Version 1.0.0 · In force from 26 July 2026
This is the contract between you and us for use of the platform. It is separate from the distribution and publishing agreement you sign for each release. The two schedules at the end matter most: Schedule 1 sets out how we handle data you collect from fans, and Schedule 2 sets out the rules on who you are allowed to email.
This summary is here to help you read the agreement. It is not part of it, and the wording below governs if the two ever differ.
The version below is the wording currently in force. When you signed up, the version in force on that date was recorded against your account, and that is the version that binds you until you accept a new one.
THIS PLATFORM AGREEMENT is entered into on the date the account holder accepted it.
BETWEEN:
1. The account holder of the email address on the account ("the User"); and
2. In A Box Records Ltd, a company registered in England and Wales under company number 09948687, whose registered office is at Hazeldean, Green Road, Wivelsfield Green, Haywards Heath, RH17 7QA, England ("the Company").
WHEREAS the Company operates an online platform providing tools for the planning, promotion and release of music, including fan sign-up forms, mailing lists, pre-save campaigns, release links, electronic press kits and industry outreach (the "Platform"), and the User wishes to use the Platform on the terms set out below.
AND WHEREAS the parties acknowledge that where the User collects personal data of fans or industry contacts using the Platform, the User determines the purposes and means of that processing and is accordingly the controller of that data, and the Company processes it on the User’s behalf as processor, on the terms of Schedule 1.
IT IS AGREED:
Scope. This Agreement governs the User’s access to and use of the Platform. It does not govern the distribution or publishing of the User’s recordings, which is dealt with under a separate Distribution & Publishing Agreement entered into per release. Where this Agreement and a Distribution & Publishing Agreement conflict, the Distribution & Publishing Agreement prevails in respect of the release it covers.
Documents forming part of this Agreement. The following form part of this Agreement: Schedule 1 (Data Processing), Schedule 2 (Acceptable Use), the Privacy Policy and the Cookie Policy. Where Schedule 1 conflicts with any other part of this Agreement in relation to the processing of personal data, Schedule 1 prevails.
Eligibility. The User warrants that they are at least 18 years of age and have the legal capacity to enter into this Agreement, and that where they enter into it on behalf of a company, partnership or other organisation they have authority to bind it.
Account security. The User is responsible for maintaining the confidentiality of their credentials and for all activity under their account. Two-factor authentication is mandatory. The User shall notify the Company without undue delay on becoming aware of any unauthorised access to their account.
Collaborators. Where the User invites collaborators to a project, the User remains responsible for their acts and omissions on the Platform as if they were the User’s own, and for ensuring that any personal data made accessible to a collaborator may lawfully be shared with them.
BETA status. The User acknowledges that the Platform is provided in beta. Features may change, be withdrawn or contain defects. The Company will use reasonable endeavours to preserve the User’s data but does not warrant uninterrupted or error-free operation during the beta period, and the User is advised to retain their own copies of material they upload.
Ownership. The User retains all right, title and interest in the recordings, compositions, artwork, images, video, text and other material they upload to the Platform ("User Content"). Nothing in this Agreement transfers ownership of User Content to the Company.
Licence to operate the Platform. The User grants the Company a non-exclusive, royalty-free, worldwide licence to host, store, copy, transmit, adapt in format only, and display User Content solely to the extent necessary to provide the Platform to the User and to display it on public pages the User has chosen to publish. This licence terminates when the User Content is deleted, subject to a reasonable period for the removal of backups.
Warranties as to content. The User warrants that they own or are licensed to use all User Content, that its use on the Platform does not infringe any third party’s intellectual property, privacy or publicity rights, and that it is not defamatory, obscene or otherwise unlawful.
Confidentiality of unreleased material. The Company shall treat unreleased recordings and unannounced release information as confidential, shall not disclose them to any third party except a sub-processor listed at the published sub-processor register as necessary to operate the Platform, and shall serve them only to the User, the User’s collaborators and authorised Company personnel.
