Data protection

From: ProLitteris
Date: 06.08.2026
Validity: With immediate effect until revoked
Version: 3.0, replaces the previous privacy policy
Responsible: Team Legal

1 Scope of application

This privacy policy describes how ProLitteris processes personal data.

It applies to ProLitteris, Swiss cooperative for copyrights in literature and art, as well as to the social welfare foundation of ProLitteris and the Cultural Fund Foundation of ProLitteris. When the term «ProLitteris» is used below, it refers to these organizations, insofar as they process personal data in the specific context.

This privacy policy is addressed to persons who are in contact with ProLitteris. These include in particular rights holders, members, users of protected works and performances, licensees, customers of MyCopyright, applicants, candidates, employees, members of bodies and committees, business partners, service providers, as well as visitors to the website and portals of ProLitteris.

Personal data is any information that relates to an identified or identifiable natural person. Processing means any handling of personal data, for example collecting, storing, using, disclosing, modifying, archiving, deleting or destroying.

2 Who is responsible for data processing?

The responsible party is:

ProLitteris, Swiss cooperative for copyrights in literature and art

Zurich, Switzerland

Contact details:

ProLitteris
Universitätstrasse 100
8006 Zürich

From 01.10.2026:
Bürglistrasse 17
8002 Zürich

E-mail: info@prolitteris.ch

3 Which law applies?

For ProLitteris, Swiss data protection law applies in the first instance.

Insofar as ProLitteris processes personal data in connection with persons or activities in the Principality of Liechtenstein, the law of the Principality of Liechtenstein and the General Data Protection Regulation of the European Union may additionally apply.

Insofar as the General Data Protection Regulation of the European Union applies in exceptional cases to individual processing operations, ProLitteris takes its requirements into account. Nevertheless, this privacy policy primarily uses the terms of Swiss data protection law.

4 Why does ProLitteris process personal data?

ProLitteris processes personal data in order to fulfill its statutory, constitutional, contractual and operational tasks.

These include in particular:

the management of copyrights and related tasks
the conclusion and performance of management agreements
the management of memberships
the licensing of uses of protected works
the cooperation with collecting societies in Switzerland and abroad
the conclusion and performance of contracts with business partners
the collection of royalties
the distribution of royalties to rights holders
the application of tariffs, rules, bylaws and legal obligations
the operation of websites, portals and services
customer service, correspondence and communication
the organization of events, meetings and votes
the activities of the social welfare foundation and the Cultural Fund Foundation
the handling of applications and employment relationships
the security, further development and control of the organization and systems of ProLitteris
the assertion, exercise or defense of legal claims

5 On what basis does ProLitteris process personal data?

ProLitteris processes personal data if there is an objective reason for doing so and the processing is proportionate.

Data processing may in particular be based on:

a contract or the preparation of a contract
the Copyright Act, tariffs, rules, bylaws or official authorizations
statutory retention, information or reporting obligations
the consent of the data subject
overriding legitimate interests of ProLitteris or third parties
the performance of rights management
the conduct of court, debt collection, administrative or supervisory proceedings

Where ProLitteris obtains consent, this can in principle be revoked with effect for the future. Processing that has already taken place remains lawful, insofar as it was permissible at the time of processing or continues to be based on another legal basis.

6 Which personal data does ProLitteris process in general?

Depending on the relationship with ProLitteris, ProLitteris processes different data. These may in particular include:

last name, first name, address, e-mail address, telephone number and further contact details
year of birth and/or date of birth
nationality, language and correspondence preferences
information on companies, organizations, function, power of representation, UID and commercial register data
membership, contract and customer numbers
bank details, payment data, value-added tax information and accounting data
information on works, publications, uses, rights, participations and repertoires
information on management agreements, license agreements, tariffs, invoices, reminders and distributions
login data, portal data, technical identifiers, IP addresses, log data and usage data
correspondence, support inquiries, conversation notes and documents
information from public registers, industry directories and databases
data from court, debt collection, administrative or supervisory proceedings
application, personnel and committee data
applications in connection with social benefits and cultural promotion

ProLitteris only processes data that is necessary or appropriate for the respective purpose.

ProLitteris processes particularly sensitive personal data only insofar as this is necessary for the respective purpose, as may be the case for social benefits. Where required by law, the explicit consent of the data subject is obtained.

7 Data of rights holders and members

Rights holders share data with ProLitteris when they conclude a management agreement, become a member, declare works, participate in distributions, claim benefits from the social welfare foundation or communicate with ProLitteris.

