GDPR & your data rights

Wowzaradio is the data controller for account, billing, analytics and support data. A station owner or reseller is an independent controller for data they collect from their own audience or clients (for example contest entries or client billing).

• Contract — running your account, station, payouts and subscriptions.
• Legal obligation — tax, accounting and royalty reporting.
• Legitimate interests — security, fraud prevention, abuse limits and aggregate analytics.
• Consent — optional marketing email, ad personalisation using your city and device, and optional analytics tags a station adds.

Listeners are asked once whether ads may use their city and device type. Choosing "No thanks" means only non-personalised ads are requested. We use strictly necessary storage to keep you signed in and remember preferences; we do not use third-party advertising trackers. Marketing emails always include a one-click unsubscribe link.

• Access (Art. 15). Get a copy of the personal data we hold about you.
• Rectification (Art. 16). Correct inaccurate details — most can be edited in your profile.
• Erasure (Art. 17). Ask us to delete your account and data, unless the law requires us to keep it (for example tax records).
• Restriction (Art. 18). Ask us to pause processing while a concern is resolved.
• Portability (Art. 20). Receive your data in a common machine-readable format (CSV/JSON).
• Objection (Art. 21). Object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent (Art. 7). Withdraw consent you gave (marketing email, ad personalisation) without affecting past processing.
• Automated decisions (Art. 22). Ask for human review of an automated decision, such as a fraud-screening result that blocked a payment.
• Complaint (Art. 77). Lodge a complaint with your local data protection authority.

Email supports@wowzahosting.com with the subject "GDPR request", or use the support page. Send it from the email on your account so we can verify you. We reply within one month (extendable by two months for complex requests, with notice) and free of charge unless a request is clearly excessive.

Cloud hosting and database, streaming/CDN delivery, email delivery, payment processors (card payments and PayPal), payouts (PayPal, Wise), fraud screening (FraudLabs Pro), and the AI providers you choose to enable. Each acts on our instructions under a data processing agreement.

Some providers process data outside the EEA/UK. Where they do, transfers rely on an adequacy decision (such as the EU–US Data Privacy Framework) or Standard Contractual Clauses with supplementary safeguards.

Account and station data is kept while your account is active; dormant accounts may be archived after 90 days of inactivity (see dormant accounts). Billing and royalty records are kept as long as tax law requires. Network addresses used for abuse and fraud checks are stored only in scrambled (hashed) form.

Data is encrypted in transit, access is limited by role, private details (phone, payout email) are readable only by you and authorised staff, and your own AI keys are stored encrypted. If a breach is likely to put your rights at risk, we notify the supervisory authority within 72 hours and inform affected users without undue delay.

Accounts are not available to anyone under 16 in the EEA/UK.