Privacy policy.

01Who we are

This site is run by DJ Cy (“we”, “us”), a DJ and producer based in North London. We are the controller of the personal data collected through it, which means we decide how and why it’s used and we’re responsible for looking after it under the UK GDPR and the Data Protection Act 2018.

For anything in this policy, including using any of your rights, get in touch through the contact form. Start your message with “Privacy request” so it reaches the right place.

02What we collect

We only collect what the site needs to do the thing you asked for:

• Messages and booking requests. Your name, email address and message. Booking requests also include the event date and venue. If you’re signed in when you send one, it’s linked to your member account. When we reply from the site, our reply is kept with it (and, for a booking, the details we agreed), so the whole conversation is in one place.
• Member accounts. Your name, email address and password, plus when you joined and when you last signed in. Passwords are stored only as a one-way bcrypt hash, so nobody can read them, us included. Your appearance choices (light or dark theme, accent colour, the music player’s layout, whether the player and gallery buttons show, whether the homepage film plays, and reduced motion) and how you’ve arranged your dashboard are saved to your account too, so they follow you to any device you sign in on, and if you close your account we note when and by whom.
• Newsletter. The newsletter comes with a member account. If you sign up, when you create your account, in your account settings or with the form at the foot of each page, we note that you did and when, and send the newsletter to your account’s email address with your first name in the greeting. If you use the form without an account, we keep the email address you typed, with the link we sent it, until you use the link to create your account; otherwise the link expires after 48 hours and the address is deleted within a day of that. We keep a record of each issue (when it went out and how many people it went to), not of who it went to.
• Other emails. Members also get a reminder a couple of days before an event they have a ticket for, an email when new merch goes on sale in the store, one when new tracks go on sale by the artists, or in the genres, of tracks they've bought, and one when someone replies to their comment on a track (showing the two comments, and who replied), or, for the site's artists, when a comment mentions them. Each is on when you create your account, and you can turn any of them off in your account settings or with the link in each. We pick the tracks from the ones you've bought, and leave out merch and tracks the newsletter already tells you about. We note when each ticket's reminder went, so you only get one, and keep a record of each merch and tracks email (when it went and how many people it went to), not of who it went to.
• Profile photo. If you add one, a square copy of your photo. Your browser shrinks it and strips its metadata, including any camera location, before it’s sent. It appears on your vault and account settings pages, to us in the admin, and publicly beside any comments you leave on tracks, so anyone reading those comments can see it. Without one, your initials are shown instead. You can remove or change it at any time.
• Likes and comments. If you like a track or comment on one, we record which track, when, and what you wrote, plus, if you were listening, the moment in the track your comment is about, and which comment a reply answers. When someone replies to one of your comments, we note when you’ve seen the reply, so your dashboard can show the ones you haven’t. Comments are public: anyone can read them on the track’s page, with your name, your profile photo (or initials, if you haven’t added one) and the date.
• Vault activity. When a member plays a track (its preview, once it's played for a few seconds, or in full, once they've heard more than a preview's length) or downloads one, we record which track, whether it was a preview, a full-length play or a download, and when. When a guest plays a preview, we count it with the track and the time only: nothing that identifies them, not even their IP address. The play counts shown on the site are these totals. A member's own plays, likes and purchases also make up their listening on the members' newsletter page, and the tracks we suggest they play next there, which only they can see.
• Orders. When a member orders from the store, we keep what they ordered and what it cost, the name and UK address it’s delivered to, their account’s email address (for the receipt and delivery updates), how they paid, and when it was placed, paid for, sent or cancelled, plus any delivery note we add, such as a tracking number. Members can also save a delivery address in their account settings, or when they check out, and checkout starts from it; otherwise it starts from the address of their last order. Card payments are taken by Stripe on its own secure page, so we never see or store card details; Stripe tells us when a payment has gone through and gives us a reference for it. For bitcoin payments, we keep the address we gave that order, the amount due and the exchange rate used, and what arrived at the address. Bitcoin payments are public on the blockchain, so anyone who knows the address can see what was paid to it, but not who paid it.
• Booking payments. When we confirm a booking, we keep the details we agreed with it: the date, venue, set time and fee. If we ask for the fee to be paid through the site, we also keep the amount and the email address of whoever’s paying it, and email them a link to pay. Paying needs a member account with that email address, and the payment is kept as an order, just like a store order (above): your name, account email address, how you paid and when, with no delivery address. Card and bitcoin payments work the same way as for the store.
• Tracks you buy. Which tracks you've bought and when, the download link we made for each, how many times you've downloaded each and when you last did, and when you agreed at checkout to have them straight away.
• Tickets you buy. For each ticket, the event it's for and which kind of ticket it is (an early bird, say), a code of its own (which its QR code carries), the name it's in (the name on your order), when it's scanned at the door, and, if the event's called off, when we told you. Whoever's working the door sees the name and code when they check it.
• Artists. If we credit you as an artist on the site's tracks, we keep your artist profile (the name you go by, a short bio, up to four links and a picture, if you add one), which anyone can see on the music page with your tracks; which tracks you're credited on and your share of their sales; the bank details you give us to pay your earnings (the name on the account and its sort code and account number, or its IBAN and BIC), which are stored encrypted and seen only by you and the site's admins; and a record of each payment we make you (the amount, the day, the last four digits of the account it went to and what it was for), with its invoice. Your dashboard shows you how your tracks are doing from the totals in vault activity (below) and the orders that bought them; it never shows who played or bought them. If you ask for it, we also email you those totals weekly, every two weeks or monthly, and keep how often you chose and when we last sent one; you can stop it from the link in each email or your artist profile.
• Media playback. Music, images and video are delivered by Bunny.net, which receives your IP address and browser details when they load, like any web server. When a member watches a hosted replay, Bunny’s video player also sends Bunny anonymous playback and performance statistics, such as how much was watched and whether it buffered.
• Your cookie choice. An anonymous record of what you chose, the policy version and the time. It holds a random identifier, not your IP address or anything else that identifies you.
• Usage statistics. Cookieless page-view counts from Vercel Web Analytics and, only if you opt in, Google Analytics. See the cookie policy for the detail.
• Technical data. Like any website, our host receives your IP address and browser details with each request. We use the IP address briefly, in memory, to stop the contact and sign-in forms being flooded. We don’t save it to our database.
• Two-step verification. If you turn it on (or the site requires it), which method you use and since when. For email codes, we email you a code each time you sign in. For an authenticator app, we keep the app’s secret key, encrypted, and a one-way hash of each of your recovery codes. While you sign in or set it up, we briefly keep a record of the attempt: a hash of the code we sent, and how many wrong codes were tried.
• Bot protection. When reCAPTCHA is switched on, Google receives your IP address, browser details and how you use the page when you send one of the public forms (signing in, creating an account, forgotten passwords, messages and bookings, and the newsletter form), and gives us a score of how likely it is that you’re a person. We don’t keep the score. See the cookie policy.
• Failed sign-ins. If a sign-in attempt (or a two-step code) fails, we note the email address that was typed and the time, so we can stop anyone guessing passwords. These notes are deleted after 15 minutes, or sooner when that account next signs in. Separately, we keep a daily count of failed and held-back sign-ins and of forms our bot check turned away, for 60 days; the counts say nothing about who.

