Privacy Notice for YAMAHA MUSIC SCHOOL ONLINE 


1. Scope

This Privacy Notice applies to YAMAHA MUSIC SCHOOL ONLINE (the “Service”)  and describes how personal data is processed in connection with the Service.

It supplements the Yamaha Music Europe GmbH Privacy Policy (available at https://www.uk.yamaha.com/en/privacy-policy/) and provides service-specific information on how personal data is collected, processed, and protected in connection with the Service.

Both documents apply cumulatively; in case of any inconsistency, this Privacy Notice prevails for processing activities that are specific to the Service.


2. Data Controller and Processor Relationship

The Sservice is operated under a controller–processor structure in accordance with Article 28 GDPR.

The data controller for your personal data processed through the Service is: 

Yamaha Music Europe GmbH

Siemensstraße 22–34, 25462 Rellingen, Germany

Yamaha Music Europe GmbH (“Yamaha”) determines the purposes and essential means of processing of personal data in connection with the Service and is responsible for managing lesson operations, instructor recruitment, user registration, and local content.

The data processor is:

Yamaha Corporation, Japan

10-1, Nakazawa-cho, Chuo-ku, Hamamatsu-shi, Shizuoka, 430-8650, Japan 

Yamaha Corporation develops, maintains, and operates the shared technical infrastructure for the Service and processes personal data solely on behalf of and under the documented instructions of Yamaha Music Europe GmbH, in accordance with a Data Processing Agreement (DPA) pursuant to Article 28 GDPR.

Yamaha Corporation does not determine the purposes of processing and does not use personal data for its own independent purposes.

Cross-company data sharing between Yamaha sales companies does not occur unless required for service provision and covered by appropriate contractual safeguards.

For all questions or requests regarding the processing of your personal data in connection with the Service, you may contact:

dataprotection@contact.europe.yamaha.com


3. Types of Data Processed & Purposes

In the context of the Service, Yamaha processes the following categories of personal data:

  • User Identification Data: Name, email address, Yamaha Music ID, country/region, language preference, account and subscription information.
  • Lesson and Interaction Data: Booking history, lesson schedules, participation records, instructor and student communications (including messages, chat logs, and feedback), as well as any lesson materials or recordings you upload or provide.
  • Audio-Video Data: Live audio-visual streams generated during real-time lessons, which are not recorded or stored by Yamaha, and recorded audio or video content uploaded by users.
  • Device and Technical Data: Device type, operating system, browser details, IP address, session identifiers, connection logs, and technical error reports.
  • Payment and Transaction Data: Billing information, payment confirmations, and transaction history (processed through secure external payment providers, if applicable).

Preference and Usage Data: Interaction with service features, feedback, and performance statistics to improve the teaching experience and platform usability.

Purposes of Processing:

  • Service Provision and Administration
  • Operation, scheduling, and delivery of the Service, communication between instructors and users, and account management
  • (Art. 6 (1)(b) GDPR – contractual necessity).
  • Platform Maintenance and Security
  • Ensuring platform functionality, authentication, fraud prevention, and error detection
  • (Art. 6 (1)(f) GDPR – legitimate interests).
  • Lesson Quality and Improvement
  • Reviewing user feedback, and aggregated usage data to improve content quality and instructor performance
  • (Art. 6 (1)(f) GDPR – legitimate interests).
  • Marketing Communications Sending marketing communications where you have given explicit consent.(Art. 6 (1)(a) GDPR – consent).Legal and Compliance Purposes
  • Compliance with record-keeping, accounting, and regulatory obligations
  • (Art. 6 (1)(c) GDPR – legal obligation).


4. Purposes and Legal Bases

The processing of your personal data within the Service is based on the following legal grounds under the GDPR:

4.1 Performance of a Contract (Art. 6 (1)(b) GDPR)

Processing is necessary to perform the contract concluded with you for the use of the Service, including:

  • registration, authentication, and account management;
  • scheduling and delivery of lessons;
  • communication between instructors and learners; and
  • customer support and troubleshooting.

4.2 Legitimate Interests (Art. 6 (1)(f) GDPR)

Processing is also carried out where Yamaha has a legitimate interest in:

  • ensuring the technical functionality and security of the platform;
  • maintaining service integrity, preventing fraud, and detecting misuse;
  • improving lesson quality, instructor performance, and platform usability; and
  • performing aggregate, non-identifying analytics to enhance overall user experience.
  • Yamaha carefully balances its legitimate interests against your fundamental rights and expectations. You have the right to object to such processing at any time (Art. 21 GDPR).

