Privacy Policy

1. Who We Are

ScoreMasters® is a professional music services company founded in 1997 and operating globally online since 2006. We provide Orchestration & Arranging, Music Engraving & Score Preparation, Music Transcription, MIDI to Score, and AI Music to Score services to clients on five continents.

ScoreMasters® is operated by Samy Elgazzar, an individual music professional based in Athens, Greece. In the context of this Privacy Policy and data protection law, Samy Elgazzar trading as ScoreMasters® is the Data Controller for all personal data collected through this website and in the course of providing our services.

Data Controller:

• Name: Samy Elgazzar, trading as ScoreMasters®
• Postal address: P.O. Box 78520, Athens, GR 17602, Greece
• Telephone: +30 6944 917 867
• Privacy contact email: info@scoremastersmusic.com

Because ScoreMasters® is based in Greece, a member state of the European Union, the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) is our primary data protection framework. It applies directly to all data we process, regardless of whether the data subject is located in the EU or elsewhere. We also comply with Greek Law 4624/2019, which implements GDPR into Greek national law, and with the UK GDPR (as retained in UK law) where we process data about individuals located in the United Kingdom.

2. What Personal Data We Collect

2.1 Data You Provide to Us Directly

When you contact us, request a quote, or engage our services, you may provide some or all of the following:

• Identity data: full name, professional role or organization name
• Contact data: email address, telephone number, postal or billing address
• Project data: project description, number of instruments/voices, intended use (rehearsal, recording, publication, performance, educational), deadline, source file formats, desired output formats, reference tracks or scores, budget range
• Financial data: PayPal account details where you pay by PayPal; billing name and email where you pay by Stripe. No credit card data is stored by ScoreMasters® directly. Payment processing is handled exclusively by PayPal and Stripe, both of which are PCI DSS compliant
• Communications data: emails, messages, and written correspondence exchanged during the inquiry and project lifecycle
• Content data: audio files, MIDI files, PDFs, scanned manuscripts, handwritten sketches, reference recordings, and any other creative materials you upload or send as source material or for the purpose of receiving our services

2.2 Data Collected Automatically

When you visit this website, our hosting provider and analytics tools automatically collect the following technical data. This occurs regardless of whether you are a registered client or a first-time visitor:

• Technical data: IP address, browser type and version, device type and operating system, referring URL, pages visited, time and date of visit, session duration
• Google Analytics (GA4) data: anonymized usage data including pages viewed, traffic source, device category, and approximate geographic region. IP addresses are anonymized before storage. This data is only collected after you have given cookie consent
• Hostinger server-side statistics: visit counts, request volumes, originating countries, access logs, and server error logs (4xx/5xx). These are collected at server level and do not require cookie consent as they do not place files on your device
• Cookie data: see Section 10 for full details on the cookies we use

2.3 Data We Do Not Collect

We do not collect or process any special category personal data (such as health data, racial or ethnic origin, religious beliefs, political opinions, or biometric data). We do not collect financial credentials, bank account numbers, or credit card details directly. All payments are handled by PayPal and Stripe. We do not knowingly collect data from children under the age of 16 (see Section 13).

3. How We Collect Your Data

We collect your personal data through the following channels:

• The quote/inquiry form on this website
• Direct email to our contact address
• Telephone calls
• File transfer services, when you send us source files or when we deliver completed work to you. These services include email attachments, WeTransfer, Google Drive, and Dropbox
• Automatic data collection by our website server and analytics tools when you visit the website (see Section 2.2)

4. Lawful Basis for Processing (GDPR Article 6)

Under GDPR, every processing activity must rest on a specific lawful basis. The bases we rely on are as follows:

4.1 Performance of a Contract (Article 6(1)(b))

When you engage ScoreMasters® for a paid service, processing your name, contact details, project data, and source files is necessary for us to fulfill our contractual obligations, that is, to deliver the completed score, parts, orchestration, arrangement, engraving, transcription, or other work you have commissioned.

