Cookie Policy

1.1 The present policy explains the storage and access technologies used on the website published at www.djhubnetwork.co.uk, operated by [ORIGIN PLATFORM LIMITED] trading as DJ Hub and referred to as “we,” “us,” or “our.”

1.2 The policy should be read together with the DJ Hub Privacy Policy, which describes how personal data collected through the Platform is processed, and with the DJ Hub Terms and Conditions.

1.3 Regulatory terminology has moved beyond the word “cookie.” In its guidance on the use of storage and access technologies, finalised on 29 April 2026, the Information Commissioner’s Office confirmed that the rules apply not only to cookies but also to tracking pixels, device fingerprinting, web and local storage, scripts, tags, and link decoration. References below to storage and access technologies carry that wider meaning.

2.1 Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003, referred to as “PECR,” prohibits the storage of information on a user’s terminal equipment, and access to information already stored there, unless the user has been given clear and comprehensive information about the purposes and has given consent.

2.2 Consent for these purposes carries the meaning given by the UK GDPR, requiring a freely given, specific, informed, and unambiguous indication of the individual’s wishes expressed through a clear affirmative action. Continued browsing, a pre-ticked box, and silence do not constitute consent.

2.3 Section 112 of, and Schedule 12 to, the Data (Use and Access) Act 2025 inserted a new Schedule A1 into PECR, creating additional exceptions to the consent requirement with effect from 5 February 2026. The exceptions are described at clause 4.

2.4 The same reforms raised the maximum penalty for a breach of PECR from £500,000 to the levels applicable under the UK GDPR, namely up to £17.5 million or 4% of total annual worldwide turnover, whichever is higher.

2.5 Where a storage and access technology also involves the processing of personal data, the UK GDPR applies in addition to PECR, and a separate lawful basis under Article 6 is required for that processing.

3.1 A cookie is a small text file placed on a device by a website and returned to that website on subsequent visits. A session cookie is erased when the browser closes, whereas a persistent cookie remains until it expires or is deleted.

3.2 A first-party technology is set by the domain being visited. A third-party technology is set by another domain, typically a supplier whose content or functionality appears within the page, and it can therefore observe activity across multiple websites that use the same supplier.

3.3 Local storage and session storage retain information within the browser without transmitting it automatically with every request, and they are commonly used to preserve interface preferences and draft input.

3.4 A tracking pixel is a small image or script embedded in a page or an email that signals to a server that the content has been loaded.

3.5 Device fingerprinting combines characteristics such as screen resolution, installed fonts, language settings, and rendering behaviour in order to distinguish one device from another without storing a file. The technique falls within regulation 6 of PECR because it involves gaining access to information stored on the terminal equipment.

3.6 Link decoration appends identifiers to a URL so that a destination site can associate the visit with an earlier interaction.

4.1 Certain technologies operate without consent, either because they fall within the strictly necessary exception in regulation 6(4) of PECR or because they fall within an exception introduced by Schedule A1.

Strictly necessary technologies: Session identifiers, authentication tokens, load-balancing markers, security tokens protecting against cross-site request forgery, and the record of your consent choices. Without these, pages cannot be delivered, Accounts cannot be kept signed in, and the Platform cannot be operated securely. Consent is not required, and the technologies cannot be disabled through our preference controls without disabling the service itself.

Statistical technologies: Measurement used for the sole purpose of collecting information about how the Platform is used with a view to making improvements to it. The exception is available only where the information is not shared with any other person, save to the extent that the other person assists us with those improvements, and it requires that clear information be given and that a simple means of objecting free of charge be provided. Our objection control is described at clause 6.

Appearance and functionality technologies: Storage that records preferences such as language, region, display density, dark mode, accessibility adjustments, and the layout options a User has selected, so that the interface presents consistently between visits.

Emergency assistance technologies: Storage or access necessary to determine the approximate location of a device in order to enable emergency assistance to be sought. Deployment of a technology of that description on the Platform is not currently envisaged, and the category is described here for completeness.

4.2 An exception is available only where the technology serves the exempt purpose alone. Where a single technology serves both an exempt purpose and a purpose requiring consent, the deployment cannot be treated as exempt, and we either separate the technologies or obtain consent for the whole deployment.

4.3 Measurement services that transmit usage data to a supplier for that supplier’s own purposes fall outside the statistical exception, because the condition prohibiting onward sharing is not satisfied. Deployments configured in that manner are treated by us as requiring consent and are listed at clause 5.

5.1 The categories below are deployed only after consent has been obtained through the preference banner and may be withdrawn at any time.

Third-party analytics: Measurement services operated by an external supplier that receives usage data for purposes extending beyond improvement of the Platform, including the supplier’s own product development or aggregate benchmarking.

Embedded media players: Players supplied by SoundCloud, YouTube, Mixcloud, TikTok, Instagram, and comparable services, which set their own technologies when a Profile containing embedded material is displayed or played.

Social plugins and sharing tools: Buttons and widgets that allow content to be shared to an external network and which enable the operator of that network to observe the visit.

Advertising and audience measurement: Technologies used to deliver, cap, or measure promotional campaigns, whether on the Platform or on external channels. Advertising technologies are not presently deployed, and consent will be sought before any such deployment begins.

5.2 Withholding consent for a category does not prevent access to the Platform generally, although embedded material may be replaced by a placeholder until consent is given for the relevant player.

6.1 On a first visit, a preference banner presents the categories described above. Acceptance, rejection, and granular selection are offered with equal prominence, and rejection requires no greater number of actions than acceptance.

