Privacy Policy

This notice explains how YIN LTD, trading as DJPromoDesk, handles personal information through its membership platform, hosted artist websites, promotional tools and connected services. It also explains when an artist, rather than DJPromoDesk, is responsible for your information.

1 Who is responsible and how to contact us

YIN LTD, trading as DJPromoDesk (company number 10660966), whose registered office is 2 Western Street, Barnsley, South Yorkshire, S70 2BP, is the controller for information used to administer its own accounts, memberships, billing, security, support and business communications. Contact our privacy contact at contact@djpromodesk.com to ask about this notice or exercise your rights.

For an artist’s fan lists, industry contact lists, promotional campaigns and website enquiries, the artist generally determines the purpose of processing and acts as controller. DJPromoDesk processes that information on the artist’s documented instructions under a separate Data Processing Agreement. Contact the artist using the contact details on their website for requests about their campaigns. We will help route a request if needed. This notice does not replace the artist’s own privacy notice.

2 Information we collect and where it comes from

Account and membership information includes your name, artist or business name, email, account identifiers, application and profile details, plan, preferences and acceptance records. Optional Google sign-in verifies an account identifier and email; the authentication request includes basic profile permission. It does not request access to Gmail messages.

Billing information includes account and Stripe customer, subscription, checkout, price and payment references, billing amounts and currency, subscription status, trial and billing-period dates, cancellation status and referral or discount records. The reviewed payment flow uses hosted Stripe Checkout. Live payment configuration and log handling must be verified before activation; this notice does not claim a completed payment-security audit.

Content and communications: artwork, music, biographies and other material you upload, support enquiries, community posts and messages submitted through enabled features. Public profiles and hosted pages are visible to their intended public audience; community posts are visible to the relevant member audience.

Technical and engagement information includes timestamps, security events, network and browser information used to operate the service, campaign delivery and unsubscribe records, promo ratings and feedback and, where enabled with the relevant choice, visit and listening events. Optional website analytics stores random identifiers, reduced page/source/link information and approximate country; platform signup measurement may link a consenting browser with an internal member reference and rounded approximate coordinates. Raw IP addresses are not stored in these analytics datasets, but infrastructure and security processing are separate. Approximate network location is not GPS location.

Artist-controlled information may include fan/contact names, addresses, emails, enquiries, campaign content, recipient preferences, consent evidence and response history. Connected social tools may provide profile identifiers, posts, media, schedules, performance information and access tokens within the permissions granted.

AI features process the prompts, supplied content, relevant account context and responses needed for the feature. Avoid including sensitive information, entire fan lists, credentials or payment details in a prompt. We do not intentionally request special-category information or children’s data for ordinary membership services.

Information marked as required during application, account setup or checkout is needed to assess your application, provide the service or meet billing obligations. If you do not provide it, we may be unable to accept your application or supply the relevant service. Optional profile and marketing information is voluntary.

3 Why we use information and our lawful bases

Contract: to assess and respond to your request for membership, establish and administer your account, supply your plan and connected features, process subscriptions and communicate about the service. For an authorised contact of a business customer rather than an individual contracting customer, our basis is the legitimate interest in managing that business relationship.

Legitimate interests: to secure the service, prevent misuse and fraud, resolve support enquiries, moderate enabled community spaces, investigate rights complaints, maintain proportionate operational records and improve service reliability. We assess necessity and impact on individuals and use less intrusive information where practical. You may object to processing based on legitimate interests.

Legal obligations: to keep required accounting records, respond to lawful requests and meet applicable data-protection and other legal duties. Consent: for optional marketing and device-access technologies where consent is required. We do not treat accepting the service terms as general marketing consent.

For artist-controlled fan or campaign records, the artist must identify the appropriate lawful basis and meet electronic-marketing requirements. We act on their instructions; our contract with an artist is not itself a lawful basis for the artist to market to every recipient.

4 Marketing and recipient preferences

DJPromoDesk service notices, such as account and billing communications, are distinct from optional promotional messages. You can unsubscribe from our marketing using the message link or contact@djpromodesk.com. Withdrawal of marketing consent does not prevent necessary service communications.

Artists are responsible for the legality of their mailing lists and campaigns, sender identification and opt-outs. Artist campaigns are intended to use the artist’s own verified sending identity. A recipient’s professional DJ role does not automatically remove protections applicable to individual subscribers, including sole traders. Minimal suppression records may be kept to honour opt-outs.

5 Providers and other recipients

Cloudflare provides Workers application delivery, D1 database services, R2 file and backup storage, and network/security processing. Infrastructure is distributed internationally; no UK-only or EU-only commitment is made. GitHub-hosted Actions also processes data during backup export, temporary handling and encryption, before encrypted copies are stored in R2.

Resend: service messages and enabled artist promotional emails, processing recipient addresses, message content and delivery/event data. Resend states that stored customer data is in the United States; choosing an EU sending region does not move stored data to the EU.

Kit: fan/customer email campaigns where the artist connects their own account. Buffer: social publishing, scheduling and performance reporting where connected. Depending on the account arrangement, a provider may be directly contracted by the artist rather than appointed by DJPromoDesk; each provider’s own account/privacy terms also apply.

