DJ Promo DeskBack to the desk This notice explains how YIN LTD, trading as DJPromoDesk, handles personal information through its membership platform, hosted artist websites, promotional tools and connected services. It also explains when an artist, rather than DJPromoDesk, is responsible for your information.
1 Who is responsible and how to contact us
YIN LTD, trading as DJPromoDesk (company number 10660966), whose registered office is 2 Western Street, Barnsley, South Yorkshire, S70 2BP, is the controller for information used to administer its own accounts, memberships, billing, security, support and business communications. Contact our privacy contact at contact@djpromodesk.com to ask about this notice or exercise your rights.
For an artist’s fan lists, industry contact lists, promotional campaigns and website enquiries, the artist generally determines the purpose of processing and acts as controller. DJPromoDesk processes that information on the artist’s documented instructions under a separate Data Processing Agreement. Contact the artist using the contact details on their website for requests about their campaigns. We will help route a request if needed. This notice does not replace the artist’s own privacy notice.
2 Information we collect and where it comes from
Account and membership information includes your name, artist or business name, email, account identifiers, application and profile details, plan, preferences and acceptance records. Optional Google sign-in verifies an account identifier and email; the authentication request includes basic profile permission. It does not request access to Gmail messages.
Billing information includes account and Stripe customer, subscription, checkout, price and payment references, billing amounts and currency, subscription status, trial and billing-period dates, cancellation status and referral or discount records. Where enabled, payments are collected through hosted Stripe Checkout and handled under Stripe’s applicable terms and privacy information.
Content and communications: artwork, music, biographies and other material you upload, support enquiries, community posts and messages submitted through enabled features. Public profiles and hosted pages are visible to their intended public audience; community posts are visible to the relevant member audience.
Technical and engagement information includes timestamps, security events, network and browser information used to operate the service, campaign delivery and unsubscribe records, promo ratings and feedback and, where enabled with the relevant choice, visit and listening events. Optional website analytics stores random identifiers, reduced page/source/link information and approximate country; platform signup measurement may link a consenting browser with an internal member reference and rounded approximate coordinates. Raw IP addresses are not stored in these analytics datasets, but infrastructure and security processing are separate. Approximate network location is not GPS location.
Artist-controlled information may include fan/contact names, addresses, emails, enquiries, campaign content, recipient preferences, consent evidence and response history. Connected social tools may provide profile identifiers, posts, media, schedules, performance information and access tokens within the permissions granted.
AI features process the prompts, supplied content, relevant account context and responses needed for the feature. Avoid including sensitive information, entire fan lists, credentials or payment details in a prompt. We do not intentionally request special-category information or children’s data for ordinary membership services.
Information marked as required during application, account setup or checkout is needed to assess your application, provide the service or meet billing obligations. If you do not provide it, we may be unable to accept your application or supply the relevant service. Optional profile and marketing information is voluntary.
3 Why we use information and our lawful bases
Contract: to assess and respond to your request for membership, establish and administer your account, supply your plan and connected features, process subscriptions and communicate about the service. For an authorised contact of a business customer rather than an individual contracting customer, our basis is the legitimate interest in managing that business relationship.
Legitimate interests: to secure the service, prevent misuse and fraud, resolve support enquiries, moderate enabled community spaces, investigate rights complaints, maintain proportionate operational records and improve service reliability. We assess necessity and impact on individuals and use less intrusive information where practical. You may object to processing based on legitimate interests.
Legal obligations: to keep required accounting records, respond to lawful requests and meet applicable data-protection and other legal duties. Consent: for optional marketing and device-access technologies where consent is required. We do not treat accepting the service terms as general marketing consent.
For artist-controlled fan or campaign records, the artist must identify the appropriate lawful basis and meet electronic-marketing requirements. We act on their instructions; our contract with an artist is not itself a lawful basis for the artist to market to every recipient.
4 Marketing and recipient preferences
DJPromoDesk service notices, such as account and billing communications, are distinct from optional promotional messages. You can unsubscribe from our marketing using the message link or contact@djpromodesk.com. Withdrawal of marketing consent does not prevent necessary service communications.
Artists are responsible for the legality of their mailing lists and campaigns, sender identification and opt-outs. Artist campaigns are intended to use the artist’s own verified sending identity. A recipient’s professional DJ role does not automatically remove protections applicable to individual subscribers, including sole traders. Minimal suppression records may be kept to honour opt-outs.
5 Providers and other recipients
Cloudflare provides Workers application delivery, D1 database services, R2 file and backup storage, and network/security processing. Infrastructure is distributed internationally; no UK-only or EU-only commitment is made. GitHub-hosted Actions also processes data during backup export, temporary handling and encryption, before encrypted copies are stored in R2.
Resend: service messages and enabled artist promotional emails, processing recipient addresses, message content and delivery/event data. Resend states that stored customer data is in the United States; choosing an EU sending region does not move stored data to the EU.
Kit: fan/customer email campaigns where the artist connects their own account. Buffer: social publishing, scheduling and performance reporting where connected. Depending on the account arrangement, a provider may be directly contracted by the artist rather than appointed by DJPromoDesk; each provider’s own account/privacy terms also apply.
Stripe: subscription checkout, payments, billing and related fraud or compliance processing. Stripe may act as an independent controller for some payment and regulatory purposes. This notice does not assume direct-to-fan sales or affiliate payouts are operating through the same flow.
