Privacy policy

This privacy policy describes how HORRA collects, uses and protects personal data in the context of its showcase website horra.music and its application app.horra.music, a managed music broadcasting service (sound ambiance, audio messages and jingles) intended for professional venues. It is established in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertes).

1. Data controller

The data controller is HORRA, a simplified joint-stock company (SAS) with a share capital of 950 euros, registered with the Paris Trade and Companies Register under number 903 545 358, whose registered office is located at 135 avenue Victor Hugo, 75016 Paris, France.

SIRET (registered office): 903 545 358 00025
Intra-EU VAT: FR89903545358
APE code: 63.12Z (Web portals)
President and publication director: Amir Laieb
Chief executive officer: Manoel Hellio
Contact: hello@horra.music

HORRA has not appointed a data protection officer (DPO). Any request relating to the protection of your personal data can be addressed to hello@horra.music.

2. Data we collect

Depending on your relationship with HORRA (site visitor, prospect, client, invited collaborator, user of the application or of the player), we may process the following categories of data.

Identity and account

Last name, first name, email address, phone number, profile picture (optional), language, time zone and city.

Authentication and security

Password, activation of two-factor authentication (2FA, optional), session tokens and access tokens for the mobile and player applications.

Connection and technical logs

IP address, device and browser information, approximate location inferred from the IP address, connection timestamps, as well as the account activity history (logging for audit purposes). The approximate location is resolved locally from the IP address, using a local GeoIP database; the IP address is not sent to any external third party for this purpose.

Usage and listening

Service usage and listening data: plays, "likes", favorite playlists, broadcasting history by zone, notifications and preferences.

Establishments and zones

Company name, full postal address, SIRET number, VAT number and GPS coordinates of the establishments and zones declared by the client, the subscription being taken out per broadcasting zone.

Billing

Billing data managed through our payment provider: billing identifiers, last four digits and expiry date of the card, invoices. HORRA neither collects nor stores your full bank card number.

Invited collaborators

When a client invites collaborators, we process their name and email address. The client is responsible for the invitations it issues and for the data of the persons it adds.

Support and audio message requests

Messages exchanged with support, requests for jingles or voice messages, including, where applicable, a voice recording provided by the user. We also keep diagnostic and incident logs.

Prospects (site contact form)

The contact form on horra.music collects your last name, first name, email address, phone number (optional), your message as well as your business details, entered manually or prefilled through Google Maps after your functional consent. This information is detailed in section 10.

3. Purposes and legal bases

We process your data for the following purposes, each relying on a legal basis within the meaning of the GDPR.

Performance of the contract

Creation and management of your account, management of your establishments and zones, subscription and management of subscriptions per zone, provision of the broadcasting service, billing and collection, management of invited collaborators and handling of your support and audio message requests. Legal basis: performance of the contract (or pre-contractual measures).

Security, fraud prevention, improvement and statistics

Security of accounts and infrastructure, logging and audit, prevention of misuse and fraud, continuous improvement of the service and compilation of usage statistics. Legal basis: legitimate interest of HORRA in securing and developing its service.

Legal obligations

Retention of invoices and accounting records, compliance with accounting and tax obligations. Legal basis: legal obligation.

Marketing communications and non-essential cookies

Possible sending of commercial communications and placement of non-essential cookies or services. Legal basis: consent, which you may withdraw at any time.

4. Recipients and processors

Your data is accessible to HORRA's authorized teams and to processors acting on our instructions, in the context of providing the service. We use the following categories of recipients:

payment and billing provider (processing of bank card and SEPA direct debit payments);
service for sending service and notification emails;
hosting and storage providers for the service's files, media and data;
mapping and geolocation service for establishments;
technical providers necessary for the operation, search and security of the service;
source of music metadata (not used for broadcasting).

On the showcase site, we also use an email-sending service (transmission of contact-form messages), a mapping service (address autocomplete) and a support chat tool.

The detailed, named list of our processors can be provided on request at hello@horra.music.

The showcase website uses Google Analytics 4 through Google Tag Manager only after you consent to statistics. Optional chat and business search services, Crisp and Google Maps, load only after your separate functional consent; Google Maps is used when you search within the form. Your choices are managed by a self-hosted, open-source module, separately from processing necessary to operate the service.

