DJ Promo DeskBack to the desk This agreement governs personal data YIN LTD processes on behalf of an artist or business customer. It forms part of the Artist Service and Membership Terms when accepted through onboarding or an order by the parties’ authorised representatives. The acceptance record identifies the Controller and the exact DPA version. YIN LTD’s separate processing as controller is described in the Privacy Notice.
1 Parties scope and definitions
Controller: the artist or business identified in the accepted order, acting through its authorised representative. Processor: YIN LTD, trading as DJPromoDesk (company number 10660966), whose registered office is 2 Western Street, Barnsley, South Yorkshire, S70 2BP. Contact: contact@djpromodesk.com. “Data Protection Laws” means applicable UK GDPR, Data Protection Act 2018, PECR and, where applicable, EU GDPR and other binding data-protection laws, as amended. “Personal Data”, “Processing”, “Personal Data Breach” and “Subprocessor” have their statutory meanings. “Customer Data” means personal data processed on the Controller’s behalf under this agreement.
This agreement prevails over conflicting service terms on the protection of Customer Data. Mandatory law and applicable international-transfer clauses take precedence. Nothing here reduces a data subject’s statutory rights or excludes legally unavoidable liability.
2 Controller responsibilities and instructions
The Controller determines lawful purposes and bases, supplies privacy information and obtains required marketing/device-access consent. It must ensure its lists, content and instructions are lawful, accurate and proportionate; respect objections and suppression records; and grant only necessary connected-account permissions. Sole traders and some partnerships may be individual subscribers under PECR.
The accepted order, enabled configuration and authorised actions are documented instructions within the processing described in Schedule 1. Additional instructions must be recorded in writing or in the workspace. The Processor will notify the Controller immediately if it considers an instruction infringes Data Protection Laws and may pause the affected activity while it is resolved.
3 Processor obligations
The Processor will process Customer Data only on documented instructions, including instructions concerning transfers, unless binding law requires otherwise. Where lawful, it will inform the Controller of that requirement before processing. It will not sell Customer Data, use it for unrelated advertising or its own marketing, or use it to train AI models without a separate lawful arrangement and express documented authorisation.
People authorised to access Customer Data must be subject to confidentiality duties, receive appropriate training and have access limited to their role. The Processor will maintain required records, cooperate with competent supervisory authorities and promptly notify the Controller if it cannot fulfil this agreement.
4 Security
Taking account of the state of the art, implementation costs, nature and scope of processing and risks to people, the Processor will implement and maintain appropriate technical and organisational measures under Article 32, including the measures in Schedule 2. It will assess confidentiality, integrity, availability and resilience, restoration capability and the effectiveness of safeguards. Material changes must not reduce the agreed overall level of protection.
5 Subprocessors and connected services
The Controller gives general written authorisation only for the Processor-appointed services expressly confirmed in Schedule 3. The Processor will impose binding obligations providing substantially the same data protection required here and remains fully liable to the Controller for its Subprocessors’ performance of those obligations.
Before adding or replacing a Subprocessor, the Processor will give at least 30 days’ written notice identifying its purpose, data, location and safeguards. The Controller may object on reasonable data-protection grounds within that period. The parties will seek an alternative; the new service will not process the objecting Controller’s data until resolved. If no reasonable solution is available, the Controller may end the affected feature/service before the change, with a proportionate refund of unused prepaid fees. Urgent replacements require prompt notice and a lawful arrangement that does not bypass the Controller’s authorisation.
A service contracted directly by the Controller through its own Kit, Resend, Buffer or other account may be the Controller’s separately appointed processor, rather than DJPromoDesk’s Subprocessor. DJPromoDesk remains responsible for the processing it performs and for disclosures made on its instructions. An independent-controller service, including payment compliance processing, is not treated as a Subprocessor merely because it is integrated. Schedule 3 must identify each actual arrangement.
6 International transfers
The Processor will not make a restricted transfer of Customer Data without documented instructions/authorisation and a lawful transfer mechanism. It will verify applicable adequacy coverage or enter the appropriate UK IDTA/UK Addendum and, where required, EU SCCs, complete the relevant assessment and use necessary supplementary safeguards. The parties will complete the required annexes accurately; this agreement alone does not create valid transfer clauses.
The Processor will provide information about locations and safeguards on request, notify the Controller of material changes and, where lawful, government-access requests, and challenge requests where legally justified. Schedule 3 must record each applicable mechanism before processing begins.
7 Individual rights and regulator assistance
Taking account of the processing, the Processor will assist by appropriate measures with access, correction, erasure, restriction, portability and objections. It will forward requests relating to Customer Data without undue delay and normally within two working days, and will not respond substantively except on instructions or where law requires. It will provide timely searches/exports and preserve relevant records so the Controller can meet its deadlines.
