PRIVACY POLICY

Last Modified Date: January 3, 2024

This privacy policy (“Privacy Policy“) describes the types of personal information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined by applicable privacy laws (“Personal Information”) that Country Music Association, Inc. and/or CMA Foundation (“CMA”) may collect from members, event attendees, website users, and others who participate in or inquire about CMA business products (“you”, “your”)  in connection with your use of the websites located at cmaworld.com, cmafest.com, cmaawards.com, cmachristmas.com, cmasongwritersseries.com, cmafoundation.org, cmamember.com, cmapartnerships.com, and any other websites operated by CMA (“CMA Websites“), mobile applications related to the Sites (“Apps“) (collectively, “Sites”), and events or television sponsored by or in connection with CMA, including but not limited to CMA Fest and the CMA Awards, which may link to this Privacy Policy (“Events”). It also describes how CMA uses and discloses Personal Information, and your rights in relation to Personal Information. This Privacy Policy is part of, and is governed by, the terms and conditions set forth in CMA’s Terms of Service at CMAworld.com/terms.

By your affirmative acceptance of this Privacy Policy, you expressly consent to CMA’s collection, storage, use and disclosure of your Personal Information as described in this Privacy Policy. By accessing and using the Sites, purchasing tickets to or participating in our Events, or otherwise providing us with Personal Information, you agree to the terms and conditions of this Privacy Policy and any updates we make to it. If you do not agree to the terms and conditions of this Privacy Policy, then please do not provide us with your Personal Information. Please note, however, that if you choose to limit the information that you provide to us with regard to your access and usage of the Sites and Events, you may not be able to use or participate in certain features of the Sites or obtain tickets for the Events.

Changes and Updates to this Privacy Policy

We reserve the right to revise or update this Privacy Policy at any time, and you should periodically read the Privacy Policy to learn of any revisions or updates. CMA will notify you of changes to this Privacy Policy by posting the amended terms on the Sites five (5) business days before the effective date of the changes. If you do not agree to the new terms, you should stop using the Sites or participating in the Events, and you will not be bound by the new terms. Otherwise, the new terms will take effect after thirty (30) days. If you are a user of one of the Apps, you will be asked to affirmatively accept the new terms in order to continue using the Application. If the revision or update is material, we will provide you notification via email or a pop-up banner. Using the Sites or participating in the Events thereafter constitutes your agreement to and acceptance of the Privacy Policy and its revisions or updates.

  1. Minors Through the Sites and Events, CMA does not intentionally gather Personal Information about visitors who are under the age of 16. If a child has provided us with Personal Information, a parent or guardian of that child may contact us to have the information deleted from our records. If you believe that we might have any information from a child under age 16, please contact us at via the methods described in the below Contact Us section. If we learn that we have inadvertently collected the Personal Information of a child under 16, or equivalent minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible.
  2. Personal Information CMA Collects:
    • 2.1 Personal Information You Voluntarily Provide to CMA. We may collect Personal Information directly from you, such as name, address, email address, telephone number, and employment information. For example, we may collect this Personal Information when you sign up for an account, register for a webinar, purchase tickets to an event via the Sites, when you sign up to receive CMA information and marketing messaging by email, or when you communicate with us, such as if you participate in a CMA conducted survey through the Sites . Additionally, we may from time to time offer you the opportunity to participate in contests, giveaways, and other promotions. Any Personal Information submitted in connection with promotions will be subject to the terms of the promotion, and, if indicated in the rules of the promotion, this Privacy Policy.
    • 2.2 Personal Information That CMA Automatically Collects Through the Sites and the Applications. In addition to Personal Information that you directly and voluntarily provide to us, CMA may automatically collect Personal Information about you when you use the Sites. CMA may automatically collect the Personal Information described below from you the following ways:
      • 2.2.1 Web Browsers. CMA may automatically gather Personal Information about you that your web browser, depending on your settings, may make available to us. This information includes your Internet Protocol (“IP”) address, operating system, and browser type. CMA may also automatically gather Personal Information on the means in which you got to the Sites. This information includes device used (mobile, desktop, tablet), source type (direct, search engine, referral), referral source (URL, social network, or advertisement referred from), and Google search query.
      • 2.2.2 Third Party Cookies
        • 2.2.2.1 Google Analytics. Visitors to the Sites who have JavaScript enabled may be tracked using Google Analytics. Google Analytics collects the following types of Personal Information from users of the Sites:
          • Type of web browser used, software manufacture and version number.
          • Type of operating system
          • Color processing ability of the users screen
          • JavaScript support
          • Flash version
          • Screen resolution
          • Network location and IP address
          • Country, city, state, region, county, or any other geographic data
          • Hostname
          • Bandwidth (internet connection speed)
          • Time of visit
          • Pages visited
          • Time spent on each page of the website
          • Referring site statistics
          • The website the user came through in order to arrive at the Sites
          • Search engine query used

