Privacy Policy

Who I am

This website, joelgrainger.co.uk, is run by Joel Grainger, a professional violinist based in York, England. Under UK data protection law (the UK GDPR and the Data Protection Act 2018) Joel Grainger is the data controller for the personal information collected through this site.

• Email for anything in this policy: joelgraingermusic@gmail.com
• Business address: 50 Lotherington Avenue, York, YO10 3TU

If you have any question about how your information is handled, that email is the place to ask.

The information I collect

What you send me

When you use the enquiry form you give me the details of your event (the type of event, its date and venue), how you heard about me, your name, your email address, your mobile number if you choose to add it, and whatever you write in your message. If we go on to correspond by email, phone or message, I keep that correspondence too.

What the site records on its own

Like every website, this one is served by computers that keep a short technical log of each visit: the address your connection uses (its IP address), the type of browser and device, the pages requested and when. The site is hosted by Netlify, which keeps those logs for a limited period to keep the service secure and running. I do not use them to identify you.

Cookies and analytics

The site uses a small number of cookies. Only the essential one, which remembers your cookie choice, is set without asking. Analytics and marketing cookies run only if you say yes to them. The cookie policy lists each one and explains how to change your mind.

How I use it, and the legal basis for doing so

UK law requires me to have a lawful basis for each use of your information. These are the uses, and the basis for each:

• Replying to your enquiry and quoting for your event: a necessary step towards a contract with you (Article 6(1)(b) of the UK GDPR).
• Arranging and performing at your booking, including confirming timings and song choices with you: performance of our contract (Article 6(1)(b)).
• Keeping business and accounting records, including invoices and payments: a legal obligation, principally under tax law (Article 6(1)(c)).
• Keeping the site secure and understanding, in aggregate, how it is used: my legitimate interests in running the site well (Article 6(1)(f)), balanced against yours. Analytics runs only with your consent to the cookies involved.
• Marketing measurement, that is, whether an advert brought you here: your consent (Article 6(1)(a)), which you can withdraw at any time through the cookie settings.

I do not send marketing emails, and I do not sell or rent your information to anyone.

Who else sees it

I use a small number of service providers to run the site and the business, and each one handles your information only to provide its service to me, under a contract that requires it to protect that information. Netlify, Inc. hosts the site and receives and stores the enquiries sent through the form, and Automattic, Inc. (Akismet) checks each submission for spam before it reaches me; both are US companies, see "Where it is kept" below. Google (YouTube) plays the performance films when you press play; they are embedded in YouTube's privacy-enhanced mode, so YouTube sets no cookies until you play one, and once you do Google's own privacy policy applies to what it collects. Google Analytics and the Meta (Facebook) Pixel run only if you have accepted analytics or marketing cookies respectively, see the cookie policy. Beyond that I share a booking record with my accountant where it has to be kept for tax purposes, and I will only disclose your information where the law requires it, for example to a court or a regulator.

Where it is kept

Enquiries sent through the form are stored by Netlify, and checked by Akismet, on servers in the United States. Transfers of personal information from the UK to the US are covered by the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and otherwise by the UK's International Data Transfer Agreement or Addendum. Copies of enquiries and of any correspondence are also held in my own email and records in the UK.

How long I keep it

• Enquiries that do not lead to a booking: 12 months from your last message, in case you come back to me, and then deleted.
• Bookings: the details of your event and our correspondence for six years after the event, because HM Revenue & Customs requires business records to be kept for that long.
• Form submissions held by Netlify: deleted from Netlify's dashboard within three months of being received, once copied into my own records.
• Technical logs: kept by Netlify for a limited period under its own retention policy.

Your rights

UK data protection law gives you rights over your personal information. You can ask me:

• for a copy of the information I hold about you (the right of access);
• to correct anything that is wrong or incomplete;
• to delete it, where there is no good reason for me to keep it;
• to stop or restrict how I use it;
• for a copy in a form you can pass to someone else, where you provided it and it is processed by automated means;
• to object to a use based on my legitimate interests;
• to withdraw a consent you have given, at any time, without affecting what was done under it before.

To do any of these, email me at the address above. I will normally reply within one month, and I may need to check who you are first. There is no charge.

If you are unhappy with how I have handled your information, I would rather you told me first so that I can put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Security

The site is served only over an encrypted connection (HTTPS), so what you type into the form cannot be read on its way to me. Enquiries are held in password-protected accounts that only I have access to.

Children

This site is written for adults planning a Wedding or an event, and I do not knowingly collect information from anyone under 18. If you think a child has sent me their details, email me and I will delete them.

Links to other sites

The site links to my profiles on Spotify, Apple Music, Amazon Music, YouTube and Instagram, to my reviews on Google and Hitched, and to Google Maps. Each of those is run by its own company under its own privacy policy, which applies once you follow the link.

Changes to this policy

I will update this page if how I handle your information changes, and the date at the top will change with it.