MasterPiano B.V. ("MasterPiano," "we," "us," or "our") is a company registered in the Netherlands and is the data controller responsible for the processing of personal data through www.masterpiano.nl, our learning platform, any mobile applications, and all related online services (collectively, the "Services"). MasterPiano B.V. Mariastraat 18-K 1402 HN Bussum The Netherlands support@masterpiano.nl

2.1 Information You Provide to Us When you create an account, purchase a subscription, or contact us, we may process: · First and last name · Email address · Login credentials · Billing details · Subscription information · Transaction history · Customer service communications · Profile information (if provided) · Reviews or comments you submit · Compositions or audio files submitted via demo drop features Subscription management and billing are processed through Chargebee. We do not store full payment card details on our own servers. 2.2 Information Collected Automatically When you use our Services, we automatically collect: · IP address · Device and browser information · Operating system · Pages visited · Viewing behaviour (such as enrolled courses and watch time) · Log files and error reports · Approximate location (derived from IP address) This data is collected through cookies and similar tracking technologies. See Section 4 for more detail. 2.3 Information from Third Parties If you log in via a third-party platform (such as a social media account), we may receive certain information you have authorised that platform to share with us. We may also receive limited analytical or marketing-related data from advertising and analytics providers.

We process personal data for the following purposes and on the following legal bases: Performance of a Contract (Article 6(1)(b) GDPR) · Account creation and management · Providing access to courses and platform features · Subscription administration · Payment processing · Customer support Legal Obligations (Article 6(1)(c) GDPR) · Tax and accounting compliance (7-year statutory retention) · Fraud prevention · Compliance with lawful requests from authorities Legitimate Interests (Article 6(1)(f) GDPR) · Improving and securing our platform · Analysing usage patterns to maintain and develop our Services · Communicating service-related updates to existing customers We do not rely on legitimate interests as a legal basis for marketing to new users or for placing non-essential cookies. Where we have doubts about whether a legitimate interest applies, we apply consent instead. Consent (Article 6(1)(a) GDPR) · Sending newsletters and marketing emails · Delivering personalised advertising · Placing analytical and marketing cookies You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

We use the following categories of cookies: Essential cookies: Necessary for the platform to function. These cannot be disabled. Analytical cookies: Used via Google Analytics (GA4) to understand how users interact with our Services. Marketing cookies: Used via Meta Pixel and similar technologies to deliver relevant advertising and measure campaign performance. On your first visit, we request your consent for non-essential cookies via a cookie banner. You may update your preferences at any time through the cookie settings tool on our website or via your browser settings.

We may analyse your usage behaviour (such as enrolled courses or viewing history) to provide content recommendations or personalise marketing communications where you have consented to this. We do not engage in automated decision-making that produces legal or similarly significant effects on you.

We share personal data only where necessary, with the following categories of recipients: · Chargebee (subscription management and billing) · Payment processors · Hosting and infrastructure providers · Google (analytics services) · Meta (advertising services) · Email service providers · IT and security providers · Legal and accounting advisors · Andante Piano (our affiliated record label), where you have engaged with music release services and only to the extent necessary for that purpose We enter into Data Processing Agreements (DPAs) with all processors in accordance with Article 28 GDPR. We do not sell personal data to third parties.

Some of our service providers are based outside the European Economic Area (EEA), including in the United States. Where personal data is transferred internationally, we ensure appropriate safeguards are in place, including: · EU Standard Contractual Clauses (SCCs) approved by the European Commission · Participation in the EU-US Data Privacy Framework where applicable · Additional technical and organisational safeguards where required You may request further information about the specific safeguards applied to any given transfer by contacting us at support@masterpiano.nl.

We retain personal data only for as long as necessary for the purposes described in this policy: · Account data: for the duration of the active account relationship · Upon account deletion: we delete or anonymise personal data within 90 days, subject to legal retention obligations · Financial records: 7 years (statutory obligation under Dutch law) · Marketing data: until consent is withdrawn or until the data is no longer necessary · Log and analytics data: up to 24 months · Inactive accounts: reviewed and deleted after a reasonable period of inactivity

We implement appropriate technical and organisational measures to protect personal data, including: · SSL/TLS encryption for data in transit · Access controls and role-based permissions · Secure data storage · Monitoring against misuse and unauthorised access · Regular software updates and security reviews No method of transmission over the internet is entirely secure. We will notify affected users and relevant authorities in the event of a data breach as required by applicable law.

If you are located in the European Union or EEA, you have the following rights under the GDPR: · The right to access your personal data · The right to correct inaccurate or incomplete data · The right to request deletion ("right to be forgotten") · The right to restrict processing · The right to object to processing · The right to data portability · The right to withdraw consent at any time, without affecting prior processing To exercise any of these rights, contact us at support@masterpiano.nl. We will respond within one month. In complex cases or where a large volume of requests is received, this period may be extended by a further two months, with notice to you. You also have the right to lodge a complaint with the Dutch supervisory authority: Autoriteit Persoonsgegevens — www.autoriteitpersoonsgegevens.nl

Our Services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under 16 without verified parental or legal guardian consent. If you believe we have inadvertently collected such data, please contact us at support@masterpiano.nl and we will take prompt action to delete it.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals.

We may update this Privacy Policy from time to time to reflect changes in legal requirements, our business practices, or the technologies we use. The most current version will always be available on our website. Where changes are material, we will notify you by email or through a notice on the platform.

MasterPiano B.V. Mariastraat 18-K 1402 HN Bussum The Netherlands support@masterpiano.nl