          The Personal Information collected by Google Analytics is primarily used to optimize the Sites for CMA’s users; however, CMA may also use this data for marketing purposes.

          The Personal Information CMA automatically collects using Google Analytics is shared with Google. For more information on Google’s Privacy Policies, visit: https://policies.google.com/privacy. You can also opt-out of having your Personal Information used by Google Analytics by following the instructions located at https://tools.google.com/dlpage/gaoptout/.

          CMA also uses Google Analytics for Display and Search Advertising and, specifically, Google Analytics Demographics and Interest Reporting, on the Sites to help CMA display advertising for products or services that CMA thinks may be of interest to you. CMA will use demographic information CMA collects through CMA’s use of Google Analytics Demographics and Interest Reporting for purposes of performing internal statistical analytics relating to the Sites. You can opt-out of receiving interest-based advertisements through the Sites, as well as customize the types of advertisements that will be displayed to you through the Sites, by following the instructions located at https://support.google.com/ads.

        • 2.2.2.2 Facebook Pixels. We use the “visitor action pixels” from Facebook Inc. on our Sites.This allows user specific behavior to be tracked after they have been redirected to the advertiser’s website by clicking on a Facebook ad. This enables us to measure the effectiveness of Facebook ads for statistical and market research purposes. The data collected in this way is anonymous to us, in other words, we do not see the personal information of individual users. This data is stored and processed by Facebook. Facebook may link this information to your Facebook account and also use it for its own promotional purposes, in accordance with Facebook’s Data Usage Policy https://www.facebook.com/about/privacy/.You can regulate the collection of your data by Facebook pixel, or to the use of your data for the purpose of displaying Facebook ads by visiting the following address: https://www.facebook.com/settings?tab=ads.
        • 2.2.2.3 Cloudflare. CMA uses the Cloudflare CDN (Content Distribution Network) service from Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA.Cloudflare offers better global performance through the internal CDN (Content Distribution Network) and additional security against DDoS attacks. Allowing the placement of Cloudflare cookies onto your browser is a requirement when visiting the Sites to ensure that security features work properly.For more information about Cloudflare and Cloudflare’s Privacy Policy, please visit: https://www.cloudflare.com/privacypolicy/
      • 2.2.3 Location Services. If you access the Sites through a mobile device, CMA may request that you share your mobile device’s location information. You may choose not to share your mobile device’s location information with us, as well by adjusting your mobile device’s location services settings. For instructions on changing the relevant settings, please contact your service provider or device manufacturer.
    • 2.3 Personal Information That CMA Collects Through Third Parties, Service Providers, and Contractors. You may purchase tickets to CMA Events via links to third parties, service providers, and contractors such as Nissan Stadium Tickets, Bridgestone Arena Tickets, Ticketmaster, Stubhub, or other similar venues. CMA receives Personal Information from these third parties to verify and facilitate your participation in CMA Events. CMA may use and combine this Personal Information with other information for analytics and marketing to you. For more information regarding your marketing rights, please see the below Section 6.2.
  3. Information Collected by Third Parties. The Sites and Events may include third-party advertising, links to other websites, and other content from third party businesses. These third-parties or advertising companies working on their behalf, sometimes use “web beacons” (i.e. objects embedded in the third party web page(s) or emails that allows them to check whether you have viewed that page or email) and “cookies” (i.e. a string of information that is stored on your computer which your browser provides to the third party site each time you visit) to measure the effectiveness of their ads, personalize or optimize advertising content and to track users who link from their respective websites to the Sites or the Apps. These third-parties may use cookies and web beacons to track the actions of users online over time and across different web sites or platforms to deliver targeted electronic advertisements to an individual user. For information about how tracking works for online advertising purposes you can visit http://www.aboutads.info/choices. CMA does not have access to or control over web beacons or Cookies that these third parties may use. The information practices of these advertisers and third-party websites or businesses are not covered by this Privacy Policy. They are instead covered by each third party’s respective privacy policy. Before visiting a third-party website, whether by means of a link on the Sites or otherwise, and before providing any information to any third party, you should inform yourself of the privacy policies and practices (if any) of the applicable third-party website.
  4. Information You Post on the CMA Sites or the Apps. Some portions of the Sites may allow you to submit comments, ratings and other information which may be displayed on the Sites or the Apps and viewed by others. Public submissions to these Sites or Apps may be archived by CMA. Please do not post any information, including Personal Information, on the Sites that you do not want to make available to other users of the Sites or the public generally (“Unsolicited Information”). All Unsolicited Information shall be deemed to be non-confidential and we shall be free to reproduce, use, disclose and distribute such Unsolicited Information to others without limitation or attribution pursuant to the CMA Terms of Service. Please take care and avoid providing us or third parties with any Personal Information through such public forums. For the avoidance of doubt, the definition of Unsolicited Information shall not include any information you volunteer to us through our customer service channels, as necessary for us to provide you with products or services. YOU ASSUME ALL RESPONSIBILITY FOR ANY LOSS OF PRIVACY OR OTHER HARM RESULTING FROM UNSOLICITED INFORMATION YOU POST ON THE SITES OR THE APPS.
  5. Facebook, Twitter, YouTube, Instagram, and other Social Media. If you post any comments, photos or other information on CMA’s Facebook, Twitter, YouTube, Instagram or other social media pages, CMA may display those comments, photos or information on the Sites. Note that your use of these “social media services” may result in the collection or sharing of information about you by these social media services. By logging in to these social media services and posting a comment on the Sites, you give CMA permission to access, store and use any information that you permit these social media services to share with CMA in accordance with the privacy settings that are applicable to your account with them. Information that CMA receives from these social media services is stored and used by us in accordance with this Privacy Policy. CMA encourages you to review the privacy policies and settings on the social media services with which you interact to make sure you understand the information that may be collected, used, and shared.
  6. Contests, Promotions, and Sweepstakes. We occasionally offer sweepstakes, contests, and promotions (“Promotional Event(s)”) which require you to provide us or our Promotional Event partners with Personal Information. To participate in these Promotional Events, which may be online, via social media, or in person, we may require you to register and provide us with Personal Information, such as your name and email address. Some Promotional Events we advertise may be administered by third parties who would collect your information, and you should review the privacy policies of the administering party to understand how your data is used and protected by them. In Promotional Events we offer, we will use the Personal Information you provide us for purposes including administering the Promotional Event, subscription to our newsletter, and other purposes disclosed at the time of registration. You should carefully review the Official Rules of any Promotional Event in which you participate, including any option to opt-out of receiving special offers and marketing material by unchecking the appropriate box when registering for Promotional Events. If you have any questions or concerns, please contact us via the Contact Us section below.
  7. How CMA Uses Your Information. CMA uses Personal Information gathered through the Sites and Events to better understand how the Sites and Events are being used. By identifying patterns and trends in usage, CMA is able to better design the Sites and Events to improve your experiences, both in terms of content and ease of use. CMA may also use this information to contact and communicate with you, including to send you information about products or services that might be of interest to you and to respond to your communications and requests. CMA may link Personal Information we gather automatically from you with Personal Information that CMA directly collects from you through the Sites and Events.
    • 7.1 Your Personal Information may be used by CMA for the following reasons:
      • 7.1.1 The Personal Information used is necessary for us to provide you with Marketing Messaging. (for example, your email address)
      • 7.1.2 The Personal Information used is necessary for us to provide you with Personalized Messaging. (for example, first and last name)
      • 7.1.3 The Personal Information used is necessary for us to verify your identity so we can provide you with access to Ticketed CMA Events and Experiences. (for example, your date of birth)
      • 7.1.4 The Personal Information used is necessary for you to participate in Contests, Sweepstakes, and other CMA Fan Experiences. (for example, your street address)
      • 7.1.5 The Personal Information used is necessary for you to purchase Official CMA Merchandise or Tickets to CMA Events. (for example, your debit/credit card information)
      • 7.1.6 The Personal Information used is necessary for you to work with CMA as an employee, third-party processor, or third-party service provider. (for example, your SSN/business ID number)
      • 7.1.7 The Personal Information used is necessary for the purpose of marketing our products and services. We use your Personal Information, such as contact data and other metadata about how you use the products and services to send promotional communications that may be of specific interest to you, including by email and by displaying CMA marketing communications on other organizations’ websites and applications, as well as on third-party platforms like Facebook, Twitter, and Google. These communications are aimed at encouraging engagement and maximizing the benefits that you and your organization can gain from CMA’s products and services, including information about new products and features, survey requests, newsletters, and events that we think may be of interest to you.
      • 7.1.8 The Personal Information used is necessary for the purpose of analyzing, predicting, and improving results and operations. We use Personal Information to analyze and predict results (such as those arising from our sales and marketing efforts and product usage and consumption), improve the performance of our Sites, products and services and customer support, identify potential customers, opportunities, and potential new business areas, ascertain trends, improve our websites’ functionality, improve our security, and provide us with general business intelligence, including through the use of machine learning technology. We may also combine the metadata and usage information collected from our websites with other information to help further the purposes described in the previous sentence.
    • 7.2 Marketing Communications. CMA may email you about products and services that we believe may be of interest to you. If you wish to opt-out of receiving marketing materials from us, please follow the instructions contained in each email you receive from us describing how you can opt-out of receiving further marketing communications from us.
  8. How CMA Shares Your Information with Third Parties. CMA will not disclose your information to third parties unless we obtain your permission to do so, except as set forth below:
    • 8.1 Personal Information You Voluntarily Provide CMA and/or Vendors, Affiliates, Sponsors, and Promotional Partners. By providing Personal Information to CMA or a third party affiliated with CMA, you may be asked to allow CMA to share that data with vendors, affiliates, sponsors and/or promotional partners, in accordance with that party’s Privacy Policy.
    • 8.2 Employees, Third-Party Processors and Third-Party Service Providers. CMA may disclose your Personal Information to our employees, contractors, affiliates, vendors and suppliers (“Service Providers”) who provide certain services to CMA or on our behalf, such as operating and supporting the Sites and Events, or performing marketing or consulting services. These Service Providers are prohibited from using your information for any purpose other than the purpose for which the Service Provider was engaged by CMA and/or as stated in this Privacy Policy.
    • 8.3 Advertising and Marketing Partners. We share your Personal Information, such as metadata and contact data, with third-party advertising and marketing providers, to allow us to better reach our customers and prospective customers, and to sell our products and services. In some circumstances, we may ask you to consent to directly disclosing your Personal Information with these third parties prior to sharing your Personal Information, such as via a consent banner on our website.
    • 8.4 DMCA Infringement Notifications, Counter Notices, Notices of Violations of Site Terms of Service. CMA may share your information with third parties if you submit a Digital Millennium Copyright Act (“DMCA”) infringement notification or counter notification as described in CMA’s Digital Millennium Copyright Notice Policy available at CMAworld.com/terms. In addition, CMA may share your information with third parties if CMA receives other notices regarding violations of CMA’s Terms of Service or other user’s rights (including communications about content stored on or transmitted through the Sites or the Events). For notices other than DMCA infringement notifications and counter notices, upon request, CMA will edit out your name and contact information. However, DMCA infringement notifications and counter notifications must be forwarded as submitted to us without any deletions.
    • 8.5 Responding to Legal Orders; Protection of CMA Rights and to Comply with CMA Policies. To the extent permitted by law, CMA will disclose your information to government authorities or third parties if: (a) required to do so by law, including in response to a court order, subpoena or other legal process; (b) CMA believes in its sole discretion that disclosure is necessary to protect against fraud, to protect the rights of CMA or other users, third parties or the public at large; or (c) CMA believes that you have abused the Sites or the Events by using them to attack other systems or to gain unauthorized access to any other system, to send unauthorized or illegal communications (such as “spamming”) or otherwise to violate applicable laws. After disclosure to any third party, your information may be accessible by others as permitted or required by applicable law.
    • 8.6 Business Transfers; Bankruptcy. In the event of a sale or transfer of all or a portion of our assets, user information owned or controlled by CMA may be transferred to third parties. CMAs reserves the right, as part of this type of transaction, to transfer or assign your information and other information we have collected from users of the Sites or the Apps to third parties. Other than to the extent ordered by a bankruptcy or other court, the use and disclosure of all transferred user information will be subject to this Privacy Policy, or to a new privacy policy if you are given notice of that new privacy policy. Any information you submit or that is collected after a transfer, however, may be subject to a new privacy policy adopted by the transferee.
