GDPR Policy

1. Our role and contact point

Beyond Floor Musics is the data controller for customer, guest, enquiry and newsletter data. Our service providers (payments, hosting, database, email) act as processors under written terms. We are a small operation and are not required to appoint a Data Protection Officer; all data protection matters are handled by the owner, who can be reached at musicrequest@beyondfloormusic.co.uk.

2. Our data protection principles

• We process personal data lawfully, fairly and transparently.
• We collect it only for the purposes set out in our privacy policy.
• We collect the minimum needed. For example, a guest purchase needs only a name and email.
• We keep it accurate and let you correct it.
• We keep it no longer than the retention periods we publish.
• We protect it with access controls, row-level security, encryption in transit and signed, expiring download links.
• We take responsibility for demonstrating this compliance.

3. Lawful bases we rely on

• Contract: accounts, payments, downloads, bespoke commissions.
• Legal obligation: tax and accounting records.
• Legitimate interests: security, fraud prevention and preventing download links from being shared.
• Consent: the newsletter only. Consent is opt-out on the sign-up form (pre-ticked) and can be withdrawn at any time by emailing us; withdrawal is recorded so we do not contact you again.

We do not carry out automated decision-making or profiling, and we do not process special category data.

4. Your rights and how to use them

You have the right to:

• Be informed: read this policy and our privacy policy.
• Access: ask for a copy of the personal data we hold about you.
• Rectification: have inaccurate details corrected. Account email and password can also be changed from your dashboard.
• Erasure: ask us to delete your data. We will do so unless we must keep a limited sales record for tax purposes.
• Restriction and objection: ask us to pause or stop a particular use of your data.
• Portability: receive your data in a common machine-readable format.
• Withdraw consent: unsubscribe from the newsletter at any time.

Email musicrequest@beyondfloormusic.co.uk with the words "data request" in the subject line. We will confirm your identity, then respond within one calendar month. Requests are free; we may extend by two further months for complex requests and will tell you if we do.

5. Processors and international transfers

We use a payment processor (Stripe) and managed hosting, database and email providers. Each is engaged under terms that require them to process data only on our instructions and to keep it secure. Where a provider processes data outside the UK, the transfer is covered by the UK International Data Transfer Agreement or Addendum, or by an adequacy decision.

6. Personal data breaches

If a breach occurs we will investigate immediately, contain it, and record it. Where the breach poses a risk to your rights and freedoms we will report it to the ICO within 72 hours of becoming aware of it, and tell affected individuals without undue delay where the risk is high.

7. Records, review and complaints

We keep a record of our processing activities, retention periods and processors, and we review this policy whenever the website changes in a way that affects personal data. You can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113 at any time.