4.2 Legitimate Interests (Article 6(1)(f))

We process certain data based on our legitimate business interests, provided those interests are not overridden by your fundamental rights. These interests include:

• Responding to pre-contract inquiries and quote requests
• Retaining completed project files to support revision requests, follow-up work, and long-term client service continuity
• Improving the quality and efficiency of our services
• Protecting the security and integrity of our website
• Maintaining business records and invoices as required by law

4.3 Consent (Article 6(1)(a))

Where required, we will ask for your explicit consent, for example, before sending you marketing communications or newsletters, or before placing non-essential cookies on your device. You may withdraw consent at any time by contacting us at the email address in Section 17. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

4.4 Legal Obligation (Article 6(1)(c))

Where required by applicable law (for example, retaining invoices and financial records for Greek tax purposes), we process data to comply with that obligation.

5. Purposes of Processing

We process your personal data for the following specific purposes:

Service delivery: To receive your inquiry, communicate with you about your project, deliver the commissioned work, process payment, and handle revision requests. Lawful basis: contract performance.

Pre-contract communication: To respond to your inquiry or quote request and assess whether your project is a good fit for our services. Lawful basis: legitimate interests.

Invoicing and record-keeping: To issue invoices, process and record payments, and maintain bookkeeping records as required by Greek law. Lawful basis: legal obligation / contract performance.

Client communication and support: To manage ongoing communication throughout the project lifecycle, including delivery of work, revision rounds, and follow-up correspondence. Lawful basis: contract performance / legitimate interests.

Website operation and security: To maintain and improve the website, diagnose technical issues, and protect against unauthorized access, spam, and abuse. Lawful basis: legitimate interests.

Marketing communications (optional): If you have given explicit consent, we may contact you occasionally about new services, promotions, or relevant updates. You can opt out at any time by emailing us or clicking unsubscribe in any email. Lawful basis: consent or, for existing clients, our legitimate interests. When you subscribe to our newsletter, we first send a confirmation email, and you are added only after you confirm. Newsletter emails are sent through Hostinger Reach. If you are an existing client, we may also email you occasionally about services similar to those you have commissioned, on the basis of our legitimate interests. You can opt out at any time by clicking unsubscribe in any email or by writing to us.

We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

6. Your Project Files: Uploaded Materials and Confidentiality

This section is specific to the creative materials you share with us as part of a commissioned project. We take the handling of your artistic work seriously.

6.1 What Files This Applies To

Source materials you send us may include audio recordings, MIDI files, PDFs of existing scores, scanned handwritten manuscripts, reference recordings, lyrics, lead sheets, and any other materials needed to complete the commissioned work.

6.2 How We Use Your Files

Files you send are used solely for the purpose of completing the commissioned work and for quality assurance review. They are not shared with any third party outside the scope of your project. Where ScoreMasters® engages an assistant or subcontractor to contribute to a project, that person works under a confidentiality obligation and accesses only what is necessary for their specific contribution.

6.3 Confidentiality by Default

All project materials are treated as confidential by default. You do not need to ask. If you require a formal Non-Disclosure Agreement (NDA) for a particular project (for example, for unreleased compositions, commercially sensitive arrangements, or institutional or ecclesiastical work), please request one before sending materials and we will sign it prior to commencement.

6.4 Portfolio and Sample Use

ScoreMasters® may use anonymized or appropriately credited excerpts of completed work (such as brief score images) for portfolio and promotional purposes on this website. This applies unless:

• you have opted out of portfolio use in writing, or
• a confidentiality agreement is in place that prohibits such use, or
• the project concerns unreleased material for which publication rights have not been cleared

If you do not wish your project to be used for any promotional purpose, please notify us in writing before or during the project and we will honor that request.

6.5 File Retention

Completed project files (including source materials, working files, and final deliverables) are retained indefinitely. Our experience shows that clients regularly return, sometimes years after the original delivery, to request copies of files they have lost or need to access for follow-up projects. Indefinite retention ensures we can always assist with those requests.

This retention is based on our legitimate interest in providing long-term client service continuity, balanced against your right to have your files deleted on request. You may request deletion of your project files at any time by contacting us (see Section 11, Your Rights, and Section 17, Contact). We will action deletion requests within 30 days of receipt.

Copies of inquiries and uploaded files held on our website are deleted automatically 12 months after submission. If your project goes ahead, the files you send become project files and are retained as described above.