The User is the controller. The User is the controller of all personal data they collect or upload through the Platform relating to fans, subscribers, industry contacts and other third parties ("Third Party Data"). The User decides what is collected, why, who it is shared with and how long it is kept. The Company acts only as the User’s processor in respect of Third Party Data, on the terms of Schedule 1.
The Company is the controller of its own data. The Company is an independent controller in respect of the User’s own account data, the security and integrity of the Platform, the investigation of abuse reports, its billing records and aggregate non-identifying product analytics. Its handling of that data is described in the Privacy Policy.
The User’s obligations as controller. The User shall comply with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and all other applicable data protection and electronic marketing law. In particular the User shall: (a) have and be able to demonstrate a lawful basis for every act of processing they instruct; (b) provide the information required by Articles 13 and 14 to the individuals concerned; (c) obtain and keep records of any consent relied upon; (d) honour requests from individuals to exercise their rights; (e) register with the Information Commissioner’s Office and pay the data protection fee where required to do so; and (f) not instruct the Company to do anything that would put either party in breach of that law.
Company assistance with rights requests. Where an individual contacts the Company directly to exercise a right in respect of Third Party Data, the Company shall not respond substantively on the User’s behalf but shall forward the request to the User without undue delay and in any event within three working days, and shall provide the User with the tools and information reasonably needed to answer it. The User shall respond to the individual within the statutory period.
Indemnity. The User shall indemnify the Company against all losses, fines, penalties, damages, costs and reasonable legal expenses arising from the User’s breach of clause 3.3, of Schedule 2, or of any instruction given to the Company that was unlawful, save to the extent that the loss arises from the Company’s own breach of Schedule 1.
Fan-facing notice. The Company publishes a plain-English notice to fans at the Fan Privacy Notice, which explains the division of responsibility described in this clause 3. The User shall not represent the position to fans in terms inconsistent with that notice.
Compliance with Schedule 2. The User shall comply with Schedule 2 (Acceptable Use) in full. The warranties in Schedule 2 are given afresh on each occasion the User uploads contacts, sends a message or publishes a page through the Platform.
Sending through Company infrastructure. Email sent through the Platform is transmitted using the Company’s sending infrastructure and reputation. The User acknowledges that unlawful or unwanted sending damages that infrastructure for every other user, and that the Company may therefore suspend sending immediately under clause 6.2 where it has reasonable grounds to believe Schedule 2 has been breached.
Suppression. The Platform maintains unsubscribe and abuse-report suppression lists. The User shall not attempt to circumvent them, shall not re-add a suppressed address, and shall not export contacts in order to send to them outside the Platform in a way that would breach Schedule 2.
Provision of the Platform. The Company shall provide the Platform with reasonable skill and care. The Company may modify, add to or withdraw features, and shall give the User reasonable notice of any change that materially reduces functionality the User relies on, except where the change is required for security or legal compliance.
Fees. Where the User’s plan carries a fee, the fee, billing period and payment method applicable to that plan apply. Free and beta plans carry no fee. The Company shall give at least 30 days’ notice before introducing or increasing a fee applicable to the User’s plan, and the User may terminate under clause 6.1 rather than accept it.
No warranty of results. The Company gives no warranty as to the commercial outcome of any campaign, the number of sign-ups, streams, playlist placements or press coverage achieved, or the acceptance of any pitch by any third party.
Limitation of liability. Nothing in this Agreement limits or excludes either party’s liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, or for any other liability which cannot lawfully be limited. Subject to that, neither party shall be liable for loss of profit, loss of anticipated revenue, loss of goodwill or indirect or consequential loss, and the Company’s total aggregate liability arising under or in connection with this Agreement shall not exceed the greater of (a) the fees paid by the User to the Company in the twelve months preceding the claim and (b) five hundred pounds sterling. This clause does not limit the User’s liability under clause 3.5.
Third party services. Where the Platform connects to a third party service such as a streaming platform or messaging service, that service is provided by the third party on its own terms. The Company is not responsible for its availability, or for any act or omission of that third party.
