Privacy Policy

1.1 The present notice explains how [ORIGIN PLATFORM LIMITED] , operating the professional networking platform trading as DJ Hub, collects, uses, shares, stores, and protects personal data in connection with the website published at www.djhubnetwork.co.uk and the services delivered through it, together referred to as the “Platform.”

1.2 Publication of the notice discharges the transparency obligations imposed by Articles 12, 13, and 14 of the United Kingdom General Data Protection Regulation, referred to as the “UK GDPR,” read together with the Data Protection Act 2018. Both instruments have been amended by the Data (Use and Access) Act 2025, the substantive data-protection provisions of which came into force on 5 February 2026 under the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026.

1.3 The notice applies to DJs, venues, promoters, agencies, event organisers, private clients, visitors who browse without registering, applicants, suppliers, and any other individual whose personal data reaches us through the Platform.

1.4 Separate arrangements govern storage and access technologies. Full particulars concerning cookies, pixels, tags, local storage, and comparable technologies appear in the DJ Hub Cookie Policy, which forms part of the transparency information provided here.

1.5 Where the Platform links to an external website, or where a Profile embeds material hosted elsewhere, the privacy practices of the external operator govern the processing carried out by that operator. Review of the relevant third-party notice before interacting with such material is recommended.

2.1 For the processing described in the present notice, the controller within the meaning of Article 4(7) of the UK GDPR is [Origin Platform] of [124-128 City Road, London, EC1V 2NX], United Kingdom. Where the operator is incorporated in England and Wales, its registered company number is [17347522].

2.2 Registration with the Information Commissioner’s Office is maintained under number [ICO REGISTRATION NUMBER], as required by the Data Protection (Charges and Information) Regulations 2018.

2.3 Enquiries, requests, and complaints concerning personal data may be addressed to support@djhubnetwork.co.uk or by post to the address given at clause 2.1, marked for the attention of the person responsible for data protection.

2.4 Appointment of a statutory data protection officer is not mandatory in our circumstances, since our processing does not consist of large-scale systematic monitoring or large-scale processing of special category data within the meaning of Article 37 of the UK GDPR. A named individual nevertheless holds internal responsibility for data-protection matters and may be reached through the address given at clause 2.3.

3.1 The categories set out below reflect the data collected in the ordinary operation of the Platform.

Registration data: Full name, email address, password in hashed form, telephone number where supplied, date of birth or age confirmation, and account preferences.

Profile data: Artist or trading name, biography, profile and cover photographs, genres, performance history, equipment, travel radius, base location, availability, indicative rates, and any other particular a User elects to publish.

Linked and embedded material: Links to SoundCloud, YouTube, Mixcloud, TikTok, Instagram, and comparable services, together with the identifiers contained within embed codes supplied by a User.

Booking enquiry data: Event date, venue, location, event type, budget indications, message content, and the correspondence exchanged between a DJ and a Client through the Platform.

Transaction data: Subscription plan, billing period, amounts, currency, invoice records, payment status, transaction identifiers, and the final four digits and expiry date of a payment card. Complete card numbers are never received or stored by us.

Technical data: Internet protocol address, browser type and version, operating system, device identifiers, screen characteristics, language settings, time-zone setting, referring URL, and server-log timestamps.

Usage data: Pages viewed, searches performed, filters applied, Profiles visited, enquiries sent and received, session duration, and interaction with notifications.

Communications data: Support tickets, emails, contact-form submissions, and records of correspondence with us, including attachments.

Safety and moderation data: Reports of illegal or harmful content, copyright notices and counter-notices, moderation decisions, warnings issued, and records of suspension or termination.

Marketing data: Subscription status for newsletters or announcements, consent records, and engagement with electronic mail we send.

3.2 Provision of registration data is necessary for the creation of an Account, and an Account cannot be created without it. Profile data beyond the minimum required fields is supplied at the election of the User.

3.3 We do not deliberately seek special category data within the meaning of Article 9 of the UK GDPR. A photograph, a biography, or a message may nevertheless disclose information revealing racial or ethnic origin, religious belief, political opinion, trade-union membership, health, or sexual orientation. Where a User publishes such information on a public Profile, our processing rests upon Article 9(2)(e), which permits the processing of personal data manifestly made public by the data subject. Users are asked to consider carefully before publishing information of that character.

3.4 Criminal-offence data within the meaning of Article 10 of the UK GDPR is processed only where necessary for the prevention or detection of unlawful acts, for the exercise of a protective function, or for compliance with a duty under the Online Safety Act 2023, relying upon the conditions in Part 2 of Schedule 1 to the Data Protection Act 2018.

