People named in public music records

Sessio ApS is the data controller for the processing described on this page. We are a Danish company based in Copenhagen.

• Sessio ApS
• CVR 45830012
• Burmeistersgade 2, 1. th, 1429 København K, Denmark
• Email: [email protected]

We have not appointed a data protection officer. [email protected] reaches the people who handle these requests directly.

When a Sessio member asks us to look for royalties or credits that may belong to them, we search music-industry sources, including:

• Lists that collecting societies publish of works and recordings they have not been able to pay out, because the rights holder is unknown or unidentified.
• Licensed commercial data feeds we have a written agreement to use.
• Public music-credit, release and catalogue databases.
• Public pages on artist and label websites, and public artist or channel pages on streaming, video and social services.

A song is rarely the work of one person. A single record in one of those sources can name writers, composers, performers and other contributors, and there is no reason any of them should also be a Sessio member. We did not choose which names are in those records, and we cannot take a name out of the source itself: the source belongs to the society or database that published it.

We keep our own copy of the records we are allowed to search, together with a simplified searchable version of the names and identifiers in them — the same name with accents and punctuation stripped out — so we can compare them with a Sessio member's own catalogue. We do not build a profile of you beyond your music credits (section 9), and we do not use your name for anything unrelated to them. Where a comparison produces a possible match, it goes into the results of the search that was asked for — and the person who asked is not always the only one who sees them. Section 4 names everyone who can.

If you think unclaimed money on one of those lists is yours, the place to claim it is the collecting society that published the list. They hold the money and they decide who is paid; Sessio does not.

The law asks us to tell you which legal basis we rely on, and ours is legitimate interests — Article 6(1)(f) of the GDPR. The interest is a concrete one: musicians are owed money that goes unpaid because the records deciding who gets paid are wrong or incomplete, and a member cannot check their own catalogue against a list without reading the names on it. We have written that balance down, weighed from your side as well as ours, and we keep the assessment current. If you would rather we did not hold your details, you can object — see "Your rights" below. For records naming someone who does not use Sessio, we do not claim overriding grounds to keep them.

These are the promises in our privacy policy, written out for the person they are about:

• We use the details to understand and verify works and recordings, to credit the right people, and to show those credits on public pages (section 9).
• We do not create an account for you. If you are credited on published music, our music database may hold an entry for you and show it as a public page with your name and your credits (section 9). Every such page has a button to take it over or to object.
• We do not suggest you to anyone as a collaborator unless you use Sessio. The one other case is an invitation. When a member confirms a song, accepts a split on it or credits someone on it, that member may be shown that you are not on Sessio, under the name a register printed or one the member typed, and be given a link to send you. They send it themselves. Sessio sends you nothing. We keep a note that this was offered, with that name and the song, never an address (section 6). Your public page can show that your registered works place you in the top quarter of your role, and when people from the register are listed, those with the most registered works come first (section 9).
• We do not contact you because of these records. No email, no letter, no message: not to sell you anything, and not about the record.
• We do not use your details for unrelated recommendations, or for any purpose other than understanding works and recordings and crediting the people on them.
• We do not go looking for information about you outside music credits, and we never try to find your contact details. To credit the right person, our music database connects what different music sources publish about the same works and recordings, and can link a person's credits across them by published identifiers such as IPI and ISNI. It never merges two people on a name alone. Apart from the one standing in section 9, what it holds about a person comes only from the music sources in section 9 and the documents members upload (section 5): credits, names and identifiers, and what those sources print beside them, such as the area and country MusicBrainz gives for an artist, or dates of birth and death on some society lists.
• If your name stays inside a member's saved finding, we do not copy it out into anything else. It does not become a profile, a mailing list or a suggestion. Who can see that finding is a separate question, and section 4 answers it.

How the matching works, plainly. A computer compares names and titles and scores how similar they look. That score decides whether a record is put in front of a Sessio member as a possible lead. It is never a decision about who owns what: no claim is filed and no money moves because of it. A person reviews the lead, and anything sent to a collecting society is sent by the member, or by Sessio's own team under a written authorisation the member signed (section 4).

If we ever did contact someone named in a record, that first message would carry all the information the GDPR requires us to give — who we are, what we hold, where it came from and what you can do about it. Today no such route exists, and we are not building one out of the records themselves.

A possible match does not stay with the person who asked for it. Who else sees your name depends on who ran the search and on what they do next. This is the whole list.

