DJ Promo DeskBack to the desk This agreement governs personal data YIN LTD processes on behalf of an artist or business customer. It forms part of the DJPromoDesk Terms and Conditions when accepted through onboarding or an order by the parties’ authorised representatives. The acceptance record identifies the Controller, the exact DPA version and the applicable provider record under Schedule 3. YIN LTD’s separate processing as controller is described in the Privacy Notice.
1 Parties scope and definitions
Controller: the artist or business identified in the accepted order, acting through its authorised representative. Processor: YIN LTD, trading as DJPromoDesk (company number 10660966), whose registered office is 2 Western Street, Barnsley, South Yorkshire, S70 2BP. Contact: contact@djpromodesk.com. “Data Protection Laws” means applicable UK GDPR, Data Protection Act 2018, PECR and, where applicable, EU GDPR and other binding data-protection laws, as amended. “Personal Data”, “Processing”, “Personal Data Breach” and “Subprocessor” have their statutory meanings. “Customer Data” means personal data processed on the Controller’s behalf under this agreement.
This agreement prevails over conflicting service terms on the protection of Customer Data. Mandatory law and applicable international-transfer clauses take precedence. Nothing here reduces a data subject’s statutory rights or excludes legally unavoidable liability.
2 Controller responsibilities and instructions
The Controller determines lawful purposes and bases, supplies privacy information and obtains required marketing/device-access consent. It must ensure its lists, content and instructions are lawful, accurate and proportionate; respect objections and suppression records; and grant only necessary connected-account permissions. Sole traders and some partnerships may be individual subscribers under PECR.
The accepted order, enabled configuration and authorised actions are documented instructions within the processing described in Schedule 1. Additional instructions must be recorded in writing or in the workspace. The Processor will notify the Controller immediately if it considers an instruction infringes Data Protection Laws and may pause the affected activity while it is resolved.
3 Processor obligations
The Processor will process Customer Data only on documented instructions, including instructions concerning transfers, unless binding law requires otherwise. Where lawful, it will inform the Controller of that requirement before processing. It will not sell Customer Data, use it for unrelated advertising or its own marketing, or use it to train AI models without a separate lawful arrangement and express documented authorisation.
People authorised to access Customer Data must be subject to confidentiality duties, receive appropriate training and have access limited to their role. The Processor will maintain required records, cooperate with competent supervisory authorities and promptly notify the Controller if it cannot fulfil this agreement.
4 Security
Taking account of the state of the art, implementation costs, nature and scope of processing and risks to people, the Processor will implement and maintain appropriate technical and organisational measures under Article 32, including the measures in Schedule 2. It will assess confidentiality, integrity, availability and resilience, restoration capability and the effectiveness of safeguards. Material changes must not reduce the agreed overall level of protection.
5 Subprocessors and connected services
The Controller gives general written authorisation for the Processor-appointed services identified in the applicable provider record supplied with the accepted order under Schedule 3. A catalogue entry alone does not authorise an unidentified legal entity or an undocumented restricted transfer. The Processor will impose binding obligations providing substantially the same data protection required here and remains fully liable to the Controller for its Subprocessors’ performance of those obligations.
Before adding or replacing a Subprocessor, the Processor will give at least 30 days’ written notice identifying its purpose, data, location and safeguards. The Controller may object on reasonable data-protection grounds within that period. The parties will seek an alternative; the new service will not process the objecting Controller’s data until resolved. If no reasonable solution is available, the Controller may end the affected feature/service before the change, with a proportionate refund of unused prepaid fees. Urgent replacements require prompt notice and a lawful arrangement that does not bypass the Controller’s authorisation.
A service contracted directly by the Controller through its own Kit, Resend, Buffer or other account may be the Controller’s separately appointed processor, rather than DJPromoDesk’s Subprocessor. DJPromoDesk remains responsible for the processing it performs and for disclosures made on its instructions. An independent-controller service, including payment compliance processing, is not treated as a Subprocessor merely because it is integrated. Schedule 3 must identify each actual arrangement.
6 International transfers
The Processor will not make a restricted transfer of Customer Data without documented instructions/authorisation and a lawful transfer mechanism. It will verify applicable adequacy coverage or enter the appropriate UK IDTA/UK Addendum and, where required, EU SCCs, complete the relevant assessment and use necessary supplementary safeguards. The parties will complete the required annexes accurately; this agreement alone does not create valid transfer clauses.
The Processor will provide information about locations and safeguards on request, notify the Controller of material changes and, where lawful, government-access requests, and challenge requests where legally justified. Schedule 3 must record each applicable mechanism before processing begins.