These include in particular:

address and contact details
information on the person, activity, nationality and language
information on membership and management agreement
information on rights, works, publications, exhibitions, broadcasts, online uses or other forms of use
information on publishing houses, co-authors, heirs, representatives or beneficiaries
bank details, tax and value-added tax information
payout, accounting and distribution data
identification numbers such as MemberID, creditor number or international rights holder identifiers
where applicable, copies of identity documents or powers of attorney, insofar as this is necessary for identification or verification
data from publicly accessible registers, library catalogues, industry directories and work databases
correspondence and support data

ProLitteris processes this data in particular in order to conclude and perform management agreements, to manage rights, to record uses, to distribute royalties, to fulfill legal and regulatory obligations and to cooperate with collecting societies in Switzerland and abroad. erträge abzuschliessen und durchzuführen, Rechte zu verwalten, Nutzungen zu erfassen, Vergütungen zu verteilen, gesetzliche und reglementarische Pflichten zu erfüllen und mit in- und ausländischen Verwertungsgesellschaften zusammenzuarbeiten.

8 Data of users and licensees

Users of protected works, licensees and organizations subject to tariffs share data with ProLitteris when they owe statutory royalties, conclude license agreements, declare uses, receive invoices or communicate with ProLitteris.

These include in particular:

address and contact details
information on company, organization, industry, activity, locations, employees, user groups or relevant operating sizes
UID, commercial register data and further identification data
information that is required under tariffs or license agreements for royalty obligations and royalty level
information on used works, types of use, uses such as broadcasts or copies or other uses
invoicing, payment, reminder and collection data
correspondence, contract documents and support data
data from public registers and industry directories

ProLitteris processes this data in particular for licensing, collection, the distribution of royalties, the enforcement of claims and the fulfillment of statutory and tariff obligations.

9 MyCopyright

MyCopyright is a digital service of ProLitteris for depositing, sealing and time-stamping files. Customers can upload files, provide them with technical evidence and deposit them with ProLitteris. A certificate can be generated if required.

When using MyCopyright, ProLitteris processes in particular the following data:

account and login data
name, address, e-mail address, language and further contact details
contract, subscription, payment and invoicing data
support and communication data
uploaded files
file names, folder structures, descriptions, titles and other information entered by customers
statements by customers regarding the file, authorization, authorship or rights holding, insofar as such information is collected
technical metadata
hash values, time stamps, signature or seal information
certificate data
log and security data
information on releases, retrievals, exports or deletions

Uploaded files may contain personal data. Customers decide themselves which files they upload. They are responsible for not uploading unauthorized personal data or unlawful content. They must respect the rights of third parties.

ProLitteris processes MyCopyright data in particular in order to provide the service, to deposit files, to generate technical evidence, to issue certificates, to support customers, to process payments, to ensure the security and integrity of the service, to prevent misuse and to assert or defend legal claims.

MyCopyright does not create copyrights. The service does not replace a legal review or legal advice. The technical deposit and the certificate can serve as evidence but do not definitively confirm authorship, rights holding, protectability, originality, novelty or freedom from third-party rights.

For the technical operation of MyCopyright, ProLitteris uses Swiss Trust Layer AG. Swiss Trust Layer operates technical components of the service, in particular for upload, storage, encryption, sealing, time stamping, certificate creation, availability, security, technical support and technical further development.

Insofar as Swiss Trust Layer processes personal data on behalf of ProLitteris, Swiss Trust Layer acts as a processor. Swiss Trust Layer may process personal data only in accordance with the contractual specifications of ProLitteris and only for the agreed purposes. ProLitteris has a data processing agreement with Swiss Trust Layer.

Swiss Trust Layer may use further technical service providers, insofar as this is necessary for the operation of MyCopyright, ProLitteris has approved their engagement in advance and the data protection requirements have been contractually specified and fulfilled. ProLitteris ensures that such service providers comply with appropriate confidentiality, data protection and security requirements.

Swiss Trust Layer obtains qualified electronic signatures from Swisscom Trust Services in accordance with the Federal Act on Electronic Signatures (ZertES).

The digital fingerprint, the qualified electronic signature, is certified and stored exclusively in Switzerland. The uploaded files are stored in the Microsoft Azure cloud with the option of choosing another storage location, in particular a storage location in Switzerland.

10 Portal and website

When you use the website of ProLitteris, the ProLitteris portal or other digital services, technical data may be processed. These include in particular:

IP address
date, time and duration of access
pages and content accessed
access status and data volume transferred
browser and operating system used
language settings
device information
referrer URL
login and session data
security and error logs

ProLitteris processes this data to provide the digital services of ProLitteris, to ensure security, to prevent misuse, to correct errors and to further develop these services.

For the ProLitteris portal and MyCopyright, additional login, account, contract, usage and support data may be processed.

The data from the portal and website is stored exclusively in Switzerland or in the European Economic Area (EEA).

11 Cookies

ProLitteris uses cookies and similar technologies.