3.5 The Platform is restricted to persons aged 18 or over, and we do not knowingly process the personal data of children. Where we learn that a child has registered, the Account will be closed and the associated data deleted without undue delay.

4.1 Most personal data reaches us directly from the individual concerned, through registration, Profile completion, enquiry submission, correspondence, or subscription purchase.

4.2 Certain data is generated automatically as the Platform operates, including server logs, technical data, and usage data collected through the storage and access technologies described in the DJ Hub Cookie Policy.

4.3 A limited quantity of data reaches us from third parties, namely payment service providers confirming the outcome of a transaction, analytics providers supplying aggregated usage measurement, email-delivery providers reporting delivery and bounce status, security providers reporting suspicious activity, and other Users where a report or a complaint concerns an Account.

4.4 Where a User connects an external social-media account or embeds material hosted elsewhere, the relevant provider may supply limited public information associated with the linked account, such as a display name, an avatar, or a track title.

5.1 Personal data is processed for the purposes set out below, each of which is matched with the lawful basis relied upon under Article 6(1) of the UK GDPR.

Account creation and administration: Registration, authentication, password management, and the maintenance of Account settings. Necessary for performance of a contract to which the data subject is party, under Article 6(1)(b).

Publication of Profiles: Hosting, displaying, and making Profiles searchable within the Platform and, where a Profile is public, to visitors and search engines. Necessary for performance of a contract, under Article 6(1)(b).

Transmission of booking enquiries: Delivery of enquiries between DJs and Clients, together with associated notifications. Necessary for performance of a contract, under Article 6(1)(b).

Subscription billing: Processing of payments, issue of invoices, management of renewals, and handling of refunds. Necessary for performance of a contract, under Article 6(1)(b), and necessary for compliance with a legal obligation in respect of accounting records, under Article 6(1)(c).

Customer support: Response to enquiries, investigation of faults, and resolution of complaints. Necessary for performance of a contract, under Article 6(1)(b), and necessary for our legitimate interest in operating a supported service, under Article 6(1)(f).

Security and fraud prevention: Detection of unauthorised access, prevention of fraudulent registration, protection of network and information systems, and investigation of abuse. Necessary for our legitimate interest in securing the Platform and protecting Users, under Article 6(1)(f).

Content moderation and online safety: Assessment of reports, removal of illegal or infringing content, enforcement of the Terms and Conditions, and maintenance of the records described at clause 3.1. Necessary for compliance with a legal obligation arising under the Online Safety Act 2023, under Article 6(1)(c), and necessary for our legitimate interest in maintaining a lawful service, under Article 6(1)(f).

Analytics and improvement: Measurement of usage, diagnosis of technical problems, and development of features. Necessary for our legitimate interest in understanding and improving the Platform, under Article 6(1)(f), subject to the storage and access rules described in the DJ Hub Cookie Policy.

Service communications: Notifications concerning enquiries, security alerts, billing events, and changes to terms. Necessary for performance of a contract, under Article 6(1)(b).

Marketing communications: Newsletters, feature announcements, and promotional messages. Consent, under Article 6(1)(a), except where the message concerns similar services and is sent to a person who previously obtained a service from us, in which case our legitimate interest under Article 6(1)(f) applies subject to regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

Legal claims and regulatory compliance: Establishment, exercise, or defence of legal claims, response to lawful requests, and compliance with tax and corporate duties. Necessary for compliance with a legal obligation, under Article 6(1)(c), and necessary for our legitimate interest in protecting our position, under Article 6(1)(f).

5.2 The Data (Use and Access) Act 2025 inserted a category of recognised legitimate interests into Article 6 of the UK GDPR, listed in the new Annex 1 to that Regulation. Processing falling within a recognised legitimate interest does not require the balancing exercise ordinarily associated with Article 6(1)(f). The listed interests concern disclosure to a public body carrying out a task in the public interest, national security, public security and defence, emergencies, the detection, investigation, or prevention of crime, and the safeguarding of vulnerable individuals. Reliance upon that basis by us would arise only in the limited circumstances described, principally where a disclosure to law enforcement or to a safeguarding body becomes necessary.

5.3 Where we rely upon a legitimate interest under Article 6(1)(f), we conduct and record an assessment weighing our interest against the interests, rights, and freedoms of the individual concerned. A copy of the assessment relevant to a particular processing activity may be requested through the contact address at clause 2.3.

