PRIVACY POLICY.

In A Box Records is a music platform operated by In A Box Records Ltd (company number 09948687), registered in England and Wales at Hazeldean, Green Road, Wivelsfield Green, Haywards Heath, RH17 7QA, England.

We are registered with the UK Information Commissioner’s Office under registration number TO BE CONFIRMED. For anything in this policy, including to exercise your rights, contact our Data Protection Lead at [email protected] or write to us at Hazeldean, Green Road, Wivelsfield Green, Haywards Heath, RH17 7QA, England.

We are based in the United Kingdom and this policy is written around the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Our services are available internationally, and where the EU GDPR applies to a visitor we apply the same standards.

This part applies to artists, songwriters, producers, managers and their collaborators who apply for or hold an account with us. For this information we are the data controller: we decide what is collected and why.

What we collect and why

Who reviews your application

Applications to join the platform are read and decided by a member of our team. We do not make decisions about your application by automated means alone, and there is no profiling involved.

Automated suspension, and how to challenge it

There is one decision we take automatically, without a person involved, that could affect you significantly. If the platform detects something that cannot happen through normal use — a request that has been altered to change a value only our servers are meant to set, an attempt to give yourself a different role or a larger allowance, pretending to be another account, or repeated forged security tokens or reused one-time codes — your account is suspended immediately. That ends your sessions and locks you out of the platform until the suspension is lifted.

Reaching a limit on your plan never causes this, and neither does opening a feature your plan does not include. Those are recorded, so that a pattern is visible to us if one develops, and nothing more happens.

Every automatic suspension is reviewed by a person, who can see exactly what was detected and can reinstate your account. We will tell you that your account has been suspended and what triggered it. If you think it is wrong, reply to us or email [email protected] and a person will look at it again. This is your right under Article 22 of the UK GDPR, and you do not have to accept a decision made by software alone.

We do not score you, profile you, or build a picture of your behaviour from these records. The decision is a fixed rule applied to a single request.

How long we keep it

• —Account and profile information: for as long as your account is open, then deleted or anonymised within 30 days of closure, apart from anything we must keep for longer as set out below.
• —Rejected applications: kept for 3 months as a cool-off (a further application cannot be submitted while the record remains), then removed automatically.
• —Signed agreements and the records that prove them: six years from the end of the agreement, because they are the evidence of a contract and may be needed for tax or a legal claim. These survive account closure by necessity.
• —Financial records including budgets, expenses and royalty accounting: six years after the end of the relevant financial year, as required by UK tax law.
• —Copies of emails we sent you: 12 months, after which the message body is deleted and only a minimal delivery record is kept.
• —Security logs: 12 months.
• —Records of refused actions: two years. Where a record is the reason an account was suspended, six years, because it is the evidence for a decision you could still challenge.

Your rights

You have the right to ask us for a copy of your personal data, to correct it if it is wrong, to have it deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.

To exercise any of them, email [email protected] from the address on your account, telling us what you want. We will respond within one month, and there is no charge. We may ask you to confirm who you are first, so that nobody else can request your data or have it deleted.

Closing your account does not remove signed agreements. Those are retained under the legal obligation described above, reduced to the minimum needed to keep the record enforceable. Everything else is removed.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

Artists use our tools to run sign-up forms, mailing lists and press outreach. When you give your details to one of those, the artist or their team decides what to collect and what to do with it. They are the data controller. We provide the software and store the data on their behalf, which makes us their data processor.

In practice this means the artist is the first person to contact about your data. The artist-specific notice at Fan Privacy Notice explains this in plain terms and tells you how to reach them. If you cannot identify or reach the artist, contact us at [email protected] and we will pass your request on and make sure it is dealt with.