• The Sessio member the search was run for. They see the work or recording title, the artist name written on the record, the society that published it, and identifiers such as ISRC or ISWC. That is how a musician recognises whether the work is one of theirs.
• Administrators at an organisation that represents a Sessio member — a label, a publisher, a manager. They see the title, the artist name, the society and the country when the organisation runs a search for one of its own musicians, and when a background sweep it has switched on runs on its own schedule. They do not get identifiers, our internal record numbers or the claim draft. Two further routes reach the same administrators: research an organisation asks us to do about one of its own musicians (section 5), and research it asks us to do about its own company profile, which can surface the names of writers credited on its catalogue.
• A record label that uses Sessio, for its own recordings. If you performed on one of a label's recordings, the label's administrators can see the performers registered on that recording: name, role, instrument where registered, and identifiers such as IPN. They see this only for the label's own recordings. We also add the line-up to our music database as a fact about the recording, so that you can find and correct your credits (section 9). The label's own business data never goes there.
• A publisher or record label that uses Sessio, when it matches its catalogue and roster against our music database in Publisher Origin. For that matching step only, we and the organisation decide together how it is done, so we are joint controllers for it. You can ask either of us about it, and each of us answers you. Everything else the organisation does with its own records is its own responsibility.
• A collecting society, when a claim or a correction is filed about a work your name is on. The filing carries the title, the artist name and the identifiers on the record. It is sent either by the member, or by Sessio's own team under a written authorisation the member signed and can withdraw. A person decides each filing: none is sent automatically, and none on our own initiative.
• Anyone using the royalty checker on sessio.io, when it is switched on. It is switched off today. When it runs, it answers only with how many unclaimed records match the name typed in: never a society, never a title. Section 5 describes it in full.
• Anyone on the internet, if our music database holds an entry for you. Your public page shows your name, your works, your roles, the people you share them with, and whether someone has claimed it. If your registered works place you in the top quarter of your role, it also shows that standing (section 9). Public pages about works show the writer names a register published. A person page shows the IPI and ISNI the sources publish; neither kind of page ever shows money or contact details.
• Signed-in Sessio members, through our collaboration graph: who has written with whom, as the registers record it.
• A co-writer on the same song whom a member has asked to confirm it. Once they have signed in and agreed, they see your name, as a register printed it or a member typed it, among the other co-writers the song is still waiting for.
• Anyone who asks us about an organisation before opening an account with us. Our research reads what the open web says about that organisation, and it can name writers credited on its public pages.
• People at Sessio, when we are working on a case. Checking a match, answering a support question or handling a request under "Your rights" means someone here reads the individual record and what it was matched to.
• The AI providers behind our search features and our assistant. A search reads source records, and any rights document a member has uploaded, into the model doing the work, so those rows travel to that provider as working material. Anthropic runs the searches; it is bound by a written data-processing agreement to act only on our instructions, and what we send it is not used to train its models. Anthropic also runs Ask Sessio, the assistant a member can ask about their findings or hand a document to, so what the assistant looks up or is given travels to Anthropic the same way. Our own team also uses Anthropic's AI assistants when it works on a case, so a record it reads passes through Anthropic. When a member asks the assistant a question aloud, or has an answer read aloud, ElevenLabs turns the recording into text and the answer into speech, so a name in either passes through it. Both are named, with the transfer safeguards, in section 6 of our privacy policy.

Two things stay off that list. Apart from what a public page shows, nobody can download these records out of Sessio, with one exception: an organisation can download the results of its own searches for its own musicians (the title, the artist name on the record, the society and the country), to send to the society or to a partner that collects for it, and that copy is its responsibility. The copy of their own data a Sessio member can request does not carry your name. And we still do not write to you.

A member's search is the main way a name from these records reaches us, but it is not the only one. Three other parts of Sessio hold or show a name, and earlier versions of this notice did not describe them.

The royalty checker anyone can use

The royalty checker on sessio.io is switched off today. When it runs, anyone can type a name into it, and the answer says only how many unclaimed records match that name. It names no society and shows no title. It works on any name, including yours, and nothing ties the name typed in to the person typing it — we have no way of knowing whether they are the person named. We never show the title of a record there, or anything else from it, and the scan itself stores nothing: not the name searched, not the answer it gave.

Rights documents a member uploads

A Sessio member can paste or upload their own works list, royalty statement or rights export from their collecting society, so that we can read what is in it. Those documents routinely name co-writers and give each one's share of a work - information about you, handed to us by somebody else. We keep what the member gave us: the text and rows we read from it, and the file itself where we store it. The member's confirmed detail - works, credits and shares - stays for as long as their account does, like the rest of the catalogue they keep here. While a search is running, that text goes to the AI provider along with the source records, as described in section 4.