We don’t collect special category data, we don’t buy data about you from anyone, and we never sell yours.

03How we use it and why

The UK GDPR requires a lawful basis for each use of your data. Ours are:

Where we rely on legitimate interests, we’ve checked that the use is expected, limited and doesn’t override your rights. We only send the newsletter to members who’ve asked for it, and we don’t make automated decisions about you.

04Who we share it with

We use a small number of providers who process data on our behalf, under contract and only on our instructions:

• Vercel hosts the site and provides the cookieless Web Analytics.
• Our database provider stores accounts, enquiries, orders, vault activity, likes and comments, and cookie choice records.
• Bunny.net (BunnyWay d.o.o., Slovenia) stores and delivers the site’s music, images and video, including profile photos, and provides the video player for hosted replays.
• Stripe (Stripe Payments Europe Ltd and its UK branch) takes card payments for store orders and bookings on its own checkout page, and receives your email address, what you’re paying for (what you ordered, or the booking’s date and venue) and its price, and your card or wallet details, which it handles under its own privacy notice as well as on our behalf. It may run fraud checks as part of taking the payment.
• mempool.space, a public bitcoin block explorer, is asked by our server what has been paid to a bitcoin order’s address, and for the current bitcoin price. Only the address is sent, never anything about you.
• Google provides Google Analytics, but only after you opt in. Advertising features, Google Signals and ad personalisation are switched off. When it’s switched on, Google also provides reCAPTCHA, which checks the public forms for bots. Google Cloud stores the site’s backups, in London.

Links to Mixcloud, SoundCloud, YouTube and Instagram take you to services we don’t control. Their own privacy policies apply once you’re there. The same goes for the share buttons on tracks, playlists and catalogues: they’re plain links that open WhatsApp, X, Facebook or Bluesky with the link filled in, so nothing is sent to those services unless you choose one, and none of their code runs on this site.

We may also disclose data if the law requires it, or to protect the site or its visitors from fraud or abuse.

05International transfers

Vercel, Stripe and Google may process data outside the UK, including in the United States. Bunny.net is based in the EU, and its network delivers files from the server nearest you, which may be outside the UK. Wherever data leaves the UK, the transfer is protected by UK adequacy regulations (which cover the EU) (such as the UK Extension to the EU–US Data Privacy Framework) or by the ICO’s International Data Transfer Agreement or Addendum.

