This privacy policy applies to Internet users (“you ”) whose personal data is collected online by Y2M, in particular on Fanlinks published by Y2M and other partner websites.

Y2M markets an advertising automation and business intelligence platform called “Ctrl+Reach.” In the course of our business, we may process information about you.

We attach great importance to respecting your privacy, as well as the security and confidentiality of your personal data (“Personal Data ”).

Consequently, we undertake to process your Personal Data in compliance with French and European regulations on the protection of personal data, namely in particular: law n°78-17 of January 6, 1978 relating to information technology, files and freedoms as amended, EU Regulation 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, as well as any other French or European regulations that may apply to the protection of personal data.

This privacy policy details how we process your Personal Data.

Our Cookie Policy, available at https://y2m.link/fr/cookies-policy, sets out how we use cookies to process your Personal Data.

We invite you to read this privacy policy and the Cookie Policy carefully.

Who Processes your Personal Data?

The data controller of your Personal Data is:

Y2M, a French simplified joint-stock company registered under number 901 305 680 RCS Saint-Brieuc and whose registered office is located at 29 avenue du Léon, 22190 Plérin, France (“Y2M ” or “we ”).

In the course of our business, we may share your Personal Data with third parties. The recipients of this data are:

• authorized personnel of Y2M’s marketing, sales, customer service and IT departments, as well as their line managers, when they need to access your Personal Data as part of their duties in connection with the purposes described below;
• authorized personnel of audit departments (statutory auditors, departments responsible for internal audit procedures, etc.) and our external advisors (lawyers, etc.), where necessary for the purposes of our legitimate interests;
• authorized personnel of our partners, our subcontractors, and our service providers (for example, service providers supplying us with data hosting services or those responsible for creating customized audience pools, such as Meta), acting as data processors of your Personal Data, it being specified that we ensure that these persons present serious guarantees of security and confidentiality of the Personal Data that we transmit to them;
• bodies, auxiliaries of justice, ministerial officers, and judicial and administrative authorities, under the conditions provided for by law, when we are legally obliged to do so or to protect our rights or the rights of third parties;
• any authorized person, when we are obliged to disclose and/or share your Personal Data in order to fulfil our legal obligations.

The use of your Personal Data by third parties, when they are not acting as processors of your Personal Data, is governed by their own privacy policy.

We may also share your personal data with third parties in connection with a potential or actual sale or restructuring of our company or certain of our assets, in which case your data may be one of the transferred assets.

What Personal Data Do We Process About You?

We may process the following categories of Personal Data:

• Data you provide to us when you fill in an online form available on a Fanlink, such as your email address.

The data we collect from you that is necessary to provide you with the requested features and services is identified by an asterisk or equivalent on the collection forms or is otherwise specified as such verbally at the time of collection. If you do not fill in the required fields or do not provide the information marked as required, we will not be able to provide you with the requested features and services.

You agree to provide accurate information that does not harm the interests or rights of third parties.

• Data we automatically collect:
  • when you browse our Fanlinks or third-party websites or applications, through your browsing traces either indirectly via third-party cookies or directly via server event logs (log files). This is your navigation data. This data includes data relating to your connection to the website (IP address, date and time of connection, search engine used, etc.) and data relating to the equipment you are using (type of equipment, operating system and settings); and
  • when, in order to use a Fanlink feature (e.g. adding a track to a playlist), a connection to your personal account on a third-party platform or website is required. This includes your connection data, information relating to your interactions with the Fanlink and the third-party platform or website (number of clicks, adding or deleting music to a playlist, number of listens, etc.) information relating to your personal account on the third-party platform or website (email address, name, login, profile photo, people who follow you and public playlists).

We do not process sensitive personal data about you (such as your religion, political opinions, health, trade union membership, sexual preferences, etc.).

Our services are intended for a general audience and are not directed at children. We do not design our Fanlinks or services to specifically target children.

For What Purposes Is Your Personal Data Processed?

We process your Personal Data for the following purposes:

• Processing for which you consented:
  • Processing of navigation data used to measure the audience for our Fanlinks and to enable you to access the features and services requested, as well as third-party platforms or websites.
  • Processing your contact details to send you commercial communications concerning the artist associated with the Fanlink on which you have provided your email address.
  • We may also process information relating to your interactions with the third-party platform or website to which you connect via Fanlink (adding or deleting music from a playlist, number of listens, etc.), for the purposes of analysis, segmentation and remarketing. In such cases, we undertake to obtain your prior and specific consent to the processing of your data for these purposes.
• Processing necessary for our legitimate interest:
  • Providing and improving our Fanlinks and maintaining a secure environment.
  • Production of commercial statistics, after having made your data anonymous or in any case after having implemented process intended to prevent your re-identification.
  • Creation of advertising audiences.
  • Litigation management.
  • Management of anti-fraud operations.
  • Automatic subscription to an artist’s page on a third-party platform or website when you add a track of that artist to a playlist on the third-party platform or website, as part of your use of Fanlink. You can stop following the artist’s page directly from the platform or third-party website concerned at any time.
• Processing necessary to comply with our legal obligations: some of your Personal Data is also processed to comply with our legal obligations (for example, our obligations to manage requests to exercise rights under the personal data regulation) and to ensure the defense of our interests in the event of litigation or legal action.