OpenAI API: enabled AI writing and help features process the prompts, relevant context and responses needed for the requested task. We do not authorise use of Customer Data for AI-model training through ordinary service instructions. Provider-side security, abuse-monitoring and feature-specific retention can apply; zero retention is not promised.
SoundCloud and other approved external media providers receive technical browser and network information when a player is loaded. Meta receives and supplies data for authorised Instagram and Facebook connections, including account, post, comment and permitted response information within enabled permissions. Google provides optional authentication and receives technical network information where Google-hosted fonts are used. These services have their own privacy information and may have separate controller roles. Authorised staff, professional advisers and authorities may receive necessary data where legally justified. Business-transfer disclosures require appropriate confidentiality and legal safeguards.
6 International processing
Some providers process information outside the UK, including in the United States. Restricted transfers require an applicable UK adequacy basis or appropriate safeguards, such as the UK International Data Transfer Agreement or UK Addendum to EU Standard Contractual Clauses, together with any required transfer assessment and supplementary measures. The applicable arrangement must be established before the restricted transfer takes place. Contact contact@djpromodesk.com for information about the locations and safeguards applicable to your data or an appropriately redacted copy of the safeguards.
7 Cookies analytics and tracking
Necessary session and security storage supports requested account functions. Where optional website analytics is offered, use Allow analytics or Decline and reopen Analytics preferences to change your choice. Supported external players use a separate loading choice; unloading removes the player but does not erase information already received by its provider. Choices apply to the relevant website or domain and the features identified by the control.
The Cookie Notice explains first-party technologies, external services and how to change choices. Email-open and link tracking is a separate activity and is not authorised by accepting membership terms or making a website analytics choice. Artists remain responsible for appropriate recipient information, lawful marketing and the settings of their own provider accounts.
8 How long information is kept
We retain information only as needed for its purpose, subject to earlier lawful erasure instructions and specific legal obligations. For ordinary closure, including effective closure after unresolved non-payment under section 5 of the Terms, the restricted export and recovery period is 30 days from the recorded effective service closure date, followed by live cleanup with retries. Cancellation of future renewal is not itself effective closure. For non-payment, a private seven-calendar-day payment warning precedes parking and closure of paid access; the notified effective closure date starts the 30-day clock. A reminder is sent before routine deletion. The separately disclosed rule for unconverted trials remains deletion of trial workspace data 14 days after trial expiry. Earlier lawful deletion instructions, necessary legal retention and restricted backups remain subject to the applicable safeguards.
Our retention policy sets optional website analytics to 30 days; promo listening and visit records and saved help entries categorised as help to 90 days; closed support cases to 365 days after their last update; completed or declined privacy requests to 365 days after closure; and privacy audit records to 365 days. Social comment records have a 90-day period, social audit and post records 365 days, and temporary social media 30 days, subject to pending operations, unresolved issues and necessary legal holds. These periods apply to those categories, not to all security logs, AI histories or provider copies. Routine deletion is implemented through scheduled maintenance and cleanup processes; failures require investigation and follow-up.
Necessary accounting and transaction records are normally retained for six years from the end of the relevant company financial year, or longer where law requires. We administer that policy separately from operational account deletion. Consent and suppression evidence is kept only as needed to demonstrate permission and honour objections, with provider records managed separately. An account must not be recreated or reimported to bypass an opt-out; only the minimum record necessary to honour the objection should be retained for that purpose.
Backup pruning removes copies older than 30 days following a successful new backup. It does not guarantee expiry during prolonged backup failures, so no fixed maximum backup deletion period is promised here. Backups are restricted to recovery and may not be used for routine access or marketing. Deletion and suppression instructions must be reapplied before restored data returns to active use. Necessary legal holds are access-restricted and reviewed; provider copies may follow their own applicable retention arrangements. We assess continued retention against its purpose and take remedial action where a backup or deletion process fails.
Pausing or closing the desk stops supported new sends, but work already accepted externally may continue until cancelled with the provider. Disconnecting an artist-owned account does not close or erase that account. Stored credentials are removed with account cleanup; provider authorisations may also need revoking.
9 Security and access
We use access restrictions, session controls, protection for integration credentials, account export and deletion procedures, and encrypted backups. Appropriate access is limited to authorised users and support personnel. No system is completely secure; protect your account and avoid placing unnecessary confidential information in public content.
10 Your rights and complaints
Depending on the circumstances, you can request access, correction, deletion, restriction or portability of your information; object to processing based on legitimate interests; and withdraw consent without affecting the lawfulness of earlier processing. You have an unconditional right to object to use of your information for direct marketing. Rights may be subject to lawful exceptions.
Contact contact@djpromodesk.com. We may request proportionate information to verify identity. Requests are normally answered within one month; where a lawful extension is needed, we will explain it within that first month. Artist-controlled requests will be passed to the responsible artist and we will provide appropriate processing assistance.
You can complain to the UK Information Commissioner’s Office at ico.org.uk or call 0303 123 1113, and to any other competent supervisory authority. We welcome the opportunity to resolve concerns first, but this does not restrict your right to complain.
11 Automated decisions and updates
AI writing and help features and engagement reporting assist users with content and information. This notice does not authorise solely automated decisions producing legal or similarly significant effects. Any such processing requires its own assessment and disclosures before introduction. We update this notice when processing changes and bring material changes to your attention appropriately.