Cookies are small files that are stored on your device. They can be used to provide a website technically, to maintain a session, to save language settings, to ensure security or to analyze the use of a website.

ProLitteris in particular uses:

necessary cookies that are required for the operation of the website, the portal or a service
functional cookies, for example for language settings or preferences
analytics cookies, insofar as ProLitteris measures and improves the use of the digital services of ProLitteris

You can completely or partially deactivate or delete cookies in your browser settings. If you deactivate necessary cookies, certain functions may not be available or may be available only to a limited extent.

Insofar as ProLitteris uses analytics or marketing cookies that require consent, ProLitteris obtains this via a cookie banner. You can in principle revoke consent given with effect for the future.

Which cookies are currently used by ProLitteris can be found in our cookie policy. You can manage your personal consent preferences there.

12 Data for newsletters and communication

ProLitteris may process personal data for newsletters, invitations, specialist information, events and other communications.

For the newsletter, ProLitteris generally uses your consent. You can unsubscribe at any time. In the case of contractual or statutory communications, for example regarding membership, distributions, invoices, tariffs, portals or MyCopyright, ProLitteris may contact you even without newsletter consent, insofar as this is necessary for the respective relationship.

13 Data for the social welfare foundation and the Cultural Fund Foundation

The social welfare foundation of ProLitteris processes personal data when persons apply for or receive benefits or communicate with the foundation. These may in particular include contact details, membership and distribution data, information on the personal and financial situation, benefit data, bank data, correspondence and decision documents.

The Cultural Fund Foundation of ProLitteris processes personal data when organizations or persons submit applications, are involved in projects, receive contributions or communicate with the foundation. These may in particular include contact details, project information, information on persons involved, funding data, decision documents, payment data and correspondence.

This data is processed in order to examine applications, to grant benefits or contributions, to process payments, to document decisions, to fulfill statutory and constitutional obligations and to manage the activities of the foundations.

14 Data of employees, applicants and committee members

ProLitteris processes personal data of employees, applicants, former employees, members of bodies and committees and other persons who work for ProLitteris or apply for a position.

These include in particular:

contact and identification data
application documents
information on education, professional experience and qualifications
employment contract, salary, social insurance, tax and bank data
working time, absence and performance data
IT, access and security data
correspondence and personnel documents

Data in connection with activities in bodies and committeesThis data is processed in order to examine applications, to carry out employment and mandate relationships, to fulfill statutory obligations, to ensure security and organization and to assert or defend claims.

15 From where does ProLitteris obtain personal data?

ProLitteris obtains personal data in particular:

directly from data subjects
from rights holders, members, users, customers, applicants and business partners
via portals, forms, e-mail, telephone, mail or personal contacts
from public registers, for example the commercial register, the UID register or other official registers
from library catalogues, industry directories, work catalogues, catalogues of publishing houses and publicly accessible sources
from collecting societies in Switzerland and abroad
from authorities, courts, debt collection offices, legal representatives and collection agencies
from service providers insofar as they transmit data on behalf of or with authorization
through technical systems, servers, portals, websites and security logs

16 To whom does ProLitteris disclose personal data?

ProLitteris discloses personal data only if this is necessary for a permissible purpose.

Recipients may in particular be:

collecting societies in Switzerland and abroad
rights holders, publishing houses, users or licensees, insofar as this is necessary for rights management, licensing, accounting or clarification of claims
authorities, courts, debt collection offices, supervisory bodies and other official entities
banks, payment service providers, auditors, insurance companies, fiduciaries and consultants
attorneys, collection agencies and other representatives
IT, hosting, cloud, portal, support, printing, shipping, communication and security service providers
technical operators of services, in particular Swiss Trust Layer in connection with MyCopyright
service providers for events, newsletters, surveys or communication
recipients in connection with foundation benefits or cultural promotion, insofar as this is necessary

ProLitteris does not sell personal data.

17 Does ProLitteris disclose personal data abroad?

ProLitteris operates in Switzerland, processes and stores personal data mostly in Switzerland or in the European Economic Area (EEA), but also works with foreign collecting societies, service providers, authorities, courts, legal representatives and other entities. Personal data may therefore also be disclosed abroad or processed there.

Disclosure abroad occurs in particular if:

this is necessary for the international management of rights
a foreign collecting society requires data for licensing or distribution
a service provider processes data abroad
there is a statutory obligation
claims are asserted, exercised or defended
the data subject has given consent

Since ProLitteris cooperates with collecting societies around the world, a transfer is also conceivable to countries outside Switzerland or the EEA.

If a recipient is located in a country without adequate data protection, ProLitteris takes appropriate measures, insofar as this is required by law. These may include contractual safeguards, standard contractual clauses or other appropriate protection measures. In certain cases, a transfer may also be permissible without such safeguards, for example in the case of explicit consent, for contract execution or for legal enforcement.