5.4 Where processing rests upon consent, consent may be withdrawn at any time under Article 7(3) of the UK GDPR. Withdrawal operates prospectively and does not affect the lawfulness of processing already carried out.

5.5 Personal data will not be used for a new and incompatible purpose without prior notification and, where required, a fresh lawful basis. Article 8A of the UK GDPR, inserted by the Data (Use and Access) Act 2025, identifies categories of further processing that may be treated as compatible with the original purpose, and any reliance upon those provisions will be assessed on the facts.

6.1 A completed Profile is designed to be found. Depending upon the settings selected, Profile content may be visible to registered Users, to unregistered visitors, and to search engines that index public pages, and it may appear in search results outside the Platform.

6.2 Material published on a public Profile may be copied, cached, screenshotted, or archived by third parties beyond our control. Removal from the Platform does not guarantee removal from a third-party cache or archive, although we will assist with reasonable requests to search-engine operators where practicable.

6.3 Submission of a Booking Enquiry discloses to the recipient the particulars contained in the enquiry, together with the sender’s display name and the contact route selected. Once contact is established, each party processes the other party’s personal data as an independent controller and assumes its own responsibilities under data-protection law.

6.4 A DJ or Client who uses the Platform in a professional capacity and who retains contact details obtained through it must comply with the UK GDPR in respect of that retention, including the provision of privacy information and the observance of direct-marketing rules under the Privacy and Electronic Communications (EC Directive) Regulations 2003.

6.5 Visibility settings, where offered, permit a User to limit the audience for a Profile. Users who prefer not to be indexed publicly should adjust those settings before publishing.

7.1 Personal data is disclosed only where a lawful basis exists and, in the case of a processor, only under a written contract satisfying Article 28 of the UK GDPR.

Hosting and infrastructure providers: Suppliers of servers, storage, content-delivery networks, and database services on which the Platform operates.

Payment service providers: Stripe Payments UK Ltd, registered in England and Wales under number 08480771, and any successor provider engaged to process subscription payments, each acting as an independent controller in respect of the payment transaction and as a processor in respect of data supplied by us.

Communication providers: Transactional email, newsletter, and notification services used to deliver messages to Users.

Analytics providers: Measurement services used to understand aggregate usage, deployed in accordance with the DJ Hub Cookie Policy.

Security and anti-abuse providers: Services supplying protection against distributed denial-of-service attacks, automated abuse, spam, and fraudulent registration.

Professional advisers: Lawyers, accountants, auditors, and insurers, each bound by professional obligations of confidentiality.

Public authorities: Law-enforcement agencies, Ofcom, the Information Commissioner, courts, and other regulators, where disclosure is required by law or is necessary for the establishment, exercise, or defence of legal claims.

Acquirers and successors: A purchaser or prospective purchaser of the business, together with its advisers, subject to appropriate confidentiality undertakings, in the event of a merger, reorganisation, financing arrangement, or sale of assets.

7.2 Personal data is never sold, rented, or traded, and it is not disclosed to data brokers.

7.3 Embedded players supplied by SoundCloud, YouTube, Mixcloud, TikTok, and comparable services operate under the control of the relevant provider. Interaction with such a player, and in some configurations the mere loading of the page containing it, causes technical data to be transmitted to that provider under its own privacy notice. Further detail, together with the means of controlling that transmission, appears in the DJ Hub Cookie Policy.

7.4 A current list of the processors engaged at any given time may be requested through the contact address at clause 2.3.

8.1 Certain suppliers store or access personal data outside the United Kingdom. A transfer of that description occurs only where one of the mechanisms recognised by Chapter V of the UK GDPR applies.

Adequacy regulations: Transfers to a country or territory covered by adequacy regulations made by the Secretary of State, which include the member states of the European Economic Area.

International Data Transfer Agreement: The agreement issued by the Information Commissioner and laid before Parliament, in force since 21 March 2022, entered into with the recipient.

Addendum to the European Union standard contractual clauses: The United Kingdom Addendum, used where the recipient has already entered into the clauses adopted by the European Commission.

United Kingdom extension to the EU-US Data Privacy Framework: Commonly described as the UK-US Data Bridge, available where the recipient in the United States has self-certified to the framework and has designated participation in the extension.

8.2 Before relying upon a transfer agreement, we carry out the assessment of the destination country now described in United Kingdom legislation as the data protection test, examining the legal regime of the destination, the practical risks to the individuals concerned, and the supplementary measures required.

8.3 Transfers into the United Kingdom from the European Economic Area continue to benefit from the adequacy decisions renewed by the European Commission on 19 December 2025, which remain valid until 27 December 2031 unless extended or withdrawn.

