Data protection

From: ProLitteris
Date: 06.08.2026
Validity: With immediate effect until revoked
Version: 3.0, replaces the previous privacy policy
Responsible: Team Legal

1 Scope of application

This privacy policy describes how ProLitteris processes personal data.

It applies to ProLitteris, Swiss cooperative for copyrights in literature and art, as well as to the ProLitteris welfare foundation and the ProLitteris cultural fund foundation. When the term «ProLitteris» is used below, these organizations are meant, insofar as they process personal data in the specific context.

This privacy policy is aimed at persons who are in contact with ProLitteris. These include in particular rights holders, members, users of protected works and performances, licensees, customers of MyCopyright, applicants for benefits, job applicants, employees, members of bodies and committees, business partners, service providers, as well as visitors to the website and portals of ProLitteris.

Personal data is all information that relates to an identified or identifiable natural person. Processing means any handling of personal data, for example collecting, storing, using, disclosing, modifying, archiving, deleting or destroying.

2 Who is responsible for data processing?

The responsible party is:

ProLitteris, Cooperative for authors’ rights

Zurich, Switzerland

Contact details:

ProLitteris, Cooperative for authors’ rights
Universitätstrasse 100
8006 Zurich

From 01.10.2026:
Bürglistrasse 17
8002 Zurich

Email: info@prolitteris.ch

3 Which law applies?

For ProLitteris, Swiss data protection law applies primarily.

Insofar as ProLitteris processes personal data in connection with persons or activities in the Principality of Liechtenstein, the law of the Principality of Liechtenstein and the General Data Protection Regulation of the European Union may additionally be applicable.

Insofar as the General Data Protection Regulation of the European Union is exceptionally applicable to individual processing operations, ProLitteris takes its requirements into account. Nevertheless, this privacy policy primarily uses the terms of Swiss data protection law.

4 Why does ProLitteris process personal data?

ProLitteris processes personal data in order to fulfill its statutory, constitutional, contractual and operational tasks.

These include in particular:

the administration of copyrights and related tasks
the conclusion and performance of management agreements
the administration of memberships
the licensing of uses of protected works
the cooperation with collecting societies in Switzerland and abroad
the conclusion and performance of contracts with business partners
the collection of royalties
the distribution of royalties to rights holders
the application of tariffs, rules, statutes and legal obligations
the operation of websites, portals and services
customer service, correspondence and communication
the organization of events, meetings and votes
the activities of the welfare foundation and the cultural fund foundation
the handling of job applications and employment relationships
the security, further development and control of the organization and systems of ProLitteris
the assertion, exercise or defense of legal claims

5 On what basis does ProLitteris process personal data?

ProLitteris processes personal data if there is a legitimate reason for doing so and the processing is proportionate.

Data processing may in particular be based on:

a contract or the preparation of a contract
the Copyright Act, tariffs, rules, statutes or official authorizations
statutory retention, information or reporting obligations
the consent of the data subject
overriding legitimate interests of ProLitteris or third parties
the fulfillment of rights management
the conduct of court, debt collection, administrative or supervisory proceedings

Where ProLitteris obtains consent, this can generally be revoked with effect for the future. Processing already carried out remains lawful, insofar as it was permissible at the time of processing or continues to be based on another ground.

6 Which personal data does ProLitteris generally process?

Depending on the relationship with ProLitteris, ProLitteris processes different data. These may in particular include:

name, first name, address, email address, telephone number and other contact details
year of birth and/or date of birth
nationality, language and correspondence preferences
information on companies, organizations, function, signing authority, UID and commercial register data
membership, contract and customer numbers
bank details, payment data, value added tax information and accounting data
information on works, publications, uses, rights, participations and repertoires
information on management agreements, license agreements, tariffs, invoices, reminders and distributions
login data, portal data, technical identifiers, IP addresses, log data and usage data
correspondence, support requests, conversation notes and documents
information from public registers, industry directories and databases
data from court, debt collection, administrative or supervisory proceedings
application, personnel and committee data
applications in connection with social benefits and cultural promotion

ProLitteris only processes those data that are necessary or appropriate for the respective purpose.

ProLitteris only processes particularly sensitive personal data insofar as this is necessary for the respective purpose, as may be the case with social benefits. Where required by law, the explicit consent of the data subject is obtained.

7 Data of rights holders and members

Rights holders share data with ProLitteris when they conclude a management agreement, become a member, declare works, participate in distributions, claim benefits from the welfare foundation or communicate with ProLitteris.