7 Individual rights and regulator assistance
Taking account of the processing, the Processor will assist by appropriate measures with access, correction, erasure, restriction, portability and objections. It will forward requests relating to Customer Data without undue delay and normally within two working days, and will not respond substantively except on instructions or where law requires. It will provide timely searches/exports and preserve relevant records so the Controller can meet its deadlines.
Taking account of the nature of processing and information available, the Processor will assist with security obligations, breach notifications, data-protection impact assessments and prior consultation under Articles 32–36. Routine assistance is included; exceptional additional work may be charged only if disclosed and agreed in advance, without delaying legally required assistance.
8 Personal data breaches
The Processor will notify the Controller without undue delay after becoming aware of a Personal Data Breach affecting Customer Data, with an initial contractual target of within 24 hours. It will not wait for a completed investigation. Notification will describe the nature of the breach, affected categories and approximate numbers where known, contact point, likely consequences, mitigation and outstanding information. Updates may follow in phases without undue delay.
The Processor will contain, investigate and remediate the incident, preserve appropriate evidence and assist the Controller’s assessment and notifications. The Controller decides notifications for its data, subject to legal requirements; the Processor will not make public statements identifying the Controller without agreement unless required by law. The Controller’s own statutory reporting deadlines remain separate.
9 Return deletion and ending the service
At the Controller’s choice, the Processor will return Customer Data in a reasonably usable format or delete it and existing copies after processing ends, unless binding law requires retention. Earlier lawful deletion instructions will be reviewed and acted on without forcing the Controller to wait for an export window. Retention does not authorise continued marketing or unrelated use.
For ordinary closure, including effective closure after unresolved non-payment under section 5 of the Terms, the restricted export and recovery period is 30 days from the recorded effective service closure date, followed by live cleanup with retries. Cancellation of future renewal is not itself effective closure. For non-payment, a private seven-calendar-day payment warning precedes parking and closure of paid access; the notified effective closure date starts the 30-day clock. A reminder is sent before routine deletion. The separately disclosed rule for unconverted trials remains deletion of trial workspace data 14 days after trial expiry. Earlier lawful deletion instructions, necessary legal retention and restricted backups remain subject to the applicable safeguards.
Any account requiring managed closure must have an individually recorded deadline and a documented reason. This does not extend necessary retention indefinitely or override earlier lawful return or deletion instructions. Restricted recovery copies follow the backup safeguards below.
Closing or pausing an account blocks new supported sends from DJPromoDesk. Operations already accepted by an external provider may still execute and must be reviewed or cancelled there. Removal of stored credentials on account purge does not necessarily revoke provider authorisation. The Processor will carry out or coordinate the necessary provider cleanup and record the outcome.
Where selective deletion from recovery copies is not practicable, backups must remain restricted to disaster recovery until expiry. Deletion and suppression instructions must be reapplied before restored data returns to active use. Routine pruning removes copies older than 30 days after a successful new backup; this alone does not ensure expiry during repeated backup failures. The Processor must monitor failures, assess continued retention and take appropriate remedial action. No fixed maximum backup deletion period is agreed here; necessary retention must remain limited by purpose and applicable law.
Specific statutory retention and documented holds must be limited to what is necessary, access-restricted and reviewed. Account-wide holds must be used only where justified, with their scope and review date recorded. On request, the Processor will confirm completed deletion and identify any remaining data, the reason and the expected deletion date or criteria determining that date.
10 Demonstrating compliance and audits
The Processor will make available all information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the Controller or its mandated independent auditor. Reports and documents may be used first, but do not remove the inspection right. Audits ordinarily use reasonable notice, business hours and confidentiality safeguards protecting other customers; these conditions must not prevent an urgent investigation, regulator requirement or effective Article 28 audit.
The Processor will remedy material findings promptly. Reasonable costs for exceptional audit work may be agreed in advance; no fee or contractual restriction may obstruct statutory rights or investigation of a breach caused by the Processor. The Processor will immediately flag an audit instruction it considers unlawful.
11 Acceptance and identification
Processor: YIN LTD, company number 10660966, 2 Western Street, Barnsley, South Yorkshire, England, S70 2BP. Privacy and incident contact: contact@djpromodesk.com. Document version: 2026-10-19. Publication of this document does not itself execute an agreement; it becomes binding through the acceptance process described in this section.
The Controller’s legal name, business address, account or order identifier, authorised representative and privacy or incident email are supplied in the accepted order and form part of this agreement. The effective date is the recorded date on which the parties accept this version. The order and its provider record are retained with the accepted DPA.
