SUB-PROCESSORS.

Where an account holder collects personal data from fans or industry contacts using this platform, they are the controller of it and In A Box Records is their processor. Data protection law requires us to tell them which other companies we involve in that processing, so they can object before we engage anyone new. This page is how we do that, and it is referred to in Schedule 1 of the Platform Agreement.

It also serves the transparency duty we owe directly to everyone whose data we hold. If you want to know who can see your information, the answer is on this page, in full.

• —Our processor. Acts only on our instructions, under a written contract that binds them to the same obligations we owe. We remain accountable for what they do.
• —Independent controller. Decides for itself what it does with the data, because the individual has their own relationship with them. Telegram is here: a fan who messages an artist’s bot is using an account they already hold, and that company’s own privacy policy governs it.
• —No personal data. Receives only release identifiers, such as a UPC or ISRC, to look up streaming links. Nothing that identifies a person is sent. Spotify is here too, since fan Pre-Save connections are not yet open to the public.

All personal data on this platform is stored in the United Kingdom, and email is sent from Ireland. Some of the companies above are headquartered in the United States, which means data held in their infrastructure could in principle be accessed from there even though it is stored here. Where that is the case, the transfer is covered by the safeguard named below.

Before we add a company that would receive personal data, we will update this page and notify account holders, so there is a genuine opportunity to object rather than a notice after the fact. If an account holder objects on reasonable data protection grounds and we cannot find a way around it, they may terminate without penalty.

Questions about anything on this page go to [email protected].