Taking account of the nature of processing and information available, the Processor will assist with security obligations, breach notifications, data-protection impact assessments and prior consultation under Articles 32–36. Routine assistance is included; exceptional additional work may be charged only if disclosed and agreed in advance, without delaying legally required assistance.
8 Personal data breaches
The Processor will notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, with an initial contractual target of within 24 hours. It will not wait for a completed investigation. Notification will describe the nature of the breach, affected categories and approximate numbers where known, contact point, likely consequences, mitigation and outstanding information. Updates may follow in phases without undue delay.
The Processor will contain, investigate and remediate the incident, preserve appropriate evidence and assist the Controller’s assessment and notifications. The Controller decides notifications for its data, subject to legal requirements; the Processor will not make public statements identifying the Controller without agreement unless required by law. The Controller’s own statutory reporting deadlines remain separate.
9 Return deletion and ending the service
At the Controller’s choice, the Processor will return Customer Data in a reasonably usable format or delete it and existing copies after processing ends, unless binding law requires retention. Earlier lawful deletion instructions will be reviewed and acted on without forcing the Controller to wait for an export window. Retention does not authorise continued marketing or unrelated use.
For ordinary closure, the proposed contractual period is 30 days from the recorded effective closure date for restricted export and recovery, after which live deletion begins. Cancelling renewal does not itself start this period. Attached subscriptions must reach an appropriate terminal state before automated closure. Deletion is processed in batches and failures require retry and review; it is not represented as instantaneous deletion at midnight on day 30.
For non-payment parking, the proposed policy is the same 60-day retention period and further seven-day written notice in section 5 of the Terms. The final notice states the export deadline and effective termination date. There is no additional 30-day window after that final deadline. A failed payment alone does not currently start automatic deletion. Protected or legacy accounts require managed closure and an individually recorded deadline.
Closing or pausing an account blocks new supported sends from DJPromoDesk. Operations already accepted by an external provider may still execute and must be reviewed or cancelled there. Removal of stored credentials on account purge does not necessarily revoke provider authorisation. The Processor will carry out or coordinate the necessary provider cleanup and record the outcome.
Where selective deletion from recovery copies is not practicable, backups must remain restricted to disaster recovery until expiry, and deletion and suppression instructions must be reapplied before restored data returns to active use. The backup job removes copies older than 30 days after a successful new backup. That mechanism alone does not guarantee expiry during repeated backup failures. Any enforceable maximum backup period depends on separately verified expiry controls. No fixed backup deletion guarantee is adopted in this revision.
Specific statutory retention and documented holds must be limited to what is necessary, access-restricted and reviewed. The current account hold can pause cleanup across an account and must be used sparingly. On request, the Processor will confirm completed deletion and identify any remaining data, reason and expected deletion date.
10 Demonstrating compliance and audits
The Processor will make available all information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the Controller or its mandated independent auditor. Reports and documents may be used first, but do not remove the inspection right. Audits ordinarily use reasonable notice, business hours and confidentiality safeguards protecting other customers; these conditions must not prevent an urgent investigation, regulator requirement or effective Article 28 audit.
The Processor will remedy material findings promptly. Reasonable costs for exceptional audit work may be agreed in advance; no fee or contractual restriction may obstruct statutory rights or investigation of a breach caused by the Processor. The Processor will immediately flag an audit instruction it considers unlawful.
11 Acceptance and identification
Processor: YIN LTD, company number 10660966, 2 Western Street, Barnsley, South Yorkshire, England, S70 2BP. Privacy and incident contact: contact@djpromodesk.com. Document version: 2026-10-15-r2. This is a review version and is not an executed agreement.
The Controller’s legal name, business address, account or order identifier, authorised representative and privacy or incident email are supplied in the accepted order and form part of this agreement. The effective date is the recorded date on which the parties accept this version. Customer details must come from that customer’s verified order; they cannot be filled in for all members in this master template.
For online acceptance, the retained receipt must identify both parties, the representative, authority declaration, terms and DPA versions, document copies or hashes, acceptance timestamp and order. The Controller must be able to download the accepted agreement and receipt after later versions are published. For a manually signed order, both parties’ representatives and dates are recorded on that order.
Schedule 1 Processing details
Subject matter and duration: supplying the Controller’s selected hosted artist website and desk, contact management, enquiries, private promotions and explicitly enabled email, social and AI features for the service term and the return or deletion period in section 9. A feature’s presence in the software does not mean it is enabled for a particular account. The accepted order and authorised configuration define the actual scope.
Operations: collection, storage, organisation, retrieval, editing, controlled disclosure, sending, scheduling, engagement reporting, export, suppression and erasure. Data subjects are the Controller’s authorised team, fans, subscribers, industry contacts, promo recipients, enquirers, collaborators, website visitors and people interacting with an authorised social account.