4.3 Consent (Art. 6 (1)(a) GDPR)

Certain optional processing activities require your explicit consent, such as:

  • receiving marketing communications;
  • using cookies or similar technologies for analytics and marketing (see Yamaha’s Cookie Policy).

You may withdraw your consent at any time with future effect. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4.4 Consent Management

When registering for Yamaha Music Connect, which is required to use the Service, and within your user account settings, you will be presented with clear options to grant or withhold consent for optional processing.

You may modify or withdraw your consent at any time through your account settings or by contacting Yamaha at:

dataprotection@contact.europe.yamaha.com.

Refusing or withdrawing consent will not affect your access to the core lesson functions of the Service. 


5. International Transfers

Personal data processed in connection with the Service may be transferred to Yamaha Corporation, Japan (as the data processor) and, where necessary, to other authorized Yamaha Group entities or trusted external service providers (for example, providers of video-communication, cloud storage, or payment infrastructure) located outside the European Economic Area (EEA).

All such transfers are performed only where an adequate level of protection for personal data is ensured. In particular, Yamaha relies on:

  • Adequacy Decisions of the European Commission (e.g., for Japan);
  • EU Standard Contractual Clauses (SCCs) concluded with the recipient, supplemented where required by additional technical and organisational safeguards; or
  • Other legally recognized transfer mechanisms in accordance with Articles 44–49 GDPR.

Yamaha ensures that personal data transferred to recipients outside the EEA remains subject to protection essentially equivalent to that guaranteed under EU law.

Where service providers are engaged (for instance, for hosting or online-communication functions), Yamaha verifies that such providers process data exclusively on Yamaha’s instructions and under data-processing agreements consistent with Art. 28 GDPR.

For further details on Yamaha’s general approach to international data transfers, please refer to the corresponding section of the Yamaha Privacy Policy, which applies in addition to this service-specific Privacy Notice.

Where the GDPR does not apply (for example, for users outside the EU/EEA whose data are processed wholly outside the EEA), Yamaha nevertheless handles personal data in accordance with applicable local data-protection laws and the principles set out in this Privacy Notice.


6. Data Security and Technical Measures

Yamaha applies appropriate technical and organisational measures to protect personal data processed in connection with  the Service against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access, in accordance with Article 32 GDPR.

These measures include, in particular:

  • Secure transmission of all communications using industry-standard encryption (e.g. TLS) and, where applicable, end-to-end encryption of audio-video sessions;
  • Access control and authentication ensuring that only authorized users (students, instructors, and Yamaha staff with a support role) can access relevant lesson data;
  • Data minimization and segregation, ensuring that lesson data and user accounts are logically separated and accessible only for legitimate business purposes;
  • Regular monitoring and audits of Yamaha’s IT systems and those of its authorized service providers;
  • Training and confidentiality obligations for Yamaha personnel handling customer data; and
  • Incident-response procedures to detect, report, and remediate any suspected personal-data breach in accordance with GDPR requirements.

Where third-party processors are engaged (for example, to provide communication or cloud-hosting services), Yamaha ensures through contractual agreements that equivalent data-protection and security standards are maintained.


7. Storage Period for Personal Data

Yamaha stores personal data processed in connection with the Service only for as long as necessary to fulfil the purposes described in this Privacy Notice. The specific retention periods depend on the category of data and the context of processing.

  • Account and Profile Data (e.g. name, email address, Yamaha Music ID, user preferences): retained for the duration of your active Service account. When you delete your account or terminate participation, your data is erased or anonymised without undue delay, unless statutory retention obligations apply.
  • Lesson and Communication Data (e.g. lesson schedules, instructor messages, chat content, user-uploaded audio or video content): stored for as long as required to provide the service and enable review or follow-up. 
  • Service Usage and Technical Logs: retained for a limited time to maintain platform security, ensure service continuity, and detect malfunctions or misuse. Thereafter, such data is anonymised or deleted.
  • Marketing and Consent-Based Data: kept until you withdraw your consent or object to processing. After withdrawal, Yamaha ceases the processing and erases or anonymises the data unless legal retention duties apply.
  • Legal Retention Obligations: where commercial, tax, or other regulatory laws require longer storage, Yamaha retains the data for the prescribed period; processing during this time is restricted to compliance purposes only.
  • Assertion or Defence of Legal Claims: Yamaha may retain relevant personal data beyond the standard period where necessary to establish, exercise, or defend legal claims.

Yamaha regularly reviews its retention practices to ensure that personal data is not kept longer than required and is securely erased or anonymised in accordance with applicable legal and technical standards.


8. Children’s Data

The Service is intended exclusively for adults aged 18 or older.