These include in particular:

address and contact details
information on the person, activity, nationality and language
information on membership and management agreement
information on rights, works, publications, exhibitions, broadcasts, online uses or other forms of use
information on publishing houses, co-authors, heirs, representatives or beneficiaries
bank details, tax and value added tax information
payment, accounting and distribution data
identification numbers such as MemberID, creditor number or international rights holder identifiers
where applicable, copies of identity documents or powers of attorney, insofar as this is necessary for identification or verification
data from publicly accessible registers, library catalogs, industry directories and work databases
correspondence and support data

ProLitteris processes these data in particular in order to conclude and perform management agreements, to manage rights, to record uses, to distribute royalties, to fulfill statutory and regulatory obligations and to cooperate with collecting societies in Switzerland and abroad. erträge abzuschliessen und durchzuführen, Rechte zu verwalten, Nutzungen zu erfassen, Vergütungen zu verteilen, gesetzliche und reglementarische Pflichten zu erfüllen und mit in- und ausländischen Verwertungsgesellschaften zusammenzuarbeiten.

8 Data of users and licensees

Users of protected works, licensees and organizations subject to tariffs share data with ProLitteris when they owe statutory royalties, conclude license agreements, declare uses, receive invoices or communicate with ProLitteris.

These include in particular:

address and contact details
information on company, organization, industry, activity, locations, employees, user groups or relevant operating sizes
UID, commercial register data and other identification data
information required under tariffs or license agreements for royalty liability and the amount of royalties
information on used works, types of use, uses such as broadcasts or copies or other uses
invoicing, payment, reminder and collection data
correspondence, contract documents and support data
data from public registers and industry directories

ProLitteris processes these data in particular for licensing, collection, distribution of royalties, enforcement of claims and fulfillment of statutory and tariff obligations.

9 MyCopyright

MyCopyright is a digital service of ProLitteris for depositing, sealing and time-stamping files. Customers can upload files, provide them with technical evidence and deposit them with ProLitteris. A certificate can be generated if required.

When using MyCopyright, ProLitteris processes in particular the following data:

account and login data
name, address, email address, language and other contact details
contract, subscription, payment and invoicing data
support and communication data
uploaded files
file names, folder structures, descriptions, titles and other information entered by customers
declarations by customers regarding the file, authorization, authorship or rights holding, insofar as such information is collected
technical metadata
hash values, time stamps, signature or seal information
certificate data
log and security data
information on releases, retrievals, exports or deletions

Uploaded files may contain personal data. Customers decide themselves which files they upload. They are responsible for not uploading unauthorized personal data or unlawful content. They must respect the rights of third parties.

ProLitteris processes MyCopyright data in particular in order to provide the service, to deposit files, to generate technical evidence, to issue certificates, to support customers, to process payments, to ensure the security and integrity of the service, to prevent misuse and to assert or defend legal claims.

MyCopyright does not create copyrights. The service does not replace a legal review or legal advice. The technical deposit and the certificate can serve as evidence, but do not conclusively confirm authorship, rights holding, protectability, originality, novelty or freedom from third-party rights.

For the technical operation of MyCopyright, ProLitteris uses Swiss Trust Layer AG. Swiss Trust Layer operates technical components of the service, in particular for upload, storage, encryption, sealing, time-stamping, certificate creation, availability, security, technical support and technical further development.

Insofar as Swiss Trust Layer processes personal data on behalf of ProLitteris, Swiss Trust Layer acts as a processor. Swiss Trust Layer may only process personal data in accordance with the contractual specifications of ProLitteris and only for the agreed purposes. ProLitteris has a data processing agreement with Swiss Trust Layer.

Swiss Trust Layer may use further technical service providers, insofar as this is necessary for the operation of MyCopyright, ProLitteris has approved their involvement in advance and the data protection requirements are contractually stipulated and fulfilled. ProLitteris ensures that such service providers comply with appropriate confidentiality, data protection and security requirements.

Swiss Trust Layer obtains qualified electronic signatures from Swisscom Trust Services in accordance with the Federal Act on Electronic Signatures (ZertES).

The digital fingerprint, the qualified electronic signature, is certified and stored exclusively in Switzerland. The uploaded files are stored in the Microsoft Azure cloud with the option of choosing another storage location, in particular a storage location in Switzerland.

10 Portal and website

When you use the ProLitteris website, the ProLitteris portal or other digital offerings, technical data may be processed. These include in particular:

IP address
date, time and duration of access
pages and content accessed
access status and data volume transferred
browser and operating system used
language settings
device information
referrer URL
login and session data
security and error logs

ProLitteris processes these data in order to provide the digital offerings of ProLitteris, to ensure security, to prevent misuse, to correct errors and to further develop these offerings.

For the ProLitteris portal and MyCopyright, additional login, account, contract, usage and support data may be processed.

The data from portal and website are stored exclusively in Switzerland or the European Economic Area (EEA).