Where Is Your Personal Data Processed?

Your Personal Data is processed mainly within the European Union.

Where our relationships with our processors involve cross-border exchanges of your Personal Data outside the European Union, we undertake in the absence of an adequacy decision by the European Commission under Article 45 of the GDPR, to frame such a transfer by appropriate transfer mechanisms under Articles 46 et seq. of the GDPR (such as standard contractual clauses adopted by the European Commission). You will be able to obtain a copy of these (excluding confidential provisions) at any time by contacting us using the contact details set out in Section ‎8 below.

We use the following sub-processors to provide our services. Each acts on our instructions and provides appropriate security and confidentiality safeguards:

Sub-processor	Purpose	Data location
Amazon Web Services (AWS)	Database hosting	France (Paris)
Microsoft Azure	Application and Fanlinks hosting	France (France Central)
PostHog	Audience measurement and product analytics	European Union
Mailgun (Sinch)	Email delivery	European Union
Meta	Campaign delivery and audience building	Ireland / United States
Google	Campaign delivery	Ireland
TikTok	Campaign delivery	United Kingdom
Spotify	Fanlink features (pre-save, follow)	Sweden / United States
Stripe	Billing and payment	United States

List last updated on 17/07/2026.

How Is Your Personal Data Protected and Stored?

Security is one of our core concerns.

Accordingly, we implement appropriate technical and organizational measures, including physical, hardware and software measures, to preserve the security, integrity and confidentiality of your Personal Data, and to protect it from unauthorized access, use, misappropriation, alteration, disclosure or destruction.

We also require our data processors to provide sufficient guarantees of security and confidentiality.

How Long Will Your Data Be Kept?

We keep your Personal Data for the period of time strictly necessary for the purposes set out herein and in accordance with the applicable regulations.

• Concerning data collected with your consent for the purpose of sending commercial communications relating to an artist: your Personal Data is processed until you unsubscribe through the unsubscribe link provided for this purpose in each communication or 3 years after your last interaction (click) with one of these communications.
• Concerning your browsing or connection data collected via trackers: your Personal Data is kept until it is made anonymous or, at the latest, within 25 months of collection.

Please note that your Personal Data may be kept for a longer period of time, for example in order to establish proof of a right or to comply with a legal obligation. In any case, your data is not kept beyond what is strictly necessary for the purposes for which it is processed. When your Personal Data is no longer required, we will ensure that it is deleted or anonymized.

In this respect, we may keep your Personal Data for analysis or aggregate statistical purposes, for a period exceeding that necessary for the purposes for which we have processed them, after having irreversibly anonymized them.

What Are Your Rights Regarding the Processing of Your Personal Data?

Regarding the processing of your Personal Data, you have the right to access, object, rectify, delete and modify it.

In addition, you have the right to provide us with instructions on how you wish your Personal Data to be handled after your death (for example, whether you wish it to be retained, deleted or passed on to a designated third party).

You may object to any processing of your Personal Data that is based on our “legitimate interest”.

In addition, you may also exercise your right to limitation of processing and your right to portability of your Personal Data.

You also have the right to withdraw your consent to the processing of your Personal Data (if the processing we carry out is based on your consent).

You may exercise your right not to be subject to a decision based exclusively on automated processing (such as profiling, for example) that produces legal effects concerning you or significantly affects you.

Finally, you have the right to lodge a complaint with a competent supervisory authority regarding the processing of your Personal Data. In France, the supervisory authority for the protection of personal data is the CNIL (www.cnil.fr).

You can exercise these rights by contacting us at the address indicated in Section ‎8 of this policy.

Contact

If you have any questions, please contact us in one of the following ways:

• By email: hello@y2m.io;

Our Data Protection Officer (DPO) can be reached at: jules@ctrlreach.co.

• By post: Y2M, 29 avenue du Léon, 22190 Plérin, France.

Privacy Policy Update

We reserve the right to change this privacy policy at any time without notice.

We invite you to consult this privacy policy regularly to be informed of any changes.

When necessary, we will notify you by email of any changes to this privacy policy.