06How long we keep it

• Messages and booking requests: up to two years after our last contact, so we can follow up on a conversation or a booking, along with the details of a booking we agreed and any payment we asked for. A booking that was paid for through the site keeps its payment record with the orders (below).
• Member accounts: until you close yours, which you can do yourself from your account settings. A closed account can’t be used, but is kept for 90 days so we can restore it if it was closed by mistake or by someone else, then erased for good automatically. Messages and booking requests you sent stay (see above), no longer linked to an account.
• Newsletter sign-up: until you unsubscribe or your account is erased. An address typed into the footer form without an account is deleted within three days unless it’s used to create one. Each issue has an unsubscribe link, and it’s in your account settings too.
• Your other email choices: until you change them or your account is erased. Each of those emails has a link to stop it, and they're in your account settings too.
• Profile photos: until you remove or replace yours, or your account is erased. The old photo is deleted from storage straight away, and anything a deletion misses is cleared within a day.
• Likes and comments: until you take a like back or delete a comment, which you can do at any time on the track’s page, or your account is erased. While your account is closed they’re hidden. We remove comments that break the terms, and they go if the track is removed. Deleting a comment also deletes the replies to it.
• Tracks you buy: while your account exists, so you can keep playing and downloading them; they're erased with your account (download copies to keep before you close it). Refunding an order removes the tracks it bought. The record of each sale stays with the order (below).
• Tickets you buy: while your account exists, so you can show them at the door and keep them afterwards; they're erased with your account. Refunding an order cancels and removes its tickets. The record of each sale stays with the order (below).
• Saved delivery address: until you change or remove it in your account settings, or your account is erased.
• Orders, including payments for bookings: six years from the end of the tax year they were placed in, as UK tax law requires sales records to be kept, even if you close your account (they’re then no longer linked to it). Orders that were never paid for are kept for the same time with the rest, so the records are complete. Stripe keeps its own record of card payments under its privacy notice.
• Artist profiles and bank details: until we stop crediting you as an artist or your account is erased, when your profile, picture, bank details and track credits are deleted. You can change or remove your bank details at any time on your artist profile.
• Payments to artists: like orders, six years from the end of the tax year they were made in, even if you stop being an artist or close your account (they're then no longer linked to it).
• Vault activity: while your account exists. When an account is erased, its plays and downloads stay only as anonymous totals, no longer linked to anyone.
• Cookie choice records: kept as evidence of consent. They don’t identify you.
• Google Analytics: no longer than 14 months, under the retention setting in Google Analytics.
• Failed sign-ins: 15 minutes, or until that account next signs in.
• Two-step verification: your method, app secret and recovery codes until you turn it off or your account is erased. Records of sign-in and set-up attempts are deleted within a day of expiring, 10 or 15 minutes after they start.
• IP addresses: held only in server memory for rate limiting, never written to our database, and gone when the server restarts.
• Backups: we keep a few copies of the site and its files, so we can put things right after a fault or an attack. Each is deleted automatically as newer ones replace it, so anything erased from the site is gone from the backups once the oldest copy that held it goes. If we ever have to restore one, we erase again anything that was erased after it was made.

07Your rights

Under the UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you. Members can download most of it, including their orders, straight away from their account settings; ask us for the rest.
• Correct anything that’s wrong or incomplete. Members can change their name, photo, email and password in their account settings.
• Delete your data. Members can delete their own comments on each track’s page, and close their account themselves in their account settings; it’s erased for good 90 days later. If you’d rather it went sooner, ask us.
• Restrict or object to how we use it, including anything based on legitimate interests.
• Send it to you or another service in a machine-readable format. The download in your account settings is a JSON file.
• Withdraw consent at any time: for analytics, using “Cookie settings” in the footer; for the newsletter, using the unsubscribe link in any issue or your account settings. You can stop event reminders, the new merch and tracks emails and reply emails the same way.

It’s free, and we’ll reply within one month. To ask, get in touch. We may need to check it’s really you before acting on a request.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

08Keeping it secure

The site is served only over HTTPS. Passwords are hashed with bcrypt, sign-in sessions are held in signed and encrypted cookies, and the sign-in, sign-up and contact forms are rate-limited, and can be checked for bots with reCAPTCHA. Members can turn on two-step verification, so a password alone isn’t enough to get in. Only site admins can see enquiries and member details. No system is perfectly secure, but if a breach ever puts your data at risk we’ll tell you and the ICO as the law requires.

09Children

The site isn’t aimed at children. You must be 13 or over to create a member account. If you think a child has given us their details, let us know and we’ll delete them.

10Changes to this policy

We’ll update this page when what we collect or how we use it changes, and the date at the top will move with it. If a change affects your cookie choices, the cookie prompt will ask you again.