The lawUpdated September 24, 2026

Data protection

The GDPR and your label: who does what

Your artists' names, addresses, bank details and contracts are personal data. Here is what the European regulation asks of a label, whether it applies to yours, what Labelmate does for you, and what stays in your hands.

Apply for access

This page is for information only; it is not legal advice.

Two padlocks on a door painted orange and yellow.

The regulation

The GDPR in brief

The GDPR, or General Data Protection Regulation, is Regulation (EU) 2016/679. Adopted on April 27, 2016, it has applied since May 25, 2018. It is a regulation, not a directive: it applies directly in every EU country, in France as in Belgium, where Labelmate is published.

It protects natural persons, meaning human beings, with regard to the processing of their personal data. Personal data is "any information relating to an identified or identifiable natural person" (Article 4): a name, an address, an account number, an email. And processing is almost anything you can do with it: collecting, recording, organizing, consulting, passing on or erasing it.

Each EU country has its own supervisory authority to oversee it: the CNIL in France, the Data Protection Authority in Belgium. The full text is on EUR-Lex, the official site for EU law, and in French on the CNIL's website.

Wherever your label is

Is your label outside the European Union?

The GDPR applies to a label established in the European Union, wherever its artists live. It can also apply to a label established elsewhere, in the United States or Canada for example, when it offers goods or services to people in the EU or monitors their behavior there (Article 3). Otherwise, your own country's laws set your obligations: the UK GDPR in the United Kingdom; PIPEDA or your province's law in Canada; in the United States, state laws such as California's CCPA, depending on your size and where you work.

Labelmate itself is established in the EU, so the GDPR governs everything we do with your data, wherever your label is. And what this page describes is good practice anywhere: know what you keep and why, protect it, and answer the people who ask you about it.

Why you

A label processes personal data every day

Paying an artist means handling their data: their name, their address, their bank details, their contract, their statements, the emails exchanged with them or their manager. As soon as a label keeps this information, in a spreadsheet, an inbox or a binder, it is processing it in the GDPR's sense.

Your artists aren't the only ones concerned. Featured artists, producers, managers, lawyers, your contacts at the distributor: anyone named in a contract or an email is too.

The GDPR doesn't forbid any of this. It asks you to process this data for specific purposes, to keep only what you need and for no longer than necessary, to protect it, and to be able to answer the people who ask you about it.

Your artists' and their contacts' identity and contact details
Bank details, to pay them
Contracts, advances, amounts and statements
Emails and documents exchanged

Yellow and pink folders and a pen on a wooden table.

‘controller’ means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data […]

Regulation (EU) 2016/679, Article 4(7) · EUR-Lex

The roles

Who is responsible for what

The GDPR distinguishes whoever decides, the controller, from whoever acts on their behalf, the processor. With Labelmate, the roles are shared out like this.

Your label decides

For your artists' and contacts' data, your label is the controller: it decides why it processes the data, what it keeps and for how long. Our terms say so, and the label must be entitled to process this data.

Labelmate acts for you

Where the label's data passes through our services, or through our team during onboarding, Labelmate acts on its behalf, as a processor (Article 28). A data processing agreement sets out what we do and within which limits; it forms part of our terms and applies as soon as the label uses Labelmate.

Three sub-processors

We use three providers ourselves. Cloudflare hosts our relay, the service that keeps a label's computers in sync: what it stores is kept in the European Union, and its requests go through Cloudflare's worldwide network. Anthropic reads the text of the documents and emails the app keeps, with sensitive numbers masked, in the United States, if the label turns the AI on. Google hosts our email (Google Workspace), where a label's messages to us arrive, in and outside the European Union. We tell the label at least thirty days before adding or replacing one; if it objects on reasonable grounds, it can end the service.

For our own needs

When you apply for access or write to us, Labelmate is the controller of that data. Our privacy policy says which data, why, and how long we keep it.

What Labelmate does

Your label's data stays on your computers

Labelmate is a desktop app for Mac and Windows, not a website. The emails it reads, the contracts, invoices and reports it files, the statements it prepares: everything is stored in an encrypted database on the label's computers. Its key is kept in the system's secure keychain, the protected place where Mac and Windows keep secrets. We have access to none of it, except what the label chooses to entrust to us for onboarding or Statements Managed.

The mailbox is read-only: Labelmate moves and deletes nothing in it, and its password is never sent to us.

When several of the label's computers work together, every change is sealed before it leaves: encrypted on the computer, with keys that never leave it. If the label publishes an artist's portal, the page is sealed the same way, under a key that travels only in the link sent to the artist. Our relay, whose database is in the European Union, only carries these sealed copies and pages, which we cannot read. To work, it still sees this:

The technical identifiers of the label's workspace and computers, and their public keys, which are made to be shown
The size and date of the sealed copies
The IP address of requests, including that of a browser opening an artist's page

A clean desk corner with a laptop and plants.

