Official document · Version 1.0
- Version
- 1.0
- Last updated
- July 27, 2026
- Operator
- Star Mark Agencia / Star Mark Records
- Website
starmarkrecords.starmarkagencia.com
This Policy explains how Star Mark Agencia and its Star Mark Records division collect, use, share, protect, and retain personal data when a person visits the websites, applies to the roster, uses a dashboard, submits music, purchases services, participates in booking, or communicates through WhatsApp, email, or other channels.
Controller and scope
1.1. Controller
The general data controller is Star Mark Agencia, the trade name that operates Star Mark Records, with an operational contact address at Cra. 44 #19A-100, El Poblado, Medellín, Antioquia, Colombia.
Privacy email: contacto@starmarkagencia.com
WhatsApp: +57 311 337 6000
Recommended subject line: “Privacy and personal data”.
When a proposal or agreement identifies a different company, individual, affiliate, partner, or professional as the controller of a specific processing activity, this shall be disclosed before the corresponding data is collected.
1.2. Services covered
This policy applies to:
starmarkagencia.com;starmarkrecords.starmarkagencia.com;- contact and application forms;
- the dashboard and private areas;
- email, WhatsApp, and commercial assistance;
- distribution, production, marketing, booking, and collaborations;
- EPKs, artist websites, and tools administered by Star Mark;
- royalty, billing, verification, and claims processes.
Third-party websites and platforms have their own policies. When you open WhatsApp, Spotify, YouTube, SoundCloud, Instagram, Google Drive, a payment processor, or any external link, that third party may act as an independent controller.
1.3. Current operation of forms and demo tools
In the current public version, certain contact and application forms organize information within the browser and prepare a draft for WhatsApp. The content does not leave the website until the person chooses to open and send the message. From that moment, WhatsApp/Meta and Star Mark process the conversation under their respective policies.
The private EPK preview uses files selected on the device to generate a local view. Those files are not uploaded to the server by that tool and disappear when the experience is closed or reloaded, unless the user later sends them through another channel.
Data that may be collected
2.1. Categories of data
| Category | Examples |
|---|---|
| Identification and contact | legal name, stage name, identity document when necessary, age or date of birth, city, country, email, telephone, address, and representative. |
| Artistic and professional profile | biography, music genre, experience, goals, photographs, social networks, links, availability, languages, booking information, and work preferences. |
| Music and catalog | audio, masters, compositions, lyrics, artwork, videos, metadata, credits, ISRC, UPC/EAN, territories, dates, explicit-content designation, links, and release status. |
| Rights and documentation | agreements, beat or sample licenses, split sheets, collaborator authorizations, registrations, assignments, claims, and chain of title. |
| Account and authentication | user name, encrypted credentials, login records, permissions, dashboard activity, and settings. |
| Financial, tax, and payment | billing information, receipts, payment method, payment request, limited banking information, tax identifier, withholding, royalties, and beneficiary. Star Mark should not store full card data when payment is processed by a third party. |
| Booking and commercial activity | artist fee, dates, cities, venues, agreements, logistics, budget, commissions, clients, proposals, invoices, and settlements. |
| Communications | emails, WhatsApp messages, requests, attachments, calls, support, consents, and communicated decisions. |
| Technical data | IP address, browser, device, operating system, language, time zone, URL, date, logs, errors, security, and anti-fraud activity. |
| Preferences and local technologies | language, sound, volume, motion, visual environment, consent, and other options stored in the browser. |
| Public or third-party sources | professional profiles, music platforms, social networks, references, clients, distributors, platforms, and authorized providers. |
2.2. Sensitive data
Star Mark does not generally request data concerning health, biometrics, sexual orientation, religion, political opinions, ethnic origin, or other sensitive categories. If a legitimate project requires any such data, the purpose shall be disclosed and explicit authorization shall be requested when required by law. Providing sensitive data is never mandatory unless it is strictly necessary and a lawful basis exists.
2.3. Minors
Commercial services are directed primarily to adults. A minor’s data shall be processed only with verifiable authorization from the minor’s legal representative, with respect for the child’s best interests and with information limited to what is necessary. Star Mark may request the representative’s identification, image authorization, consent, and the adult’s presence in agreements or activities.
2.4. Data relating to other persons
If you provide information about collaborators, representatives, clients, songwriters, or other third parties, you represent that you are authorized to do so and have informed them about the processing. You must not share documents or data that are unnecessary.
Purposes of processing
Star Mark may use data for the following purposes:
3.1. Application and A&R evaluation
- receive and organize the application;
- verify identity, links, rights, and compatibility;
- request supporting documentation;
- communicate acceptance, rejection, or next steps;
- prevent fraudulent or duplicate applications.
The final A&R decision is not made exclusively by an automated system. Technical tools may assist in organizing information, but the evaluation is human.
3.2. Contracting and administration of the service
- prepare proposals, agreements, orders, and invoices;
- enable accounts and the dashboard;
- provide distribution, production, design, marketing, web, booking, or other services;
- respond to support, changes, warranties, and requests;
- administer renewals, cancellations, and takedowns.
