YOUR DATA, EXPLAINED.

When you fill in an artist’s sign-up form, join their mailing list or start a chat with their Telegram bot, your details go to that artist. They chose what to ask you and they decide what to do with the answers. In legal terms they are the data controller, and they carry the responsibility.

In A Box Records makes the tools the artist used. We store the data on their behalf and do what they ask us to do with it. In legal terms we are their data processor. We do not use your details for our own marketing, we do not sell them, and we do not share them with other artists.

There is one exception. We look after the security of the platform itself, and we investigate reports that a message sent through it was unwanted or abusive. For those narrow purposes we act in our own right.

Sign-up and capture forms

Your email address, plus whichever of your name, phone number, town or city and country the artist chose to ask for. If they added their own questions, your answers to those. If they invited you to upload a photo or video, whatever you chose to upload.

We send you an email to confirm the address is really yours. If you never confirm, everything you submitted is deleted automatically after seven days.

Photos and videos you upload

You keep ownership of anything you upload. When you tick the box on the form you are giving the artist permission to use it to promote their music, without a fee. You are not signing it over to them, and you can ask for it to be taken down at any time.

Mailing lists and emails

If you opt in, the artist can email you about releases. Those emails record when they were opened and which links were clicked, so the artist can tell whether the campaign worked. Every one of them has an unsubscribe link at the bottom, and unsubscribing takes one click with no sign-in.

If a message you receive was not something you asked for, there is a link in the footer to report it. That goes to us, not to the artist, and we look into it.

Visiting a page

If you agreed to analytics cookies, we store a random identifier in your browser so repeat visits count as one person rather than several. It contains nothing about you. If you declined, we still count the visit but attach no identifier at all. Full details are in our Cookie Policy.

These forms are not meant for children. When you submit one you are confirming that you are 16 or over. Artists are contractually required not to aim their forms at children.

If you are a parent or guardian and you think we hold information about your child, email [email protected] and we will delete it promptly.

All of these are free, and we have to answer within one month:

• —A copy of everything held about you.
• —A correction, if something is wrong.
• —Deletion of your details.
• —A pause on any use of your details while a complaint is looked into.
• —An objection to your details being used for marketing, which we must always honour.
• —Your details in a portable file you can take elsewhere.

Because the artist is the controller, the quickest route is usually to contact them directly. If you would rather not, or you cannot reach them, send the request to us and we will pass it on and make sure it gets dealt with. Here is how:

• —Unconfirmed form submissions: deleted automatically after seven days.
• —Confirmed sign-up details: kept while the artist runs their list, and deleted when they delete the form or your record, or when you ask us to.
• —Unsubscribe records: kept indefinitely, holding only your email address and the fact you opted out. We have to remember, otherwise we could email you again by mistake.

Everything is stored in the United Kingdom. Emails are sent through a provider based in Ireland. A small number of our suppliers have parent companies in the United States; where data reaches them it is covered by the safeguards UK law requires. The full list, and the safeguard relied on for each, is at /subprocessors.

Tell us at [email protected] and we will try to sort it out. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113, and you do not have to come to us first.

Our full policy, including the technical detail, is in our Privacy Policy.