Privacy Policy

Last updated: 5 August 2026

This Privacy Policy explains how Akumudzi Bwaiz collects, uses, stores, shares and protects personal information when people visit the website, create accounts, submit music, buy releases, contact us or use artist and administrator services.

We handle personal information under Malawi's Data Protection Act, 2024 and other applicable privacy and electronic-transactions requirements. This policy applies to the services and providers enabled on the website.

1. Information we collect

Depending on how you use the platform, we may collect:

name, email address, telephone number and account credentials;
profile photograph, artist cover image, stage name, biography and social links;
identity documents, legal name, tax information and COSOMA information supplied for artist verification;
bank or mobile-money destination details needed for payouts;
music masters, previews, artwork, contributor information, licences, split sheets and rights declarations;
order references, payment status, amount, currency and provider transaction identifiers;
contact messages, copyright complaints, evidence and support correspondence;
device, browser, approximate network and security information;
stream duration, download events and fraud-prevention signals; and
cookie and privacy choices.

We do not need or ask users to send payment-card credentials directly to us when checkout is handled by an approved payment provider.

2. Why we use information

We use personal information to:

create and secure accounts;
verify professional artists and authorised representatives;
review music, artwork, rights and contributor details;
publish approved artist profiles and catalogue information;
process purchases and provide secure downloads;
calculate transparent royalty ledger entries and statements;
review and process payout requests;
prevent fraud, false streams, abuse and security attacks;
respond to support messages and legal complaints;
meet accounting, audit, tax and legal obligations;
improve performance and accessibility; and
send necessary service messages.

Optional marketing or advertising uses should rely on the appropriate consent or another lawful basis.

3. Public and private information

Stage names, artist photographs, cover images, biographies, approved social links, song credits and release information may be displayed publicly.

Identity documents, bank details, payout tokens, private rights documents, original masters, paid ZIP files and internal review notes are private. Access is limited to authorised people and service providers who need it for platform operations.

Artists must not upload another person's private information unless they have authority to do so.

4. Payment providers and other service providers

We may share the minimum necessary information with providers that support payments, hosting, object storage, email, security, backups, analytics or advertising. These providers process information under their own terms and privacy obligations.

Payment status and transaction references may be received from PayChangu or another approved payment provider. Original masters and private files may be stored on the configured hosting or object-storage provider, including an S3-compatible service.

We review provider contracts, security controls and data-location implications before enabling a service.

5. Cookies and advertising

Essential cookies support login, security, sessions, purchases and privacy choices. Optional analytics and advertising technology should load only after the required choice has been made.

Google AdSense or another advertising provider may process device and usage information under its own policies when advertising is enabled. Advertising must remain disabled until the required approval and consent controls are ready.

6. Security

We use measures such as password hashing, access controls, private storage, encryption for sensitive tokens, secure cookies, rate limits, signed links, activity logs and server-side payment verification.

No system is completely risk-free. Users should use a strong unique password and immediately report suspected unauthorised access.

7. Retention

We keep information only for as long as reasonably needed for the purpose for which it was collected, including legal, accounting, fraud-prevention, copyright and dispute requirements.

Examples:

active account information is retained while the account is operating;
transaction and royalty records may need longer retention for accounting and audit;
copyright and rights-review records may be retained to demonstrate decisions and authority;
temporary security logs should be deleted or anonymised after the documented retention period; and
rejected files that are no longer needed should be securely deleted, subject to dispute and legal-hold requirements.

Retention decisions are documented and reviewed so information is not kept longer than its operational, accounting, dispute or legal purpose requires.

8. Your choices and rights

Subject to applicable law and valid exceptions, a person may ask us to:

confirm whether we process their personal information;
provide access to relevant information;
correct inaccurate or incomplete information;
delete information that no longer has a lawful purpose;
restrict or object to certain processing;
withdraw consent where processing relies on consent; or
explain a significant automated decision, if one is introduced.

We may need to verify identity before acting on a request. Some records cannot be deleted immediately where they are required for transactions, legal claims, copyright evidence, fraud prevention or regulatory obligations.

9. Children

The platform is not intended for unsupervised commercial use by young children. Where an artist, contributor or customer is under the legal age to contract, we may require a parent, guardian or authorised representative.

10. International storage and transfers

A hosting, email, payment or storage provider may process data outside Malawi. Before using such a provider, we assess the legal safeguards, security measures and contractual terms required for the transfer.

11. Changes and complaints

We may update this policy when services, providers or legal requirements change. The current date will appear at the top.

Privacy questions or requests can be sent through our contact page. A person may also seek guidance or make a complaint to Malawi's Data Protection Authority where applicable.