We also learn from these documents about the works themselves, and we keep that on the work rather than on the member: its titles and identifiers, and the writers and publishers registered on it, by name, role and rights identifier, as a register would list them. That way the next member whose song is the same work finds it correctly. The shares and amounts of the people a document names are not part of it, and it builds no profile of you. The one share and amount we keep with a fact about a work are the uploading member's own, from a line of their own statement, kept beside the figure for the whole work that we worked out from that line. Section 5 of our privacy policy sets this out in full.

If you are named in a document a member uploaded and you ask us to erase or correct your details, we take you out of the lists we read from it, and because a file cannot be edited, we delete the file itself. Where the document was a register's own export, your listing as a writer or publisher on the work, as that register publishes it, stays on the work.

Research an organisation asks us to do about its own musician

Where a musician has given an organisation the highest level of representation, that organisation can ask us to research the musician's public professional profile from the open web — the biography, credited roles, links and press pages. The research is about that musician and never about you: your name arrives only because it is written on a page about them. But pages about one musician name others. The structured parts of that research now report other people as a count and never by name, so your name does not reach an organisation that way. It can still reach them inside the written biography, and inside the running commentary the tool shows while it searches, because neither is prose we can reliably take a name back out of. We have written that limit down rather than papered over it, and it is to be revisited when a reliable way of stripping names out of free text exists.

A name is kept as part of the music records it belongs to. Where our music database holds an entry for you (section 9), that entry exists only because of those records, and it goes when you ask us to erase it.

• We keep our copy of a source record, with its source and the dates we saw it, as long as the work or recording is in our database. For a society's list we keep every edition, also after the society removes a line, because the record of who was listed is part of getting credits right. We also keep the fact that a named person, or an heir, had unclaimed money at a society for a work, as part of that work's payout history and as evidence if a late claim is made. One thing has a clock: any contact details a list carries, which we keep only while the line is on the society's current list, the society's window for claiming or correcting that money is open, a case about it is open, or the person is a Sessio member or has agreed to it. Then we delete them. Your name and your credits leave our copy when you ask us to erase them or object (section 7).
• A name inside a Sessio member's saved finding follows that finding: the member can delete it at any time, and it goes when they close their account. The full schedule is in section 8 of our privacy policy.
• A name inside a document a member uploaded is kept with that document, and no clock deletes it. It goes from the document when the member asks us to delete it, from everything we read out of it when the member erases their account, and from both when you ask us (section 5). A listing on a work as a register publishes it stays on the work.
• A note that a member may invite you to a song (your name, as a register printed it or a member typed it, and the song; never an address; section 3.5 of our privacy policy lists the rest): the member is shown it for twelve months. We keep it, whatever its age, for as long as a claim on the song may still wait for you, and delete it when the member's account is erased. A request a member makes of a co-writer to confirm several songs at once is deleted when its 30-day link runs out with no answer, and when the member's account is erased. An answer, "Not me" and "Not right" included, is kept until then.

If you would rather not wait for any of that, you can ask us to delete the records that name you — see section 7.

You have rights over information about you whether or not you use Sessio. Publishing this notice instead of writing to you individually removes only our duty to send you a letter; it removes none of your rights.

• See what we have (access) — a copy of the records that match the name you give us, where each one came from, what we do with them, and who has received them.
• Correct it (rectification) — if a detail about you is wrong.
• Delete it (erasure).
• Freeze it (restriction) — have the records left out of every search while a question is open.
• Object — tell us you do not want us holding records that name you.

What an answer from us looks like

When you ask what we hold, our answer is a list of the records that match the name and the spellings you gave us. It is not a certificate that we hold nothing about you. Different people share a name, names are spelled differently in different countries, artists work under stage names, and a band's name and a person's name can look identical in a register. So the honest form of our answer is "these are the records matching the name you gave", and we will not dress it up as more than that.

Correcting our copy is not correcting the source

The record came from a collecting society or a database, and theirs is the authoritative version. We can correct our copy, and we will tell you exactly which source the record came from so you can ask them to correct the original. If only our copy were corrected, the next refresh from that source would bring the old version back.

When we delete, we make it stick

Deleting the records on their own would not be enough: the next time we refresh that source, the same record would return. So alongside the deletion we keep a minimal entry that blocks it from coming back. That entry holds no name — only the source's own reference for the record, or a one-way scrambled code that cannot be read back as a name. We will tell you that the entry exists, what it holds and why it is there. We do not refuse a deletion on the grounds that the record was already public.

