Privacy Notice

Contents

• 1. Who we are
• 2. What we collect and why
• 3. Our lawful bases
• 4. Who we share it with
• 5. Cookies and embedded players
• 6. Transfers outside the UK
• 7. How long we keep it
• 8. Your rights
• 9. Changes to this notice

1. Who we are

1.1 audiomix is the mixing and production studio of Matt Rist Music Ltd (“we”, “us”), the controller of the personal data described here. Our company details and email address are shown at the top of this page; write to either about anything in this notice.

1.2 This notice covers audiomix.uk, the client portal at portal.audiomix.uk, and the emails, calls and file transfers that go with a booking or an enquiry.

2. What we collect and why

2.1 Booking a mix. Your name, email address, artist or band name, song titles, the stem and add-on options you choose, any notes, your agreement to the Terms and your request that work start straight away (with the time of each). We use them to take your booking, do the work and stay in touch about it. Payment is taken by Stripe on its own page: we receive confirmation of what you paid, never your card details.

2.2 Discussing a project. Your name, email address, artist or band name if you give it, your message, any demo link, and the call time you pick. We use them to reply with a quote and to send you a calendar invitation with a Google Meet link for the call.

2.3 Working together. Once you book, the stems and files you send us, the mixes we send back, your comments and approvals in the portal, and our invoices and payment records. To sign you in, the portal emails you a one-time link.

2.4 Newsletter. Your email address and the date you subscribed, used only to send studio notes and mix updates.

2.5 Security. Our hosting provider keeps short-lived server logs (such as your IP address and browser type) to run and protect the site. Our forms carry a hidden field that catches automated spam; it stores nothing about you.

2.6 We do not sell your data, use it for advertising, or make decisions about you by automated means.

3. Our lawful bases

• Contract (UK GDPR Article 6(1)(b)): bookings, project work, the portal, and replying to an enquiry you send us before a booking.
• Consent (Article 6(1)(a)): the newsletter. You can withdraw it at any time (§8.2).
• Legal obligation (Article 6(1)(c)): keeping invoices and payment records for HMRC.
• Legitimate interests (Article 6(1)(f)): keeping the site secure and free of spam, and keeping records of credits and royalty splits on work we made together.

4. Who we share it with

4.1 We use these providers to run the studio. Each handles your data on our instructions and under a data processing agreement:

• Vercel: hosts the website and the portal.
• Turso: hosts the database holding bookings, enquiries, clients and newsletter subscribers.
• Stripe: takes payments. Stripe also uses payment data for its own fraud-prevention and legal duties, as a controller under its own privacy policy.
• Google: our email, calendar and Google Meet, used for consultation calls and correspondence.
• Resend: sends the site’s and the portal’s emails (confirmations, sign-in links, invitations).
• Dropbox: receives your stems and stores project audio.

4.2 We share data with no one else, except our accountant for invoices and tax records, or where the law requires it.

5. Cookies and embedded players

5.1 audiomix.uk sets no cookies of its own and runs no analytics or advertising trackers.

5.2 The portal sets one cookie, audiomix_portal_session, which keeps you signed in for up to 14 days and is removed when you sign out. It is strictly necessary, so it needs no consent.

5.3 Some pages show other services’ players. The Spotify player and videos load only when you press play. Spotify may then set its own cookies. Videos use YouTube’s privacy-enhanced player, and before you press play their preview images come from YouTube, which sees your IP address. Stripe’s checkout page sets its own cookies for security. Each service’s use is governed by its own privacy policy.

6. Transfers outside the UK

6.1 Several of our providers are based in, or reach your data from, the United States. Where a provider is certified under the UK Extension to the EU–US Data Privacy Framework, the transfer is covered by UK adequacy regulations; otherwise it is protected by the ICO’s International Data Transfer Agreement or Addendum.

7. How long we keep it

• Invoices and payment records: six years after the end of the financial year they belong to, as tax law requires.
• Client and project records (contact details, bookings, approvals): for the same six years, so we can deal with any question about the work.
• Project audio (your stems, sessions and mixes): while the project runs, and then archived for two years after final delivery so we can re-deliver or revise. Ask, and we will delete it sooner.
• Credits and royalty splits: for as long as royalties can arise from the work.
• Enquiries and bookings that don’t go ahead: two years from our last contact.
• Newsletter: until you unsubscribe. After that we keep only your email address on a do-not-send list, so you are not emailed again.
• Server logs: a short period set by our hosting provider.

8. Your rights

8.1 You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to have it sent to you or another provider in a portable form. Email us; it is free, and we will reply within one month. Some records, such as invoices, we must keep even if you ask us to delete them, and we will tell you when that applies.

8.2 To leave the newsletter, reply to any newsletter or email us, and we will stop at once.

8.3 If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

9. Changes to this notice

9.1 When this notice changes, we publish the new version here with a new version number and effective date.