Data Protection and UK GDPR

This internal policy explains how Alexander Baker trading as @thatbakerface manages personal data in its DJ, event, media, production, design, web, technical and administrative work. It supports, but does not replace, the public privacy notice.

Controller and responsibility

The data controller is Alexander Baker trading as @thatbakerface, of Unit 100743, PO Box 6945, London W1A 6US, United Kingdom. Alexander Baker is responsible for data protection compliance and for responding to enquiries received through the contact page.

Data protection principles

Personal data will be:

processed lawfully, fairly and transparently;
collected for specified, explicit and legitimate purposes;
adequate, relevant and limited to what is necessary;
kept accurate where necessary;
kept in identifiable form for no longer than necessary;
protected by appropriate technical and organisational measures; and
managed so that compliance can be demonstrated proportionately.

Personal data handled

Depending on the work, the business may handle:

names, contact details, job titles and organisations;
enquiries, quotes, contracts, schedules and correspondence;
payment, invoice and accounting information;
venue, supplier, freelancer and subcontractor information;
website, form, cookie, security and technical data;
audio, video, photographs, voice recordings, interviews, contributor details and production metadata;
accessibility, dietary, emergency or other event information where relevant; and
credentials or access information supplied for authorised technical work.

The business does not seek special category or criminal-offence data routinely. Where such data is necessary, it will be processed only where an appropriate legal condition applies and with additional care. Processing for journalistic, artistic or literary purposes will be assessed case by case; no exemption is treated as automatic.

Purposes and lawful bases

Personal data may be used to:

respond to enquiries and take steps towards a contract;
manage bookings, projects, events, production and delivery;
communicate with clients, venues, suppliers, contributors and workers;
invoice, receive payment, keep tax records and meet legal obligations;
protect people, equipment, systems, information and legal rights;
maintain service quality, records and business administration;
publish or distribute agreed media and creative work; and
send relevant marketing where consent or another lawful route applies.

The lawful basis will normally be contract, steps requested before a contract, legal obligation, legitimate interests or consent. The business will not rely on consent where another basis is more appropriate, and consent can be withdrawn where it is the basis used.

Transparency and collection

People will be given appropriate privacy information when data is collected directly or, where required, when it is obtained from another source. Personal data will not be collected merely because it may become useful later.

Data minimisation and access

Only information reasonably needed for the task will be requested or retained.
Access will be limited to the owner and any authorised person who needs it for the work.
Client credentials will be used only for authorised purposes and will not be retained longer than needed.
Test, demo or production data will be anonymised or minimised where practicable.

Security

Controls will be selected according to the sensitivity, volume and risk of the data and may include:

strong unique passwords and multi-factor authentication where available;
device locking, supported encryption and current security updates;
restricted sharing and careful recipient checking;
secure cloud, payment, hosting, e-signature and production services;
backups appropriate to the work and contractual requirements;
secure deletion, disposal and erasure of storage devices; and
confidentiality requirements for authorised subcontractors.

Data may be shared where necessary with venues, clients, subcontractors, payment providers, accountants, insurers, professional advisers, cloud and software providers, hosting providers, couriers, public authorities or other parties involved in the agreed service. Sharing will be limited to what is reasonably necessary and supported by an appropriate lawful basis.

Service providers processing personal data on behalf of the business will be selected with regard to security and reliability. Data-processing terms will be used where required.

International transfers

Where a provider or recipient processes personal data outside the United Kingdom, the business will use a lawful transfer route and proportionate safeguards where required, taking account of the provider, destination and nature of the data.

Retention

Retention is based on purpose, legal requirements, risk and any contractual need. Typical periods are:

Unconverted enquiries and routine contact-form correspondence: normally six months after the last interaction.
Bookings, contracts, project administration and material client correspondence: normally up to six years after completion where needed for legal, insurance or business records.
Tax and accounting records: for the statutory period applicable to a self-employed business and longer where an enquiry or legal hold requires it.
Production media and project files: for the agreed delivery or archive period, or while reasonably needed for the project, rights, portfolio, legal or technical purpose.
Marketing records: until consent is withdrawn, an objection is received or continued retention is no longer justified, while retaining a minimal suppression record where needed.

Data will be securely deleted, anonymised or reduced when it is no longer needed. Backup copies may remain until they are overwritten through the normal backup cycle.

Individual rights

Depending on the circumstances, people may have rights to be informed, access their data, correct it, erase it, restrict processing, object, receive portable data, withdraw consent and challenge certain automated decisions. Requests will be identified, verified where necessary and answered within the applicable legal timescale. The rights are not absolute and lawful exemptions may apply.

A person may complain to the Information Commissioner’s Office, although the business should be contacted first where possible so that the issue can be considered directly.

Direct marketing and cookies

Electronic marketing will be sent only where a lawful route applies and will include a clear way to opt out. Objections and withdrawals will be respected. Website cookies and similar technologies will be managed through appropriate information and consent controls where required.

Personal data breaches

A suspected breach will be contained, recorded and assessed promptly. Where the legal threshold is met, the Information Commissioner’s Office will be notified without undue delay and, where feasible, within 72 hours of awareness. Affected people will also be informed without undue delay where the breach is likely to create a high risk to their rights and freedoms.

Data protection fee and records

The business will keep under review whether it must register with and pay a data protection fee to the Information Commissioner’s Office. Proportionate records of processing, decisions, requests, breaches and supplier arrangements will be kept where useful or legally required.

Review

This policy will be reviewed when data uses, systems, suppliers, services or legal requirements change materially.