8.4 A copy of the safeguard applicable to a particular transfer may be requested through the contact address at clause 2.3, subject to the redaction of commercially confidential terms.

9.1 Personal data is retained only for so long as necessary for the purposes for which it was collected, taking account of legal, accounting, evidential, and regulatory requirements.

Account and Profile data: Retained for the duration of the Account and for 12 months following closure, after which the data is deleted or anonymised, save where a longer period is justified under a heading below.

Booking enquiry records: Retained for 24 months from the date of the enquiry, reflecting the period within which a dispute concerning an introduction is likely to arise.

Transaction and accounting records: Retained for six years from the end of the accounting period to which they relate, reflecting the retention requirements administered by HM Revenue and Customs. Where the operator is a company, the duty to keep adequate accounting records arises under section 386 of the Companies Act 2006, and section 388(4) of that Act prescribes a minimum preservation period of three years for a private company and six years for a public company.

Support correspondence: Retained for 24 months from closure of the relevant ticket.

Safety, moderation, and copyright records: Retained for the period required by the record-keeping duty in section 23 of the Online Safety Act 2023 and, in any event, for six years where the record may be relevant to a claim, reflecting the limitation periods prescribed by sections 2 and 5 of the Limitation Act 1980 for actions founded on tort and on simple contract respectively.

Server and security logs: Retained for up to 12 months, save where a log forms part of an active investigation.

Marketing consent records: Retained for the duration of the subscription and for 24 months following withdrawal, in order to evidence the currency of consent and to honour a suppression request.

9.2 Where deletion is not immediately achievable for technical reasons, the data is isolated and secured until deletion becomes possible. Residual copies may persist within routine backups until overwritten in the ordinary cycle, and such copies are not restored into active systems except where a genuine recovery event requires it.

9.3 Anonymised data, from which no individual can be identified, may be retained indefinitely for statistical and analytical purposes and falls outside the scope of data-protection legislation.

10.1 Article 32 of the UK GDPR requires technical and organisational measures appropriate to the risk. Measures applied to the Platform include encryption of data in transit through current transport-layer security, encryption of stored credentials through salted one-way hashing, role-based access control, the principle of least privilege, logging of administrative activity, network segregation, regular patching, and periodic review of supplier security.

10.2 Access to production systems is restricted to personnel who require it, is subject to authentication controls, and is withdrawn promptly when a role changes or an engagement ends.

10.3 No system connected to a public network can be guaranteed absolutely secure. Users contribute materially to security by selecting a strong and unique password, by enabling any additional authentication offered, and by reporting suspected compromise without delay.

10.4 A personal data breach likely to result in a risk to the rights and freedoms of individuals will be notified to the Information Commissioner within 72 hours of our becoming aware of it, in accordance with Article 33 of the UK GDPR. Where the breach is likely to result in a high risk, the individuals affected will be informed without undue delay under Article 34.

11.1 Decisions producing legal effects concerning an individual, or similarly significant effects, are not taken by automated means alone in the ordinary operation of the Platform.

11.2 Automated systems are nevertheless used to rank search results, to suggest Profiles, to filter suspected spam, and to detect suspected fraudulent registration. Where an automated tool restricts an Account, a human review is available upon request.

11.3 Section 80 of the Data (Use and Access) Act 2025 replaced Article 22 of the UK GDPR with Articles 22A to 22D, in force since 5 February 2026. Significant decisions taken by automated means and not involving special category data are now permitted subject to the safeguards prescribed by Article 22C, which require that the individual be informed, be enabled to make representations, be able to obtain human intervention, and be able to contest the decision. The stricter prohibition continues to apply where special category data is involved.

11.4 Requests for human intervention, representations, and contestation should be sent to support@djhubnetwork.co.uk.

12.1 Subject to the conditions and exemptions provided by the UK GDPR and the Data Protection Act 2018, the following rights are available.

Right of access: Confirmation of whether personal data concerning you is processed, a copy of that data, and the supplementary information required by Article 15.

Right to rectification: Correction of inaccurate personal data and completion of incomplete personal data, under Article 16.

Right to erasure: Deletion where the data is no longer necessary, where consent is withdrawn and no other basis applies, where an objection succeeds, or where the data has been processed unlawfully, under Article 17.

Right to restriction: Restriction of processing while accuracy is contested, while an objection is assessed, or where the data is required only for legal claims, under Article 18.