11 Cookies

ProLitteris uses cookies and similar technologies.

Cookies are small files that are stored on your device. They can be used to provide a website technically, to maintain a session, to store language settings, to ensure security or to analyze the use of a website.

ProLitteris uses in particular:

necessary cookies that are required for the operation of the website, the portal or a service
functional cookies, for example for language settings or preferences
analytics cookies, insofar as ProLitteris measures and improves the use of the digital offerings of ProLitteris

You can deactivate or delete cookies in whole or in part in your browser settings. If you deactivate necessary cookies, certain functions may not be available or may only be available to a limited extent.

Insofar as ProLitteris uses analytics or marketing cookies that require consent, ProLitteris obtains this via a cookie banner. You can generally revoke consent given with effect for the future.

You can find which cookies are currently used by ProLitteris in our cookie policy. You can manage your personal consent preferences there.

12 Data for newsletters and communication

ProLitteris may process personal data for newsletters, invitations, specialist information, events and other communications.

For the newsletter, ProLitteris generally uses your consent. You can unsubscribe at any time. For contractual or statutory communications, for example regarding membership, distributions, invoices, tariffs, portals or MyCopyright, ProLitteris may contact you even without newsletter consent, insofar as this is necessary for the respective relationship.

13 Data for the welfare foundation and the cultural fund foundation

The ProLitteris welfare foundation processes personal data when persons apply for, receive or communicate about benefits with the foundation. These may in particular include contact details, membership and distribution data, information on the personal and financial situation, benefit data, bank data, correspondence and decision documents.

The ProLitteris cultural fund foundation processes personal data when organizations or persons submit applications, are involved in projects, receive contributions or communicate with the foundation. These may in particular include contact details, project information, information on persons involved, funding data, decision documents, payment data and correspondence.

These data are processed in order to review applications, grant benefits or contributions, process payments, document decisions, fulfill statutory and constitutional obligations and manage the activities of the foundations.

14 Data of employees, job applicants and committee members

ProLitteris processes personal data of employees, job applicants, former employees, members of bodies and committees and other persons who work for ProLitteris or apply for a position.

These include in particular:

contact and identification data
application documents
information on education, professional experience and qualifications
employment contract, salary, social security, tax and bank data
working time, absence and performance data
IT, access and security data
correspondence and personnel documents

Data in connection with activities in bodies and committeesThese data are processed in order to review applications, carry out employment and mandate relationships, fulfill statutory obligations, ensure security and organization and assert or defend claims.

15 From where does ProLitteris obtain personal data?

ProLitteris obtains personal data in particular:

directly from data subjects
from rights holders, members, users, customers, applicants and business partners
via portals, forms, email, telephone, post or personal contacts
from public registers, for example commercial register, UID register or other official registers
from library catalogs, industry directories, work directories, publishing house directories and publicly accessible sources
from collecting societies in Switzerland and abroad
from authorities, courts, debt collection offices, legal representatives and collection agencies
from service providers, insofar as they transmit data on behalf of or with authorization
through technical systems, servers, portals, websites and security logs

16 To whom does ProLitteris disclose personal data?

ProLitteris only discloses personal data if this is necessary for a permissible purpose.

Recipients may in particular be:

collecting societies in Switzerland and abroad
rights holders, publishing houses, users or licensees, insofar as this is necessary for rights management, licensing, accounting or clarification of claims
authorities, courts, debt collection offices, supervisory bodies and other official bodies
banks, payment service providers, audit firms, insurance companies, fiduciaries and consultants
lawyers, collection agencies and other representatives
IT, hosting, cloud, portal, support, printing, shipping, communication and security service providers
technical operators of services, in particular Swiss Trust Layer in connection with MyCopyright
service providers for events, newsletters, surveys or communication
recipients in connection with foundation benefits or cultural promotion, insofar as this is necessary

ProLitteris does not sell personal data.

17 Does ProLitteris disclose personal data abroad?

ProLitteris operates in Switzerland, processes and stores personal data mostly in Switzerland or the European Economic Area (EEA), but also works with foreign collecting societies, service providers, authorities, courts, legal representatives and other bodies. Personal data may therefore also be disclosed abroad or processed there.

Disclosure abroad takes place in particular if:

this is necessary for the international management of rights
a foreign collecting society requires data for licensing or distribution
a service provider processes data abroad
there is a statutory obligation
claims are asserted, exercised or defended
the data subject has consented

As ProLitteris cooperates with collecting societies all over the world, a transfer to countries outside Switzerland or the EEA is also conceivable.