    • 8.7 Anonymous, Aggregated Information. CMA may share information relating to users of the Sites or the Events with affiliated or unaffiliated third parties on an anonymous, aggregated basis. This information is collected and analysed for the purpose of better understanding the Country Music consumer, their interests, and how they interact with CMA Sites, Events, and brands.
  9. Data Retention. How long we keep the personal information we collect depends on the type of information, the purpose for which it is used, how sensitive it is, and similar factors. In general, we will retain your personal information for the length of time reasonably needed to fulfill the purposes outlined in this privacy policy (including for as long as needed to provide you or our customer with products and services), unless a longer retention period is required or permitted by law. We will also retain and use your information for as long as necessary to resolve disputes and/or enforce our rights and agreements. Non-personally identifiable and aggregated information may be stored indefinitely.
  10. United States Consumer Rights & Transparency.
    • 10.1 California Civil Code Section 1798.83. A California resident who has provided personal information to a business with whom he/she has established a business relationship for personal, family, or household purposes (“California customer”) is entitled to request information about whether the business has disclosed personal information to any third parties for the third parties’ direct marketing purposes. In general, if the business has made such a disclosure of personal information, upon receipt of a request by a California customer, the business is required to provide a list of all third parties to whom Personal Information was disclosed in the preceding calendar year, as well as a list of the categories of Personal Information that were disclosed.
    • 10.2 Additionally, there are other state privacy laws such as the California Consumer Privacy Act and the California Privacy Rights Act (the amendment “CPRA”, together, “CCPA”), Virginia’s Consumer Data Protection Act (“VCDPA”), Colorado Privacy Act (“CPA”), and Connecticut Data Privacy Act (“CTDPA”), which are not applicable because CMA is a non-profit organization and/or does not collect requisite volumes of personal information. However, we value our customer’s privacy and thus California, Virginia, Colorado, and Connecticut customers may reference the above sections of this Privacy Policy for transparency regarding our current data practices related to such information. Additionally, customers may request further information, correction, deletion, or limitations of use relating to their Personal Information via the Contact Us section below.
  11. European Economic Area and United Kingdom Users. This section of this Privacy Policy applies only if you use the Sites or inquire about Events from a country that is a Member State of the European Economic Area (“EEA”) or the United Kingdom, and supplements the information in this Privacy Policy. For this section, Personal Data means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
    • 11.1 Personal Data Collected. While CMA may sponsor or comarket with events outside of the United States, no Personal Data is transferred to CMA with regard to these events. However, we may obtain Personal Data directly from you by signing up for our newsletters, browsing our Sites, or inquiring about the Sites and Events.
    • 11.2 Consumer Rights. Data Subjects may have the following rights under the GDPR:
      • Right of Access: You have the right to obtain confirmation from us as to whether or not we process Personal Data from you, and you also have the right to at any time obtain access to your Personal Data stored by us.
      • Right to Rectification: If we process your Personal Data, we use reasonable measures to ensure that your Personal Data is accurate and up-to-date for the purposes for which your Personal Data was collected. If your Personal Data is inaccurate or incomplete, you have the right to require us to correct it.
      • Right to Erasure: You may have the right to require us to delete your Personal Data.
      • Right to Restrict Processing: You may have the right to request the restriction or suppression of Personal Data.
      • Right to Withdraw Consent: If you have given your consent to the processing of your Personal Data, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on the consent before the withdrawal.
      • Right to Data Portability: You may have the right to receive the Personal Data concerning you and which you have provided to us, in a structured, commonly used and machine-readable format or to transmit this data to another controller.
      • Right to Object: You may have the right to object to the processing of your Personal Data as further specified in this Privacy Policy and you may have the right to object to decisions being made with your Personal Data based solely on automated decision making or profiling.
      • Right to Lodge a Complaint with Supervisory Authority: You have the right to lodge a complaint with a data protection supervisory authority located in the European Union or UK. Further information about how to contact your local data protection authority is available on the European Commission’s website.