6.2 Preferences may be revisited at any time through the cookie-preferences link published in the footer of every page. Changes take effect immediately in respect of future storage, and technologies already set may be cleared through the browser controls described at clause 7.

6.3 For technologies relying upon the statistical exception at clause 4.1, consent is not sought, and a simple means of objecting is instead provided through the same preferences panel, free of charge and without adverse consequence for access to the Platform.

6.4 A record of the choices made is retained in order to evidence compliance and to avoid repeated prompting. The record is refreshed periodically, and in any event no less frequently than every six months, so that the position remains current.

7.1 Independent controls are available within every major browser, permitting cookies to be blocked, restricted to first-party domains, or deleted. Guidance is published by the browser developers as follows.

Google Chrome: https://support.google.com/chrome/answer/95647.

Mozilla Firefox: https://support.mozilla.org/en-US/kb/enhanced-tracking-protection-firefox-desktop.

Apple Safari: https://support.apple.com/en-gb/guide/safari/sfri11471/mac.

Microsoft Edge: https://support.microsoft.com/en-gb/microsoft-edge/delete-cookies-in-microsoft-edge.

7.2 Blocking all cookies will prevent sign-in and will disable features that depend upon session continuity. Deleting cookies also deletes the record of your preferences, and the banner will therefore reappear.

7.3 Mobile operating systems provide additional controls governing advertising identifiers and cross-application tracking, which operate independently of the browser settings described above.

7.4 Browser signals expressing a general objection to tracking, including Do Not Track and Global Privacy Control, are not yet the subject of a binding standard in the United Kingdom. Where a signal of that description is received and can be interpreted reliably, we treat it as an objection for the purposes of clause 6.3.

8.1 A central feature of the Platform is the display of mixes, sets, and videos hosted by external services. Loading such material causes the browser to communicate directly with the hosting provider.

8.2 Information transmitted in that communication may include the internet protocol address, the browser and device characteristics, the address of the page containing the player, and, where the visitor is signed in to the relevant service, the account identifier held by that service.

8.3 Processing carried out by the hosting provider is governed by that provider’s own notice, and we exercise no control over it. The principal providers publish the following information.

SoundCloud: https://soundcloud.com/pages/privacy.

YouTube and Google: https://policies.google.com/privacy.

Mixcloud: https://www.mixcloud.com/privacy/.

TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/en.

8.4 Where consent for embedded players has not been given, players are replaced by a placeholder that loads no external resource until the visitor elects to activate it. Activation of a placeholder constitutes consent in respect of that provider for the current session.

9.1 The summary below sets out the technologies presently in use. Names, suppliers, and durations change as the Platform develops, and the current position is always reflected in the preferences panel described at clause 6.

Session and authentication: First-party. Purpose: maintaining a signed-in session and protecting form submissions against forgery. Duration: session, or up to 30 days where a “remember me” option is selected. Basis: strictly necessary.

Consent record: First-party. Purpose: storing the choices made in the preferences panel. Duration: up to 6 months. Basis: strictly necessary.

Security and abuse prevention: First-party and, where a protection service is engaged, third-party. Purpose: rate limiting, bot detection, and mitigation of denial-of-service activity. Duration: session to 12 months. Basis: strictly necessary.

Interface preferences: First-party. Purpose: language, region, display density, and accessibility settings. Duration: up to 12 months. Basis: appearance and functionality exception.

Platform statistics: First-party. Purpose: aggregate measurement of page views, search behaviour, and feature use, for the sole purpose of improving the Platform. Duration: up to 13 months. Basis: statistical exception, with an objection control.

Third-party analytics: Third-party. Purpose: usage measurement where the supplier receives data for its own purposes. Duration: as stated by the supplier, commonly up to 24 months. Basis: consent.

Embedded media: Third-party. Purpose: playback of mixes and videos hosted by SoundCloud, YouTube, Mixcloud, TikTok, and comparable services. Duration: as stated by the provider. Basis: consent.

9.2 Precise names and durations may be inspected at any time through the developer tools of the browser, under the storage or application section.

10.1 Certain identifiers generated by these technologies amount to personal data, since they permit a device or a signed-in User to be distinguished. Processing of that data is described in the DJ Hub Privacy Policy, which also sets out the rights available under the UK GDPR and the means of exercising them.

10.2 Data derived from statistical technologies is aggregated at the earliest practicable stage, and reports are produced in a form from which individuals cannot be identified.

10.3 Retention periods stated at clause 9.1 refer to the lifetime of the stored file or entry. Retention of the underlying records generated by the technology is governed by clause 9 of the DJ Hub Privacy Policy.

11.1 The present policy is reviewed whenever a new technology is introduced, a supplier is changed, or regulatory guidance is revised, and in any event at intervals of no more than 12 months.

11.2 Material changes affecting the categories described at clause 5 will be brought to the attention of visitors through the preference banner, and fresh consent will be sought where the change alters the purposes for which consent was originally given.

11.3 The date of the most recent revision appears at the head of the document.

12.1 Questions concerning the present policy may be sent to support@djhubnetwork.co.uk or by post to [Origin Platform], [124-128 City Road, London, EC1V 2NX], United Kingdom.

12.2 Complaints concerning our use of storage and access technologies may be raised with us under the complaints procedure described at clause 13 of the DJ Hub Privacy Policy, which gives effect to section 164A of the Data Protection Act 2018.

12.3 Complaints may also be made to the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, by telephone on 0303 123 1113, or through https://ico.org.uk/make-a-complaint/.