If a recipient is located in a country without adequate data protection, ProLitteris takes appropriate measures, insofar as this is required by law. These may include contractual guarantees, standard contractual clauses or other appropriate protective measures. In certain cases, a transfer may also be permissible without such guarantees, for example in the case of explicit consent, for contract processing or for legal enforcement.

18 How does ProLitteris protect personal data?

ProLitteris takes appropriate technical and organizational measures to protect personal data.

Depending on the system and data category, these include in particular:

access restrictions
role and authorization concepts
password protection and, where appropriate, multi-factor authentication
encryption or secure transmission
logging of security-relevant events
data backups
protection against loss, misuse, unauthorized access and modification
training and confidentiality obligations
security requirements for service providers
procedures for handling security incidents

Despite such measures, security risks cannot be completely excluded. Internet-based communication and digital services may in particular be impaired by technical disruptions, attacks or misconduct by third parties.

19 How long does ProLitteris retain personal data?

ProLitteris retains personal data for as long as this is necessary for the respective purpose.

The duration depends in particular on:

contract duration
statutory retention obligations
constitutional and regulatory obligations
limitation periods
interests in evidence and documentation
requirements of authorities, courts or supervisory bodies
legitimate interests of ProLitteris or data subjects

Business, contract, accounting and bookkeeping documents may generally be retained for ten years. Certain data may be retained for longer if this is necessary for rights management, distributions, claims, archives, disputes or statutory obligations.

For MyCopyright, the contractual rules of the service apply additionally. Uploaded files, hash values, time stamps, certificate data and logs are generally retained for as long as this is necessary for the provision of the service, the evidentiary function, security, contract performance and statutory or evidence-related purposes. After contract termination, cancellation or non-payment, files and data may be deleted, blocked or archived in accordance with the terms of use. Before deletion, ProLitteris may provide for an export or transition period.

20 What rights do data subjects have?

Within the framework of the applicable data protection law, data subjects in particular have the right:

to request information about their personal data
to have incorrect personal data corrected
to request the deletion of personal data
to request the restriction of certain processing operations
to object to certain processing operations
to revoke consent given with effect for the future
to request the handover or transfer of certain data, insofar as provided for by law
to lodge a complaint with the competent data protection authority

ProLitteris may restrict or reject a request if statutory, contractual, constitutional or overriding legitimate reasons conflict with it. This may in particular be the case if data are still required for rights management, distribution, accounting, legal enforcement, documentation or fulfillment of statutory obligations.

Requests can be addressed to the contact point in accordance with section 2. ProLitteris may require appropriate identification so that data are not disclosed to unauthorized persons.

21 Is the provision of personal data voluntary?

In many cases, you provide data to ProLitteris voluntarily. Without certain data, however, ProLitteris cannot provide its services or can only provide them to a limited extent.

Examples:

Without contact details, ProLitteris cannot communicate.
Without bank details, ProLitteris cannot pay out royalties.
Without work or usage data, ProLitteris cannot carry out certain distributions or licensing.
Without tariff-relevant information, ProLitteris cannot correctly assess royalty obligations.
Without login and security data, portals or MyCopyright cannot be used.
Without certain information, the welfare foundation or the cultural fund foundation cannot review an application.

For users of works, there is a statutory obligation under Art. 51 para. 1 URG to provide the collecting societies with the information required and reasonable for tariffs and revenue distribution, which may also include personal data.

22 Are automated individual decisions made?

ProLitteris may process data automatically, for example in portals, for calculations, checks, distributions, invoices or technical security processes.

Insofar as ProLitteris uses automated processing, this generally serves the efficient performance of statutory, contractual or regulatory tasks. If a decision with legal effect or significant impact were to be made solely in an automated manner, ProLitteris informs the data subject, insofar as this is required by law.

23 Does this privacy policy also apply to third-party offerings?

This privacy policy does not apply to websites, platforms or offerings of third parties to which ProLitteris links or which are accessible in another way. The privacy policies of the respective providers apply to such offerings. ProLitteris assumes no responsibility for their data processing.

Insofar as ProLitteris uses service providers that process personal data on behalf of ProLitteris, contractual data protection and security requirements apply.

24 Amendment of the privacy policy

ProLitteris may amend this privacy policy at any time, in particular if the activities, digital offerings, service providers, legal requirements or internal processes of ProLitteris change.

The current version published on the ProLitteris website applies. In the event of significant changes, ProLitteris may additionally inform in an appropriate manner, for example via website, portal or email.

25 Who can I contact?

For questions about data protection, for information requests or for other concerns in connection with personal data, you can contact the following office:

Contact for data protection issues:

ProLitteris, Swiss cooperative for copyrights
Universitätstrasse 100
8006 Zurich

Team Legal
Email: info@prolitteris.ch

The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC).