This policy explains how DJ Shakespeare Sounds (“we”, “us”) collects, uses and protects your personal information when you use djshakespearesounds.com — whether you’re enquiring about a booking, buying a product, taking a lesson, joining a challenge or just reading the blog. We are the data controller for the information described here, and we handle it in line with UK data protection law (UK GDPR and the Data Protection Act 2018).

What we collect, and why

Booking enquiries. When you ask for a quote we collect your name, email, phone number (optional), event details (type, date, venue, budget) and your message. We use this to respond to your enquiry, prepare a quote and manage your booking. Legal basis: taking steps to enter into a contract with you.

Accounts. When you create an account we store your name, email address and a securely hashed version of your password — we never store the password itself. If you sign in with Google, we receive your name, email and profile picture from Google instead. Legal basis: performance of a contract (running your account, dashboard, downloads and sessions).

Purchases and lessons. When you buy a digital product or book a lesson or mentoring call, we keep a record of what you bought, when, and for how much, plus any availability you tell us for scheduling. We never see or store your card details — payments are processed entirely by Stripe. Legal basis: performance of a contract; keeping financial records is also a legal obligation (HMRC requires us to retain them).

Challenge entries. When you join a challenge we collect your name, email, Instagram handle and location (UK / international) to run the challenge, share the group link and pick winners. Legal basis: your consent, which you can withdraw at any time by asking us to remove your entry.

Newsletter. If you subscribe we store your email address and use it to send occasional updates about events, products and bookings. Legal basis: consent. Every email includes a way to unsubscribe, or just reply and ask.

Contact messages. If you message us through the contact form we keep your name, email and message so we can reply. Legal basis: our legitimate interest in responding to you.

Cookies

We keep cookies to a minimum. We use essential cookies only: a session cookie that keeps you signed in to your account, and a security (CSRF) cookie that protects forms. These are strictly necessary for the site to work and don’t track you across other websites. We don’t use advertising cookies. If we add analytics in future, we’ll update this policy first.

Who we share data with

We don’t sell your data, ever. We share it only with the service providers who run the platform, each acting under their own data-processing terms:

• Stripe — payment processing (they handle your card details; see Stripe’s privacy policy).
• Vercel — hosting the website.
• Neon — our database, where the records above are stored.
• Resend — sending transactional emails (confirmations, booking updates), where enabled.
• Google — only if you choose to sign in with Google.

Some of these providers store data outside the UK (for example in the EU or US); where they do, transfers are protected by recognised safeguards such as the UK Extension to the EU–US Data Privacy Framework or standard contractual clauses.

How long we keep it

• Booking enquiries — up to 2 years after your event or last contact, so we can serve repeat bookings; unconverted enquiries are reviewed and cleared periodically.
• Orders and invoices — at least 6 years, as required for UK tax records.
• Accounts — for as long as your account is open. Ask us and we’ll delete it.
• Challenge entries and newsletter subscriptions — until you ask to be removed or unsubscribe.
• Contact messages — up to 12 months after resolution.

How we protect it

All traffic to the site is encrypted (HTTPS). Passwords are hashed with bcrypt and can’t be read by anyone, including us. Access to admin data is restricted to authorised accounts, and payment data never touches our servers.

Your rights

Under UK GDPR you have the right to:

• access a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted (“right to be forgotten”), subject to records we must keep by law;
• object to or restrict how we use your data;
• receive your data in a portable format;
• withdraw consent at any time, where consent is the basis we rely on.

To exercise any of these, contact us — we’ll respond within one month. If you’re unhappy with how we’ve handled your data, you can complain to the UK Information Commissioner’s Office (ico.org.uk), though we’d appreciate the chance to put it right first.

Children

The site isn’t aimed at children under 16, and we don’t knowingly collect their data. If you believe a child has given us personal information, contact us and we’ll delete it.

Changes to this policy

If we change how we handle your data — for example by adding analytics or new services — we’ll update this page and change the date at the top. Significant changes will be flagged on the site or by email.

Contact

Data questions, requests or anything else: use the contact form and we’ll get back to you promptly.