Stripe: subscription checkout, payments, billing and related fraud or compliance processing. Stripe may act as an independent controller for some payment and regulatory purposes. This notice does not assume direct-to-fan sales or affiliate payouts are operating through the same flow.

OpenAI API: enabled AI writing and help features. API inputs and outputs are not used for model training by default unless the account holder opts in. Provider-side abuse-monitoring and feature-specific retention can apply; this is not a promise of zero retention.

SoundCloud and other approved external media providers receive technical browser/network information when a player is loaded. Meta receives and supplies data for authorised Instagram and Facebook connections, including account, post, comment and permitted response information according to enabled scopes. Google provides optional authentication; the prepared welcome page also requests Google-hosted fonts. These operations have distinct roles and provider notices. Authorised staff, professional advisers and authorities may receive necessary data where legally justified. Business-transfer disclosures require appropriate confidentiality and legal safeguards.

6 International processing

Some providers process information outside the UK, including in the United States. For restricted transfers we must establish an applicable UK adequacy basis or appropriate contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, with the required transfer assessment and supplementary measures. Ask contact@djpromodesk.com for information about applicable safeguards or an appropriately redacted copy.

7 Cookies analytics and tracking

Necessary session and security storage supports requested account functions. Where optional website analytics is offered, use Allow analytics or Decline and reopen Analytics preferences to change your choice. Supported external players load only after the on-page loading choice; unloading removes the player but does not erase information already received by that provider. These controls do not constitute a universal banner for every legacy artist page or provider.

The Cookie Notice lists identified first-party technologies and explains where further provider or browser verification is required. Email-open or link tracking is a separate activity and is not authorised by accepting membership terms or a website analytics choice. Artists remain responsible for appropriate recipient information, lawful marketing and the settings of their own provider accounts.

8 How long information is kept

We retain information for the purpose for which it is needed, subject to valid earlier erasure instructions and specific legal obligations. Switching off renewal is not necessarily the date the service ends. The intended ordinary closure period is 30 days of restricted export and recovery from effective closure, followed by live cleanup in batches with retries. Protected and legacy accounts require managed handling.

The proposed non-payment policy retains content for 60 days from parking and gives a further seven days’ written notice with a final export deadline. There is no second 30-day period after that deadline. Failed payment alone currently does not start automatic deletion. This proposed policy requires implementation before adoption.

The reviewed retention rules set optional website analytics to 30 days; promo listening/visit records and saved help entries specifically categorised as help to 90 days; closed support cases to 365 days after their last update; completed or declined privacy requests to 365 days after closure; and privacy audit records to 365 days. Social comment records have a 90-day rule, social audit/post records 365 days, and temporary social media 30 days, with exceptions for pending operations, unresolved issues and holds. These are application rules that depend on the relevant maintenance jobs running. They are not blanket periods for all security logs, AI histories or provider copies.

Necessary accounting and transaction records are normally retained for six years from the end of the relevant company financial year, or longer where law requires. The reviewed code does not automate an accounting purge; the owner and accountant must administer that policy. Consent and suppression evidence is kept only as needed to demonstrate permission and honour objections, with provider records managed separately. Generic-account suppression is removed with operational account data; a recreated account must not be used to bypass an opt-out.

Backup pruning removes copies older than 30 days after a successful new backup. A separately verified expiry rule is needed to prevent old copies remaining during prolonged failures. Accordingly, this revision does not promise that every deleted record disappears from every backup within 30 days. Backups remain restricted to recovery, and deletion and suppression instructions must be reapplied before reuse. Provider retention may differ; the DPA register identifies published periods and remaining account checks.

Pausing or closing the desk stops supported new sends, but work already accepted externally may continue until cancelled with the provider. Disconnecting an artist-owned account does not close or erase that account. Stored credentials are removed with account cleanup; provider authorisations may also need revoking.

9 Security and access

The reviewed application includes scoped access, Master authenticator MFA, optional member MFA, limited sessions, protected integration secrets, account exports and cleanup controls. Backups use encryption and local recovery checks. Whether a feature is active depends on the deployed release and configuration. No system is completely secure; protect your account and avoid unnecessary confidential information in public content.

10 Your rights and complaints

Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your information; object to processing based on legitimate interests; and withdraw consent without affecting the lawfulness of earlier processing. You have an unconditional right to object to use of your information for direct marketing. Rights may be subject to lawful exceptions.

Contact contact@djpromodesk.com. We may request proportionate information to verify identity. Requests are normally answered within one month; where a lawful extension is needed, we will explain it within that first month. Artist-controlled requests will be passed to the responsible artist and we will provide appropriate processing assistance.

You can complain to the UK Information Commissioner’s Office at ico.org.uk or call 0303 123 1113, and to any other competent supervisory authority. We welcome the opportunity to resolve concerns first, but this does not restrict your right to complain.

11 Automated decisions and updates

AI writing/help and engagement reporting do not by themselves constitute decisions producing legal or similarly significant effects. Any such decision-making introduced later requires its own assessment and disclosures. This notice will be updated when processing changes; material changes will be brought to your attention appropriately.