18 How does ProLitteris protect personal data?

ProLitteris takes appropriate technical and organizational measures to protect personal data.

Depending on the system and data category, these include in particular:

access restrictions
role and authorization concepts
password protection and, where appropriate, multi-factor authentication
encryption or secure transmission
logging of security-relevant processes
data backups
protection against loss, misuse, unauthorized access and modification
training and confidentiality obligations
security requirements for service providers
procedures for dealing with security incidents

Despite such measures, security risks cannot be completely excluded. Internet-based communication and digital services may in particular be impaired by technical malfunctions, attacks or misconduct by third parties.

19 How long does ProLitteris retain personal data?

ProLitteris retains personal data for as long as this is necessary for the respective purpose.

The duration depends in particular on:

contract term
statutory retention obligations
constitutional and regulatory obligations
limitation periods
interests in evidence and documentation
requirements of authorities, courts or supervisory bodies
legitimate interests of ProLitteris or data subjects

Business, contract, accounting and bookkeeping documents can generally be retained for ten years. Certain data may be retained for a longer period if this is necessary for rights management, distributions, claims, archives, disputes or statutory obligations.

For MyCopyright, the contractual rules of the service additionally apply. Uploaded files, hash values, time stamps, certificate data and logs are in principle retained for as long as this is necessary for the provision of the service, the evidential function, security, contract performance and statutory or evidentiary purposes. After the end of the contract, termination or non-payment, files and data may be deleted, blocked or archived in accordance with the terms of use. Before deletion, ProLitteris may provide for an export or transition period.

20 What rights do data subjects have?

Within the framework of applicable data protection law, data subjects in particular have the right:

to request information about their personal data
to have incorrect personal data corrected
to request the deletion of personal data
to request the restriction of certain processing operations
to object to certain processing operations
to revoke consent given with effect for the future
to request the handover or transfer of certain data, insofar as provided for by law
to lodge a complaint with the competent data protection authority

ProLitteris may restrict or reject a request if legal, contractual, constitutional or overriding legitimate grounds conflict with it. This may in particular be the case if data is still required for rights management, distribution, accounting, legal enforcement, documentation or the fulfillment of statutory obligations.

Requests can be addressed to the contact point in accordance with section 2. ProLitteris may require appropriate identification so that data is not disclosed to unauthorized persons.

21 Is the provision of personal data voluntary?

In many cases, you provide data to ProLitteris voluntarily. However, without certain data, ProLitteris cannot provide its services or can provide them only to a limited extent.

Examples:

Without contact details, ProLitteris cannot communicate.
Without bank details, ProLitteris cannot pay out royalties.
Without work or usage data, ProLitteris cannot carry out certain distributions or licensing.
Without tariff-relevant information, ProLitteris cannot correctly assess royalty obligations.
Without login and security data, portals or MyCopyright cannot be used.
Without certain information, the social welfare foundation or the Cultural Fund Foundation cannot examine an application.

For users of works, there is a statutory obligation under Art. 51 para. 1 CopA to provide collecting societies with the information required and reasonable for tariffs and revenue distribution, which may also include personal data.

22 Are automated individual decisions made?

ProLitteris may process data in an automated manner, for example in portals, for calculations, checks, distributions, invoices or technical security processes.

Insofar as ProLitteris uses automated processing operations, they generally serve the efficient performance of statutory, contractual or regulatory tasks. If a decision with legal effect or significant impact were made solely in an automated manner, ProLitteris informs the data subject, insofar as this is required by law.

23 Does this privacy policy also apply to third-party services?

This privacy policy does not apply to websites, platforms or services of third parties to which ProLitteris links or which are accessible in another way. The privacy policies of the respective providers apply to such services. ProLitteris assumes no responsibility for their data processing.

Insofar as ProLitteris uses service providers that process personal data on behalf of ProLitteris, contractual data protection and security requirements apply.

24 Amendments to the privacy policy

ProLitteris may amend this privacy policy at any time, in particular if the activities, digital services, service providers, legal requirements or internal processes of ProLitteris change.

The current version published on the website of ProLitteris applies. In the event of material changes, ProLitteris may additionally inform in an appropriate manner, for example via the website, portal or e-mail.

25 Who can I contact?

For questions about data protection, for information requests or for other concerns in connection with personal data, you can contact the following office:

Contact for data protection questions:

ProLitteris, Swiss cooperative for copyrights
Universitätstrasse 100
8006 Zürich

Team Legal
E-mail: info@prolitteris.ch

The competent supervisory authority in Switzerland is the Swiss Federal Data Protection and Information Commissioner (FDPIC).