Data protection terms for organisations

Effective 30 Oct 2026

These terms are part of our agreement with organisations that use Premium Business or Spaces (see our Business terms). They explain who is responsible for which personal data, and what you and Lodo, s. r. o. ("we") each promise. Words like "controller", "processor" and "personal data" have the meaning they have in the EU General Data Protection Regulation (GDPR).

1. The short version

• You and we are separate controllers. We don't process personal data on your behalf.
• You decide whom to invite. We run the accounts, the app and the statistics, for our own purposes, as described in our Privacy policy.
• You never get data about what an individual listens to. You get the people list of your licence and totals for groups of at least 5 people.
• Spaces screens don't process any data about the people in your venue.
• If an authority or court ever decides that we act as your processor for some of this, section 8 applies.

2. Why we are separate controllers

Under the GDPR, whoever decides why and how personal data is processed is a controller. Each person in your licence has their own Noiserun account. We decide how accounts, sign-in, the Library, usage statistics and the technical log work, and we use them for our own purposes: to provide Noiserun to that person, to keep it secure and to improve it. The person keeps their account, Library and purchases when they leave you. You can't see or change what they do in Noiserun.

You decide whether to offer Noiserun, whom to invite, whether people with your e-mail domain may join, and what to do with the people list and totals you see. These are your own purposes, for example running an employee benefit.

So neither of us processes personal data on the other's instructions, and we don't need a processing agreement under Article 28 GDPR for the normal use of Noiserun.

3. Who is responsible for what

4. What we promise

• We never give you, or anyone else, data about what an individual listens to, when, or for how long. We refuse any request for it.
• Totals are shown only when they cover at least 5 people. Listening totals include only people who chose to link their statistics to their account.
• We use the e-mail addresses you share only to invite people, give them access and manage your licence. We don't send them marketing.
• We don't sell personal data and don't use it for advertising.
• We keep the data on our server in the European Union. The only exception is that copies of e-mails sent to us are forwarded to our Gmail inbox (Google LLC, under the EU–US Data Privacy Framework).
• We protect the data with appropriate technical and organisational measures: encrypted connections, keyed hashes instead of raw IP addresses and sign-in keys, two-factor sign-in and role-based access for our team, and a log of every support view of personal data.
• Only people in our team who need it can see personal data, and they are bound to keep it confidential.
• If a security incident affects personal data of your people that you shared with us, we tell you without undue delay, so you can inform them if needed. We also meet our own duties towards the authority and the people affected.
• We keep the people list of your licence, including invitations and people who left, while the licence runs. After it ends, we keep it only as long as we need it for the contract, accounting or a legal claim, and then delete it. A person's own account stays theirs, as described in our Privacy policy.

5. What we ask from you

• Share only e-mail addresses that you are allowed to share for this purpose, for example under your legitimate interest in offering an employee benefit.
• Tell your people, before you invite them, that you are offering Noiserun, what you will see and what you won't. You can use the text in section 9.
• If you turn on joining by e-mail domain, tell your people that signing in to Noiserun with a work address adds them to your licence.
• Make joining voluntary. Don't require people to use Noiserun or link their statistics, and don't use the totals to judge anyone's work.
• Don't try to find out what an individual listens to, for example by comparing totals before and after someone joins or leaves.
• Keep your admins' access secure, and remove admins who no longer need it.

6. Requests from people

Each of us answers requests about the data we control. If a person asks you about their Noiserun account, please send them to privacy [at] noiserun.com. If someone asks us about your decisions as their organisation, we send them to you. We help each other where needed.

7. Spaces

Spaces screens show scenes in public places. Noiserun doesn't use cameras, microphones or location, and doesn't record anything about the people who see or hear the screens. We process only technical data about the screens (pairing, what plays, whether they are online, how smoothly they play) and the accounts of your managers. Our web server logs the IP address of each screen for at most 5 weeks, for security.

8. If we are ever treated as your processor

If a supervisory authority or court decides that we process some personal data on your behalf, then for that data only:

1. we process it only on your documented instructions, which are these terms and your settings in Noiserun, unless the law requires otherwise; we tell you if we think an instruction breaks the law,
2. people who process it for us are bound to confidentiality,
3. we keep it secure as described in section 4,
4. we use only the sub-processors listed below and tell you at least 30 days before adding or replacing one, so you can object; each is bound by the same data protection duties,
5. we help you answer requests from people, as far as we can,
6. we help you with security, breach notifications, impact assessments and prior consultation, taking into account the information we have,
7. when the processing ends, we delete the data or return it to you, unless the law requires us to keep it,
8. we give you the information you need to show that these duties are met, and allow and contribute to audits, by you or an auditor you appoint, with reasonable notice and at your cost.

Sub-processors

9. Text you can give your people

We're giving you Noiserun Premium. You'll get an invitation e-mail from Noiserun. If you join, you sign in with your work e-mail and get Premium on your own phone, computer and TV, at work and at home. Joining is up to you. We see your e-mail address, your role and when you joined or left. We never see what you listen to, when or for how long – only totals for groups of at least 5 people. Your account and Library are yours, and you can leave at any time. How Noiserun handles your data: play.noiserun.com/privacy.

10. Data we handle about your licence

• People: your members, invited people, admins, curators and Spaces managers.
• Data: e-mail addresses, roles, status and dates (invited, joined, left, how they joined); for your organisation, contact and billing details.
• Not included: what an individual listens to is never shared with you.
• How long: the people list while the licence runs and after it only as long as section 4 says; billing details and invoices as long as accounting law requires (10 years after the year of the sale); everything about a person's own account as described in our Privacy policy.