5. Transfers outside the European Union

Some of our processors are located outside the European Union, in particular in the United States. These transfers are governed by appropriate safeguards within the meaning of the GDPR, in particular the standard contractual clauses adopted by the European Commission and, where applicable, certification under the Data Privacy Framework. The back-end application infrastructure is hosted within the European Union (France).

6. Retention periods

We keep your data for as long as necessary for the purposes described, then delete or anonymize it. The precise periods are being defined:

Account and usage data: kept for the lifetime of the account, then deleted or anonymized within 3 months of the account being closed.
Connection logs and technical logs: 12 months.
Activity and listening history: 13 months.
Support requests and voice recordings: for the duration of the contract plus 1 year.
Billing data and accounting records: kept in accordance with accounting and tax obligations, in principle 10 years.
Prospect data (contact form): 3 years from the last contact.

The deletion of your account is carried out upon request; the process is operated by HORRA.

7. Security

HORRA implements appropriate technical and organizational measures to protect your data, in particular:

encryption of exchanges in transit via HTTPS;
role-based access control;
two-factor authentication (2FA) available as an option;
access to audio files by means of signed URLs with a limited period of validity;
logging of access and activities for audit and security purposes.

As no system can guarantee absolute security, we strive to continuously improve these measures.

8. Your rights

In accordance with the applicable regulations, you have the following rights over your data: right of access, rectification, erasure, restriction of processing, objection, portability, withdrawal of consent at any time (without affecting processing already carried out), as well as the right to set directives regarding the fate of your data after your death.

You may exercise these rights by writing to hello@horra.music. We may ask you for proof of identity in the event of reasonable doubt.

If you consider that your rights are not being respected, you may lodge a complaint with the French Data Protection Authority (Commission Nationale de l'Informatique et des Libertes, CNIL), www.cnil.fr. If you are located in the European Union or the United Kingdom, you may also contact your own national data protection authority.

9. Cookies

The showcase website uses a self-hosted, open-source module to manage your choices. You can accept or refuse statistics and optional functional services, chat and business search, separately. Strictly necessary functions, including remembering your choices, remain active.

Application (app.horra.music)

Essential cookies: session cookie, XSRF-TOKEN security cookie, "remember me" cookie (if you enable it). They are necessary for the operation of the service.
Preference cookies (non-essential): interface preferences such as the theme, appearance and display of the sidebar.

Showcase website (horra.music)

Google Tag Manager and Google Analytics 4 load only after you consent to statistics, to measure visits and interactions. This processing may involve browser identifiers, technical browsing information and events. These choices do not enable advertising consent.

Your functional consent for chat and business search allows Crisp chat to load and, when you use the form’s search feature, Google Maps to search for and prefill your business details. Search terms and technical connection data may then be sent to Google. Manual entry and form submission remain available without this consent.

Your choice, whether acceptance or refusal, is kept in your browser’s local storage for 182 days, approximately six months, for the Site origin you are visiting. It is not shared with the Application at app.horra.music.

You can change your choices or withdraw consent at any time using the “Cookie settings” button in the footer. Withdrawal applies to future processing. If a service was already loaded when you withdraw consent, the Site reloads to apply your choice. The module deletes known Google Analytics cookies when statistics consent is withdrawn, and known Crisp cookies for the HORRA workspace when functional consent is withdrawn, if they were stored and are accessible from the Site; this mechanism does not delete third-party Google Maps cookies. You can also delete cookies through your browser settings. Refusing these optional services does not prevent you from browsing the site or using the contact form.

10. Contact form and prospects

When you use the site's contact form, we collect your last name, first name, email address, phone number (optional), your message as well as your business details, entered manually or prefilled through Google Maps after your functional consent. This information is transmitted by email to our teams in order to handle your request. The legal basis for this processing is our legitimate interest in responding to your inquiries and, where applicable, your consent for subsequent communications.

11. Changes to the policy

HORRA may amend this privacy policy, in particular to take account of legal, technical or service developments. The applicable version is the one published on this page. We invite you to consult it regularly; significant changes may be the subject of specific information.

12. Contact

For any question relating to this policy or to the exercise of your rights, you can contact us:

By email: hello@horra.music
By post: HORRA SAS, 135 avenue Victor Hugo, 75016 Paris, France

13. Governing law

This privacy policy is governed by French law. This English text is a translation provided for convenience; in case of any discrepancy, the French version prevails.

Last updated: 19 October 2026.