Yamaha does not knowingly offer the Service to, and does not collect personal data from, individuals under the age of 18. If Yamaha becomes aware that personal data of an individual  under the age of 18 has been collected inadvertently, such data will be promptly deleted.


9. Cookies & Tracking Technologies

The Service uses cookies and similar technologies (such as local storage, pixels, and web beacons) to ensure the secure and efficient operation of the platform, enhance the user experience, and enable certain personalised or analytic functions.

These technologies serve the following purposes:

  • Essential (Necessary) Cookies: Required for the operation of the Service platform — for example, maintaining secure log-ins, managing sessions during lessons, and ensuring stable audio-video connections.
  • Analytics Cookies: Used to understand how users interact with lesson features, identify technical issues, and improve platform performance.
  • Personalisation and Marketing Cookies: Used only with your consent to tailor offers, recommendations, and information about Yamaha’s educational services to your interests.

When you first access the Service platform, you will be informed about the use of cookies and similar technologies. Yamaha will obtain your consent for any non-essential cookies in accordance with the GDPR and applicable local data-protection laws.

You can manage or withdraw your cookie preferences at any time via the cookie-settings interface within the Service or through your browser settings. Withdrawing consent does not affect the lawfulness of processing carried out prior to withdrawal.

For further details on the use of cookies, tracking technologies, and your options to control them, please refer to Yamaha’s Cookie Policy, which applies in addition to this Privacy Notice.


10. Data Recipients and Processors

Yamaha restricts access to personal data processed in connection with the Service to those employees, affiliates, and service providers who require it to fulfill their respective tasks and obligations.

Data may be shared with:

  • Yamaha Group entities, including Yamaha Corporation, Japan, and regional subsidiaries, to the extent necessary for service provision, support, and centralized data management under applicable controller–processor or intra-group data-transfer agreements;
  • Authorized instructors or lesson providers, where required for the delivery of individual or group lessons. Such instructors receive only the information necessary for lesson organisation and are contractually bound to maintain confidentiality;
  • External service providers (processors) supporting the operation of the Service (e.g., IT hosting, cloud infrastructure, communication platforms, payment systems, or customer support). These providers act exclusively on Yamaha’s instructions and are bound by data-processing agreements in accordance with Article 28 GDPR, ensuring appropriate technical and organisational safeguards; and
  • Public authorities or legal representatives, where disclosure is required by law or necessary to establish, exercise, or defend legal claims.

Yamaha does not disclose personal data to independent third parties for their own marketing, profiling, or unrelated commercial purposes. All transfers are governed by Yamaha’s internal Data Protection Policy and applicable data-processing or intra-group transfer agreements.


11. Your Rights

As a user of the Service , you have the rights granted to you under the General Data Protection Regulation (GDPR) and other applicable privacy laws. These include:

  • Right of Access (Art. 15 GDPR): to obtain confirmation as to whether Yamaha processes your personal data and to access such data.
  • Right to Rectification (Art. 16 GDPR): to request correction of inaccurate or incomplete data.
  • Right to Erasure (Art. 17 GDPR): to request deletion of your personal data where legal grounds apply, e.g., where the data is no longer necessary or consent has been withdrawn.
  • Right to Restriction (Art. 18 GDPR): to request temporary limitation of processing, for example while the accuracy of the data or the legitimacy of processing is verified.
  • Right to Data Portability (Art. 20 GDPR): to receive your personal data in a structured, commonly used, and machine-readable format and to transmit it to another controller.
  • Right to Object (Art. 21 GDPR): to object at any time to processing based on legitimate interests, including profiling related to such processing, or to direct marketing.
  • Right to Withdraw Consent (Art. 7(3) GDPR): if processing is based on your consent (e.g., for marketing or analytics), you may withdraw it at any time with future effect.
  • Right to Lodge a Complaint (Art. 77 GDPR): to contact or file a complaint with a supervisory authority if you believe that the processing of your personal data infringes the GDPR.

You may exercise your rights at any time by contacting Yamaha at:

dataprotection@contact.europe.yamaha.com

For users outside the EU/EEA, additional rights may apply under local laws (such as the CCPA/CPRA, LGPD, or APPI). 


12. Further Information

This Privacy Notice for the Service supplements the Yamaha Privacy Policy, which provides further details on Yamaha’s data-processing practices, data-recipient categories, international data transfers, storage and retention, and overall data-protection framework.

You can access the latest version of the Yamaha Privacy Policy here: 

 https://uk.yamaha.com/en/privacy-policy/If you have any questions or concerns regarding the processing of your personal data within the Service, or about this Privacy Notice, you may contact our Data Protection Officer at any time:

dataprotection@contact.europe.yamaha.com

Last updated:  January 29, 2026