Termination by the User. The User may terminate this Agreement at any time by written notice to the Company, sent from the email address on the account. The Company shall close the account and delete the User’s personal data and User Content in accordance with the Privacy Policy within 30 days of the notice, save for records the Company is required to retain under clause 6.4. The Company may first ask the User to confirm their identity, so that an account cannot be closed by someone other than its holder.
Suspension. The Company may suspend the User’s access, or the sending of email from the User’s account, with immediate effect where it has reasonable grounds to believe that the User has breached Schedule 2, that the account has been compromised, or that continued access presents a risk to the Platform, to third parties or to the Company’s legal position. The Company shall notify the User of the suspension and its reason as soon as reasonably practicable, and shall lift it once the concern is resolved.
Termination by the Company. The Company may terminate this Agreement on 30 days’ written notice, or immediately on written notice where the User is in material breach and has failed to remedy it within 14 days of being asked to, or where the breach is incapable of remedy.
Consequences of termination. On termination the User’s access ceases and, save as set out below, their personal data and User Content are deleted within 30 days. The Company shall retain: (a) signed agreements and the records evidencing their execution, for six years from the end of the agreement concerned, as required to establish and defend legal claims; (b) financial records, for six years after the end of the relevant financial year, as required by tax law; and (c) unsubscribe and abuse suppression records, indefinitely, because they exist to prevent further unwanted messages. Clauses 2.1, 2.4, 3.5, 5.4 and this clause 6.4 survive termination.
Export before closure. The User may request a machine-readable copy of their data at any time by writing to the Company, which shall provide it within one month and without charge. The User is advised to do so before giving notice to close their account, and to export their fan and contact lists using the export function on each list. Deletion following closure is irreversible.
Changes to this Agreement. The Company may amend this Agreement. Where an amendment is material the Company shall notify the User by email to the address on their account, and by publishing the amended version at /terms, not less than 30 days before it takes effect. The notice shall summarise what has changed. If the User continues to use the Platform on or after the date the amendment takes effect, the amended Agreement applies from that date. If the User does not wish to accept it they may terminate under clause 6.1 at any time before that date, or afterwards, without penalty and without losing any right to export their data. Amendments required by law or necessary to address a security risk may take effect on shorter notice, in which case the Company shall give as much notice as is reasonably possible. The version the User accepted on registration, and the date of that acceptance, are retained by the Company.
Notices. Notices to the User may be given by email to the address on their account or by notice within the Platform. Notices to the Company shall be sent to [email protected] for data protection matters, or to its registered office for any other matter.
Assignment. The User may not assign this Agreement without the Company’s written consent. The Company may assign or novate it to a successor in connection with a reorganisation or sale of its business, provided the successor assumes its obligations, including those in Schedule 1.
Entire agreement and severance. This Agreement constitutes the entire agreement between the parties as to the Platform and supersedes any prior understanding as to it. If any provision is held unenforceable, the remainder continues in force. No failure to enforce a right is a waiver of it.
Third parties. No person other than a party to this Agreement has any right to enforce any of its terms under the Contracts (Rights of Third Parties) Act 1999.
Governing law and jurisdiction. This Agreement and any dispute arising out of it are governed by the law of England and Wales, and the parties submit to the exclusive jurisdiction of the courts of England and Wales.
Status of the parties. This Schedule applies whenever the Company processes Third Party Data on the User’s behalf. In respect of that data the User is the controller and the Company is the processor. This Schedule is the written contract required by Article 28(3) of the UK GDPR.
Subject matter and duration. The subject matter of the processing is the operation of the Platform features the User chooses to use. The processing continues for as long as the User’s account remains open and the relevant data remains on the Platform, and ends in accordance with clause S1.11.
Nature and purpose of the processing. Collection through forms the User publishes; storage; organisation and retrieval; sending of email and messages the User initiates; measurement of how the User’s pages and campaigns perform; generation of reports and audience insight for the User; deletion on the User’s instruction. The purpose is to enable the User to build and communicate with their audience and to pitch their music.
Categories of data subject. Fans and subscribers who complete the User’s sign-up forms, connect a pre-save or join a messaging channel; and industry contacts such as playlist curators, journalists, broadcasters, promoters and label personnel whom the User contacts or uploads.