6.6 No AI Processing of Your Files

Your source files are not used to train any artificial intelligence model, and they are not processed through any AI system without your knowledge and explicit consent. Our work is delivered by a human professional. If you ask us to use AI tools as part of the workflow for a specific service (such as AI Music to Score), we will explain what tools are used and obtain your agreement before proceeding.

7. Third-Party Service Providers (Sub-Processors)

To operate this website and deliver our services, ScoreMasters® uses the following third-party services. Each may process some personal data on our behalf. We only use providers whose privacy and security standards we have assessed as appropriate.

We require all sub-processors to process personal data only as instructed by us and to maintain appropriate technical and organizational security measures. We do not sell or rent personal data to any third party, and we do not allow sub-processors to use your data for their own purposes.

8. International Data Transfers

ScoreMasters® is based in Greece and operates within the European Union. Because we use third-party service providers (listed in Section 7), some of your data may be processed in countries outside the EU/EEA, for example, servers operated by US-based technology companies including Google, Stripe, PayPal, and Dropbox.

Where personal data is transferred outside the EU/EEA, we ensure that appropriate safeguards are in place in accordance with GDPR Chapter V. These safeguards may include:

• Standard Contractual Clauses (SCCs) approved by the European Commission under Article 46(2)(c) GDPR
• Adequacy decisions by the European Commission confirming that a country or territory provides an equivalent level of data protection to the EU
• Other appropriate safeguards as permitted under GDPR and assessed on a per-provider basis

Note: WeTransfer B.V. is headquartered in the Netherlands and processes data within the EU/EEA, which means transfers to WeTransfer do not require additional safeguards under GDPR.

You may request further information about the specific safeguards in place for any particular transfer by contacting us (see Section 17).

9. How Long We Retain Your Data

We retain personal data only for as long as necessary to fulfill the purpose for which it was collected, or as required by law. Our standard retention periods are:

Residual data held in encrypted backup systems may persist for an additional period beyond the above timelines, in line with standard backup rotation schedules. Such residual data is not actively accessed and is overwritten as part of the normal backup cycle.

10. Cookies and Similar Technologies

Our website uses cookies and similar technologies to operate properly, remember your preferences, and, where consent is given, understand how visitors use the site.

10.1 What Are Cookies?

Cookies are small text files placed on your device by a website when you visit. They allow the website to recognize your device across pages or visits, and to store information about your preferences or activity.

10.2 Types of Cookies We Use

Strictly necessary cookies: Required for the website to function. These cannot be disabled. Examples include session management cookies, security cookies, and your cookie consent preference record. No consent is required for these cookies.

Functional cookies: Used to remember choices you have made to provide an enhanced experience. These are used only with your consent where required.

Analytics cookies: Set by Google Analytics (GA4) to help us understand how visitors use the website, for example which pages are most visited and how users navigate the site. These cookies are only placed after you have given your consent via the cookie banner.

Marketing cookies: ScoreMasters® does not currently use advertising or retargeting cookies. If this changes, this policy will be updated and consent will be sought before any such cookies are placed.

10.3 Managing Cookies

When you first visit the website, a cookie consent banner will appear giving you a clear choice to accept or decline non-essential cookies. Non-essential cookies, including Google Analytics, are not placed until you give your explicit consent. You can withdraw or change your consent at any time using the cookie settings link in the website footer.

You can also control cookies through your browser settings. Most browsers allow you to block or delete cookies. Disabling some cookies may affect website functionality. For browser-specific instructions, consult your browser's help documentation.

11. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights regarding your personal data. These rights apply regardless of where you are located, because ScoreMasters® is subject to GDPR as a data controller based in Greece.

Right of Access (Article 15): You have the right to request a copy of the personal data we hold about you, together with information about how and why we process it.

Right to Rectification (Article 16): You have the right to request correction of any inaccurate or incomplete personal data we hold about you.

Right to Erasure, "Right to be Forgotten" (Article 17): You have the right to request deletion of your personal data where it is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where we have processed it unlawfully. Some data may need to be retained for legal or contractual reasons, in which case we will explain this.

Right to Restriction of Processing (Article 18): You have the right to request that we restrict the processing of your data in certain circumstances, for example while the accuracy of data is being contested, or while an objection is being considered.

Right to Data Portability (Article 20): Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format, and to have it transmitted to another controller where technically feasible.