The AI

The AI reads nothing until you turn it on

Reading by the AI is optional, and stays off until the label turns it on. Once it is on, the app sends Claude, Anthropic's AI model, two kinds of text: a document's, a contract or an invoice, to propose the values to use (a rate, an advance, an amount), and that of the emails it keeps (the subject and what the sender wrote), to spot who is waiting on the label.

Before sending, IBANs, card numbers and social security numbers are masked, and newsletters, notifications and music submissions are never sent. Neither the file nor the mailbox is sent, but the text may contain names and amounts. The app calls Anthropic directly, with Labelmate's access key: the text does not go through our servers.

Anthropic processes this text in the United States, as our sub-processor, and its commercial terms rule out using this data to train its models. It deletes these texts and its answers within 30 days, unless it must keep them longer to enforce its usage policy or because the law requires it. This transfer outside the European Economic Area relies on the European Commission's Standard Contractual Clauses, model contracts it has adopted, written into Anthropic's data processing addendum.

Can be turned off at any time, in Settings
Every value checked against the document's text
Nothing is saved until a person at the label accepts it
A monthly cap limits what it reads

Example

The journey of a contract received by email

A contract arrives in the label's mailbox. Here is where it sits at each step, and who can read it.

Step	Where it is	Who can read it
It arrives by email	In the label's mailbox, at your email provider	Whoever already had access to the mailbox; Labelmate reads it without changing anything
Labelmate files it	In the encrypted database, on the label's computer	The label, on its computers
The AI reads it, if you turned it on	Its text goes to Anthropic, with IBANs, card and social security numbers masked	Anthropic, for the time of the reading; deleted there within 30 days, save the exceptions in its terms
A colleague opens it on their computer	It travels as a sealed copy through our relay, which keeps it in the European Union	The label's computers; the relay cannot open it
The label makes a backup	An encrypted file, in your Documents folder	The label: the backup stays with you

An example: if the AI stays off, step 3 never happens.

What stays in your hands

On what basis do you process your artists' data?

That is for the label to determine. Article 6 of the GDPR provides six legal bases, the grounds that make processing lawful: consent is only one of them, alongside, for example, performing a contract or complying with a legal obligation. Labelmate doesn't choose for you; an adviser can help.

Do you have to inform your artists?

The GDPR asks the controller to inform the people whose data it processes: who it is, why and on what basis it processes their data, and who receives it (Articles 13 and 14). Our pages describe exactly what Labelmate and its sub-processors do with it, should you need to explain.

An artist asks to see their data. Who answers?

The label: the data is on its computers, and we only see it if the label entrusts it to us, for onboarding for instance. The GDPR provides for an answer within one month, which can be extended by two further months given the complexity and number of requests (Article 12). In the data processing agreement, we commit to helping you answer.

Do you need to keep a record?

Article 30 asks every controller to keep a record of its processing activities, with exceptions set out in the same article. If you keep one, our data processing agreement describes what Labelmate processes for you, where, and for how long.

What about the security of your computers?

Labelmate encrypts the label's database on every computer, but the computers remain yours: who uses them, their passwords, their updates. Keep your backups somewhere safe too: if the label loses all its computers and the means to restore its backups, nobody, not even us, can recover its data.

Our commitments

What Labelmate commits to

The data processing agreement puts our commitments in writing. Here is what matters most.

Helping you, and letting you check

We help the label answer requests from its artists and contacts, carry out an impact assessment (a study of the risks a processing poses to people) where one is needed, and meet its security obligations. Once a year, it can check that we keep these commitments.

Keeping little, not for long

Sealed copies and artist pages stay on the relay while the label uses Labelmate, then are deleted no later than one month after it asks; a page taken down goes at once. Its data stays on its computers; what it entrusts to us for onboarding or Statements Managed is deleted within the time the data processing agreement sets.

Telling you fast

If we become aware of a personal data breach affecting the label, such as a loss, a leak or unauthorized access, we tell it without undue delay and no later than 48 hours after becoming aware of it. The GDPR then asks the label to notify the competent supervisory authority (in France, the CNIL) without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk to people's rights and freedoms (Article 33).

Saying what's missing

Our Security page also says what we don't have yet: no penetration test by an outside firm, no SOC 2 or ISO 27001 certification. You judge the rest knowing the gaps.

Sources

Your next statements, without spreadsheets.

50% off year one for the first 10 labels, with no risk: you pay nothing until your last statements are rebuilt to the cent.