If you object, we do not argue

For records naming someone who does not use Sessio, we do not claim overriding grounds to keep them. If Sessio has not checked and approved a member's claim to your public page, we take the records out of every search straight away, and then delete them and block their return, unless you would rather we did something else. If Sessio has checked and approved a member's claim to your public page, that page stays up while someone at Sessio checks who is objecting, and then acts. Write to [email protected], as for any request on this page.

Telling anyone who already received it

If something we correct, delete or restrict had already reached someone else — an organisation using Sessio, a member whose saved finding quotes it, or a society a claim was already sent to — we tell them, and if you ask, we tell you who they were. Where something has already been sent and cannot be unsent, we say so plainly rather than implying it was pulled back.

One right that does not apply here

Data portability covers information you gave us yourself, and a register's published record is not that. We would rather say so than quietly leave it out.

Write to us. That is the whole procedure.

• Email [email protected], or
• post a letter to Sessio ApS, Burmeistersgade 2, 1. th, 1429 København K, Denmark.

There is no form to fill in and no account to create. You do not have to explain why you are asking. Any other Sessio address or support channel reaches us too — it will be passed to the right people.

Write in English or Danish and we answer you directly. Write in another language and we will have your request translated. The translation is our job, not yours, and it does not come out of your time.

It helps if you tell us the name to search for, including any other spellings or stage names it may appear under, and what you want: to see, to correct, to delete, to freeze or to object. One request covers one person and up to six spellings or names for that person — enough for almost anyone, and it stops this route being used to look people up in bulk.

Please do not send identity documents. We never ask for a passport, a driving licence, a photo or a national ID number. If one arrives anyway, we do not open it, copy it or keep it: we delete it the same working day and tell you we have.

When you will hear back

We acknowledge your request on the working day we receive it and tell you the date your answer is due. We answer without undue delay and at the latest within one month. Our own target is 10 working days. If a request is genuinely complicated we may take up to two further months, but then we tell you why within the first month — and being short-handed or away on holiday is never that reason.

If we cannot be sure who you are

Some of what you can ask for is simply the record as the society or the database already publishes it. We do not ask you to prove who you are for that: it would be absurd to demand identification before handing back a row that anyone can read on a public list.

Where an answer would go further than the published record — what our own systems made of it, or which Sessio members or organisations have seen it — we need to be reasonably satisfied that you are the person named, and to get there without collecting new information about you. If we cannot, we do not guess: we will not hand your details to someone who might not be you. Instead we freeze the records so they are left out of every search, explain in writing why we stopped, and tell you how to complain.

Sessio maintains a database of music credits built from licensed and public sources:

• The MLC's licensed publisher data;
• the registers and lists collecting societies publish;
• what publishers and record labels using Sessio tell us about their own works and recordings, never their business data;
• the open music databases MusicBrainz (CC0), Credits.fm (CC BY 4.0) and Discogs's monthly artist lists (CC0).

If you are credited on published music, an entry keyed to your public rights identifier (IPI) may exist. It carries your published name and your credits as the sources published them, each with its source. The entry can appear as a public page that anyone can find by searching your name. Lists of people, in our app and in our public data, show those with the most registered works first; in the app, people who use Sessio are listed before people from the register. The page shows your name, your works, your roles, the people you share them with, and whether someone has claimed it. If your registered works place you in the top quarter of people in the same role, the page can also show that standing, rounded to the top 1, 5, 10 or 25 percent. The exact rank and the size of the group sit behind it in our public data. It shows the IPI and ISNI the sources publish for you, and never money or contact details, and it carries a button to take it over or to object. Apart from that one standing we derive no scores about you. We do not look for contact details for you, no public page shows any, and what a society's list prints we keep only as section 6 says. We do not contact you because of these records. You can object to or erase your entry with no account, no form and no identity document via the intake route above; erasure is permanent and survives future data updates.

If you are unhappy with how we handled your request, or with the fact that we hold records naming you at all, you can complain to a data protection authority. In Denmark that is Datatilsynet, and you may also go to the authority in the EU country where you live or work. You can take the matter to court as well.

• Datatilsynet — Carl Jacobsens Vej 35, 2500 Valby, Denmark
• Email: [email protected]
• Phone: +45 33 19 32 00
• Website: www.datatilsynet.dk

Complaining costs you nothing, and you do not have to come to us first.

Our privacy policy covers everything else we do, including what happens for the people who do use Sessio. The paragraph about people named in external records is in section 3.5, and it says the same as this page in shorter form: read the privacy policy.

If anything on this page is unclear, or if you want it explained in Danish, email [email protected] and a person will answer you.