3.3. Distribution and catalog
- validate audio, artwork, credits, and metadata;
- deliver content to distributors, platforms, and territories;
- assign or manage identifiers;
- administer corrections, takedowns, and migrations;
- consolidate available statuses, metrics, and reports;
- identify and resolve catalog conflicts.
Some of this information—stage name, titles, credits, artwork, date, and metadata—must necessarily be published on platforms to perform the requested distribution.
3.4. Royalties, payments, and compliance
- collect, reconcile, and pay royalties;
- verify identity, ownership, and beneficiary;
- manage taxes, withholding, and accounting;
- prevent fraud, money laundering, sanctions violations, and chargebacks;
- comply with requirements from banks, processors, distributors, and authorities.
3.5. Booking, collaborations, and opportunities
- create profiles and EPKs;
- present artists to organizers, brands, venues, or collaborators;
- verify availability and compatibility;
- negotiate terms, agreements, and logistics;
- administer collections, commissions, and settlements;
- document permissions concerning image, voice, and trademarks.
Only data reasonably necessary to evaluate or carry out the opportunity shall be shared.
3.6. Communications and marketing
- respond to inquiries and send requested information;
- communicate changes concerning the service, security, or account;
- send reminders about expiration dates and release tasks;
- send news, opportunities, or promotions when there is consent or another valid lawful basis;
- measure interest in content and improve the experience.
A person may withdraw consent to promotional communications without affecting messages necessary for an agreement, payment, security, or claim.
3.7. Security, integrity, and defense of rights
- protect accounts, systems, the catalog, and personnel;
- detect abuse, artificial streams, impersonation, or malware;
- preserve evidence;
- manage copyright claims, counter-notices, and other claims;
- exercise or defend rights in administrative, judicial, or out-of-court proceedings.
3.8. Internal management and improvement
- prepare aggregated statistics;
- audit processes and quality;
- train the team using minimized data;
- plan services, territories, and providers;
- perform backups and ensure business continuity.
Whenever possible, information used for analysis shall be aggregated or pseudonymized.
Legal bases and authorizations
4.1. Applicable bases
Depending on the country and activity, processing may rely on:
- authorization or consent, when you voluntarily provide data, select a checkbox, or request contact;
- pre-contractual measures and performance of an agreement, to evaluate an application, prepare a quote, distribute, pay royalties, or manage booking;
- legal obligation, for accounting, taxes, fraud prevention, copyright, consumer matters, or authority requests;
- legitimate interests, where recognized by law, for security, defense of claims, reasonable improvement, and communication with clients, always assessing the person’s rights;
- protection of vital interests or public interest, only in exceptional situations provided by law.
For data subjects in Colombia, processing shall be carried out in accordance with the general data-protection regime and applicable authorization requirements. For data subjects in Mexico, the principles and rights applicable to personal data held by private parties shall apply. Where the European Union General Data Protection Regulation applies, the corresponding legal bases and safeguards for international transfers shall be disclosed.
4.2. Verifiable consent
Star Mark may preserve evidence of authorization, including the date, channel, accepted text, IP address, checkbox, message, or electronic signature. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal and does not prevent retention of data required by an agreement or by law.
4.3. Marketing
Contact databases shall not be sold and mass campaigns shall not be sent without a valid basis. Each promotional communication shall provide a reasonable way to opt out. Messages required to provide the service are not optional marketing.
4.4. Consequences of not providing data
A person may refuse to provide optional data. However, Star Mark may be unable to evaluate, distribute, pay, contract, or respond to certain requests without the minimum information required for identity, rights, payment, security, and compliance.
Processors and transfers
5.1. Providers and recipients
Star Mark may share data, subject to agreements and reasonable safeguards, with:
- hosting, cloud, storage, backup, security, and technical-support providers;
- email, messaging, and WhatsApp/Meta services;
- payment processors, banks, accounting, and billing providers;
- verification, identity, signature, and fraud-prevention providers;
- music distributors, aggregators, DSPs, social platforms, and identification services;
- domain, hosting, EPK, web, and authorized analytics providers;
- studios, producers, designers, photographers, videographers, and project personnel;
- organizers, venues, brands, promoters, and collaborators when an opportunity exists;
- lawyers, accountants, auditors, and insurers subject to confidentiality;
- authorities or courts when there is a legal obligation or valid request.
Providers may use the information only for the contracted service or in accordance with their independent legal role.
5.2. International transfers
Music distribution and digital tools involve international data flows. Data may be processed in Colombia, Mexico, the United States, the European Union, or other countries where providers and platforms operate. Some territories may provide different levels of protection.
Where required by law, Star Mark shall use valid mechanisms such as informed consent, data-transmission agreements, protective clauses, adequacy decisions, or other safeguards. It shall also limit data to what is necessary for the purpose.
