Privacy Policy

Last Updated: January 19, 2026

1. Introduction

Pipeline Media ("we," "our," or "us") respects your privacy and is committed to protecting your personal data in compliance with applicable data protection laws, including the EU General Data Protection Regulation (EU GDPR), the UK General Data Protection Regulation (UK GDPR, as amended by the Data (Use and Access) Act 2025), the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and other relevant laws.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.pipeline.media (the "Website"), sign up for our waiting list, or otherwise interact with us in connection with our services (collectively, the "Service").

This policy focuses primarily on the collection of information through our waiting list sign-up form. It applies to individuals (such as company representatives) providing information on behalf of music companies or other businesses. This is an initial version; as we launch additional platform features, we may update or supplement this policy.

We act as the data controller for the personal information we collect (under GDPR/UK GDPR terms) or the business collecting personal information (under CCPA/CPRA terms).

2. Information We Collect

We collect the following categories of personal information:

• Contact and Identification Information: Your name, business email address (and phone number, if later provided voluntarily).

• Company-Related Information: The name of your company and details regarding membership in the collective licensing organization "Merlin" (including membership number, if provided). Note: Merlin membership details may constitute personal information if they relate to or can identify you as an individual.

• Technical and Usage Information (automatically collected): IP address, browser type, operating system, device information, access times, pages viewed, and referral sources (via server logs and cookies/tracking technologies).

We do not intentionally collect sensitive personal information (e.g., racial/ethnic origin, health data) or information about children under 13 (or 16 in some jurisdictions).

3. How We Use Your Information (Purposes and Lawful Bases)

We use your personal information for the following purposes:

• To operate and maintain the Website and manage the waiting list (including responding to your sign-up and providing initial follow-up).

• To evaluate your company's potential eligibility for our capital advance services (pre-contractual assessment).

• To communicate with you regarding administrative matters (e.g., updates to this policy or our terms) or in response to inquiries.

• To send you marketing communications, updates, and "mail blasts" about Pipeline's services (only with your consent).

• To analyze Website usage trends, improve our services, and ensure security (analytics).

Lawful Bases for Processing (primarily under EU/UK GDPR):

• Legitimate interests (Art. 6(1)(f) GDPR/UK GDPR): For responding to your sign-up, Website operations, basic analytics, security, and pre-contractual evaluation/due diligence. We have conducted a legitimate interests assessment and believe our interests are not overridden by your rights.

• Consent (Art. 6(1)(a) GDPR/UK GDPR): For sending marketing communications. You provide this explicitly (via a checkbox on the sign-up form: "I consent to receiving marketing updates about Pipeline's services"). Consent is freely given, specific, informed, and easy to withdraw at any time (e.g., via unsubscribe link or contacting us).

• Compliance with legal obligations (where applicable).

Under CCPA/CPRA, we process for business purposes (e.g., providing the Service, improving it) and may rely on consent where required.

You can object to processing based on legitimate interests (including direct marketing in some cases) or withdraw consent at any time — see Section 7.

4. Sharing and Disclosure of Your Information

We do not sell your personal information (as defined under CCPA/CPRA) and have not done so in the past 12 months.

We may share personal information in the following circumstances or with the following partners:

• Service providers/processors: Third-party vendors (e.g., email service providers, website hosting, analytics tools) who assist us. They are contractually bound to protect data and use it only for our purposes.

• Legal requirements: If required by law, court order, or to protect our rights, safety, or property (or that of others).

• Business transfers: In connection with a merger, acquisition, sale of assets, or similar transaction.

5. International Data Transfers

As a company with offices in the US, we may transfer personal information outside the UK, EU/EEA (including to the United States).

For transfers from the EU/EEA: We rely on the EU-U.S. Data Privacy Framework (“DPF”) where applicable (we participate/self-certify if using it for relevant transfers), or EU Standard Contractual Clauses (SCCs 2021) with supplementary measures as needed.

For transfers from the UK: We rely on the UK Extension to the EU-U.S. DPF (where applicable) or UK-approved mechanisms (e.g., International Data Transfer Addendum to SCCs).

We implement appropriate safeguards to ensure an adequate level of protection.

6. Cookies and Tracking Technologies

We use cookies, web beacons, and similar technologies for essential functions, analytics, and (with consent) marketing.

For non-essential cookies: We obtain consent via a cookie banner (in compliance with UK GDPR/PECR, as amended by DUAA 2025, and EU GDPR). You can manage preferences through the banner or your browser settings. Disabling cookies may affect certain features of the Service or limit Website functionality.

7. Your Data Privacy Rights

Your rights depend on your location:

For individuals in the UK/EU/EEA (GDPR/UK GDPR), your rights include the right to:

• Access your data and receive a copy.

• Rectify inaccurate or incomplete data.

• Erase data (right to be forgotten) in certain circumstances.

• Restrict processing.

• Object to processing (especially for marketing based on legitimate interests).

• Data portability.

• Withdraw consent (where processing is based on consent).

• Not be subject to solely automated decisions with legal/significant effects (we do not currently use such technologies).

For California residents (CCPA/CPRA), your rights include the right to: :

• Know/access the personal information we collect/use/share.

• Delete personal information.

• Correct inaccurate information.

• Opt-out of sale/sharing (we do not sell/share for cross-context behavioral advertising).

• Limit use/disclosure of sensitive personal information (we do not collect/use sensitive PI).

• Non-discrimination for exercising rights.

How to Exercise Your Rights: Email us at privacy@pipeline.media with your request. We may verify your identity (e.g., via email confirmation). We will respond within the applicable statutory timelines (i.e., 1 month for GDPR/UK GDPR and 45 days for CCPA/CPRA, extendable if needed).

You may also complain to your supervisory authority (e.g., ICO in the UK, relevant EU DPA, or California Privacy Protection Agency/Attorney General).

For marketing communications opt-out: Every marketing email includes an unsubscribe link. You can also contact us directly.

8. Data Security

We use administrative, technical, and physical security measures to help protect your personal information. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure.

9. Data Retention

We will only keep your personal information for as long as it is necessary for the purposes outlined (e.g., waiting list data is typically retained until you opt out, request deletion, or we determine it is no longer needed for follow-up, subject to a maximum of 3 years unless required longer by law). After that, we securely delete or anonymize it.  Information for marketing purposes is retained until you request deletion or unsubscribe.

10. Children’s Privacy

Our Service is not intended for children under 13 (or under 16 in certain jurisdictions). We do not knowingly collect personal information from children. If we learn we have collected such data, we will delete it immediately.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted here with an updated "Last Updated" date. You are encouraged to review this page periodically.  For material changes (especially affecting consent/marketing), we may notify you by email or prominent notice on the Website.

12. Contact Us

If you have questions or comments about this Privacy Policy, wish to exercise your rights, or need more information please contact us at privacy@pipeline.media or at our office addresses:  UK - 162 Buckingham Palace Road, London, SW1W 9TR, United Kingdom; US - 1370 North Saint Andrews Place, Los Angeles, CA 90028, United States.