Types of personal data. Name; email address; telephone number; town or city and country; answers to questions the User has configured, including free-text answers; photographs and video submitted by fans; streaming platform and messaging identifiers and access tokens; records of email opens and link clicks; page view and interaction records associated with a pseudonymous identifier; and for industry contacts, name, role, outlet, contact details and the User’s own notes. The User shall not use the Platform to process special category data within the meaning of Article 9, or criminal offence data, and shall not configure form questions that solicit it.
Processing only on instructions. The Company shall process Third Party Data only on the User’s documented instructions, which comprise this Agreement and the actions the User takes within the Platform, except where required to do otherwise by law, in which case the Company shall inform the User of that requirement before processing unless legally prohibited from doing so. The Company shall inform the User if, in its opinion, an instruction infringes data protection law.
Confidentiality of personnel. The Company shall ensure that any person authorised to process Third Party Data is subject to a duty of confidence, is trained appropriately, and has access only to the data necessary for their role.
Security measures. The Company shall implement and maintain technical and organisational measures appropriate to the risk, as required by Article 32, including: encryption of all data in transit using TLS; encryption at rest of identifying personal details using AES-256-GCM; storage of passwords only as irreversible bcrypt hashes; mandatory two-factor authentication for platform accounts; role-based access control; logging of administrative access; rate limiting of authentication and public endpoints; segregation of private uploaded files behind authentication; tamper-evident hashing of signed agreement records; and regular review of these measures. A current description is maintained in the Company’s security documentation and is available to the User on request.
Sub-processors. The User gives general written authorisation for the Company to engage sub-processors. The current sub-processors are published at the sub-processor register. The Company shall give the User at least 30 days’ notice before adding or replacing a sub-processor, during which the User may object on reasonable data protection grounds; if the objection cannot be resolved the User may terminate the affected feature or this Agreement without penalty. The Company shall impose on each sub-processor obligations no less protective than those in this Schedule and remains liable to the User for their performance.
International transfers. The Company hosts the Platform, its database and its file storage in the United Kingdom. Where Third Party Data is transferred outside the United Kingdom, the Company shall ensure a lawful transfer mechanism is in place, being UK adequacy regulations where available or otherwise the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. Where a fan chooses to connect their own account with a third party service, that transfer is made by the fan to that service on its own terms and is outside the scope of this Schedule.
Deletion and return. On the User’s instruction, and in any event on termination of this Agreement, the Company shall delete all Third Party Data within 30 days, save to the extent that it is required by law to retain it, and save that unsubscribe and abuse suppression records shall be retained in minimised form because they exist to prevent further unwanted messages. Before deletion the User may export the data in a machine-readable format using the export function on each list. On written request the Company shall certify that deletion has taken place.
Assistance with data subject rights. The Company shall assist the User in fulfilling requests under Articles 15 to 22, including by providing search, export and deletion functions within the Platform for the fan and contact lists the User holds, by carrying out on request any step the Platform does not itself expose, and by forwarding any request it receives directly in accordance with clause 3.4.
Personal data breach. The Company shall notify the User without undue delay, and in any event within 24 hours, of becoming aware of a personal data breach affecting Third Party Data, and shall provide the information the User needs in order to meet its own obligations under Articles 33 and 34, including the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences and the measures taken or proposed. The Company shall not notify the Information Commissioner’s Office on the User’s behalf unless asked to.
Assistance with impact assessments. The Company shall provide the User with reasonable assistance in carrying out any data protection impact assessment relating to the Platform, and in any prior consultation with the Information Commissioner’s Office.
Audit. The Company shall make available to the User the information reasonably necessary to demonstrate compliance with this Schedule, and shall allow for and contribute to audits, including inspections, by the User or an auditor mandated by the User. Audits shall be conducted on not less than 30 days’ notice, no more than once in any twelve month period except following a personal data breach, during business hours, subject to confidentiality undertakings, and in a manner that does not disrupt the Platform or compromise the confidentiality of other users’ data. The Company may satisfy an audit request by providing an existing report or documented description of its measures where that reasonably answers the request.