Website and contacts: account or artist identifiers; names and email or other contact details supplied through supported forms or imports; artist profile, biography, artwork, links and uploaded content; enquiry text; contact categories and notes; subscription, preference and suppression records. Public website content is visible to visitors. Contact lists and private workspace material are not made public by upload alone.
Promotions: campaign identifiers, selected recipient names and email addresses, message content, media references, send and provider message identifiers, delivery and unsubscribe events, feedback ratings and comments, and optional visit or listening events and timestamps. Identifiable promo links are intended for selected recipients, but a recipient may forward a link. Permission to access a promo does not grant permission to reuse the music.
Optional website measurement: artist identifier, random browser and event identifiers, page path, source or referring host, outbound destination host, timestamp or day and approximate country. Platform acquisition measurement can additionally associate a consenting browser with an internal signup reference and rounded approximate coordinates. These analytics datasets do not store raw IP addresses; network infrastructure and security processing are separate. Referrer and full page URLs can reach the collection endpoint before the server reduces them, so members must avoid placing personal data in public URL parameters.
Connected email and social: authorised account and profile identifiers, encrypted connection credentials, recipient addresses, message or post text, selected media, schedules, provider responses, delivery or publishing status and available performance information. Native Meta features may process Instagram or Facebook account, post and comment identifiers, comment text and enabled replies or private replies, subject to permissions, review status and account controls. This does not authorise unrestricted inbox access, follower-list scraping or unapproved automatic messaging.
AI processing: text prompts, relevant feature context, supplied artist or campaign content and generated text for requested writing or help. The inspected desk-help endpoint uses OpenAI Responses with store:false; this is not evidence that every AI endpoint has identical settings or that provider abuse-monitoring retention is zero. No blanket authorisation is given to submit contact databases, payment credentials, secrets or sensitive personal data. AI output requires human review before publication or sending. Audio hosting does not itself authorise transcription, voice analysis or model training.
Authorised audiences: the Controller’s permitted users, role-limited DJPromoDesk support or administrators, specifically selected campaign or promo recipients, public visitors for approved public content, and providers necessary for the authorised operation. Special-category data, criminal-offence data and intentional children’s-data processing are outside ordinary instructions and require prior written assessment and safeguards.
Schedule 2 Security measures
The following describes controls evidenced in the reviewed production-preparation code and available backup records. It is not a certification that every control has been deployed or that every staff or supplier account is configured correctly. Deployment and operational exceptions are listed in the companion review checklist.
Application access: email-based authentication, scoped sessions, owner checks and separate Master access. The security service requires authenticator MFA for Master accounts; ordinary member MFA is supported but is not represented as mandatory. Session cookies use Secure and HttpOnly attributes with same-site restrictions. Session policy limits normal sessions to eight hours and 30 minutes of inactivity. MFA enrolment and recovery have replay and attempt controls. Managed support access is scoped and audited in the prepared release.
Secrets and transport: protected integration settings and MFA secrets use application encryption; the inspected MFA implementation uses AES-GCM with per-record nonces and identity binding. Application service calls use HTTPS. Access to deployment credentials and encrypted settings remains dependent on the operator’s account permissions and key management. Application encryption does not imply that every database field is individually encrypted.
Backups: the workflow is scheduled daily at 02:17 UTC, subject to environment enablement and successful execution. Database exports, file copies and manifests are encrypted using AES-256-GCM before storage in a separate R2 bucket in the same Cloudflare account. Recovery verifies checksums, authenticated decryption and local database integrity. The database and files are copied separately, so a run is not a single transactionally consistent snapshot. GitHub-hosted runners temporarily process plaintext during export and encryption.
Backup recovery and expiry: successful local recovery verification has been recorded for staging and production. That is different from restoring and testing a complete application in disposable Cloudflare resources. A quarterly cloud restore test has not been established as an existing recurring control. Old copies are pruned after a successful backup; a separately verified bucket lifecycle rule is needed to enforce expiry despite failed runs. The service makes no recovery-time or recovery-point SLA in this agreement.
Deletion and safeguards: owner-scoped exports, new-send pauses, account-closure deadlines, bounded cleanup with retries, privacy-request records and legal holds exist in the prepared privacy implementation. Provider-accepted queues and provider token revocation require separate handling. Recovered data must remain isolated until current deletion requests, suppression, billing and access state are reconciled. Protected or legacy accounts need managed review.
Organisational obligations: authorised personnel must be bound to confidentiality, trained for their responsibilities, granted only necessary access and removed promptly when access is no longer needed. The Processor must maintain incident handling, supplier review, vulnerability and change management, access review and recovery procedures appropriate to the risks. These obligations are not evidence of completed staff training, signed confidentiality agreements or a certified management system.
