any given time.

14. Frequencies of the World and Music

The project may include works and recordings created, commissioned, acquired or controlled by Ecosystem entities, as well as music voluntarily submitted by emerging artists, labels, producers, DJs, representatives and independent collaborators.

When receiving third-party materials, we may process stage name, biography, contacts, music files, cover art, images, videos, metadata, credits, territories, restrictions and authorizations. Receipt does not imply an obligation to publish, exclusivity, representation, hiring or payment.

Responsibility for rights and permissions related to submitted content primarily belongs to the sender under the representations, warranties and licenses established in the Terms and in any specific form or agreement.

15. Podcasts, Interviews, Guests and Events

We may record, edit, transcribe, translate, distribute, promote and archive participations when there is authorization, agreement or legal basis. This may include name, voice, image, biography, opinions and professional data.

Individuals should avoid disclosing sensitive third-party information. Participation by minors will require authorization when applicable.

16. Fluye News and Editorial Processing

Fluye News may use data from public sources, press releases, authorities, testimonials, social media and documentary material to report, contextualize, illustrate or archive matters of public interest.

Privacy rights may be subject to limits and exceptions compatible with freedom of expression, journalistic activity, archiving, research, public interest and defense of rights. Reasonable requests for correction, update or removal will be addressed when appropriate.

17. Artificial Intelligence and Automation

We may use artificial intelligence systems for assistance with writing, translation, transcription, classification, search, moderation, design, images, analysis, security, automation and support.

We do not publish details that compromise security, trade secrets, internal models or proprietary processes. We seek to apply proportional oversight, minimize data and avoid solely automated decisions with significant legal effects unless there is a legal basis and appropriate safeguards.

Users should not enter confidential, sensitive or third-party information into tools or forms without authorization.

18. Store, Payments, Billing and Logistics

We may process identity, contact, address, order, payment, tax, delivery, return and communication information. Cards are normally processed by specialized providers and are not stored in full by the Ecosystem.

We may share the minimum necessary information with processors, manufacturers, printers, carriers, commercial platforms, insurers and tax authorities.

19. Marketing and Communications

We may send necessary operational and legal communications. Promotional communications will be sent on the required basis and may be canceled through the available mechanism. Opting out of marketing does not prevent essential messages about orders, security, projects or contracts.

20. Public Content and Social Media

When a person posts, tags, comments, submits or authorizes content in public spaces, certain data may be visible, shared or indexed. Do not post information you wish to keep private.

Interactions on external platforms are also subject to the policies of those platforms.

21. Minors

The Ecosystem is directed to a general audience. We do not intentionally collect data from children under 13 in the United States without verifiable parental consent when COPPA applies, nor data from minors in Ecuador or other countries without the required authorizations.

If we learn that data from a minor was submitted without a valid basis, we may delete it, restrict it or request verification.

22. Sensitive Categories

We will process sensitive categories only when necessary, proportional, permitted and accompanied by safeguards. We ask that medical, biometric, financial or immigration data, sexual orientation, religion, passwords or complete documents not be submitted through general channels.

23. Disclosure of Data

We may disclose data to providers; related entities; clients when acting on their behalf; collaborators in a production; advisors; insurers; business acquirers; authorities; courts; and third parties necessary to protect rights or perform services.

We will not share more information than is reasonably necessary for the corresponding purpose.

24. International Transfers

Data may be processed in the United States, Ecuador and other countries where entities or providers operate. We will apply reasonable mechanisms and, when legally required, clauses, assessments, safeguards, consents or other valid instruments for international transfers.

25. Retention

We retain data for the time necessary for contracts, support, security, archiving, exercise of rights, tax obligations, fraud prevention, business continuity and legal defense.

Retention periods vary depending on the type of data. Business and tax records may be retained in accordance with legal periods. Published or licensed content may be retained while there is a legitimate editorial, historical, contractual or archival purpose.

26. Security

We apply reasonable administrative, technical and organizational measures appropriate to the risk. These may include access controls, authentication, encryption in transit, backups, logs, segmentation, updates, provider review and incident response.

No system is invulnerable. We do not guarantee absolute security. If an incident subject to notification occurs, we will act in accordance with applicable laws.

27. Rights of Data Subjects

Depending on the jurisdiction, the data subject may request information, access, rectification, update, deletion, objection, restriction, portability, withdrawal of consent, review of automated decisions and opt-out of certain advertising uses.

Requests should be sent to info@fluyeradio.com with the subject line "Privacy Request," indicating country or state, the right requested and sufficient information to verify identity.

We may reject or limit requests when there is a legal obligation, editorial exception, defense of rights, inability to verify, impact on third parties or a manifestly unfounded or excessive nature.

28. Special Rights of United States Residents

When a state privacy law applies, required information and mechanisms will be provided regarding categories collected, purposes, recipients, access, correction, deletion, portability, appeal, targeted advertising and uses defined as sale or sharing.

We will not unlawfully discriminate for exercising rights. Rights vary by state and are subject to exceptions.

29. Rights in Ecuador

When Ecuador's Organic Law on Personal Data Protection and its regulations apply, data subjects may exercise the rights recognized by that law, including access, rectification and updating, deletion, objection, suspension, portability and other applicable rights.

Processing will observe principles such as lawfulness, fairness, transparency, purpose limitation, relevance, minimization, proportionality, confidentiality, security and proactive responsibility.

30. EEA, United Kingdom and Other Jurisdictions

When the GDPR, UK GDPR or other equivalent regulations apply, the required legal bases, safeguards, rights and complaint mechanisms will be provided. The data subject may contact the competent authority without prejudice to contacting us first.

31. Privacy Signals and Preferences

We will honor legally recognized preference signals when applicable and technically interpretable. The traditional "Do Not Track" signal does not have a universal standard.

32. Incidents and Authority Requests

We may investigate, preserve and disclose information when reasonably necessary to respond to fraud, attacks, threats, claims, judicial proceedings or valid orders.

We will evaluate the legality and scope of government requests and seek to limit disclosure to what is required.

33. Corporate Changes

In a merger, acquisition, restructuring, financing, asset transfer or succession, data may be part of the transaction, subject to this Policy, applicable notices and legal safeguards.

34. Changes to This Policy

We may update the Policy due to legal, technological, business or Ecosystem changes. The current version will be identified by its date. When a change requires special notice or new consent, it will be provided in accordance with the law.

35. Contact and Exercise of Rights

Entities: Fluye Radio LLC (United States) and Fluye Radio S.A.S. (Ecuador), as applicable.

Main operating brand: Fluye Radio Studios.

Email: info@fluyeradio.com

Website: https://www.fluyeradio.com/

Registered addresses, tax identifications and complete contractual data may appear in contracts, invoices, corporate records, local notices or communications required by law.