What is collected through these tools

• —Sign-up and capture forms: your email address, and whichever of name, telephone number, town or city and country the artist has chosen to ask for, plus your answers to any questions they add and any photos or videos you choose to upload.
• —Mailing lists: your email address and whether you opted in, so the artist can send you release announcements. We record when an announcement email is opened and which links are clicked, so the artist can tell whether their campaign worked.
• —Telegram announcements: if you start a chat with an artist’s bot, your Telegram identifier, username and first name.
• —Industry contacts: if you work at a playlist, blog, station or label, an artist may hold your name, role, outlet and contact details in order to pitch music to you. Those details come from the artist, not from us.

What we do in our own right

For a limited set of purposes we act as a controller rather than a processor, because we decide to do these things for the protection of the platform as a whole and not on any artist’s instructions:

• —Keeping the service secure and available, including rate limiting, abuse detection and error investigation. Our lawful basis is our legitimate interest in platform security.
• —Investigating reports that a message sent through the platform was unwanted or abusive. Our lawful basis is our legitimate interest in preventing misuse of our service and complying with electronic marketing law.
• —Producing aggregate, non-identifying statistics about how our features perform. Our lawful basis is our legitimate interest in improving the product.

Your choices

• —Every marketing email contains a one-click unsubscribe link and a link to report it as abusive. Neither requires you to sign in.
• —You can stop Telegram announcements by blocking the bot or sending it a stop message.
• —To ask for a copy of your data or have it deleted, follow the instructions at /fan-data-request.

How long it is kept

• —Unverified form submissions are deleted automatically seven days after submission if you never confirm your email address.
• —Verified sign-up details are kept by the artist for as long as they run their list, and are deleted when they delete the form or your record, or when you ask for removal.
• —Unsubscribe and abuse records are kept indefinitely, because we have to remember not to email you again. These hold only your email address and the fact that you opted out.

We do not sell personal data, and we do not use fan data to advertise to you on behalf of anyone other than the artist whose form you filled in.

Platform accounts are only available to people aged 18 or over, and we verify date of birth before an application can be submitted.

Our fan-facing tools are not directed at children. Sign-up forms ask you to confirm that you are 16 or over before you submit, and artists are contractually required not to aim their forms at children. If you believe we hold information about a child, tell us at [email protected] and we will delete it promptly.

We use a small number of cookies. Those needed to sign you in, keep your session secure and remember your cookie choice are always active. Anything else is only used if you agree, and you can change your mind at any time. The full list, with what each one does and how long it lasts, is in our Cookie Policy.

We do not use Google Analytics, advertising pixels or any third-party tracking service. All of our analytics are produced in-house from data we already hold.

We share personal data only with the service providers we need to run the platform, and only what each of them needs. They act on our instructions under a written contract and cannot use the data for their own purposes, except where identified below as an independent controller.

The current list is always published at /subprocessors. We may also disclose information where we are legally required to, or to establish or defend legal claims.

Sending data outside the UK

Our application, database and file storage are hosted in London. Some of our providers are based in, or have parent companies in, the United States. Where personal data is transferred outside the UK we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with an assessment of the risks in the destination country. You can ask us for details of the safeguards for any particular transfer.

We take the security of personal data seriously and apply measures appropriate to the risk, as UK GDPR Article 32 requires:

• —All traffic is encrypted in transit using HTTPS, with strict transport security enforced.
• —Sensitive personal details, including names, dates of birth, telephone numbers and addresses, are encrypted at rest using AES-256-GCM.
• —Passwords are never stored, only irreversible bcrypt hashes.
• —Two-factor authentication is mandatory for every account.
• —Access is controlled by role, and administrative actions are recorded.
• —Sign-in attempts and sensitive endpoints are rate limited to slow down attacks.
• —Signed agreements are protected by a hash and a server-side signature so any tampering is detectable.
• —Uploaded files are only served to people entitled to see them, and private files are never cached by shared networks.

If a breach occurs that is likely to risk your rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell you without undue delay where the risk to you is high.

If we change how we use personal data we will update this policy, increase the version number shown at the top and change the date. Where a change materially affects you we will tell you directly, by email or in the platform, before it takes effect.