Your accepted order identifies the contracting customer and authorised representative. We retain the acceptance date and exact versions of the Terms and DPA agreed. We provide a durable copy of the accepted documents and order. Acceptance of these documents does not constitute consent to optional marketing or tracking. The retained online receipt identifies both parties, the representative and authority declaration, account/order, acceptance time and immutable document versions or copies. Previously accepted versions remain available after updates. Manually signed orders record both representatives and dates.
Schedule 1 Processing details
Subject matter and duration: supplying the Controller’s selected hosted artist website and desk, contact management, enquiries, private promotions and explicitly enabled email, social and AI features for the service term and the return or deletion period in section 9. A feature’s presence in the software does not mean it is enabled for a particular account. The accepted order and authorised configuration define the actual scope.
Operations: collection, storage, organisation, retrieval, editing, controlled disclosure, sending, scheduling, engagement reporting, export, suppression and erasure. Data subjects are the Controller’s authorised team, fans, subscribers, industry contacts, promo recipients, enquirers, collaborators, website visitors and people interacting with an authorised social account.
Website and contacts: account or artist identifiers; names and email or other contact details supplied through supported forms or imports; artist profile, biography, artwork, links and uploaded content; enquiry text; contact categories and notes; subscription, preference and suppression records. Public website content is visible to visitors. Contact lists and private workspace material are not made public by upload alone.
Promotions: campaign identifiers, selected recipient names and email addresses, message content, media references, send and provider message identifiers, delivery and unsubscribe events, feedback ratings and comments, and optional visit or listening events and timestamps. Identifiable promo links are intended for selected recipients, but a recipient may forward a link. Permission to access a promo does not grant permission to reuse the music.
Optional website measurement: artist identifier, random browser and event identifiers, page path, source or referring host, outbound destination host, timestamp or day and approximate country. Platform acquisition measurement can additionally associate a consenting browser with an internal signup reference and rounded approximate coordinates. These analytics datasets do not store raw IP addresses; network infrastructure and security processing are separate. Referrer and full page URLs can reach the collection endpoint before the server reduces them, so members must avoid placing personal data in public URL parameters.
Connected email and social: authorised account and profile identifiers, encrypted connection credentials, recipient addresses, message or post text, selected media, schedules, provider responses, delivery or publishing status and available performance information. Native Meta features may process Instagram or Facebook account, post and comment identifiers, comment text and enabled replies or private replies, subject to permissions, review status and account controls. This does not authorise unrestricted inbox access, follower-list scraping or unapproved automatic messaging.
AI processing: text prompts, relevant feature context, supplied artist or campaign content and generated text for requested writing or help. Provider-side security, abuse-monitoring and feature-specific retention may apply; zero retention is not promised. No blanket authorisation is given to submit contact databases, payment credentials, secrets or sensitive personal data. AI output requires human review before publication or sending. Audio hosting does not itself authorise transcription, voice analysis or model training.
Authorised audiences: the Controller’s permitted users, role-limited DJPromoDesk support or administrators, specifically selected campaign or promo recipients, public visitors for approved public content, and providers necessary for the authorised operation. Special-category data, criminal-offence data and intentional children’s-data processing are outside ordinary instructions and require prior written assessment and safeguards.
Schedule 2 Security measures
The Processor must implement and maintain the following measures for Customer Data, with deployment and configuration appropriate to the risks. These are contractual requirements and do not represent certification of a particular management system. Any additional order-specific security commitments must be recorded with the accepted order.
Application access: restrict access through authenticated, scoped sessions, ownership checks and separate administrative access. Require authenticator multi-factor authentication for Master administrative accounts; support member multi-factor authentication where available. Use Secure and HttpOnly session cookies with appropriate same-site restrictions. Limit normal sessions to a maximum of eight hours and 30 minutes of inactivity. Protect MFA enrolment and recovery against replay and repeated attempts. Scope, log and revoke managed support access.
Secrets and transport: protect stored integration credentials and MFA secrets using appropriate application encryption, with controlled key access. Use HTTPS for application service calls. Manage deployment credentials and keys through access restrictions and controlled rotation and recovery procedures. Application-level protection of secrets does not imply individual encryption of every database field.
Backups: maintain scheduled daily encrypted database and file backups in a separate storage bucket with restricted access. Use authenticated encryption and verify integrity during recovery. Restrict and remove temporary plaintext handled by operational automation. Where database and file copies are taken separately, account for consistency limits during restoration. Monitor backup failures and take remedial action.
Backup recovery and expiry: periodically test recovery and retain the results. Reconcile restored records with current deletion, suppression, billing and access instructions before returning them to live use. Routine pruning and any independent expiry controls must be monitored. No recovery-time or recovery-point service level, fixed maximum backup retention period or specified quarterly testing frequency is agreed by this DPA.