      If you would like to exercise any of these rights, please contact us as set forth in the Contact Us section below. CMA will process such requests in accordance with applicable law.

    • 11.3 Choices under GDPR.
      Data Subjects have the right to opt out of (a) disclosures of their Personal Data to third parties not identified at the time of collection or subsequently authorized, and (b) uses of Personal Data for purposes materially different from those disclosed at the time of collection or subsequently authorized. Data Subjects who wish to limit the use or disclosure of their Personal Data should please contact us as set forth in the Contact Us section below. We will cooperate with Data Subjects’ instructions regarding Data Subjects’ choices.
    • 11.4 Legal Basis for Processing Data. We process Personal Data for the purposes set out in this Privacy Policy, as described above. Our legal basis to process Personal Data includes processing that is: necessary for the performance of the contract between you and us (for example, to provide you with the services you request and to identify and authenticate you so you may use the Sites or participate in the Events); necessary to comply with legal requirements (for example, to comply with applicable accounting rules and to make mandatory disclosures to law enforcement); necessary for our legitimate interests (for example, to manage our relationship with you and to improve the Sites or Events); and based on consent by our customers (for example, to communicate with you about our products and services and provide you with marketing information), which may subsequently be withdrawn at any time (by using preference settings in emails, using this form, or emailing us as set out in Section 12: Contact Information) without affecting the lawfulness of processing based on consent before its withdrawal. In some instances, you may be required to provide us with Personal Data for processing as described above, in order for us to be able to provide you to use all the features of the Sites or Apps.European Economic Area and United Kingdom Users. This section of this Privacy Policy applies only if you use the Sites or inquire about Events from a country that is a Member State of the European Economic Area (“EEA”) or the United Kingdom, and supplements the information in this Privacy Policy. For this section, Personal Data means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
    • 11.5 We may use automated decision making technologies, including profiling, to support our data processing activities. Our automated decision making capabilities include logic that attempts to identify artists, music, communications, products, or offers that we believe may interest you. By using this logic, it helps us personalize your interactions with CMA and CMA Affiliates. For you, this means that you may see online advertisements, direct marketing communications (if you have subscribed), or other advertising or marketing messages or special offers based on your activity on our Sites or interactions with CMA Companies or our third party partners.
    • 11.6 International and onward transfers. If you are located outside the United States and choose to provide Personal Data to us, please be aware that we transfer your Personal Data to the United States and process and store it there. Subject to the applicable laws, we will use reasonable efforts to ensure that appropriate protections are in place to maintain protections on the Personal Data. By submitting your Personal Data, you consent to having your Personal Data transferred to, processed, and stored in the United States. Our sharing your Personal Data in accordance with this Privacy Policy, may involve transferring your data outside the European Economic Area (EEA). Whenever we transfer your personal data out of the EEA, and in compliance with the Accountability for Onward Transfer Principles of the GDPR, we ensure a similar degree of protection is afforded to your data by ensuring, where required by law, at least one of the following safeguards is implemented:
      • 11.6.1 transferring personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission; or
      • 11.6.2 using specific contracts approved by the European Commission which give personal data the same protection it has in Europe;