Right to Object (Article 21): You have the right to object at any time to processing based on legitimate interests. You also have an absolute right to object to direct marketing at any time, after which we will cease that processing immediately.

Right to Withdraw Consent (Article 7(3)): Where we process your data on the basis of consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before the withdrawal.

Right Not to Be Subject to Automated Decision-Making (Article 22): You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects. ScoreMasters® does not engage in such automated decision-making.

How to Exercise Your Rights

To exercise any of the rights above, please contact us at the privacy email address in Section 17. We will respond within one calendar month of receiving your request. If a request is complex or we receive a high volume, we may extend this by a further two months. We will notify you if this is the case. We may need to verify your identity before actioning a request.

There is no charge for exercising your rights. However, if requests are manifestly unfounded, excessive, or repetitive, we reserve the right to charge a reasonable administrative fee or refuse to act, in accordance with Article 12(5) GDPR.

Right to Lodge a Complaint

If you are not satisfied with how we handle your personal data or respond to a rights request, you have the right to lodge a complaint with the supervisory authority in your country of residence or the country where the alleged infringement occurred. As ScoreMasters® is based in Greece, our lead supervisory authority is:

If you are located in the United Kingdom, you also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. If you are in another EU member state, you may lodge a complaint with the supervisory authority in your country of residence.

12. Data Security

We take the security of your personal data and creative materials seriously. The technical and organizational measures we apply include:

• SSL/TLS encryption for all data transmitted through this website (HTTPS)
• Secure password management for all systems and accounts associated with client data
• Payment processing exclusively through PayPal and Stripe, both of which are PCI DSS compliant; no credit card data is stored by ScoreMasters®
• Access to client files and data is restricted to Samy Elgazzar and, where necessary, trusted assistants operating under confidentiality obligations
• Regular review of third-party service provider security practices
• Client project files stored in password-protected or access-controlled environments

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. If you transmit personal data to us, you do so at your own risk. We will notify you promptly in the event of a data breach that is likely to affect your rights and freedoms (see Section 15).

13. Children's Privacy

Our services are intended for adults and professional clients. We do not knowingly collect personal data from individuals under the age of 16. If we become aware that we have inadvertently collected personal data from a child under 16 without verifiable parental or guardian consent, we will delete that information as promptly as practicable.

If you believe that we may have collected personal data from a child under 16, please contact us immediately at the address in Section 17.

14. Links to Third-Party Websites

This website may contain links to third-party websites, platforms, and resources, for example, our LinkedIn profiles, YouTube content, or other professional platforms. This Privacy Policy applies only to ScoreMasters® and this website. We are not responsible for the privacy practices or content of third-party websites.

We encourage you to review the privacy policy of any website you visit. Clicking a link to an external site means you are leaving the ScoreMasters® website, and any data you provide to that third party is governed by their own policies.

15. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to the rights and freedoms of individuals, we will:

• Notify the Hellenic Data Protection Authority (HDPA) within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR
• Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms, in accordance with Article 34 GDPR, including a description of the nature of the breach, the likely consequences, and the measures taken or proposed to address it
• Maintain an internal record of all breaches, including those that do not meet the notification threshold, as required by GDPR Article 33(5)

If you believe a breach has occurred involving your data, please contact us immediately using the details in Section 17.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the services we offer, or applicable legal requirements. Material changes, changes that meaningfully affect how we handle your data, will be communicated by posting a notice on this website and updating the "Last updated" date at the top of this page.

We encourage you to review this policy periodically. Continued use of the website after changes have been posted constitutes acceptance of the updated policy, subject to any applicable legal requirements regarding consent.

17. How to Contact Us

For any questions or concerns about this Privacy Policy, to exercise your data subject rights, or to request a copy of any data we hold about you, please contact us by any of the following means:

Samy Elgazzar, ScoreMasters®

• Privacy email: info@scoremastersmusic.com
• Postal address: P.O. Box 78520, Athens, GR 176 02, Greece
• Telephone: +30 6944 917 867

We aim to respond to all data protection inquiries within one calendar month.

ScoreMasters® is committed to handling your personal data with the same care and professionalism we bring to every score.

© ScoreMasters®, Est. 1997. All rights reserved.