Company processing as controller. Nothing in this Schedule applies to the Company’s processing of the data described in clause 3.2, in respect of which it acts as an independent controller and not as the User’s processor.
Lawful basis for every contact. The User warrants that for every individual to whom they send a message through the Platform they have a lawful basis to do so, and that they can produce evidence of it on request. Where the User relies on consent, that consent was freely given, specific, informed and unambiguous, was obtained by a positive act, was not bundled with unrelated terms, and is recorded with the date, the wording shown and the source.
Uploaded contacts. On each upload of contact details to the Platform, the User warrants that: (a) the details were obtained lawfully and not scraped, purchased from a list broker, or harvested from a website, directory or social platform in breach of its terms; (b) the User has a lawful basis to contact each person for the purpose intended; (c) the User has provided or will provide the information required by Article 14 to any person whose details were not obtained from them directly; and (d) the User has removed anyone who has previously objected to being contacted. The Platform requires the User to confirm these matters at the point of import, and that confirmation is recorded.
Individual subscribers under PECR. The User acknowledges that under regulation 22 of the Privacy and Electronic Communications Regulations, unsolicited electronic marketing to an "individual subscriber" requires prior consent or the narrow soft opt-in, and that sole traders and unincorporated partnerships count as individual subscribers. The User warrants that they have assessed each contact accordingly, and shall not assume that a business-looking email address falls outside regulation 22.
Soft opt-in. Where the User relies on the soft opt-in, they warrant that the contact details were obtained in the course of a sale or negotiations for a sale to that person, that the marketing relates to similar products, and that the person was given a simple means of refusing at the point of collection and in every message since.
Identification and unsubscribe. The User shall not disguise or conceal their identity as sender, shall not use a misleading subject line or sender name, shall not send from an address at which replies cannot be received, and shall not remove, obscure or disable the unsubscribe link or the abuse report link that the Platform includes in outgoing messages.
Honouring objections. The User shall act on every unsubscribe request and shall not send further marketing to a suppressed address. The Platform enforces this automatically; the User shall not attempt to defeat it.
Children. The User warrants that their forms, pages and campaigns are not directed at children, that they will not knowingly collect personal data from anyone under 16 through the Platform, and that they will notify the Company and delete the data if they discover that they have. The User shall not configure form questions designed to appeal specifically to children or to elicit data from them.
Purpose limitation. The User shall use Third Party Data only for the purposes disclosed to the individual when it was collected. The User shall not sell, rent or otherwise disclose Third Party Data to a third party for that third party’s own marketing purposes, and shall not combine it with data from another source in a way that is incompatible with the original purpose or that the individual would not reasonably expect.
Fan-submitted media. Where a form invites fans to submit photographs or video, the User shall use that material only within the scope of the licence the fan granted at the point of submission, shall not represent that they own it, and shall remove it on request from the person who submitted it or from any identifiable person appearing in it.
Prohibited use of the Platform. The User shall not: use the Platform to send anything unlawful, deceptive, harassing, hateful or obscene; impersonate any person or entity; upload malware; attempt to gain unauthorised access to the Platform, to another user’s data or to the underlying infrastructure; probe, scan or load-test the Platform without written permission; circumvent rate limits or authentication; scrape the Platform; resell or provide the Platform to a third party as a service without written permission; or use it to publish material that infringes another person’s rights.
Security research. The Company welcomes good-faith reports of security vulnerabilities, made in accordance with the disclosure policy published at /.well-known/security.txt. Testing conducted within that policy is not a breach of clause S2.10.
Consequences of breach. A breach of this Schedule is a material breach of this Agreement. The Company may suspend sending or access immediately under clause 6.2, may remove offending content or contacts, may be required to disclose the breach to a regulator or to an affected individual, and may terminate under clause 6.3. The indemnity in clause 3.5 applies.
Registered name: In A Box Records Ltd
Company number: 09948687
Company type: Private limited company
Registered office: Hazeldean, Green Road, Wivelsfield Green, Haywards Heath, RH17 7QA, England
Registered in: England and Wales
Data protection contact: Data Protection Lead, [email protected]