      CMA may disclose Personal Data to subcontractors and third-party agents. Before disclosing Personal Data to a subcontractor or third-party agent, we will obtain assurances by contractual agreement from the recipient that it will: (i) transfer such data only for limited and specified purposes; (ii) ascertain that the subcontractor or third-party agent is obligated to provide at least the same level of privacy protection as is required by the GDPR; (iii) take reasonable and appropriate steps to ensure that subcontractors and third-party agents effectively process the Personal Data transferred in a manner consistent with the organization’s obligations under the GDPR; (iv) require subcontractors and third-party agents to notify the organization if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the GDPR; (v) upon notice, including under (iv), take reasonable and appropriate steps to stop and remediate unauthorized processing; and (vi) provide a summary or a representative copy of the relevant privacy provisions of its contract with subcontractors and third-party agents to the Supervisory Authorities upon request.

      CMA also may be required to disclose, and may disclose, Personal Data in response to lawful requests by public authorities, including for the purpose of meeting national security or law enforcement requirements, or in the event of a merger or acquisition.

    • 11.7 Security Measures To Protect Your Personal Data. CMA uses industry standard data protection protocols to protect your data.
  12. Canadian Users While CMA Fest is a non-profit organization, we follow and adhere to the principles laid out in the Personal Information Protection and Electronic Documents Act (“PIPEDA”). In addition to the information in the above Privacy Policy, Canadian users may:
    • 12.1 PIPEDA Principle 8 – Openness. This Privacy Policy is designed to provide you with required information about CMA’s policies and practices with respect to the management of Personal Information.
    • 12.2 PIPEDA Principle 9 – Individual Access. Individuals have the following privacy rights under the PIPEDA:
      • 12.2.1 Right of Access. Upon request, CMA must inform you whether or not we hold Personal Information about you and the source of this information. You also have the right to request an account of the use that has been made or is being made of your Personal Information and an account of the third parties to which it has been disclosed.
      • 12.2.2 Right to Challenge Accuracy and Completeness. If you have successfully demonstrated the inaccuracy or incompleteness of your Personal Information, we will amend the information as required, and where appropriate, transmit the amended information to third parties with whom we have shared or disclosed the information in question. Depending upon the nature of the Personal Information challenged, we may either correct, delete, or add additional information to the information in question. If we are unable to resolve your challenge to your satisfaction, we will record the substance of the unresolved challenge, and when appropriate, transmit the unresolved challenge to third parties with whom we have shared or disclosed the information in question.
      • 12.2.3 Right to Data Portability. You may have the right to receive your requested information in a reasonable time and at a minimal or no cost to you, and in a form that is a generally understandable.
      • 12.2.4 Right to Withdraw Consent. If you have given your consent to the processing of your Personal Information, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on the consent before the withdrawal.
    • 12.3 PIPEDA Principle 10 – Challenging Compliance. You have the right to make inquiries or lodge complaints concerning CMA’s compliance with any of the Principles under PIPEDA. You may contact them as specified in the Contact Information section below with a reference to “PIPEDA Complaint.” Upon contact, they will inform you of CMA’s relevant complaint procedures, including any regulatory handling practices.
    • 12.4 Commercial Electronic Messages (“CEM”) in Canada. Canada’s Anti-Spam Law requires that the CMA obtain the express consent of Canadian citizens before sending an electronic message such as an email that contains a promotion about our products. We will ask you for your explicit consent when you provide us with your email address or other personal information through which we intend to encourage your participation in a commercial activity, such as a promotion for our products. If you explicitly consent to receiving CEM, each communication sent to you will contain an option to unsubscribe to the communications or to revoke your consent to receive CEM. Alternatively, you can contact us at the address or email provided in the “Contact and Electronic Communications” section to be removed from our mailing lists.

    If you would like to exercise your Canadian privacy rights, please contact us as specified in the Contact Information section with a reference to “Canada.”

  13. Contact Us.If you have any questions about this Privacy Policy, or wish to have your information removed from our systems, you may do so in the following ways:
    • Write to us by postal mail at: Privacy Policy: Country Music Association, Inc.; 35 Music Square East, Suite 201, Nashville TN 37203
    • Email us at [email protected].
    • Call us toll-free at 1-800-998-4636