Schedule 3 Providers and transfer register
This register distinguishes DJPromoDesk-appointed processing from customer-connected services and independent-provider activities. Published supplier terms identify likely legal entities and safeguards; the account contract, region, plan and configuration must match them. Unresolved items below are not deemed authorised simply by appearing in this review copy. No UK-only or EU-only processing commitment is made.
DJPromoDesk appointed processing
Cloudflare Inc — Workers application delivery, D1 database, R2 files and encrypted backup storage, plus network and security processing. Data includes hosted content, contact and campaign records, identifiers, encrypted credentials and backups. Processing is distributed; the actual D1, R2 and backup jurisdictions and support locations have not been verified. The published Cloudflare DPA contains EU SCC and UK Addendum arrangements. Live retention follows the agreed lifecycle; the backup script prunes copies older than 30 days only after a successful run. Native recovery and log periods depend on plan and settings. Account DPA coverage, resource locations and independent expiry remain to be confirmed.
GitHub hosted Actions — build and operational automation, including database export, temporary plaintext file handling and encryption during backups. This makes GitHub relevant to Customer Data processing, not merely source-code storage. The applicable contracting entity may depend on the purchase arrangement; confirm it from the account agreement. Runner processing location, applicable DPA and transfer safeguards, job-log retention and removal of temporary data need account-level verification. The script cleans its temporary directory and does not intentionally upload plaintext backups as job artifacts; abnormal termination and runner disposal must still be covered.
Resend operated by Plus Five Five Inc — platform service email and any artist campaign sent under a DJPromoDesk-owned account. Data includes sender and recipient addresses, email content, message identifiers and delivery events. Published information identifies US storage and DPA SCC/UK Addendum provisions. Published email/log retention is 30 days for Free, Pro and Scale plans; remaining customer data is deleted within 90 days of account termination, with seven-day backups. Those periods do not prove single-artist erasure in a shared account. Confirm plan, contracting account, tracking settings and the per-recipient deletion process.
OpenAI API — requested text generation and help where Customer Data is sent through a DJPromoDesk account. The current published DPA identifies OpenAI OpCo LLC for a UK customer and UK SCC/Addendum arrangements. Actual account coverage and project region remain to be verified. Prompts, supplied context and outputs are processed; no-training defaults and retention settings require account confirmation. Standard abuse-monitoring logs can persist for up to 30 days, subject to exceptions, and endpoint state has separate rules. The inspected help request sets store:false; zero retention is not promised.
Services connected by the customer
Kit Inc — artist-owned email lists and campaigns when the artist contracts directly with Kit. Subscriber/contact details, preferences, campaign text and engagement records may be exchanged. Published terms identify US and other-country processing and a DPA with transfer provisions. The artist’s account terms, retention, deletion settings and transfer assessment apply; exact account periods are not verified here. If DJPromoDesk supplies the account instead, reclassify the arrangement and complete a platform subprocessor entry before use.
Buffer Inc — artist-owned social scheduling and reporting where the artist contracts directly. Data includes connected profiles, tokens, post text, media, schedules and available engagement data. The current applicable DPA, countries, retention and UK transfer mechanism must be checked against that account. Disconnecting DJPromoDesk does not delete the Buffer account or necessarily cancel accepted posts. A DJPromoDesk-owned Buffer arrangement requires a separate subprocessor entry.
Artist-owned Resend — the same service functions and published provider periods described above may apply, but the artist appoints the provider directly. DJPromoDesk remains responsible for its own instructions, data handling and disclosures. Record the account owner rather than assuming every Resend connection is a platform subprocessor.
Other recipients and services with separate roles
Meta Instagram and Facebook — authorised social-account connections, publishing, comments and permitted replies. The applicable Meta contracting entity, processing role and transfer terms vary with the account and product. These are not automatically DJPromoDesk subprocessors for every operation. Verify approved scopes, account ownership, retention and deletion obligations before enabling each feature. Revocation and provider-side content deletion are distinct operations.
Stripe — hosted membership checkout and subscription, payment, fraud and compliance processing when enabled. Stripe has independent-controller activities as well as any contract-defined processing services. Confirm the actual merchant contracting entities, live account countries, retention and safeguards. This register does not authorise direct-to-fan sales or automatic affiliate payouts.
Google — optional account authentication and any remotely loaded fonts on the prepared welcome page. Identity data and technical network information can be disclosed; authentication is not access to Gmail messages. Confirm applicable Google entities and roles. Self-hosting fonts would remove the external font request. SoundCloud and any other approved media provider receive browser/network data when their player loads and operate under their own notices. Audit each actually used embed and its storage before publication.