Right to data portability: Receipt of data supplied by you, in a structured, commonly used, and machine-readable format, and transmission to another controller where technically feasible, under Article 20.

Right to object: Objection to processing based on legitimate interests, and an unqualified right to object to processing for direct-marketing purposes, under Article 21.

Rights concerning automated decisions: The safeguards described at clause 11, under Articles 22A to 22D.

Right to withdraw consent: Withdrawal at any time where processing rests upon consent, under Article 7(3).

12.2 Requests are ordinarily answered within one month of receipt. Article 12(3) of the UK GDPR permits an extension of up to two further months where a request is complex or where several requests have been received, and any extension will be notified with reasons within the first month.

12.3 The Data (Use and Access) Act 2025 clarified two aspects of the response process. A controller is required to conduct a reasonable and proportionate search rather than an exhaustive one, and the period for responding may be paused where further information is genuinely required in order to identify the requester or to clarify the scope of the request, the period resuming once that information is supplied.

12.4 Requests are answered free of charge. A reasonable administrative fee may nevertheless be charged, or a request refused outright, where a request is manifestly unfounded or excessive, in which case the reasons will be explained together with the routes of challenge available.

12.5 Verification of identity may be required before a request is answered, and we may decline to disclose personal data where disclosure would adversely affect the rights and freedoms of another individual, including the rights of another User whose data appears within the same correspondence.

12.6 Requests should be sent to support@djhubnetwork.co.uk and should identify the right relied upon and, where possible, the data or processing activity concerned.

13.1 Section 103 of the Data (Use and Access) Act 2025 inserted section 164A into the Data Protection Act 2018, which came into force on 19 June 2026 and requires every controller to operate a data-protection complaints procedure. The arrangements described below give effect to that duty.

13.2 A complaint that we have infringed data-protection legislation may be made by completing the electronic complaint form published on the Platform, or by writing to support@djhubnetwork.co.uk, or by post to the address at clause 2.1. No particular form of words is required, and no fee is charged.

13.3 Receipt of a complaint will be acknowledged within 30 days, as section 164A requires.

13.4 Appropriate steps to respond will then be taken without undue delay, including such investigation as the subject matter warrants. The complainant will be informed of the outcome and, where the investigation extends over a longer period, will be kept informed of progress.

13.5 Escalation to the Information Commissioner is available where a complaint remains unresolved or where the response is considered unsatisfactory. The Commissioner ordinarily expects a complainant to raise the matter with the controller first.

13.6 The contact particulars of the supervisory authority are as follows. Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone 0303 123 1113. Website https://ico.org.uk. Complaints may be submitted at https://ico.org.uk/make-a-complaint/.

13.7 The Data (Use and Access) Act 2025 provides for the office of the Information Commissioner to be replaced by a body corporate to be known as the Information Commission. Transfer of functions requires further secondary legislation, and references in the present notice to the Information Commissioner should be read as references to the successor body once that transfer takes effect.

13.8 Recourse to the Commissioner does not displace the right to pursue a judicial remedy under Article 79 of the UK GDPR or to claim compensation under Article 82.

14.1 Service messages concerning enquiries, security, billing, and changes to terms form part of the Platform and are sent to all Users. Messages of that description are not marketing and cannot be declined while an Account remains open.

14.2 Marketing messages are sent only with consent, or to a person who previously obtained a service from us where the message relates to similar services and an opportunity to refuse was given at the point of collection, in accordance with regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

14.3 Every marketing message carries a functioning unsubscribe facility. Withdrawal may also be communicated to support@djhubnetwork.co.uk and takes effect promptly, and in any event within 28 days.

14.4 Penalties for breach of the 2003 Regulations were raised on 5 February 2026 to the levels applicable under the UK GDPR, namely up to £17.5 million or 4% of total annual worldwide turnover, whichever is higher. Our marketing practices are configured accordingly.

15.1 The present notice may be revised to reflect changes in the Platform, in our suppliers, in applicable legislation, or in regulatory guidance. The date of the most recent revision appears at the head of the document.

15.2 Where a revision materially alters the purposes of processing, the lawful bases relied upon, the categories of recipient, or the rights available, we will notify registered Users by email or by prominent notice on the Platform before the revision takes effect.

15.3 Earlier versions are retained and may be requested through the contact address at clause 2.3.

Data protection enquiries, rights requests, and complaints: support@djhubnetwork.co.uk

General support: support@djhubnetwork.co.uk

Website: www.djhubnetwork.co.uk

Postal address: Origin platform limited [124-128 City Road, London, EC1V 2NX] United Kingdom.