5.3. Platforms as independent controllers
A platform may independently determine how it processes accounts, audiences, payments, streaming, or advertising. Star Mark does not control those decisions. A person should review the third party’s policy before opening an account, playing content, making a payment, or submitting information.
5.4. Business transactions
In a reorganization, investment, merger, acquisition, or asset transfer, relevant data may be reviewed or transferred subject to confidentiality and in accordance with the original purpose and applicable law.
5.5. No sale of data
Star Mark does not sell personal data and does not operate as a data broker. It also does not share data for cross-context behavioral advertising without providing the notice and choice or obtaining the consent required by law.
Retention and security
6.1. Periods and criteria
Data is retained for the time required for the purpose and applicable obligations. As a general guideline:
| Information | Indicative retention period |
|---|---|
| Drafts in public forms | Remain in the browser and are not transmitted until the person chooses to send them. |
| EPK demo files | Are processed locally and deleted when the tool is closed or reloaded. |
| A&R applications not selected | Up to 12 months from the last interaction, unless deletion is requested, consent is given to retain them, or there is a legal need. |
| Active account, catalog, and agreements | During the relationship and for the subsequent period required for reports, payments, takedowns, and legal obligations. |
| Billing, taxes, and accounting | For the mandatory periods established by applicable law. |
| Copyright, fraud, and claims | During the dispute and the applicable limitation or defense periods. |
| Promotional communications | Until the person withdraws consent or objects. |
| Technical and security logs | For a period proportionate to prevention, investigation, and business continuity. |
Data may be anonymized for statistics; once irreversibly anonymized, it no longer identifies the person.
6.2. Security
Star Mark applies reasonable and proportionate measures, including:
- access and privilege controls;
- authentication and protected passwords;
- encryption in transit where available;
- backups and activity logs;
- confidentiality agreements and restricted access;
- provider review;
- incident management and technical updates;
- verification before changes to payment or ownership information.
No system is infallible. Do not send passwords, full card data, private keys, or unnecessarily sensitive information by email or WhatsApp.
6.3. Incidents
When an incident may materially affect people’s rights, Star Mark shall investigate, contain the risk, document the measures taken, and notify data subjects or authorities when required by law. The notice may include the nature of the incident, affected data, likely consequences, and recommendations.
6.4. User responsibility
The user must protect credentials, keep devices updated, verify links, and report unauthorized access. Star Mark shall never request a full password through chat.
Rights of data subjects
7.1. General rights
Depending on the jurisdiction, a person may request:
- access to or knowledge of personal data;
- updating and rectification;
- erasure, deletion, or cancellation where applicable;
- objection to or restriction of processing;
- withdrawal of consent;
- proof of authorization;
- information about use and recipients;
- portability where legally and technically applicable;
- not to be subject to decisions based solely on automated processing that produce significant effects;
- submission of a complaint to the competent authority.
In Colombia, recognized rights include the right to know, update, rectify, request proof of authorization, be informed, submit complaints, and request withdrawal or deletion in permitted cases. In Mexico, rights of access, rectification, cancellation, and objection—ARCO rights—as well as withdrawal and restriction, shall be addressed. Where the GDPR applies, erasure, restriction, portability, and objection shall also be considered in accordance with that regulation.
7.2. How to submit a request
Send an email to contacto@starmarkagencia.com with the subject “Privacy and personal data” and include:
- full name and stage name, if applicable;
- a method for receiving the response;
- a clear description of the right or request;
- the related data, account, conversation, or project;
- a document or reasonable information to verify identity;
- the representative’s authorization, if another person is acting.
Do not send more information than necessary. Star Mark may request clarification to avoid disclosing data to the wrong person.
7.3. Response and limitations
The request shall be addressed within the applicable legal time limits. It may be denied in whole or in part where there is a retention obligation, defense of rights, fraud, third-party rights, inability to verify identity, or another legal exception. The response shall explain the reason and available remedies.
No fee shall be charged for an ordinary request, except for costs permitted by law in the case of manifestly unfounded, excessive, or repetitive requests.
7.4. Authorities
A person may approach the competent data-protection authority. Where the law requires a prior inquiry or complaint to Star Mark, the channel above must be used before the external complaint is submitted.
7.5. Non-discrimination
Star Mark shall not unjustifiably deny a service or retaliate because a person legitimately exercises privacy rights. Some functions may cease to be available if the deleted data was essential to providing the service.
Contact and updates
8.1. Privacy contact
Controller: Star Mark Agencia / Star Mark Records
Email: contacto@starmarkagencia.com
WhatsApp: +57 311 337 6000
Address: Cra. 44 #19A-100, El Poblado, Medellín, Antioquia, Colombia.
Subject line: “Privacy and personal data”.
8.2. Changes
This policy may be updated when services, providers, tools, territories, or rules change. The version and date shall appear at the beginning. If a change materially alters a purpose or requires new authorization, notice shall be provided and consent requested where applicable.
8.3. Languages
Translations may be published. In the event of a difference, the Spanish version shall be the general reference, unless an agreement or mandatory rule provides otherwise.