Deletion and safeguards: restrict exports to authorised users; pause new supported sends when an account closes; record closure and deletion deadlines; run cleanup with retries; and maintain records of privacy requests and justified legal holds. Separately address provider-accepted queues and revocation of provider authorisations. Accounts requiring managed closure must receive documented review.
Organisational obligations: bind authorised personnel to confidentiality, train them for their responsibilities, grant only necessary access and remove it promptly when no longer required. Maintain incident handling, supplier review, vulnerability and change management, access review and recovery procedures appropriate to the risks. Keep records sufficient to demonstrate that these obligations are met.
Schedule 3 Providers and transfer register
This schedule distinguishes Processor-appointed services, customer-connected services and providers with separate roles. Before processing begins, the Processor must supply and retain an applicable provider record with the accepted order. For each appointed provider, that record must identify the contracting legal entity, service and data categories, processing and support locations, retention and deletion arrangements, applicable data-processing terms and the specific lawful basis and safeguards for any restricted transfer. Services may be used only within that documented scope. No UK-only or EU-only processing commitment is made.
DJPromoDesk appointed processing
Cloudflare — application delivery through Workers, D1 database services, R2 file and encrypted backup storage, and network and security services. Relevant data includes hosted content, contact and campaign records, identifiers, protected credentials and backup copies. Processing may be distributed internationally. The provider record must identify the contracted Cloudflare entity, resource and support locations, applicable DPA and transfer arrangements, log and native-recovery retention and backup expiry controls.
GitHub-hosted Actions — build and operational automation, including database export, temporary plaintext file handling and encryption during backups. This can involve Customer Data as well as source code. The provider record must identify the contracted GitHub entity, runner and support locations, applicable DPA and transfer arrangements, job-log retention, temporary-data disposal and handling of interrupted jobs. Plaintext Customer Data must not be included in published build artifacts or logs.
Resend — platform service messages and artist campaigns sent through a DJPromoDesk-owned account. Relevant data includes sender and recipient addresses, message content, identifiers and delivery events. The provider record must identify the contracted entity, storage and support locations, account plan, applicable DPA and transfer arrangements, tracking settings, retention and per-recipient deletion arrangements. A sending region alone does not determine the location of stored data.
OpenAI API — requested text generation and help where Customer Data is sent through a DJPromoDesk account. Relevant data includes prompts, selected context and outputs. The provider record must identify the contracted entity, project and processing locations, applicable DPA and transfer arrangements, endpoint retention, abuse-monitoring arrangements and the settings governing training use. Zero retention is not assumed and Customer Data may not be submitted for unrelated model training.
Services connected by the customer
Kit — artist-owned email lists and campaigns where the Controller contracts directly. Relevant data includes subscriber details, preferences, campaign content and engagement records. The Controller’s provider terms, locations, retention and transfer arrangements apply. If the Processor supplies the account instead, it must document and authorise that arrangement as a Subprocessor before use.
Buffer — artist-owned social scheduling and reporting where the Controller contracts directly. Relevant data includes profiles, connection credentials, post content, media, schedules and engagement records. The Controller’s provider terms, locations, retention and transfer arrangements apply. Disconnecting DJPromoDesk does not itself delete the Buffer account or cancel accepted posts. A Processor-owned account requires a documented Subprocessor arrangement before use.
Artist-owned Resend — where the Controller contracts directly for email services, it appoints that provider under its own account terms. DJPromoDesk remains responsible for its own processing and instructions. Account ownership, retention, deletion and transfer arrangements must be identified; a customer connection is not automatically a DJPromoDesk-appointed Subprocessor.
Other recipients and services with separate roles
Meta Instagram and Facebook — authorised social connections, publishing, comments and permitted replies. Applicable entities, processing roles, permissions and transfer terms depend on the account and product. Enabled functions must have a documented lawful arrangement and appropriate retention and deletion handling. Revocation of access and deletion of provider-side content are distinct operations.
Stripe — hosted membership checkout and subscription, payment, fraud and compliance services where enabled. Stripe may have independent-controller activities as well as contract-defined processing services. The merchant arrangement must identify the relevant entities, locations, data-protection terms, retention and transfer safeguards. This schedule does not activate direct-to-fan sales or automatic affiliate payouts.
Google — optional authentication and remotely loaded fonts where used. Identity or technical network information may be disclosed under the relevant Google service terms; authentication does not authorise Gmail-message access. SoundCloud and other approved media providers receive browser and network information when a player loads and have their own notices. Each actual integration must have an identified provider, role, permissions and any required loading or tracking consent.